IT threat evolution

guest · May 20, 2020

Overview of threats in Q1 2020:
IT threat evolution Q1 2020
May 20, 2020
https://securelist.com/it-threat-evolution-q1-2020/96886/

Targeted attacks and malware campaigns
Operation AppleJeus: the sequel [...] Roaming Mantis turns to SMiShing and enhances anti-researcher techniques [...]
WildPressure on industrial networks in the Middle East [...] TwoSail Junk [...]
A sprinkling of Holy Water in Asia [...]
Click to expand...

Other security news
Shlayer Trojan attacks macOS users [...] Cybercriminals exploiting fears about data breaches [...]
AZORult campaign abuses popular VPN service to steal crypto-currency [...]
Distributing malware under the guise of security certificates [...]
Click to expand...

guest · May 20, 2020

IT threat evolution Q1 2020. Statistics
May 20, 2020
https://securelist.com/it-threat-evolution-q1-2020-statistics/96959/

These statistics are based on detection verdicts for Kaspersky products received from users who consented to providing statistical data.
Mobile threats
Starting in Q2 2019, we have seen a steady rise in the number of mobile threats detected. Although it is too early to sound the alarm (2019 saw the lowest number of new threats in recent years), the trend is concerning.

Of all the threats detected in Q1, half were unwanted adware apps (49.9%), their share having increased by 19 p.p. compared to the previous quarter. Most often, we detected members of the HiddenAd and Ewind families, with a combined slice of 40% of all detected adware threats, as well as the FakeAdBlocker family (12%).
Geography of mobile threats
In Q1 2020, the leader by share of attacked users was Iran (39.56%). Inhabitants of this country most frequently encountered adware apps from the Notifyer family, as well as Telegram clone apps. In second place was Algeria (21.44%), where adware apps were also distributed, but this time it was the HiddenAd and FakeAdBlocker families.
Click to expand...

Attacks on Apple macOS
In Q1 2020, we detected not only new versions of common threats, but one new backdoor family, whose first member was Backdoor.OSX.Capip.a. The malware’s operating principle is simple: it calls the C&C for a shell script, which it then downloads and executes.
The top 20 threats for macOS did not undergo any major changes in Q1 2020.
Ransomware programs
Ransomware attacks on organizations, as well as on city and municipal networks, did not ease off. Given how lucrative they are for cybercriminals, there is no reason why this trend of several years should cease.
More and more ransomware is starting to supplement encryption with data theft. To date, this tactic has been adopted by distributors of ransomware families, including Maze, REvil/Sodinokibi, DoppelPaymer and JSWorm/Nemty/Nefilim. [...]
Click to expand...

guest · Sep 3, 2020

IT threat evolution Q2 2020
September 3, 2020
https://securelist.com/it-threat-evolution-q2-2020/98230/

Targeted attacks
PhantomLance: hiding in plain sight [...] Naikon’s Aria [...]
COMpfun authors spoof visa application with HTTP status-based Trojan [...] Mind the [air] gap [...]
SixLittleMonkeys [...]
Click to expand...

Other malware
Loncom packer: from backdoors to Cobalt Strike [...] xHelper: the Trojan matryoshka [...]
Spike in RDP brute-force attacks [...] Gaming during the COVID-19 pandemic [...]
Rovnix bootkit back in business [...] Web skimming with Google Analytics [...]
Click to expand...

guest · Sep 3, 2020

IT threat evolution Q2 2020. PC statistics
September 3, 2020
https://securelist.com/it-threat-evolution-q2-2020-pc-statistics/98292/

These statistics are based on detection verdicts of Kaspersky products received from users who consented to provide statistical data.
Financial threat statistics
In Q2 2020, Kaspersky solutions blocked attempts to launch one or more types of malware designed to steal money from bank accounts on the computers of 181,725 users.
Quarterly trend highlights
Ransomware written in Go began surfacing more often than before. Examples of recently discovered Trojans include Sorena, Smaug, Hydra, Satan/M0rphine, etc.
Vulnerable applications used by cybercriminals during cyberattacks
Exploit distribution statistics for Q2 2020, as before, show that vulnerabilities in the Microsoft Office suite are the most common ones. However, their share decreased to 72% in the last quarter. The same vulnerabilities we had seen before still topped the list. CVE-2017-8570, [...]
Click to expand...

Attacks on Apple macOS
In Q2 2020, we discovered new versions of previously known threats and one new backdoor, which received the verdict of Backdoor.OSX.Lador.a. The malware is notable for being written in Go, a language gaining popularity as a means to create malware aimed at the macOS platform.
IoT threat statistics
Q2 2020 saw no dramatic change in cybercriminal activity targeting IoT devices: attackers most frequently ran Telnet login and password brute-force campaigns. [...]
Click to expand...

guest · Sep 4, 2020

IT threat evolution Q2 2020. Mobile statistics
September 3, 2020
https://securelist.com/it-threat-evolution-q2-2020-mobile-statistics/98337/

These statistics are based on detection verdicts of Kaspersky products received from users who consented to provide statistical data.
Quarterly figures
According to Kaspersky Security Network, the second quarter saw:

1,245,894 detected malicious installers, of which

38,951 packages were related to mobile banking trojans

3,805 packages proved to be mobile ransomware trojans

A total of 14,204,345 attacks on mobile devices were blocked

Click to expand...

Quarterly highlights
In summing up the results of the second quarter, we will begin with the number of attacks that targeted mobile devices. In Q2 2019, we thwarted 15,137,884 attacks, but one year later, the number decreased insignificantly, to 14,204,345.
The absence of significant changes indicates that malware developers kept up their activities in the face of the coronavirus pandemic.

Further good news from Q2 2020 is a decrease in the number of devices that were found to contain stalkerware.

Adware topped the list with 48%, a decrease of one percentage point from the previous quarter. The Ewind adware family (60.53% of all adware detected) was most common in Q2, followed by the FakeAdBlocker family with 13.14% and Inoco with 10.17%.
RiskTool-type potentially unwanted software ranked second among all detected threat classes. Its share was 20%, which is eight percentage points smaller than in Q1 2020 and 21 p.p. smaller than in Q2 2019.
Click to expand...

Mobile banking Trojans
The first and second places on our list went to mobile bankers that targeted mobile users from Russia: Trojan-Banker.AndroidOS.Rotexy.e (13.29%) and Trojan-Banker.AndroidOS.Svpeng.q (9.66%).
Various members of the Asacub family took three positions out of ten on the TOP 10 for mobile financial threats. Although this threat family is not particularly numerous, it is very popular with attackers.
Mobile ransomware Trojans
The number of detected objects has been decreasing from quarter to quarter. We believe that there are two main causes:
It is much harder to extort cash from users than to steal the bank account data right away. [...] in their turn, try to keep their malware undetected on the device as long as possible, which runs counter to the whole idea of mobile ransomware.
Click to expand...

guest · Nov 20, 2020

Malware Report Q3 2020:
IT threat evolution Q3 2020
November 20, 2020
https://securelist.com/it-threat-evolution-q3-2020/99382/

Targeted attacks
MATA: Lazarus’s multi-platform targeted malware framework [...] Lazarus on the hunt for big game [...]
WastedLocker [...] CactusPete’s updated Bisonal backdoor [...] Operation PowerFall [...]
The latest activities of Transparent Tribe [...] DeathStalker: mercenary cybercrime group [...]
Click to expand...

Other malware
The Tetrade: Brazilian banking malware goes global [...] The dangers of streaming [...]
Threats facing digital education [...] Undeletable adware on smartphones [...]
Click to expand...

guest · Nov 20, 2020

IT threat evolution Q3 2020. Non-mobile statistics
November 20, 2020
https://securelist.com/it-threat-evolution-q3-2020-non-mobile-statistics/99404/

These statistics are based on detection verdicts of Kaspersky products received from users who consented to provide statistical data.
Quarterly figures
According to Kaspersky Security Network, in Q3:

• Kaspersky solutions blocked 1,416,295,227 attacks launched from online resources across the globe.
• 456,573,467 unique URLs were recognized as malicious by Web Anti-Virus components.
• Attempts to run malware for stealing money from online bank accounts were stopped on the computers of 146,761 unique users.
• Ransomware attacks were defeated on the computers of 121,579 unique users.
• Our File Anti-Virus detected 87,941,334 unique malicious and potentially unwanted objects.
Click to expand...

Financial threat statistics
In Q3 2020, Kaspersky solutions blocked attempts to launch one or more types of malware designed to steal money from bank accounts on the computers of 146,761 users.
Quarterly trends and highlights
Q3 2020 saw many high-profile ransomware attacks on organizations in various fields: education, healthcare, governance, energy, finance, IT, telecommunications and many others. Such cybercriminal activity is understandable: a successful attack on a major organization can command a ransom in the millions of dollars, which is several orders of magnitude higher than the typical sum for mass ransomware.
Vulnerable applications used by cybercriminals during cyberattacks
According to our statistics, vulnerabilities in the Microsoft Office suite continue to lead: in Q3, their share amounted to 71% of all identified vulnerabilities. [...]
Click to expand...

guest · Nov 20, 2020

IT threat evolution Q3 2020 Mobile statistics
November 20, 2020
https://securelist.com/it-threat-evolution-q3-2020-mobile-statistics/99461/

The statistics presented here draw on detection verdicts returned by Kaspersky products and received from users who consented to providing statistical data.
Quarterly figures
According to Kaspersky Security Network, the third quarter saw:

1,189 797 detected malicious installers, of which

39,051 packages were related to mobile banking trojans;

6063 packages proved to be mobile ransomware trojans.

A total of 16,440,264 attacks on mobile devices were blocked.

Click to expand...

Quarterly highlights
In Q3 2020, Kaspersky mobile protective solutions blocked 16,440,264 attacks on mobile devices, an increase of 2.2 million on Q2 2020.
It is worth noting that in Q3 2020, the share of users attacked by malware increased, whereas the number of users who encountered adware and grayware decreased.

In Q3 2020, the share of users who encountered adware according to our data decreased by four percentage points. Notably, the complexity of these applications is no lower than that of malware.
Mobile threat statistics
In Q3 2020, Kaspersky solutions detected 1,189,797 malicious installation packages, 56,097 more than in the previous quarter.
For the first time in a year, the number of detected mobile threats dropped when compared to the previous period. This was no ordinary year, though. [...]
Click to expand...

guest · Aug 12, 2021

Malware Report Q2 2021:
IT threat evolution Q2 2021
August 12, 2021
https://securelist.com/it-threat-evolution-q2-2021/103597/

Targeted attacks
The leap of a Cycldek-related threat actor [...] Zero-day vulnerability in Desktop Window Manager used in the wild [...]
Operation TunnelSnake [...] PuzzleMaker [...]
Andariel adds ransomware to its toolset [...] Ferocious Kitten [...]
Click to expand...

Other malware
Evolution of JSWorm ransomware [...] Black Kingdom ransomware [...]
Gootkit: the cautious banking Trojan [...] Bizarro banking Trojan expands into Europe [...]
Malicious code in APKPure app [...] Browser lockers [...]
Malware targets Apple M1 chip [...] Attempted supply-chain attack using PHP [...]
Click to expand...

guest · Aug 12, 2021

IT threat evolution in Q2 2021. PC statistics
August 12, 2021
https://securelist.com/it-threat-evolution-in-q2-2021-pc-statistics/103607/

Quarterly figures
According to Kaspersky Security Network, in Q2 2021:

Kaspersky solutions blocked 1,686,025,551 attacks from online resources across the globe.

Web antivirus recognized 675,832,360 unique URLs as malicious.

Attempts to run malware for stealing money from online bank accounts were stopped on the computers of 119,252 unique users.

Ransomware attacks were defeated on the computers of 97,451 unique users.

Our file antivirus detected 68,294,298 unique malicious and potentially unwanted objects.

Click to expand...

Quarterly trends and highlights
Attack on Colonial Pipeline and closure of DarkSide
Ransomware attacks on large organizations continued in Q2. Perhaps the most notable event of the quarter was the attack by the DarkSide group on Colonial Pipeline, one of the largest fuel pipeline operators in the US.
Closure of Avaddon
Another family of targeted ransomware whose owners shut up shop in Q2 is Avaddon.
Attacks on NAS devices
In Q2, cybercriminals stepped up their attacks on network-attached storage (NAS) devices. [...]
Click to expand...

guest · Aug 12, 2021

IT threat evolution in Q2 2021. Mobile statistics
August 12, 2021
https://securelist.com/it-threat-evolution-q2-2021-mobile-statistics/103636/

Quarterly figures
In Q2 2021, according to data from Kaspersky Security Network:

14,465,672 malware, adware and riskware attacks were prevented.

The largest share of all detected threats accrued to RiskTool programs — 38.48%.

886,105 malicious installation packages were detected, of which:

24,604 packages were mobile banking Trojans;

3,623 packages were mobile ransomware Trojans.

Click to expand...

Quarterly highlights
The development of Google Play Protect is worth highlighting, and the rights of apps have since been severely restricted, as now they have to request all permissions from users explicitly. Moreover, the security subsystem was moved to a separate updatable component, independent of the device manufacturer.

Yet there is one thing both the old 1.6 version and the latest Android 11 have in common which significantly compromises the operating system’s security: the freedom to install apps from third-party sources. [...] — but it gives all sorts of cybercriminals a real “window of opportunity” from a security point of view.
Click to expand...

guest · Aug 15, 2022

Malware Report Q2 2022:
IT threat evolution Q2 2022
August 15, 2022

Targeted attacks
New technique for installing fileless malware [...] WinDealer’s man-on-the-side spyware [...]
ToddyCat: previously unknown threat actor attacks high-profile organizations in Europe and Asia [...]
SessionManager IIS backdoor [...]
Click to expand...

Other malware
Spring4Shell [...] Actively exploited vulnerability in Windows [...] Follina vulnerability in MSDT [...]
BlackCat: a new ransomware gang [...] Yanluowang ransomware: how to recover encrypted files [...]
Click to expand...

guest · Aug 15, 2022

IT threat evolution in Q2 2022. Non-mobile statistics
August 15, 2022

These statistics are based on detection verdicts of Kaspersky products and services received from users who consented to providing statistical data.
Quarterly figures
According to Kaspersky Security Network, in Q2 2022:

Kaspersky solutions blocked 1,164,544,060 attacks from online resources across the globe.

Web Anti-Virus recognized 273,033,368 unique URLs as malicious. Attempts to run malware for stealing money from online bank accounts were stopped on the computers of 100,829 unique users.

Ransomware attacks were defeated on the computers of 74,377 unique users.

Our File Anti-Virus detected 55,314,176 unique malicious and potentially unwanted objects.

Click to expand...

Financial threat statistics
In Q2 2022, Kaspersky solutions blocked the launch of malware designed to steal money from bank accounts on the computers of 100,829 unique users.
Quarterly trends and highlights
In the second quarter, the Lockbit group launched a bug bounty program. The cybercriminals are promising $1,000 to $1,000,000 for doxing of senior officials, reporting web service, Tox messenger or ransomware Trojan algorithm vulnerabilities, as well as for ideas on improving the Lockbit website and Trojan.

Another well-known group, Conti, said it was shutting down operations.
Click to expand...

Number of new miner modifications
In Q2 2022, Kaspersky solutions detected 40,788 new modifications of miners. A vast majority of these (more than 35,000) were detected in June.
Number of users attacked by miners
In Q2, we detected attacks using miners on the computers of 454,385 unique users of Kaspersky products and services worldwid
Click to expand...

Vulnerable applications used by criminals during cyberattacks
Quarterly highlights
During Q2 2022, a number of major vulnerabilities were discovered in the Microsoft Windows. For instance, CVE-2022-26809 critical error allows an attacker to remotely execute arbitrary code in a system using a custom RPC request.
Attacks on macOS
The second quarter brought with it a new batch of cross-platform discoveries. For instance, a new APT group Earth Berberoka (GamblingPuppet) that specializes in hacking online casinos, uses malware for Windows, Linux, and macOS. The TraderTraitor campaign targets cryptocurrency and blockchain organizations, attacking with malicious crypto applications for both Windows and macOS.
Click to expand...

guest · Aug 15, 2022

IT threat evolution in Q2 2022. Mobile statistics
August 15, 2022

These statistics are based on detection verdicts of Kaspersky products received from users who consented to providing statistical data.
Quarterly figures
According to Kaspersky Security Network, in Q2 2022:
• 5,520,908 mobile malware, adware and riskware attacks were blocked.
• The most common threat to mobile devices was adware: 25.28% of all threats detected.
• 405,684 malicious installation packages were detected, of which:

• 55,614 packages were related to mobile banking Trojans;
• 3,821 packages were mobile ransomware Trojans.
Click to expand...

Quarterly highlights
In the second quarter of 2022, cybercriminal activity continued to decline — if the number of attacks on mobile devices is any indication.
As in the previous quarter, fraudulent apps occupied seven out of twenty leading positions in the malware rankings. That said, the total number of attacks by these apps started to decrease.
Mobile threat statistics
In Q2 2022, Kaspersky detected 405,684 malicious installation packages, a reduction of 110,933 from the previous quarter and a year-on-year decline of 480,421.

Adware ranked first among all threats detected in Q2 2022 with 25.28%, exceeding the previous quarter’s figure by 8.36 percentage points. A third of all detected threats of that class were objects of the AdWare.AndroidOS.Ewind family (33.21%). This was followed by the AdWare.AndroidOS.Adlo (22.54%) and AdWare.AndroidOS.HiddenAd (8.88%) families.
Click to expand...

guest · Nov 18, 2022

Malware Report Q3 2022:
IT threat evolution Q3 2022
By David Emm @emm_david - November 18, 2022

Targeted attacks
CosmicStrand: discovery of a sophisticated UEFI rootkit [...] Andariel deploys DTrack and Maui ransomware [...]
VileRAT: DeathStalker’s continuous strike at foreign and crypto-currency exchanges [...]
Kimsuky’s GoldDragon cluster and C2 operations [...] Targeted attacks on industrial enterprises [...]
Click to expand...

Other malware
Prilex: the pricey prickle credit card complex [...] Luna and Black Basta: new ransomware for Windows, Linux and ESXi [...]
Malicious packages in online code repositories [...] Cyberthreats facing gamers [...]
NullMixer: oodles of Trojans in a single dropper [...] Potential threat in the browser [...]
Click to expand...

guest · Nov 18, 2022

IT threat evolution in Q3 2022. Non-mobile statistics
November 18, 2022

These statistics are based on detection verdicts of Kaspersky products and services received from users who consented to providing statistical data.
Quarterly figures
According to Kaspersky Security Network, in Q3 2022:
• Kaspersky solutions blocked 956,074,958 attacks from online resources across the globe.
• Web Anti-Virus recognized 251,288,987 unique URLs as malicious.
• Attempts to run malware for stealing money from online bank accounts were stopped on the computers of 99,989 unique users.
• Ransomware attacks were defeated on the computers of 72,941 unique users.
• Our File Anti-Virus detected 49,275,253 unique malicious and potentially unwanted objects.
Click to expand...

Financial threats
In Q3 2022, Kaspersky solutions blocked the launch of at least one piece of banking malware on the computers of 99,989 unique users.
Quarterly trends and highlights
The third quarter of 2022 saw the builder for LockBit, a well-known ransomware, leaked online. LockBit themselves attributed the leakage to one of their developers’ personal initiative, not the group’s getting hacked. One way or another, the LockBit 3.0 build kit is now accessible to the broader cybercriminal community.

The creators of the little-known AstraLocker and Yashma ransomware published decryptors and stopped spreading both of them. The hackers provided no explanation for the move, but it appeared to be related to an increase in media coverage.
Click to expand...

Number of new modifications
In Q3 2022, we detected 17 new ransomware families and 14,626 new modifications of this malware type.
Number of users attacked by ransomware Trojans
In Q3 2022, Kaspersky products and technologies protected 72,941 users from ransomware attacks.
Miners
Number of new miner modifications
In Q3 2022, Kaspersky systems detected 153,773 new miner mods.
Number of users attacked by miners
In Q3, we detected attacks that used miners on the computers of 432,363 unique users of Kaspersky products worldwide.
Click to expand...

Vulnerable applications used by criminals during cyberattacks
Quarterly highlights
Q3 2022 was remembered for a series of vulnerabilities discovered in various software products. Let’s begin with Microsoft Windows and some of its components. Researchers found new vulnerabilities that affected the CLFS driver: CVE-2022-30220, along with CVE-2022-35803 and CVE-2022-37969, both encountered in the wild. By manipulating Common Log File System data in a specific way, an attacker can make the kernel write their own data to arbitrary memory addresses, allowing cybercriminals to hijack kernel control and elevate their privileges in the system
Attacks on macOS
The third quarter of 2022 brought with it a significant number of interesting macOS malware discoveries. In particular, researchers found Operation In(ter)ception, a campaign operated by North Korean Lazarus group, which targets macOS users looking for cryptocurrency jobs. The malware was disguised as documents containing summaries of positions at Coinbase and Crypto.com.
Click to expand...

guest · Nov 18, 2022

IT threat evolution in Q3 2022. Mobile statistics
By Tatyana Shishkova, Anton Kivva - November 18, 2022

These statistics are based on detection verdicts of Kaspersky products received from users who consented to providing statistical data.
Quarterly figures
According to Kaspersky Security Network, in Q3 2022:
• A total of 5,623,670 mobile malware, adware, and riskware attacks were blocked.
• Droppers (Trojan-Dropper), accounting for 26.28% of detections, were the most common threat to mobile devices.
• 438,035 malicious installation packages were detected, of which:

• 35,060 packages were related to mobile banking Trojans,
• 2,310 packages were mobile ransomware Trojans.
Click to expand...

Quarterly highlights
Judging by the number of attacks on mobile devices, cybercriminal activity stabilized in Q3 2022 after a gradual drop in the previous quarters.
Despite a general decline in the number of mobile attacks, we can see that cybercriminals are using increasingly smarter tricks to deliver malware to user devices.

The new Triada Trojan, discovered inside a modified WhatsApp build, was an interesting find. It was notable for spreading via ads inside the popular Snaptube app and through the Vidmate internal store.
Mobile threat statistics
In Q3 2022, Kaspersky detected 438,035 malicious installation packages, which is 32,351 more than in the previous quarter and down 238,155 against Q3 2021.
Threats in the Trojan-Dropper class ranked first among all threats detected in Q3, with 26.28%, exceeding the previous quarter’s figure by 22.15 percentage points.
Click to expand...

Log in or Sign up

IT threat evolution

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Log in or Sign up

IT threat evolution

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Useful Searches