Meanwhile, xHelper mobile malware continues its vicious activities, reinstalling itself even after a victim removes it.
The infamous Emotet malware has surged back to 1st place in the Check Point Global Threat Index, impacting 5% of organizations globally.
Since February 2020, Emotet’s activities—primarily sending waves of malspam campaigns—started to slow down and eventually stopped, until re-emerging in July. This pattern was observed in 2019 when the Emotet botnet ceased activity during the summer months but resumed in September.
In July 2020, Emotet malware was spreading malspam campaigns, infecting its victims with TrickBot and Qbot, which are used to steal banking credentials and spread inside networks. Some of the malspam campaigns contained malicious file with names like “form.doc” or “invoice.doc”.
According to researchers, the malicious document launches a PowerShell to pull the Emotet binary from remote websites to infect machines, adding them to the botnet. The resumption of Emotet’s activities highlights the scale and power of the botnet globally.
Said Maya Horowitz, Check Point’s Director, Threat Intelligence & Research, Products: “It’s interesting that Emotet was dormant for several months earlier this year, repeating a pattern we first observed in 2019. We can assume that the developers behind the botnet were updating its features and capabilities. But as it is active again, organizations should educate employees about how to identify the types of malspam that carry these threats and warn about the risks of opening email attachments or clicking on links from external sources. Businesses should also look at deploying anti-malware solutions that can prevent such content reaching end-users.”
The research team also warns that “MVPower DVR Remote Code Execution” is the most common exploited vulnerability, impacting 44% of organizations globally, followed by “OpenSSL TLS DTLS Heartbeat Information Disclosure” which impacts 42% of organizations worldwide. “Command Injection Over HTTP Payload” is in third place, with a global impact of 38%.
Top malware families
This month, Emotet is the most popular malware with a global impact of 5% of organizations, closely followed by Dridex and Agent Tesla affecting 4% of organizations each.
- ↑ Emotet
- ↑ Dridex
- ↓ Agent Tesla
Top exploited vulnerabilities
- ↑ MVPower DVR Remote Code Execution
- ↓ OpenSSL TLS DTLS Heartbeat Information Disclosure (CVE-2014-0160; CVE-2014-0346)
- ↑ Command Injection Over HTTP Payload
Top mobile malware families
This month xHelper is the most popular malware, followed by Necro and PreAMo.
- xHelper
- Necro
- PreAMo
Check Point’s Global Threat Impact Index inspects over 2.5 billion websites and 500 million files daily to identify malware activities.
