December 2020’s Most Wanted Malware: Emotet Returns as Top Malware Threat

Our latest Global Threat Index for December 2020 has revealed that the Emotet trojan has returned to first place in the top malware list, impacting 7% of organizations globally, following a spam campaign which targeted over 100,000 users per day during the holiday season.

In September and October 2020, Emotet was consistently at the top of the Global Threat Index, and was linked to a wave of ransomware attacks. But in November it was much less prevalent, dropping to 5^th place in the Index.  It has now been updated with new malicious payloads and improved detection evasion capabilities: the latest version creates a dialogue box, which helps it evade detection from users.  The new malicious spam campaign uses different delivery techniques to spread Emotet, including embedded links, document attachments, or password-protected Zip files.

First identified in 2014, Emotet has been regularly updated by its developers to maintain its effectiveness for malicious activity.  The Department of Homeland Security has estimated that each incident involving Emotet costs organizations upwards of $1 million dollars to rectify.

The research team also warns that “MVPower DVR Remote Code Execution” is the most common exploited vulnerability, impacting 42% of organizations globally, followed by “HTTP Headers Remote Code Execution (CVE-2020-13756)” which impact 42% of organizations worldwide.

Top malware families

*The arrows relate to the change in rank compared to the previous month.

This Month, Emotet remains the most popular malware with a global impact of 7% of organizations, closely followed by Trickbot and Formbook – which impacted 4% of organizations worldwide, each.

1. ↑ Emotet – Emotet is an advanced, self-propagating and modular Trojan. Emotet was once a banking Trojan, but recently has been used as a distributer for other malware or malicious campaigns. It uses multiple methods for maintaining persistence and Evasion techniques to avoid detection. In addition, it can be spread through phishing spam emails containing malicious attachments or links.
2. ↑ Trickbot – Trickbot is a dominant banking Trojan constantly being updated with new capabilities, features and distribution vectors. This enables Trickbot to be a flexible and customizable malware that can be distributed as part of multi purposed campaigns.
3. ↑ Formbook – Formbook is an Info-stealer that harvests credentials from various web browsers, collects screenshots, monitors, and logs keystrokes, and can download and execute files according to its C&C orders.
4. ↓ Dridex – Dridex is a Trojan that targets the Windows platform and is reportedly downloaded via a spam email attachment. Dridex contacts a remote server and sends information about the infected system. It can also download and execute arbitrary modules received from the remote server.
5. ↑ XMRig– XMRig is an open-source CPU mining software used for the mining process of the Monero cryptocurrency and was first seen in May 2017.
6. ↑ Qbot – Qbot is a banking Trojan that first appeared in 2008, designed to steal users banking credentials and keystrokes. Often distributed via spam email, Qbot employs several anti-VM, anti-debugging, and anti-sandbox techniques, to hinder analysis and evade detection.
7. ↓ Hiddad – Hiddad is an Android malware which repackages legitimate apps and then releases them to a third-party store. Its main function is to display ads, but it can also gain access to key security details built into the OS.
8. ↔ RigEK– RigEK delivers exploits for Flash, Java, Silverlight, and Internet Explorer. The infection chain starts with a redirection to a landing page that contains JavaScript that checks for vulnerable plug-ins and delivers the exploit.
9. ↑ Ramnit – Ramnit is a banking Trojan that steals banking credentials, FTP passwords, session cookies and personal data.
10. ↑ Glupteba – Glupteba is a backdoor which gradually matured into a botnet. By 2019 it included a C&C address update mechanism through public BitCoin lists, an integral browser stealer capability and a router exploiter.