June‘s Most Wanted Malware: Notorious Phorpiex Botnet Rises Again, Doubling Its Global Impact On Organizations

Check Point Research finds sharp increase in attacks using the Phorpiex Botnet delivering new ‘Avaddon’ ransomware via malspam campaigns

Our latest Global Threat Index for June 2020 has revealed that in the past month the Phorpiex botnet has been delivering Avaddon Ransomware,  a new Ransomware-as-a-Service (RaaS) variant that emerged in early June, via malspam campaigns, causing it to jump up 13 places to 2nd in the Top Malware listing and doubling its impact on organizations worldwide compared to May.

As reported previously by Check Point researchers, Phorpiex is known for spreading large-scale sextortion malspam campaigns, as well as distributing other malware families. The latest malspam messages distributed via Phorpiex try to entice recipients into opening a Zip file attachment by using a wink emoji in the email subject. If a user clicks on the file, the Avaddon ransomware is activated, scrambling data on the computer and demanding a ransom in return for file decryption.  In 2019, Check Point researchers found over a million Phorpiex-infected Windows computers. Researchers estimated the annual criminal revenue generated by Phorpiex botnet at approximately $500,000.

Meanwhile, the Agent Tesla remote access trojan and info-stealer continued to have a significant impact throughout June, moving up from 2^nd place in May to 1^st place, while the XMRig cryptominer remains in 3^rd place for the second month running.

In the past Phorpiex, also known as Trik, was monetized by distributing other malware such as GandCrab, Pony or Pushdo, using its hosts to mine cryptocurrency, or for sextortion scams. It is now being used to spread a new ransomware campaign. Organizations should educate employees about how to identify the types of malspam that carry these threats, such as the latest campaign targeting users with emails containing a wink emoji, and ensuring they deploy security that actively prevents them from infecting their networks.

The research team also warns that “OpenSSL TLS DTLS Heartbeat Information Disclosure” is the most common exploited vulnerability, impacting 45% of organizations globally, closely followed by “MVPower DVR Remote Code Execution” which impacts 44% of organizations worldwide. “Web Server Exposed Git Repository Information Disclosure” remains in third place, with a global impact of 38%.

Top malware families

*The arrows relate to the change in rank compared to the previous month.

This month Agent Tesla is the most popular malware with a global impact of 3% of organizations, closely followed by Phorpiex and XMRig impacting 2% of organizations each.

1. ↑ Agent Tesla – Agent Tesla is an advanced RAT functioning as a keylogger and information stealer, which is capable of monitoring and collecting the victim’s keyboard input, system clipboard, taking screenshots, and exfiltrating credentials belonging to of a variety of software installed on a victim’s machine (including Google Chrome, Mozilla Firefox and Microsoft Outlook email client).
2. ↑ Phorpiex – Phorpiex is a botnet known for distributing other malware families via spam campaigns as well as fueling large scale Sextortion campaigns.
3. ↔ XMRig – XMRig is open-source CPU mining software used for the mining process of the Monero cryptocurrency, and first seen in-the-wild on May 2017.
4. ↓ Dridex – Dridex is a Trojan that targets the Windows platform and is reportedly downloaded via a spam email attachment. Dridex contacts a remote server and sends information about the infected system. It can also download and execute arbitrary modules received from the remote server.
5. ↑ Trickbot – Trickbot is a dominant banking Trojan constantly being updated with new capabilities, features and distribution vectors. This enables Trickbot to be a flexible and customizable malware that can be distributed as part of multi purposed campaigns.
6. ↑ Ramnit – Ramnit is banking Trojan that steals banking credentials, FTP passwords, session cookies and personal data.
7. ↔ Emotet – Emotet is an advanced, self-propagate and modular Trojan. Emotet once used to employ as a banking Trojan, and recently is used as a distributer to other malware or malicious campaigns. It uses multiple methods for maintaining persistence and Evasion techniques to avoid detection. In addition, it can be spread through phishing spam emails containing malicious attachments or links.
8. ↑ Glupteba – Glupteba is a backdoor which gradually matured into a botnet. By 2019 it included a C&C address update mechanism through public BitCoin lists, an integral browser stealer capability and a router exploiter.
9. ↓ Formbook – Formbook is infoStealer that harvests credentials from various web browsers, collects screenshots, monitors, and logs keystrokes, and can download and execute files according to its C&C orders.
10. ↑ NetwiredRC – NetWiredRC is a Backdoor capable of getting system information and stealing login credentials.

Top exploited vulnerabilities

This month “OpenSSL TLS DTLS Heartbeat Information Disclosure” is the most common exploited vulnerability, impacting 45% of organizations globally, closely followed by “MVPower DVR Remote Code Execution” which impacts 44% of organizations worldwide. “Web Server Exposed Git Repository Information Disclosure” remains in third place, with a global impact of 38%.

1. ↑ OpenSSL TLS DTLS Heartbeat Information Disclosure (CVE-2014-0160; CVE-2014-0346) – An information disclosure vulnerability exists in OpenSSL. The vulnerability is due to an error when handling TLS/DTLS heartbeat packets. An attacker can leverage this vulnerability to disclose memory contents of a connected client or server.
2. ↓MVPower DVR Remote Code Execution – A remote code execution vulnerability that exists in MVPower DVR devices. A remote attacker can exploit this weakness to execute arbitrary code in the affected router via a crafted request.
3. ↔ Web Server Exposed Git Repository Information Disclosure – An information disclosure vulnerability has been reported in Git Repository. Successful exploitation of this vulnerability could allow an unintentional disclosure of account information.
4. ↔ Dasan GPON Router Authentication Bypass (CVE-2018-10561) – An authentication bypass vulnerability exists in Dasan GPON routers. Successful exploitation of this vulnerability would allow remote attackers to obtain sensitive information and gain unauthorized access into the affected system.
5. ↑SQL Injection (several techniques) – Inserting an injection of SQL query in input from client to application, while exploiting a security vulnerability in an application’s software.
6. ↑ HTTP Headers Remote Code Execution (CVE-2020-13756) – HTTP headers let the client and the server pass additional information with an HTTP request. A remote attacker may use a vulnerable HTTP Header to run arbitrary code on the victim machine.
7. ↑WordPress portable-phpMyAdmin Plugin Authentication Bypass – An authentication bypass vulnerability exists in WordPress portable-phpMyAdmin Plugin. Successful exploitation of this vulnerability would allow remote attackers to obtain sensitive information and gain unauthorized access into the affected system.
8. ↔ OpenSSL Padding Oracle Information Disclosure – An information disclosure vulnerability exists in the AES-NI implementation of OpenSSL. The vulnerability is due to memory allocation miscalculation during a certain padding check. A remote attacker can exploit this vulnerability to obtain sensitive clear text information via a padding-oracle attack against an AES CBC session.
9. ↓PHP DIESCAN information disclosure – An information disclosure vulnerability has been reported in the PHP pages. Successful exploitation could lead to the disclosure of sensitive information from the server.
10. ↑ HP Universal CMDB Default Credentials Arbitrary File Upload (CVE-2014-2617) – A code execution vulnerability exists in PHP Universal CMDB. The vulnerability is due to the use of hard-coded credentials when processing HTTP requests. A remote attacker can upload arbitrary files to arbitrary locations using the default credentials.

Top mobile malware families

This month Necro is the most popular malware, following by Hiddad and Lotoor.

1. Necro – Necro is an Android Trojan Dropper. It is capable of downloading other malware, showing intrusive ads and stealing money by charging paid subscriptions.
2. Hiddad – Hiddad is an Android malware which repackages legitimate apps and then releases them to a third-party store. Its main function is to display ads, but it can also gain access to key security details built into the OS.
3. Lotoor – Lotoor is a hacking tool that exploits vulnerabilities on the Android operating system to gain root privileges on compromised mobile devices.