March 2021’s Most Wanted Malware

IcedID Banking Trojan Enters Top 10 Following Covid-Related Campaign

Check Point Research reports that IcedID has entered the global malware index for the first time, taking second place, after exploiting the COVID-19 pandemic to lure new victims

SAN CARLOS, Calif., April 13, 2021 (GLOBE NEWSWIRE) -- Check Point Research (CPR), the Threat Intelligence arm of Check Point Software Technologies Ltd. (NASDAQ: CHKP), a leading provider of cyber security solutions globally, has published its latest Global Threat Index for March 2021. Researchers report that the IcedID banking trojan has entered the Index for the first time, taking second place, while the established Dridex trojan was the most prevalent malware during March, up from seventh in February.

First seen in 2017, IcedID has been spreading rapidly in March via several spam campaigns, affecting 11% of organizations globally. One widespread campaign used a COVID-19 theme to entice new victims into opening malicious email attachments; the majority of these attachments are Microsoft Word documents with a malicious macro used to insert an installer for IcedID. Once installed, the trojan then attempts to steal account details, payment credentials, and other sensitive information from users’ PCs. IcedID also uses other malware to proliferate, and has been used as the initial infection stage in ransomware operations.

“IcedID has been around for a few years now but has recently been used widely, showing that cyber-criminals are continuing to adapt their techniques to exploit organizations, using the pandemic as a guise,” said Maya Horowitz, Director, Threat Intelligence & Research, Products at Check Point. “IcedID is a particularly evasive trojan that uses a range of techniques to steal financial data, so organizations must ensure they have robust security systems in place to prevent their networks being compromised and minimize risks. Comprehensive training for all employees is crucial, so they are equipped with the skills needed to identify the types of malicious emails that spread IcedID and other malware.”

CPR also warns that “HTTP Headers Remote Code Execution (CVE-2020-13756)” is the most common exploited vulnerability, impacting 45% of organizations globally, followed by “MVPower DVR Remote Code Execution” which impact 44% of organizations worldwide. “Dasan GPON Router Authentication Bypass (CVE-2018-10561)” is on the third place in the top exploited vulnerabilities list, with a global impact of 44%.