April 2025 Top Malware Report

Check Point Software Technologies Ltd, an AI-based, cloud-delivered cybersecurity company, has released its Global Threat Index for April 2025. FakeUpdates remains the most prevalent malware this month, affecting 6% of organizations worldwide, closely followed by Remcos and AgentTesla.

For April, researchers uncovered a sophisticated, multi-stage malware campaign that delivers AgentTesla, Remcos, and Xloader (a FormBook spinoff). The attack begins with phishing emails posing as order confirmations that trick victims into opening a malicious 7-Zip archive. This archive contains an encoded JScript (.JSE) file that executes a Base64-encoded PowerShell script, which in turn executes a second stage executable based on .NET or AutoIt. The final malware is injected into legitimate Windows processes such as RegAsm.exe or RegSvcs.exe, significantly increasing stealth and detection evasion.

See more articles from iGuRu.gr when you search for news on Google.

iGuRu.gr preferred source

These findings reflect a notable trend in cybercrime: the convergence of malware with advanced technology. Tools that were once sold openly and at low cost, such as AgentTesla and Remcos, are now being integrated into complex delivery chains that mimic the tactics of state-sponsored actors – blurring the lines between economically and politically motivated threats.

Lotem Finkelstein, Director of Threat Intelligence at Check Point Software, commented: “This latest campaign exemplifies the increasing sophistication of cyber threats. Attackers are deploying coded scripts, legitimate processes, and obscure execution chains to remain undetected. What was once considered low-level malware is now a weapon in advanced operations. Organizations must adopt a prevention-first approach that integrates real-time threat intelligence, artificial intelligence, and behavioral analytics.”

Top Malware Families

(Arrows indicate the change in ranking compared to March.)

1. ↔ FakeUpdates – Fakeupdates (AKA SocGholish) is a downloader malware that was first discovered in 2018. It spreads via drive-by downloads on compromised or malicious websites, prompting users to install a fake browser update. The Fakeupdates malware is associated with a Russian hacking group called Evil Corp and is used to deliver various secondary payloads after the initial infection. (Incidence: 6%).
2. ↔ Remcos Remcos is a remote access Trojan (RAT) first observed in 2016 and often distributed via malicious documents in phishing campaigns. It is designed to bypass Windows security mechanisms, such as UAC, and execute malware with elevated privileges, making it a versatile tool for threat actors. (Incidence: 3%).
3. ↔ agent Tesla – AgentTesla is an advanced RAT (Remote Access Trojan) that acts as a keylogger and password stealer. Active since 2014, AgentTesla can monitor and collect the victim’s keyboard input and clipboard, and can capture screenshots and hide credentials entered for various software installed on the victim’s machine (including Google Chrome, Mozilla Firefox, and Microsoft Outlook email client). AgentTesla is openly sold as a legitimate RAT with customers paying $15 – $69 for licenses (impact: 3%).

Top Ransomware Groups

Data based on information from ransomware “shame sites,” which are run by double-extortion ransomware groups. Akira is the most prevalent ransomware group this month, responsible for 11% of published attacks, followed by SatanLock and Qilin with 10% each.

1. Akira Akira Ransomware, first reported in early 2023, targets Windows and Linux systems. It uses symmetric encryption with CryptGenRandom() and Chacha 2008 to encrypt files and is similar to the leaked Conti v2 ransomware. Akira is distributed through various means, including infected email attachments and exploits on VPN endpoints. After infection, it encrypts data and appends a “. akira” extension to file names, then displays a ransom note demanding payment for decryption.
2. SatanLock – SatanLock is a new group that has been publicly active since early April. It has posted 67 victims, but as with many other new actors, over 65% of them have already been reported by other actors.
3. qilin – Qilin, also referred to as Agenda, is a ransomware-as-a-service criminal enterprise that works with affiliate companies to encrypt and isolate data from exposed organizations, then demand a ransom. This ransomware variant was first detected in July 2022 and is developed in Golang language. Agenda is known for targeting large businesses and high-value organizations, with a particular focus on the healthcare and education sectors. Qilin typically infiltrates victims via phishing emails containing malicious links to gain access to their networks and exfiltrate sensitive information. Once inside, Qilin typically moves laterally through the victim's infrastructure, looking for critical data to encrypt.

Top Mobile Malware

1. ↔ Anubis – Anubis is a versatile banking trojan that originated on Android devices and has evolved to include advanced capabilities such as bypassing multi-factor authentication (MFA) by intercepting one-time passwords (OTPs) sent via SMS, keystroke logging, audio recording, and ransomware functionality. It is often distributed via malicious apps on the Google Play Store and has become one of the most widespread mobile malware families. In addition, Anubis includes remote access (RAT) capabilities, allowing for extensive monitoring and control of infected systems.
2. ↑ AhMyth – AhMyth is a remote access trojan (RAT) that targets Android devices, usually disguised as legitimate applications such as screen recorders, games, or cryptocurrency tools. Once installed, it gains extensive permissions to persist across reboots and extract sensitive information such as banking credentials, cryptocurrency wallet details, multi-factor authentication (MFA) codes, and passwords. AhMyth also allows for keystroke logging, screen recording, camera and microphone access, and SMS interception, making it a versatile tool for data theft and other malicious activities.
3. ↑ Hydra Hydra is a banking trojan designed to steal banking credentials by asking victims to enable dangerous permissions and access every time they log into any banking application.

April's data reveals a growing use of stealthy, multi-stage malware campaigns and a continued focus on sectors with lower defenses. With FakeUpdates remaining the most prevalent threat and new ransomware actors like SatanLock emerging, organizations must prioritize proactive, layered security to stay ahead of evolving attacks.

Top attacking industries worldwide

For the third consecutive month, the education sector was the most targeted sector, due to its broad user base and typically weaker cybersecurity. Government and telecommunications followed, reflecting the continued focus on critical infrastructure and public services, particularly in high-risk or rapidly digitizing areas.

1. Education
2. Government
3. Telecommunications

April data reveals an increasing use of stealthy, multi-stage malware campaigns and a continued focus on areas with lower defenses. With FakeUpdates remaining the most prevalent threat and new ransomware vectors like SatanLock emerging, organizations must prioritize proactive, layered security to stay ahead of evolving attacks.

AgentTesla: Champion of cyber threats in Greece – How the map of malware is shaped worldwide

The AgentTesla malware emerges as the biggest threat to the Greek digital reality, as it is responsible for 5,11% of detected attacks in the country, far exceeding its global average (3,52%). Remcos, Formbook and AsyncRat follow, all with rates above 4%, showing that remote access tools and information thieves have found fertile ground in our country. The difference compared to global trends is interesting: while FakeUpdates dominates internationally (6,37%), its presence is reduced in Greece (3,83%), which reflects different attack patterns. Threats such as Formbook and the specialized Injuke show rates more than double the international average, indicating targeted attacks or greater vulnerability at a local level. The Greek cyber threat landscape appears to deviate from global trends, making it imperative for defense strategies that take into account the particular challenges of the domestic market.

For the full April 2025 Global Threat Index and additional information, visit the Check Point Blog.

newsbot

Although the press releases will range from very select to rare, I said I'd pass...because sometimes the editors hide.