Check Point Research’s Global Threat Index for February 2022 shows that Emotet is still the most prevalent malware in the world, impacting 5% of organisations worldwide, while Trickbot has slipped further down the index into sixth place.
Trickbot is a botnet and banking trojan that can steal financial details, account credentials, and personally identifiable information, as well as spread laterally within a network and drop ransomware. During 2021, it appeared at the top of the most prevalent malwares list seven times.
During the past few weeks, however, Check Point Research, has noted no new Trickbot campaigns and the malware now ranks sixth in the index. This could be due in part to some Trickbot members joining the Conti ransomware group, as suggested in the recent Conti data leak.
This month, CPR has witnessed cybercriminals taking advantage of the Russia/Ukraine conflict in order to lure people to download malicious attachments, and February’s most prevalent malware, Emotet, has indeed been doing just this, with emails that contain malicious files and the subject “Recall: Ukraine -Russia Military conflict: Welfare of our Ukrainian Crew member”.
“Currently we are seeing a number of malwares, including Emotet, take advantage of the public interest around the Russia/Ukraine conflict by creating email campaigns on the topic that lure people into downloading malicious attachments. It’s important to always check that a sender’s email address is authentic, look out for any misspellings in emails and don’t open attachments or click on links unless you are certain that the email is safe.” said Maya Horowitz, VP Research at Check Point Software
CPR revealed this month that Education/Research continues to be the most attacked industry globally followed by Government/Military and ISP/MSP. “Web Server Exposed Git Repository Information Disclosure” is the most commonly exploited vulnerability, impacting 46% of organisations globally, followed by “Apache Log4j Remote Code Execution” which dropped from first to second place and impacts 44% of organisations worldwide. “HTTP Headers Remote Code Execution” is the third most exploited vulnerability, with a global impact of 41%.
Top Malware Families
*The arrows relate to the change in rank compared to the previous month.
This month, Emotet is still the most prevalent malware impacting 5% of organizations worldwide, closely followed by Formbook which is impacting 3% of organizations and Glupteba which is impacting 2%. In South Africa this month, RigEK is the most prevalent malware impacting 5.75% of organizations in the country, closely followed by Emotet which is impacting 5.75% of organizations and Ramnit which is impacting 2.88%.
- ↔ RigEK – The oldest and best known of the currently operating Exploit Kits, RigEK has been around since mid-2014. Its services are offered for sale on hacking forums and the TOR Network. Some ¿entrepreneurs¿ even re-sell low-volume infections for those malware developers not yet big enough to afford the full-fledged service. RigEK has evolved over the years to deliver anything from AZORult and Dridex to little-known ransomware and cryptominers.
- ↑ Emotet – Emotet is an advanced, self-propagating and modular Trojan that was once used as a banking Trojan, and currently distributes other malware or malicious campaigns. Emotet uses multiple methods for maintaining persistence and evasion techniques to avoid detection and can be spread via phishing spam emails containing malicious attachments or links.
- ↑ Ramnit – Ramnit is a modular banking Trojan first discovered in 2010. Ramnit steals web session information, giving its operators the ability to steal account credentials for all services used by the victim, including bank accounts, and corporate and social networks accounts. The Trojan uses both hardcoded domains as well as domains generated by a DGA (Domain Generation Algorithm) to contact the C&C server and download additional modules.
Top Attacked Industries Globally
This month Hardware vendor is the most attacked industry in South Africa , followed by Finance/Banking and ISP/MSP.
- Hardware vendor
- Finance/Banking
- ISP/MSP
Top Exploited Vulnerabilities
This month “Web Server Exposed Git Repository Information Disclosure” is the most commonly exploited vulnerability, impacting 46% of organizations globally, followed by “Apache Log4j Remote Code Execution” which has dropped from first place to second and impacts 44% of organizations worldwide. “HTTP Headers Remote Code Execution” is the third most exploited vulnerability, with a global impact of 41%.
- ↑ Web Server Exposed Git Repository Information Disclosure – An information disclosure vulnerability has been reported in Git Repository. Successful exploitation of this vulnerability could allow an unintentional disclosure of account information.
- ↓ Apache Log4j Remote Code Execution (CVE-2021-44228) – A remote code execution vulnerability exists in Apache Log4j. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system.
- ↔ HTTP Headers Remote Code Execution (CVE-2020-10826,CVE-2020-10827,CVE-2020-10828,CVE-2020-13756) – HTTP headers let the client and the server pass additional information with a HTTP request. A remote attacker may use a vulnerable HTTP Header to run arbitrary code on the victim’s machine.
Top Mobile Malwares
This month XLoader is the most prevalent mobile malware, followed by xHelper and AlienBot.
- XLoader – XLoader is an Android Spyware and banking Trojan developed by the Yanbian Gang, a Chinese hacker group. This malware uses DNS spoofing to distribute infected Android apps to collect personal and financial information.
- xHelper – A malicious application seen in the wild since March 2019, used for downloading other malicious apps and display advertisement. The application can hide itself from the user and reinstalling itself in case it was uninstalled.
- AlienBot – AlienBot malware family is a Malware-as-a-Service (MaaS) for Android devices that allows a remote attacker to firstly inject malicious code into legitimate financial applications then allows the attacker to obtain access to the victims’ accounts, and eventually completely control their device.