Check Point Research Reveals Threat of Mobile Malware Persists as Attacks Targeting iOS Devices Increase

SAN CARLOS, CA--(Marketwired - May 17, 2016) - Check Point® Software Technologies Ltd. (NASDAQ: CHKP) today published its latest Threat Index, highlighting the most prevalent malware families being used to attack organizations' networks and mobile devices globally in April 2016.

Check Point identified 2,000 unique malware families during April, which was more than a 50 percent increase on the previous month. The findings revealed a wide range of threats that organizations' networks face and the scale of the challenges that security teams need to think about in preventing an attack on their business critical information. Most notably:

• Researchers found XcodeGhost, a compromised version of the iOS developer platform Xcode, is still an imminent threat to enterprise mobile devices, even though it was pulled from the Apple App Store in September 2015. In general, attacks targeting iOS devices moved into the top three of most common mobile malware for the first time.
  
  
• Android malware HummingBad remained in the overall top-10 of malware attacks across all platforms globally during the period. Despite only being discovered by Check Point researchers in February, it has rapidly become commonly used, indicating hackers view Android mobile devices as weak spots in enterprise security and as potentially highly rewarding targets.
  
  

"As organizations' dependence on mobility continues to grow, this latest research highlights cyber criminals are taking advantage of these devices, as they are proving to be the weakest link in enterprise IT security," said Michael Shaulov, head of mobility product management, Check Point. "This data also reinforces the need for businesses to have a strategy of advanced threat prevention on not only networks - but also on all endpoints and mobile devices - in order to best stop malware at the pre-infection stage."

Overall in April, Conficker was the most prominent malware family, accounting for 17 percent of recognized attacks; Sality was responsible for 12 percent; and Zeroaccess for 6 percent of the recognized attacks. The top-10 families were responsible for over half of all recognized attacks:

1. ↔ Conficker - A worm that allows remote operations and malware to be downloaded. The infected machine is then controlled by a botnet, which contacts its Command & Control server to receive instructions.
2. ↔ Sality - A virus that allows remote operations and downloads of additional malware to infected systems by its operator. Its main goal is to persist in a system and provide means for remote control and installing further malware.
3. ↑ Zeroaccess - A worm that targets Windows platforms, allowing remote operations and malware download. It utilizes a peer-to-peer (P2P) protocol to download or update additional malware components from remote peers.

The top three mobile malware families in April were: