August’s Top Malware

Emotet Knocked off Top Spot by FormBook while GuLoader and Joker Disrupt the Index - Seite 2

CPR also revealed this month that the Education/Research sector is still the most targeted industry by cybercriminals globally. With Government/Military and Healthcare taking second and third place as the most attacked sectors. “Apache Log4j Remote Code Execution” returns to first place as the most exploited vulnerability, impacting 44% of organizations worldwide, after overtaking “Web Server Exposed Git Repository Information Disclosure” which had an impact of 42%.

Top malware families

*The arrows relate to the change in rank compared to the previous month.

FormBook is the most widespread malware this month impacting 5% of organizations worldwide, followed by AgentTesla with an impact of 4% and XMRig with 2%.

1. ↑ FormBook – FormBook is an Infostealer targeting Windows OS and was first detected in 2016. It is marketed as a Malware as a Service (MaaS) in underground hacking forums for its strong evasion techniques and relatively low price. FormBook harvests credentials from various web browsers, collects screenshots, monitors and logs keystrokes and can download and execute files according to orders from its C&C.
2. ↑ AgentTesla - AgentTesla is an advanced RAT functioning as a keylogger and information stealer, which is capable of monitoring and collecting the victim’s keyboard input, system keyboard, taking screenshots and exfiltrating credentials to a variety of software installed on a victim’s machine (including Google Chrome, Mozilla Firefox and the Microsoft Outlook email client).
3. ↓ XMRig – XMRig is open-source CPU software used to mine Monero cryptocurrency. Threat actors often abuse this open-source software by integrating it into their malware to conduct illegal mining on victim’s devices.

Top Attacked Industries Globally 

This month the Education/Research sector remained in first place as the most attacked industry globally, followed by Government/Military and Healthcare.

1. Education/Research
2. Government/Military
3. Healthcare
   

Top Exploited Vulnerabilities 

This month, “Apache Log4j Remote Code Execution” is the most common exploited vulnerability, impacting 44% of organizations globally, followed by “Web Server Exposed Git Repository Information Disclosure” which dropped from first place to second with an impact of 42%. “Web Servers Malicious URL Directory Traversal” remains in the third place, with a global impact of 39%.