April 2020’s Most Wanted Malware

Agent Tesla Remote Access Trojan Spreading Widely In COVID-19 Related Spam Campaigns

Check Point’s researchers find sharp increase in attacks using new version of Agent Tesla capable of stealing Wi-Fi passwords, while Dridex banking trojan is most common threat

SAN CARLOS, Calif., May 11, 2020 (GLOBE NEWSWIRE) -- Check Point Research, the Threat Intelligence arm of Check Point Software Technologies Ltd. (NASDAQ: CHKP), a leading provider of cyber security solutions globally, has published its latest Global Threat Index for April 2020. Researchers saw several COVID-19 related spam campaigns distributing a new variant of the Agent Tesla remote access trojan, moving it up to 3^rd place in the Index, impacting 3% of organizations worldwide.

The new variant of Agent Tesla has been modified to steal Wi-Fi passwords in addition to other information – such as Outlook email credentials – from target PCs. During April, Agent Tesla was distributed as an attachment in several malicious COVID-19 related spam campaigns, which attempt to lure the victim into downloading malicious files under the cover of providing interesting information about the pandemic. One of these campaigns claimed to be sent by the World Health Organization with the subject ‘URGENT INFORMATION LETTER: FIRST HUMAN COVID-19 VACCINE TEST/RESULT UPDATE.’ This highlights how hackers will exploit global news events and public concerns to increase their attack success rates.

The well-known banking trojan Dridex, which entered the Threat Index top ten for the first time in March, had an even greater impact in April. It moved up to 1^st place in the index from 3^rd last month, impacting 4% of organizations worldwide. XMRig, March’s most prevalent malware, dropped to second place.

“The Agent Tesla malspam campaigns we saw in April underline just how agile cybercriminals can be when it comes to exploiting news events and tricking unsuspecting victims to click on an infected link,” said Maya Horowitz, Director, Threat Intelligence & Research, Products at Check Point. “With both Agent Tesla and Dridex in the top three of the threat index, criminals are focusing on stealing users’ personal and business data and credentials so that they can monetize them. So it’s essential that organizations take a proactive and dynamic approach to user education, keeping their staff informed of the latest tools and techniques, particularly as more staff are now working from home.”