May 2023’s Most Wanted Malware

New Version of Guloader Delivers Encrypted Cloud-Based Payloads

Check Point's Global Threat Index reveals innovative cloud-based, encrypted malware; Education/Research sector remains highly vulnerable

SAN CARLOS, Calif., June 09, 2023 (GLOBE NEWSWIRE) -- Check Point Software Technologies Ltd. (NASDAQ: CHKP), a leading provider of cybersecurity solutions globally, has published its Global Threat Index for May 2023. Researchers reported on a new version of shellcode-based downloader GuLoader, which was the fourth most prevalent malware last month. With fully encrypted payloads and anti-analysis techniques, the latest form can be stored undetected in well-known public cloud services, including Google Drive. Meanwhile, Qbot and Anubis took first place on their respective lists, and Education/Research remained the most exploited industry.

The GuLoader malware, widely used by cybercriminals to bypass antivirus detection, has undergone significant changes. The latest iteration employs a sophisticated technique of replacing code in a legitimate process, facilitating its evasion from process monitoring security tools. The payloads are fully encrypted and stored undetected in renowned public cloud services, including Google Drive. This unique blend of encryption, raw binary format, and separation from the loader makes the payloads invisible to antivirus programs, posing a significant threat to users and businesses worldwide.

Last month also saw both Qbot and Anubis taking first place on their respective lists. Despite efforts to slow down malware distribution by blocking macros in Office files, Qbot operators have been quick to adapt their distribution and delivery. It has recently been seen abusing a dynamic link library (DLL) hijacking flaw in the Windows 10 WordPad program to infect computers.

"Public tools and services are increasingly being exploited by cybercriminals to deliver and store malware campaigns. The trustworthiness of a source no longer guarantees complete security," said Maya Horowitz, VP Research at Check Point Software. "This highlights the urgent need for education on identifying suspicious activities. We strongly advise against disclosing personal information or downloading attachments unless the authenticity and benign nature of the request have been confirmed. Additionally, it's crucial to have advanced security solutions like Check Point Horizon XDR/XPR in place, which can effectively identify if an allegedly benign behavior is actually malicious, providing an extra layer of protection against sophisticated threats."