August 2020’s Most Wanted Malware

Evolved Qbot Trojan Ranks On Top Malware List For First Time - Seite 2

The research team also warns that “Web Server Exposed Git Repository Information Disclosure” is the most common exploited vulnerability, impacting 47% of organizations globally, followed by “MVPower DVR Remote Code Execution” which impacted 43% of organizations worldwide. “Dasan GPON Router Authentication Bypass (CVE-2018-10561)” is in third place, with a global impact of 37%.

Top malware families
*The arrows relate to the change in rank compared to the previous month.

This month Emotet remains the most popular malware with a global impact of 14% of organizations, closely followed by Agent Tesla and Formbook affecting 3% of organizations each.

1. Emotet – Emotet is an advanced, self-propagating and modular Trojan. Emotet was originally a banking Trojan, but recently is used as a distributor of other malware or malicious campaigns. It uses multiple methods for maintaining persistence and evasion techniques to avoid detection. In addition, it can be spread through phishing spam emails containing malicious attachments or links.
   
   
2. ↑ Agent Tesla - Agent Tesla is an advanced RAT functioning as a keylogger and information stealer , capable of monitoring and collecting the victim's keyboard input, system clipboard, taking screenshots, and exfiltrating credentials belonging to of a variety of software installed on a victim's machine (including Google Chrome, Mozilla Firefox and Microsoft Outlook email client). 
   
   
3. ↑ Formbook - Formbook is an Info Stealer that harvests credentials from various web browsers, collects screenshots, monitors and logs keystrokes, and can download and execute files according to its C&C orders.
   

Top exploited vulnerabilities

This month “Web Server Exposed Git Repository Information Disclosure” is the most common exploited vulnerability, impacting 47% of organizations globally, followed by “MVPower DVR Remote Code Execution” which impacted 43% of organizations worldwide. “Dasan GPON Router Authentication Bypass (CVE-2018-10561)” is in third place, with a global impact of 37%.

1. ↑ Web Server Exposed Git Repository Information Disclosure – An information disclosure vulnerability that has been reported in Git Repository. Successful exploitation of this vulnerability could allow an unintentional disclosure of account information.
2. ↓MVPower DVR Remote Code Execution - A remote code execution vulnerability that exists in MVPower DVR devices. A remote attacker can exploit this weakness to execute arbitrary code in the affected router via a crafted request.
3. ↑ Dasan GPON Router Authentication Bypass (CVE-2018-10561) – An authentication bypass vulnerability that exists in Dasan GPON routers. Successful exploitation of this vulnerability would allow remote attackers to obtain sensitive information and gain unauthorized access into the affected system.