August 2020's Most Wanted Malware: Evolved Qbot Trojan Ranks On Top Malware List For First Time
SAN CARLOS, Calif., Sept. 09, 2020 (GLOBE NEWSWIRE) -- Check Point Research, the Threat Intelligence arm of Check Point® Software Technologies Ltd. (NASDAQ: CHKP), a leading provider of cyber security solutions globally, has published its latest Global Threat Index for August 2020. Researchers found that the Qbot trojan, also known as Qakbot and Pinkslipbot, has entered the top ten malware index for the first time, ranking as the 10th most prevalent malware in August, while the Emotet trojan remains in 1st place for a second month, impacting 14% of organizations globally.
First seen in 2008, Qbot has been continually developed and now uses sophisticated credentials theft and ransomware installation techniques, making it the malware equivalent of a Swiss Army knife according to researchers. Qbot now also has a dangerous new feature: a specialized email collector module which extracts email threads from the victim’s Outlook client and uploads them to an external remote server. This enables Qbot to hijack legitimate email conversations from infected users, and then spam itself out using those hijacked emails to increase its chances of tricking other users into getting infected. Qbot can also enable unauthorized banking transactions, by allowing its controller to connect to the victim's computer.
Check Point’s researchers found several campaigns using Qbot’s new strain between March and August 2020, which included Qbot being distributed by the Emotet trojan. This campaign impacted 5% of organizations globally in July 2020.
“Threat actors are always looking at ways to update existing, proven forms of malware and they have clearly been investing heavily in Qbot’s development to enable data theft on a massive scale from organizations and individuals. We have seen active malspam campaigns distributing Qbot directly, as well as the use of third-party infection infrastructures like Emotet's to spread the threat even further. Businesses should look at deploying anti-malware solutions that can prevent such content reaching end-users and advise employees to be cautious when opening emails, even when they appear to be from a trusted source,” said Maya Horowitz, Director, Threat Intelligence & Research, Products at Check Point.
The research team also warns that “Web Server Exposed Git Repository Information Disclosure” is the most common exploited vulnerability, impacting 47% of organizations globally, followed by “MVPower DVR Remote Code Execution” which impacted 43% of organizations worldwide. “Dasan GPON Router Authentication Bypass (CVE-2018-10561)” is in third place, with a global impact of 37%.
Top malware families
This month Emotet remains the most popular malware with a global mpact of 14% of organizations, closely followed by Agent Tesla and Formbook affecting 3% of organizations each.
Top exploited vulnerabilities
This month “Web Server Exposed Git Repository Information Disclosure” is the most common exploited vulnerability, impacting 47% of organizations globally, followed by “MVPower DVR Remote Code Execution” which impacted 43% of organizations worldwide. “Dasan GPON Router Authentication Bypass (CVE-2018-10561)” is in third place, with a global impact of 37%.
Top mobile malware families
This month xHelper is the most popular mobile malware, followed by Necro and Hiddad.
Check Point’s Global Threat Impact Index and its ThreatCloud Map is powered by Check Point’s ThreatCloud intelligence, the largest collaborative network to fight cybercrime which delivers threat data and attack trends from a global network of threat sensors. The ThreatCloud database inspects over 2.5 billion websites and 500 million files daily, and identifies more than 250 million malware activities every day.
The complete list of the top 10 malware families in August can be found on the Check Point Blog.
About Check Point Research
About Check Point Software Technologies Ltd.