February 2022’s Most Wanted Malware: Emotet Remains Number One While Trickbot Slips Even Further Down the Index

Rhea-AI Summary

Check Point Research has reported that Emotet remains the most prevalent malware, affecting 5% of organizations globally, while Trickbot has dropped to sixth place after lacking recent campaigns. The report highlights the exploitation of the Russia/Ukraine conflict by cybercriminals using Emotet to distribute malicious emails. The Education/Research sector continues to be the most targeted industry, followed by Government/Military and ISP/MSP. The most exploited vulnerability is the Web Server Exposed Git Repository Information Disclosure, impacting 46% of organizations.

Positive

• Emotet is currently the most prevalent malware, affecting 5% of organizations.
• Education/Research remains the most attacked industry, indicating robust demand for cybersecurity solutions.

Negative

• Trickbot's decline to sixth place suggests a decrease in its threat level, which could imply shifting dynamics in malware prevalence.
• The exploitation linked to the Russia/Ukraine conflict may raise concerns over increasing cyber threats and damages.

Check Point Research reveals that Emotet is again the most prevalent malware, while Trickbot falls from second place into sixth. Apache Log4j is no longer the most exploited vulnerability but Education/Research is still the most attacked industry.

SAN CARLOS, Calif., March 09, 2022 (GLOBE NEWSWIRE) -- Check Point Research (CPR), the Threat Intelligence arm of Check Point® Software Technologies Ltd. (NASDAQ: CHKP), a leading provider of cyber security solutions globally, has published its latest Global Threat Index for February 2022. Researchers report that Emotet is still the most prevalent malware, impacting 5% of organizations worldwide, while Trickbot has slipped even further down the index into sixth place.

Trickbot is a botnet and banking trojan that can steal financial details, account credentials, and personally identifiable information, as well as spread laterally within a network and drop ransomware. During 2021, it appeared at the top of the most prevalent malwares list seven times. During the past few weeks, however, Check Point Research, has noted no new Trickbot campaigns and the malware now ranks sixth in the index. This could be due in part to some Trickbot members joining the Conti ransomware group, as suggested in the recent Conti data leak.

This month, CPR has witnessed cybercriminals taking advantage of the Russia/Ukraine conflict in order to lure people to download malicious attachments, and February’s most prevalent malware, Emotet, has indeed been doing just this, with emails that contain malicious files and the subject “Recall: Ukraine-Russia Military conflict: Welfare of our Ukrainian Crew member".

“Currently we are seeing a number of malwares, including Emotet, take advantage of the public interest around the Russia/Ukraine conflict by creating email campaigns on the topic that lure people into downloading malicious attachments. It’s important to always check that a sender’s email address is authentic, look out for any misspellings in emails and don’t open attachments or click on links unless you are certain that the email is safe,” said Maya Horowitz, VP Research at Check Point Software.

CPR revealed this month that Education/Research continues to be the most attacked industry globally followed by Government/Military and Internet service provider (ISP) / managed service provider (MSP). “Web Server Exposed Git Repository Information Disclosure” is the most commonly exploited vulnerability, impacting 46% of organizations globally, followed by “Apache Log4j Remote Code Execution” which dropped from first to second place and impacts 44% of organizations worldwide. “HTTP Headers Remote Code Execution” is the third most exploited vulnerability, with a global impact of 41%.

Top Malware Families
*The arrows relate to the change in rank compared to the previous month.

This month, Emotet is still the most prevalent malware impacting 5% of organizations worldwide, closely followed by Formbook which is impacting 3% of organizations and Glupteba which is impacting 2%.

1. ↔ Emotet – Emotet is an advanced, self-propagating and modular Trojan. Emotet, once used as a banking Trojan, has recently been used as a distributer to other malware or malicious campaigns. It uses multiple methods for maintaining persistence and evasion techniques to avoid detection. In addition, it can be spread through phishing spam emails containing malicious attachments or links.
2. ↑ Formbook - Formbook is an Info Stealer that harvests credentials from various web browsers, collects screenshots, monitors and logs keystrokes, and can download and execute files according to its C&C orders.
3. ↑ Glupteba - Glupteba is a backdoor which gradually matured into a botnet. By 2019 it included a C&C address update mechanism through public BitCoin lists, an integral browser stealer capability and a router exploiter.
   

Top Attacked Industries Globally

This month Education/Research is the most attacked industry globally, followed by Government/Military and ISP/MSP.

1. Education/Research
2. Government/Military
3. ISP/MSP

 Top Exploited Vulnerabilities

This month “Web Server Exposed Git Repository Information Disclosure” is the most commonly exploited vulnerability, impacting 46% of organizations globally, followed by “Apache Log4j Remote Code Execution” which has dropped from first place to second and impacts 44% of organizations worldwide. “HTTP Headers Remote Code Execution” is the third most exploited vulnerability, with a global impact of 41%.

1. ↑ Web Server Exposed Git Repository Information Disclosure - An information disclosure vulnerability has been reported in Git Repository. Successful exploitation of this vulnerability could allow an unintentional disclosure of account information.
2. ↓ Apache Log4j Remote Code Execution (CVE-2021-44228) - A remote code execution vulnerability exists in Apache Log4j. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system.
3. ↔ HTTP Headers Remote Code Execution (CVE-2020-10826,CVE-2020-10827,CVE-2020-10828,CVE-2020-13756) - HTTP headers let the client and the server pass additional information with a HTTP request. A remote attacker may use a vulnerable HTTP Header to run arbitrary code on the victim’s machine.

Top Mobile Malwares

This month XLoader is the most prevalent mobile malware, followed by xHelper and AlienBot.

1. XLoader - XLoader is an Android Spyware and banking Trojan developed by the Yanbian Gang, a Chinese hacker group. This malware uses DNS spoofing to distribute infected Android apps to collect personal and financial information.
2. xHelper - A malicious application seen in the wild since March 2019, used for downloading other malicious apps and display advertisement. The application can hide itself from the user and reinstalling itself in case it was uninstalled.
3. AlienBot - AlienBot malware family is a Malware-as-a-Service (MaaS) for Android devices that allows a remote attacker to firstly inject malicious code into legitimate financial applications then allows the attacker to obtain access to the victims’ accounts, and eventually completely control their device.

Check Point’s Global Threat Impact Index and its ThreatCloud Map is powered by Check Point’s ThreatCloud intelligence. ThreatCloud provides real-time threat intelligence derived from hundreds of millions of sensors worldwide, over networks, endpoints and mobiles. The intelligence is enriched with AI-based engines and exclusive research data from Check Point Research, The Intelligence & Research Arm of Check Point Software Technologies.

The complete list of the top 10 malware families in February can be found on the Check Point blog.

Follow Check Point Research via:
Blog: https://research.checkpoint.com/
Twitter: https://twitter.com/_cpresearch_

About Check Point Research
Check Point Research provides leading cyber threat intelligence to Check Point Software customers and the greater intelligence community. The research team collects and analyzes global cyber-attack data stored on ThreatCloud to keep hackers at bay, while ensuring all Check Point products are updated with the latest protections. The research team consists of over 100 analysts and researchers cooperating with other security vendors, law enforcement and various CERTs.

About Check Point Software Technologies Ltd.
Check Point Software Technologies Ltd. (www.checkpoint.com) is a leading provider of cyber security solutions to corporate enterprises and governments globally. Check Point Infinity’s portfolio of solutions protects enterprises and public organizations from 5th generation cyber-attacks with an industry leading catch rate of malware, ransomware and other threats. Infinity comprises three core pillars delivering uncompromised security and generation V threat prevention across enterprise environments: Check Point Harmony, for remote users; Check Point CloudGuard, to automatically secure clouds; and Check Point Quantum, to protect network perimeters and datacenters, all controlled by the industry’s most comprehensive, intuitive unified security management. Check Point protects over 100,000 organizations of all sizes.

MEDIA CONTACT:	INVESTOR CONTACT:
Emilie Beneitez Lefebvre	Kip E. Meintzer
Check Point Software Technologies	Check Point Software Technologies
press@checkpoint.com	ir@us.checkpoint.com

FAQ

What is the most prevalent malware according to Check Point Research in February 2022?

Emotet is reported as the most prevalent malware, affecting 5% of organizations worldwide.

How has Trickbot's position changed in the malware ranking?

Trickbot has fallen from second to sixth place in the malware ranking.

Which industry is the most attacked as per the February 2022 Threat Index?

The Education/Research industry is the most attacked sector globally.

What is the most exploited vulnerability according to the report?

The most exploited vulnerability is the Web Server Exposed Git Repository Information Disclosure, impacting 46% of organizations.

What percentage of organizations are impacted by the Apache Log4j vulnerability?

The Apache Log4j vulnerability impacts 44% of organizations worldwide.