Check Point April 2021 Global Threat Index

Check Point Research reports that the Dridex trojan , which is often used in the early stages of ransomware attacks , is the most prevalent malware for the second consecutive month.

Check Point Research, the research division of Check Point® Software Technologies Ltd. , has published its Global Threat Index for April 2021. Researchers report that for the first time, AgentTesla ranked second in the Index, while the established Dridex trojan continues to be the most prevalent malware, having risen to the top spot in March.

See more articles from iGuRu.gr when you search for news on Google.

iGuRu.gr preferred source

This month, Dridex , a Trojan targeting the Windows platform , was spread via the QuickBooks Malspam campaign . The phishing emails used QuickBooks branding and attempted to lure the user with fake payment notifications and invoices. The email content asked to download a malicious Microsoft Excel attachment that could infect the system with Dridex.

This malware is often used as the initial infection stage in ransomware attacks , where hackers encrypt an organization's data and demand a ransom to decrypt it. Increasingly, these hackers are using double-blackmail methods, where they will steal sensitive data from an organization and threaten to make it public if payment is not made.

CPR reported in March that ransomware attacks had seen a 57% increase in early 2021, but the trend continues to peak, having completed a 107% increase since the same period last year. Most recently, Colonial Pipeline , a major US fuel company, fell victim to such an attack, and in 2020, ransomware is estimated to have cost businesses worldwide an estimated $20 billion – a figure that is almost 75% higher than in 2019.

For the first time, AgentTesla has taken the 2nd place in the list of top malware. AgentTesla is an advanced RAT ( remote access Trojan ) that has been active since 2014 and acts as a keylogger and password stealer. This RAT can monitor and collect user typed data, capture screenshots, and extract credentials entered for various software installed on the victim’s machine (including Google Chrome , Mozilla Firefox , and Microsoft Outlook email client ).

This month we have seen an increase in AgentTesla campaigns , which are spread via malicious email. The content of the email asks you to download a file (it can be any file type), which can cause the system to be infected with Agent Tesla.

“While we are seeing a huge increase in ransomware attacks globally, it is no surprise that this month’s top malware is related to this trend. On average, every 10 seconds globally, an organization becomes a victim of ransomware ,” said Maya Horowitz , Director , Threat Intelligence & Research , Products , Check Point.

“There have been recent calls for governments to do more to protect themselves from this growing threat, which shows no signs of slowing down. All organisations need to be aware of the risks and ensure that adequate anti- ransomware solutions are in place . Comprehensive training of all employees is also vital, so that they are equipped with the skills needed to identify the types of malicious emails that spread Dridex and other malware, as this is how many ransomware exploits are launched .”

CPR also revealed that “ Web Server Exposed Git Repository Information Disclosure ” is the most commonly exploited vulnerability, affecting 46% of organizations worldwide, followed by “ HTTP Headers Remote Code Execution ( CVE -2020-13756)” affecting 45,5% of organizations worldwide. “ MVPower DVR Remote Code Execution ” ranks third on the list of most frequently exploited vulnerabilities, with a global impact of 44%.

The 3 Most Common Malware Threats   

This month, Dridex continues to be the most popular malware with a global impact reaching 15% of organizations, followed by Agent Tesla at 12% and Trickbot at 8%.

1. ↔ Dridex – Dridex is a Trojan that targets the Windows platform and is reportedly downloaded via a spam email attachment. Dridex communicates with a remote server and sends information about the infected system. It can also download and execute arbitrary modules it receives from the remote server.

2. ↑ Agent Tesla – Agent Tesla is an advanced RAT that functions as a keylogger and information stealer, capable of monitoring and collecting information typed by the user while also stealing screenshots to obtain credentials to various software installed on the victim's computer, such as Google Chrome , Mozilla Firefox , and the Microsoft Outlook email program.

3. ↑ Trickbot – Trickbot is a dominant banking trojan that is constantly updated with new capabilities, features, and infection distribution. This allows Trickbot to be a flexible and adaptable malware that can be distributed as part of multi-purpose campaigns.

The most exploitable vulnerabilities   

This month, the “ Web Server Exposed Git Repository Information Disclosure ” vulnerability is the most frequently exploited , affecting 46% of organizations worldwide, followed by “ HTTP Headers Remote Code Execution ( CVE -2020-13756) ” which affects 45,5% of organizations worldwide. “ MVPower DVR Remote Code Execution ” ranks third on the list of most frequently exploited vulnerabilities, with a global impact of 44%.

1. ↑ Web Server Exposed Git Repository Information Disclosure – An information disclosure vulnerability has been reported in Git . Successful exploitation of this vulnerability could allow the inadvertent disclosure of account information.

2. ↓ HTTP Headers Remote Code Execution ( CVE -2020-10826, CVE -2020-10827, CVE -2020-10828, CVE -2020-13756) – Specific fields in HTTP headers allow the client and server to pass additional information. A remote attacker can use a vulnerable HTTP field to execute arbitrary code on the victim's machine.

3. ↓ MVPower DVR Remote Code Execution – A remote code execution vulnerability exists in MVPower DVR devices . A remote attacker could exploit this vulnerability and execute arbitrary code on the affected router via a crafted request.

The 3 Most Common Mobile Malware Threats

This month, xHelper ranks first among the most prevalent mobile malware, followed by Triada and Hiddad.

1. xHelper – xHelper is a malicious application that has been in the spotlight since March 2019 and is used to download other malicious applications and display advertisements. The application is capable of “hiding” itself from the user and automatically reinstalling itself if uninstalled.

3. Triada – Modular Backdoor for Android that grants superuser privileges to downloaded malware.

4. Hiddad – Hiddad is an Android malware that repackages legitimate apps and then releases them on a third-party store. Its main function is to display ads, but it can also access key security details built into the operating system.

The complete list of the most common malware threats in Greece for April is:

1. Agentesla AgentTesla is an advanced RAT (remote access Trojan) that acts as a keylogger and password thief. Active since 2014, AgentTesla can track and collect what the user types, while it can capture screenshots and extract credentials imported for various types of software installed on the victim machine (including Google Firefox, Mozilla and Microsoft Outlook email client). AgentTesla sells openly as a legal RAT with customers paying $ 15- $ 69 for licenses.
2. Dridex  Dridex is a Banking Trojan that targets the Windows platform via spam and Exploit Kits, which relies on WebInjects to monitor and redirect bank credentials to an intruder-controlled server. Dridex communicates with a remote server, sends information about the infected system, and can also download and run additional operating systems for remote control.
3. FormBook FormBook was first identified in 2016 and is an InfoStealer targeting the Windows operating system. FormBook collects credentials from various web browsers, collects screenshots, monitors and records keystrokes, and can download and execute files as instructed by its C&C.
4. Trickbot - The Trickbot dominant banking trojan targeting platforms Windows and mainly transported through spam or from other families malware As the Emotet. It Trickbot sends information about the infected system and can also download and run arbitrarily modules from a wide range of available, such as one VNC module for remote use or one SMB module to spread within an affected network. Once a machine is infected, the threat factors behind the malware Trickbot, use this wide range modules not just to steal banking credentials from the target computer, but also for lateral movement and recognition within the organism itself, before a targeted attack ransomware throughout the company.
5. Joker- The Joker An android Spyware on Google Play, designed to steal SMS messages, contact lists and device information. In addition, the malware secretly subscribes to the victim for premium services on advertising sites.
6. XMRig - The XMRig is a software CPU mining open source which is used for the process of producing the cryptocurrency Monero and was first released in May on 2017.
7. Remcos- Remcos is a RAT that first appeared in 2016. Remcos is distributed through malicious Microsoft Office documents that attach to SPAM emails and is designed to bypass Microsoft Windowss UAC security and run malicious software with high level privileges.
8. Triada -Triada is a modular backdoor for Android, which provides super-user privileges for downloading malware. Triada has also been observed to tamper with URLs loaded into the browser.
9. Danabot -Danabot is a Trickler that targets the Windows platform. The malware sends information to its control server and downloads and decrypts a file to run on the infected computer. In addition, the malware creates a shortcut in the user's boot folder to ensure that it stays on the infected system.

10. xHelper – xHelper is a malicious application that has been in the spotlight since March 2019 and is used to download other malicious applications and display advertisements. The application is capable of “hiding” itself from the user and automatically reinstalling itself if uninstalled.

The Check Point Global Threat Impact Index and ThreatCloud Map are powered by Check Point ’s ThreatCloud intelligence , the largest collaborative network for combating cybercrime, which provides threat and attack trend data, leveraging a global network of threat detectors. The ThreatCloud database includes over 3 billion websites and 600 million files daily, and detects more than 250 million malware activities every day.

At the link here you can find the full list.

newsbot

Although the press releases will range from very select to rare, I said I'd pass...because sometimes the editors hide.