December 2020’s Most Wanted Malware: Emotet Returns as Top Malware Threat

Our latest Global Threat Index for December 2020 has revealed that the Emotet trojan has returned to first place in the top malware list, impacting 7% of organizations globally, following a spam campaign which targeted over 100,000 users per day during the holiday season.

In September and October 2020, Emotet was consistently at the top of the Global Threat Index, and was linked to a wave of ransomware attacks. But in November it was much less prevalent, dropping to 5^th place in the Index.  It has now been updated with new malicious payloads and improved detection evasion capabilities: the latest version creates a dialogue box, which helps it evade detection from users.  The new malicious spam campaign uses different delivery techniques to spread Emotet, including embedded links, document attachments, or password-protected Zip files.

First identified in 2014, Emotet has been regularly updated by its developers to maintain its effectiveness for malicious activity.  The Department of Homeland Security has estimated that each incident involving Emotet costs organizations upwards of $1 million dollars to rectify.

The research team also warns that “MVPower DVR Remote Code Execution” is the most common exploited vulnerability, impacting 42% of organizations globally, followed by “HTTP Headers Remote Code Execution (CVE-2020-13756)” which impact 42% of organizations worldwide.

Top malware families

*The arrows relate to the change in rank compared to the previous month.

This Month, Emotet remains the most popular malware with a global impact of 7% of organizations, closely followed by Trickbot and Formbook – which impacted 4% of organizations worldwide, each.

1. ↑ Emotet – Emotet is an advanced, self-propagating and modular Trojan. Emotet was once a banking Trojan, but recently has been used as a distributer for other malware or malicious campaigns. It uses multiple methods for maintaining persistence and Evasion techniques to avoid detection. In addition, it can be spread through phishing spam emails containing malicious attachments or links.
2. ↑ Trickbot – Trickbot is a dominant banking Trojan constantly being updated with new capabilities, features and distribution vectors. This enables Trickbot to be a flexible and customizable malware that can be distributed as part of multi purposed campaigns.
3. ↑ Formbook – Formbook is an Info-stealer that harvests credentials from various web browsers, collects screenshots, monitors, and logs keystrokes, and can download and execute files according to its C&C orders.
4. ↓ Dridex – Dridex is a Trojan that targets the Windows platform and is reportedly downloaded via a spam email attachment. Dridex contacts a remote server and sends information about the infected system. It can also download and execute arbitrary modules received from the remote server.
5. ↑ XMRig– XMRig is an open-source CPU mining software used for the mining process of the Monero cryptocurrency and was first seen in May 2017.
6. ↑ Qbot – Qbot is a banking Trojan that first appeared in 2008, designed to steal users banking credentials and keystrokes. Often distributed via spam email, Qbot employs several anti-VM, anti-debugging, and anti-sandbox techniques, to hinder analysis and evade detection.
7. ↓ Hiddad – Hiddad is an Android malware which repackages legitimate apps and then releases them to a third-party store. Its main function is to display ads, but it can also gain access to key security details built into the OS.
8. ↔ RigEK– RigEK delivers exploits for Flash, Java, Silverlight, and Internet Explorer. The infection chain starts with a redirection to a landing page that contains JavaScript that checks for vulnerable plug-ins and delivers the exploit.
9. ↑ Ramnit – Ramnit is a banking Trojan that steals banking credentials, FTP passwords, session cookies and personal data.
10. ↑ Glupteba – Glupteba is a backdoor which gradually matured into a botnet. By 2019 it included a C&C address update mechanism through public BitCoin lists, an integral browser stealer capability and a router exploiter.

Top exploited vulnerabilities

This month “MVPower DVR Remote Code Execution” is the most common exploited vulnerability, impacting 42% of organizations globally, followed by “HTTP Headers Remote Code Execution (CVE-2020-13756)” which impact 42% of organizations worldwide. “Web Server Exposed Git Repository Information Disclosure” is at third place in the top exploited vulnerabilities list, with a global impact of 41%.

1. ↑ MVPower DVR Remote Code Execution – A remote code execution vulnerability exists in MVPower DVR devices. A remote attacker can exploit this weakness to execute arbitrary code in the affected router via a crafted request.
2. ↓ HTTP Headers Remote Code Execution (CVE-2020-13756) – HTTP headers let the client and the server pass additional information with an HTTP request. A remote attacker may use a vulnerable HTTP Header to run arbitrary code on the victim machine.
3. ↑ Web Server Exposed Git Repository Information Disclosure – Information disclosure vulnerability has been reported in Git Repository. Successful exploitation of this vulnerability could allow an unintentional disclosure of account information.
4. ↓ Dasan GPON Router Authentication Bypass (CVE-2018-10561) – Authentication bypass vulnerability exists in Dasan GPON routers. Successful exploitation of this vulnerability would allow remote attackers to obtain sensitive information and gain unauthorized access into the affected system.
5. ↔ Command Injection Over HTTP Payload (CVE-2013-6719, CVE-2013-6720) – A command Injection over HTTP payload vulnerability has been reported. A remote attacker can exploit this issue by sending a specially crafted request to the victim. Successful exploitation would allow an attacker to execute arbitrary code on the target machine.
6. ↑ Command Injection Over HTTP – A command Injection over HTTP vulnerability has been reported. A remote attacker can exploit this issue by sending a specially crafted request to the victim. Successful exploitation would allow an attacker to execute arbitrary code on the target machine.
7. ↑ Linux System Files Information Disclosure (CVE-2015-2746, CVE-2018-10093, CVE-2018-3948, CVE-2018-3948) – Linux operating system contains system files with sensitive information. If not properly configured, remote attackers can view the information on such files.
8. ↔ SQL Injection (several techniques) – Inserting an injection of SQL query in input from client to application, while exploiting a security vulnerability in an application’s software.
9. ↓ Draytek Vigor Command Injection (CVE-2020-8515) – A command injection vulnerability exists in Draytek Vigor. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system.
10. ↑ Muieblackcat PHP Scanner – Muieblackcat is a vulnerability scanning product. Remote attackers can use Muieblackcat to detect vulnerabilities on a target server.

Top mobile malware

This month, Hiddad holds 1^st place in the most prevalent mobile malware, followed by xHelper and Triada.

1. Hiddad – Hiddad is an Android malware which repackages legitimate apps and then releases them to a third-party store. Its main function is to display ads, but it can also gain access to key security details built into the OS.
2. xHelper – A malicious application seen in the wild since March 2019, used for downloading other malicious apps and display advertisement. The application is capable of hiding itself from the user and reinstall itself in case it was uninstalled.
3. Triada – A modular Backdoor for Android which grants superuser privileges to downloaded malware.