May 2023’s Most Wanted Malware

New Version of Guloader Delivers Encrypted Cloud-Based Payloads - Seite 2

The Education/Research sector continues to be the most targeted industry, according to Check Point's Index. The report also revealed that the "Web Servers Malicious URL Directory Traversal" vulnerability is the most exploited, impacting 49% of organizations globally. This is closely followed by "Apache Log4j Remote Code Execution" and "HTTP Headers Remote Code Execution" vulnerabilities, affecting 45% and 44% of organizations worldwide, respectively.

Top malware families
*The arrows relate to the change in rank compared to the previous month.
Qbot was the most prevalent malware last month with an impact of 6% worldwide organizations, followed by Formbook with a global impact of 5% and AgentTesla with a global impact of 3%.

1. ↑ Qbot – Qbot AKA Qakbot is a multipurpose malware that first appeared in 2008. It was designed to steal a user’s credentials, record keystrokes, steal cookies from browsers, spy on banking activities, and deploy additional malware. Often distributed via spam email, Qbot employs several anti-VM, anti-debugging, and anti-sandbox techniques to hinder analysis and evade detection. Commencing in 2022, it emerged as one of the most prevalent Trojans.
2. ↑ Formbook – Formbook is an Infostealer targeting the Windows OS and was first detected in 2016. It is marketed as Malware as a Service (MaaS) in underground hacking forums for its strong evasion techniques and relatively low price. FormBook harvests credentials from various web browsers, collects screenshots, monitors and logs keystrokes, and can download and execute files according to orders from its C&C.
3. ↓ AgentTesla – AgentTesla is an advanced RAT functioning as a keylogger and information stealer, which is capable of monitoring and collecting the victim’s keyboard input, system keyboard, taking screenshots, and exfiltrating credentials to a variety of software installed on a victim’s machine (including Google Chrome, Mozilla Firefox and the Microsoft Outlook email client).
   

Top Attacked Industries Globally
Last month, Education/Research remained in first place as the most exploited industry globally, followed by Government/Military and Healthcare.

1. Education/Research
2. Government/Military
3. Healthcare
   

Top exploited vulnerabilities
Last month, “Web Servers Malicious URL Directory Traversal” was the most exploited vulnerability, impacting 49% of organizations globally, followed by “Apache Log4j Remote Code Execution” impacting 45% of organizations worldwide. “HTTP Headers Remote Code Execution” was the third most used vulnerability, with a global impact of 44%.