ESET has published its latest Threat Report, presenting the trends captured in its telemetry and thesolutions of its experts from June to November 2024.
Infostealers are emerging as a dynamic threat class, with the Agent Tesla to give way to Formbook, a malware designed to eavesdrop on sensitive data data.
Lumma Stealer is also becoming increasingly popular among cybercriminals, participating in major malicious campaigns and seeing a 369% increase in detections, according to ESET telemetry.
At the same time, the emergence of new scams on social media, using deepfake videos and fake company logos, attempts to mislead users into investment scams. These attacks, which ESET classifies as HTML/Nomani, saw a 335% increase between the reporting periods, with the most detections recorded in Japan, Slovakia, Canada, Spain and the Czech Republic.
In the second half of 2024, it seems that cybercriminals focused on detecting security gaps and developing innovative methods to increase their victims, continuing the constant game of cat and mouse with defense forces. According to Jiří Kropáč, Director of Threat Detection at ESET, this period was characterized by the emergence of new attack vectors and social engineering methods, the recording of new threats in telemetry and the reorganization of established cybercrime groups, as a result of neutralization actions by the relevant authorities.
Among the infostealer malware, the notorious infostealer-as-a-service Redline Stealer was terminated by the authorities in October 2024. But it is expected that the fall of Redline Stealer will lead to the spread of other similar threats. The ransomware landscape has been reshaped by the dismantling of the cybercrime gang lockbit, creating a gap to be filled by other agencies. RansomHub collected hundreds of victims by the end of H2 2024, establishing itself as the new dominant player. APT groups linked to China, North Korea and Iran are increasingly involved in ransomware attacks.
With cryptocurrencies reaching record highs in the second half of 2024, cryptocurrency wallets have been one of the primary targets of cybercriminals. In Eset's telemetry, this is reflected in an increase in cryptostealer detections across multiple platforms. The increase was most dramatic on macOS, where Password-Stealing Ware malware – which largely targets cryptocurrency wallet credentials – more than doubled compared to H1. AMOS (also known as Atomic Stealer), malware designed to collection and the leakage of sensitive data from Mac devices, contributed significantly to this increase. Android threats, which targeted banking apps as well as cryptocurrency wallets, increased by 20%.
For more information, you can read the ESET Threat Report on the second half of 2024 at WeLiveSecurity.com.
