Trickbot September 2021 again the most widespread malware

iGuRu.gr > Trickbot September 2021 again the most widespread malware

Check Point Research , the research arm of Check Point Software Technologies , lists Trickbot as the most prevalent malware while the remote access trojan , njRAT , appears on the list for the first time.

Η Check Point Research, ensures Threat Intelligence part Check Point Software Technologies Ltd., a provider of cybersecurity solutions worldwide, published the Global Threat Index for the month of September 2021. The research team reports that Trickbot returned to the top of the list, while it had fallen to second place in August after a quarterly "kingdom".

See more articles from iGuRu.gr when you search for news on Google.

iGuRu.gr preferred source

The remote access trojan , njRAT, entered the top ten for the first time, taking the place of the no longer active Phorpiex . Trickbot is a banking trojan that can steal financial information, account credentials, and personal data, as well as spread across a network and launch a ransomware attack. Since the removal of Emotet last January, the Trickbot trojan has gained popularity. It is constantly being upgraded with new capabilities, features, and distribution channels that allow it to be a flexible and adaptable malware, which can be distributed as part of multi-purpose campaigns.

“In the same month that Trickbot once again became the most prevalent malware, it was reported that one of its members was arrested following an investigation in the US,” said Maya Horowitz , VP Research at Check Point Software . “With other charges filed this year in the fight against the trojan , we hope that the gang’s reign will soon end. But, as always, there is still a long way to go. This week, our researchers reported that in 2021 there are 40% more attacks per week on organizations worldwide compared to 2020, but most, if not all, of them could have been prevented. Organizations should no longer delay adopting a prevention-first approach to cybersecurity.”

CPR also revealed this month that “ Web Server Exposed Git Repository Information Disclosure ” is the most commonly exploited vulnerability, affecting 44% of organizations worldwide, followed by “ Command Injection Over HTTP ” affecting 43% of organizations worldwide. “ HTTP Headers Remote Code Execution ” ranks third on the list of most exploited vulnerabilities, also with a global impact of 43%.

Top malware families

* The arrows refer to the change of the ranking in relation to the previous month.

In September, Trickbot is the most popular malware affecting 4% of organizations worldwide, followed by Formbook and XMRig , each affecting 3% of organizations worldwide.

1. ↑ Trickbot – Trickbot is a modular Botnet and Banking Trojan that is constantly updated with new features, capabilities, and distribution channels. This allows Trickbot to be a flexible and adaptable malware that can be distributed as part of multi-purpose campaigns.

2. ↓ Formbook – Formbook is an infostealer that collects credentials from various web browsers and screenshots, monitors and records keystrokes, and can download and execute files according to C & C commands.

3. ↑ XMRig – XMRig is an open-source CPU mining software used for the Monero cryptocurrency mining process and first appeared in May 2017.

The most exploitable vulnerabilities

In September, “ Web Server Exposed Git Repository Information Disclosure ” was the most exploited vulnerability, affecting 44% of organizations worldwide, followed by “ Command Injection Over HTTP ” affecting 43% of organizations worldwide. “ HTTP Headers Remote Code Execution ” ranked third on the list of most exploitable vulnerabilities , also with a global impact of 43%.

1. ↔ Web Server Exposed Git Repository Information Disclosure – An information disclosure vulnerability has been reported in the Git Repository . Successful exploitation of this vulnerability could allow the inadvertent disclosure of account information.

2. ↑ Command Injection Over HTTP – A command injection over HTTP vulnerability has been reported . A remote attacker could exploit this issue by sending a specially crafted request to the victim. Successful exploitation would allow an attacker to execute arbitrary code on the target machine.

3. ↓ HTTP Headers Remote Code Execution ( CVE -2020-10826, CVE -2020-10827, CVE -2020-10828, CVE -2020-13756) – HTTP headers allow the client and server to pass additional information with an HTTP request . A remote attacker can use a vulnerable HTTP header to execute arbitrary code on the victim's machine.

Top Malware for mobile phones

In September, xHelper remained in first place among the most prevalent mobile malware, followed by AlienBot and FluBot.

1. xHelper – A malicious application that first appeared in March 2019 and is used to download other malicious applications and display ads. The application can be hidden from the user and can even be reinstalled if it is removed.

2. AlienBot – The AlienBot malware family is a Malware – as – a – Service ( MaaS ) for Android devices that allows a remote attacker to initially inject malicious code into legitimate financial applications. The attacker gains access to victims’ accounts and ultimately takes full control of their device.

3. FluBot – FluBot is an Android malware distributed via phishing SMS messages, usually impersonating shipping and logistics companies . Once the user clicks on the link in the message, FluBot installs itself and gains access to all sensitive information on the phone.

The top 10 in Greece
Name Malware	Global Impact	Impact on Greece
agent Tesla	2.59 %	8.93 %
Formbook	3.14 %	8.33 %
Trickbot	4.09 %	5.36 %
Remcos	2.20 %	4.76 %
Nanocore	0.88 %	3.87 %
Vidar	0.97 %	2.98 %
Glupteba	2.41 %	2.68 %
Joker	0.08 %	2.38 %
Lovgate	0.33 %	2.38 %
Masslogger	0.13 %	2.38 %

Malware families in detail
AgentTesla is an advanced RAT ( Remote Access Trojan ) that acts as a keylogger and password stealer. Active since 2014, AgentTesla can monitor and collect the victim’s keyboard input and system clipboard, while also capturing screenshots and extracting credentials entered for a variety of software installed on the victim’s machine (including Google Chrome , Mozilla Firefox , and Microsoft Outlook email client ). AgentTesla is openly sold as a legitimate RAT with customers paying $15 – $69 for licenses.
FormBook is an InfoStealer targeting the Windows operating system and was first detected in 2016. It is advertised on hacking forums as a tool that has strong evasion techniques and relatively low prices. FormBook collects credentials from various web browsers and screenshots, monitors and records keystrokes, and can download and execute files according to C & C instructions given to it.
Trickbot is a modular Botnet and Banking Trojan that targets Windows platforms and is primarily delivered via spam or other malware families such as Emotet . Trickbot sends information about the infected system and can also download and execute arbitrary modules from a wide range of available ones, such as a VNC module for remote use or an SMB module for spreading within an affected network. Once a machine is infected, the threat actors behind the Trickbot malware use this wide range of modules not only to steal banking credentials from the target computer, but also to laterally move and identify themselves within the organization itself, before launching a targeted ransomware attack on the entire company.
Remcos is a RAT that first appeared in 2016. Remcos is distributed via malicious Microsoft Office documents attached to SPAM emails and is designed to bypass Microsoft Windows ' UAC security and execute malware with elevated privileges.
NanoCore is a remote access Trojan , first observed in the wild in 2013, targeting Windows users . All versions of the RAT feature basic add-ons and features, such as screen recording, cryptocurrency mining, remote desktop control, and webcam session hijacking.
Vidar is an infolstealer that targets Windows operating systems. First detected in late 2018, it is designed to steal passwords, credit card data and other sensitive information from various web browsers and digital wallets. Vidar has been sold on various online forums and a malware dropper has been used to download GandCrab ransomware as its secondary load.
Known since 2011, Glupteba is a backdoor that gradually matured into a botnet . By 2019, it included a mechanism for updating C & C addresses via public BitCoin lists , a built-in browser hijacking capability, and a router exploit.
An Android Spyware on Google Play , designed to steal SMS messages , contact lists, and device information. In addition, the malware silently signs the victim up for premium services on advertising websites.
Lovegate is a computer worm that can spread via network shares, email , and file sharing networks. Once installed, the program copies itself to various folders on the victim's computer and distributes malicious files that ultimately provide remote access to attackers.
Masslogger is a .NET credential stealer . This threat is a reconnaissance tool that can be used to extract data from targeted hosts.

Check Point Software ’s Global Threat Impact Index and ThreatCloud Map are powered by the company’s ThreatCloud intelligence division. ThreatCloud provides real - time threat intelligence from hundreds of millions of sensors worldwide, across networks, endpoints and mobile devices. The intelligence is enriched with AI - based engines and exclusive research data from Check Point Research , the Intelligence & Research division of Check Point Software Technologies.