Most common malware – November 2023

AsyncRAT is a remote access Trojan (RAT) known for its ability to remotely monitor and control computer systems without detection. The malware, which came in sixth on last month's top ten list, uses various file formats such as PowerShell and BAT to trigger the process. During last month's campaign, recipients received an email containing an embedded link. Once clicked, the link triggered the download of a malicious HTML file, which then triggered a sequence of events that meant the malware could camouflage itself as a trusted application to avoid detection.

Meanwhile, the downloader FakeUpdates has returned to the top malware list after a two-month hiatus. Written in JavaScript, the malware's distribution framework deploys compromised websites to trick users into performing fake browser updates. It has led to further compromise through several other malicious programs, including GootLoader, Dridex, NetSupport, DoppelPaymer and AZORult.

“November's cyber threats confirm how threat actors are leveraging seemingly innocuous methods to infiltrate networks. The rise of the AsyncRAT campaign and the resurgence of FakeUpdates highlight a trend where attackers are using very simple deception methods to bypass traditional defenses. This underscores the need for organizations to adopt a multi-layered approach to security that is not only based on identifying known threats, but also has the ability to detect, prevent and respond to new attack vectors before they cause harm,” said Maya Horowitz, VP Research at Check Point Software.

CPR also revealed that “Command Injection Over HTTP” was the most exploited vulnerability, affecting 45% of organizations worldwide, followed by “Web Servers Malicious URL Directory Traversal” at 42%. “Zyxel ZyWALL Command Injection (CVE-2023-28771)” came third with a global impact of 41%

Top malware families

*The arrows refer to the change in ranking compared to the previous month.

The Formbook was the most prevalent malware last month with a 3% impact on global organizations, followed by FakeUpdates with a global impact of 2% and the Remcos with a global impact of 1%.

1. ↔ Formbook - TheFormbook is an Infostealer that targets the Windows operating system and was first detected in 2016. It is marketed as Malware as a Service (MaaS) on underground hacking forums for its powerful evasion techniques and relatively low price. FormBook collects credentials from various web browsers, collects screenshots, monitors and logs keystrokes, and can download and execute files according to commands from C&C.

2. ↑ FakeUpdates - The FakeUpdates (AKA SocGholish) is a downloader written in JavaScript. It writes payloads to disk before launching them. FakeUpdates led to further compromise through several additional malware, including GootLoader, Dridex, NetSupport, DoppelPaymer and AZORult.

3. ↔ Remcos - The Remcos is a RAT that first appeared in 2016. It is distributed via malicious Microsoft Office documents attached to spam emails and is designed to bypass Microsoft Windows UAC security and run malware with elevated privileges.

Industries with the top attacks worldwide

In November the branch Education / Research remained the number one most attacked worldwide, followed by industries Communications and Government / Military.

1. Education / Research
2. Communications
3. Government / Army

Top Exploited Vulnerabilities

Last month, the “Command Injection Over HTTP” was the most exploited vulnerability, affecting the 45% of organizations worldwide, followed by “Web Servers Malicious URL Directory Traversal" to 42% of organizations worldwide. The “Zyxel ZyWALL Command Injection (CVE-2023-28771)” came third with global impact 41%.

1. ↑ Command Injection Over HTTP (CVE-2021-43936, CVE-2022-24086) –An Injection command over HTTP vulnerability has been reported. A remote attacker can exploit this issue by sending a specially crafted request to the victim. Successful exploitation would allow an attacker to execute arbitrary code on the target computer.

2. ↑ Web Servers Malicious URL Directory Traversal (CVE-2010-4598,CVE-2011-2474,CVE-2014-0130,CVE-2014-0780,CVE-2015-0666,CVE-2015-4068,CVE-2015-7254,CVE-2016-4523,CVE-2016-8530,CVE-2017-11512,CVE-2018-3948,CVE-2018-3949,CVE-2019-18952,CVE-2020-5410,CVE-2020-8260) – A directory traversal vulnerability exists in different web servers. The vulnerability is due to an input validation error on a web server that does not properly sanitize the URI for directory traversal patterns. Successful exploitation allows unauthenticated remote attackers to reveal or access arbitrary files on the vulnerable server.

3. ↓ Zyxel ZyWALL Command Injection (CVE-2023-28771) – A command injection vulnerability exists in Zyxel ZyWALL. Successful exploitation of this vulnerability would allow remote attackers to execute arbitrary operating system commands on the affected system.

Top Malicious Mobile Apps

Last month Anubis remained in first place as the most widespread mobile malware, followed by AhMyth and SpinOk.

1. Anubis – Anubis is a banking malware Trojan designed for Android mobile phones. Since it was first detected, it has acquired additional features such as Remote Access Trojan (RAT) functionality, keylogger, audio recording capabilities, and various ransomware capabilities. It has been spotted in hundreds of different apps available in the Google Store.

2. AhMyth – AhMyth is a Remote Access Trojan (RAT) discovered in 2017. It is distributed through Android apps that can be found in app stores and various websites. When a user installs one of these infected apps, the malware can collect sensitive information from the device and perform actions such as keylogging, taking screenshots, sending SMS messages, and activating the camera, which is typically used to steal sensitive information. .

3. SpinOk – SpinOk is an Android software module that acts as spyware. It collects information about files stored on devices and can pass it on to malicious threat actors. The malicious module was found in more than 100 Android apps and was downloaded more than 421.000.000 times by May 2023.

The full list of the top ten malware families for November can be found on the Check Point blog.

The malicious software that affected Greece as well as their corresponding impact at the global level.

Malware Family	Country Impact	global impact
Formbook	5.07%	3.57%
agent Tesla	3.59%	1.18%
Neshta	3.38%	0.35%
Fakeupdates	2.33%	2.49%
Remcos	2.11%	1.48%
Esfury	1.69%	0.25%
AsyncRat	1.48%	1.12%
Seraph	1.48%	0.29%
Cryptonite	1.27%	0.37%
Pony	1.27%	0.24%