Threat Research Team

Reports

<h2 class="text-align-justify">Foreword&nbsp;</h2>The Gen Q3/2024 Threat Report is here, offering an in-depth look at the forces reshaping the threat landscape. Scams continued to dominate, while other serious threats—including malvertising, ransomware, droppers, and data-stealing malware—surged ahead. Many of these threats remain closely linked to scams, underscoring the relentless evolution of cybercriminal tactics.&nbsp;

One of the most alarming trends is the rise of “Scam-Yourself Attacks”—an advanced <a href="https://us.norton.com/blog/emerging-threats/what-is-social-engineering">social engineering</a> tactic that tricks users into compromising their own systems. This quarter alone, we protected over 2 million users from a variant called FakeCaptcha, which mimics CAPTCHA prompts to deliver malware. With a staggering 614% increase of these Scam-Yourself attacks quarter-over-quarter; social engineering, psychological manipulation tactics, continues to be one of the most dangerous tools in the cybercriminal arsenal.&nbsp;In addition, <a href="https://www.avast.com/c-what-is-ransomware">ransomware</a> threats escalated following a 24% increase in Q2/2024, with a further 100% rise in the risk ratio and number of protected users this quarter. This surge was primarily driven by the AliGater campaign, which delivered the Magniber ransomware. Remote Access Trojans (RATs) also saw a 26% increase, largely due to the spread of XWorm. Our researchers once again uncovered and disclosed a zero-day vulnerability, in the AFD.sys Windows driver, which was exploited in the wild by the Lazarus APT group and specifically targeted a nuclear power plant.&nbsp;Also, among the most significant changes this quarter, information stealer activity rose by 39% quarter over quarter, fueled by the rise of Lumma Stealer. This malware-as-a-service has rapidly gained prominence, fueled by the ultimate objective of data theft, employing various delivery methods like fake YouTube tutorials and abused GitHub repositories. Its ability to bypass protections has made it one of the most formidable threats this quarter.&nbsp;In other social engineering news, malvertising, one of the most persistent types of social engineering, grew this quarter by 18%. Crypto scams, particularly those orchestrated by groups like CryptoCore, have spiked, using deepfake technology to exploit media events and lure victims into fraudulent cryptocurrency schemes. Additionally, malicious browser push notifications surged by 166% in some regions such as Italy.&nbsp;Data stealing <a href="https://www.avg.com/en/signal/what-is-malware">malware</a> also increased on mobile devices in Q3/2024. Financial data theft by banking malware saw a 60% surge, with attacks like Rocinante targeting users in Brazil, while new threats like TrickMo and Octo2 emerged in Europe. <a href="https://us.norton.com/blog/malware/spyware">Spyware</a> also rose sharply, with a 166% spike driven by NGate, an advanced spyware targeting NFC data for ATM withdrawals. A common denominator for the main mobile threats seen this quarter is their delivery via malicious SMS messages. As part of our mobile section, we will also showcase the most prevalent scam types identified through our Norton Genie visibility in 2024 so far.&nbsp;As we look back on the quarter, it’s evident that the cybersecurity landscape is evolving rapidly, with new and sophisticated threats emerging across the board. From the growing impact of social engineering scams to the resurgence of malware, the challenges we face continue to escalate. We encourage you to explore the full scope of insights provided in this report to gain a clearer understanding of these threats and their implications.Jakub Křoustek, Malware Research Director<h2 class="text-align-justify">Methodology&nbsp;</h2>This report is structured into three main sections: Desktop-related threats, where we describe our intelligence around attacks targeting the Windows, Linux and Mac operating systems, with a specific emphasis on web-related threats and Mobile-related threats, where we describe the attacks focusing on Android and iOS operating systems.&nbsp;We use the term “risk ratio” in this report to denote the severity of specific threats. It is calculated as a monthly average of “Number of attacked users / Number of active users in a given country.” Unless stated otherwise, calculated risks are only available for countries with more than 10,000 active users per month.&nbsp;A blocked attack is defined as a unique combination of the protected user and a blocked threat identifier within the specified time frame.&nbsp;Our quarterly threat reports inform about the threat landscape situation as seen from the Gen family of Cyber Safety brands. We continuously enhance our threat telemetry and anticipate further refinements in our future reports.&nbsp;<h2 class="text-align-justify">Featured Story: "Scam-Yourself Attacks” Peak, Tricking Users Into Compromising Their Own Devices&nbsp;</h2>Picture this: You're at your desk, staring at a frustrating error message or a stalled software installation. In a hurry to find a solution, you turn to the Internet. There it is: a YouTube tutorial or an easy step-by-step guide, seemingly offering the perfect fix. With a few clicks, you're on your way to solving the problem. But instead of a solution, what you’ve really done is opened the door to a hidden threat, following a path laid out by cybercriminals.&nbsp;These types of attacks—what Gen has termed “Scam-Yourself Attacks”—are evolving faster than ever, and they’re proving highly effective. In fact, this quarter alone, we’ve seen a staggering 614% increase in these attacks. The term encompasses a variety of threats, from Fake Tutorials to ClickFix scams, FakeCaptcha tricks, and Fake Updates. Together, they form a broader web of deception that’s catching millions of users off guard.&nbsp;<h3 class="text-align-justify">A New Age of Cyber Trickery: Guiding Victims to Perform Their Own Attacks&nbsp;</h3>The landscape of cyberattacks has shifted. Gone are the days when malware simply hid in a suspicious email attachment or shady download. Now, attackers are using your curiosity, and your urgency to fix an issue, against you. They’ve weaponized what seem like harmless instructions to lure you in, and by the time you realize what’s happening, it’s already too late. Whether it’s through seemingly helpful tutorials or fake update prompts, cybercriminals are making you their accomplice.&nbsp;Let’s take a closer look at the different tactics that fall under the umbrella of “Scam-Yourself Attacks”, illustrating how they all work together to deceive.&nbsp;<h4>Fake Tutorials: The Trap Disguised as Help&nbsp;</h4>Imagine a cracked software installer you found online. Along with the software, there's a README file guiding you through the installation. It looks innocent enough, but buried in those instructions is a deadly line: "Disable your antivirus for this software to work properly". What you think is a helpful guide is, in fact, a direct invitation for malware to slip through your defenses.&nbsp;<ul><li>Cracked Software and README Files: These often come with hidden dangers. Cybercriminals cleverly disguise malicious steps within seemingly helpful guides. You follow the instructions, thinking it’s necessary for the installation, only to find you’ve opened the door for malware.&nbsp;</li></ul>

<ul><li>YouTube Tutorials: Another trick in the cybercriminals' playbook involves video tutorials. The video walks you through the process of installing software, but when you click the link in the comments to download it, you’re downloading malware instead. What started as a guide to help you ends with your device compromised. The worst part? You’re the one who clicked, copied, and executed the threat.&nbsp;</li></ul>&nbsp;

But there’s good news: whether you downloaded it from an unofficial website, YouTube, or even GitHub, security vendors like us don’t care where it came from. If it’s malicious, we detect it.&nbsp;<h4>ClickFix: The Illusion of Control&nbsp;</h4>Now imagine you’re trying to fix a problem on your computer—an annoying Windows error code, perhaps. You find what appears to be a genuine solution online. It asks you to copy a script to your clipboard, paste it into the command prompt, and hit Enter. You follow along, thinking you’re resolving the issue, but, in reality, you’ve just run a piece of malware that opens the floodgates to attackers.&nbsp;This is ClickFix, a specific form of so-called Fake Tutorial campaigns where users are misled into performing steps that ultimately compromise their own devices.&nbsp;

The illusion here is control—cybercriminals know you’ll follow the steps because they seem like a straightforward fix. &nbsp;<h4>FakeCaptcha: When Familiarity Breeds Danger&nbsp;</h4>Think about how often you’ve encountered CAPTCHA’s, the little “I’m not a robot” checkboxes. We’ve become so used to them that we rarely question their legitimacy. Cybercriminals know this, and they’re taking advantage. They’ve created <a href="https://www.gendigital.com/blog/news/innovation/global-surge-in-fake-captcha-attacks" target="_blank" rel="noreferrer noopener">FakeCaptcha</a>—a variant of ClickFix—designed to resemble a real CAPTCHA, tricking you into following steps that lead straight to infection.&nbsp;<ul><li>How It Works: You land on a compromised website or a malicious page, and a CAPTCHA pops up. After clicking “I am not a robot” a script is quietly copied to your clipboard, and you’re prompted to run it. Following these instructions results in malware silently taking over your system.&nbsp;</li></ul>

It’s a perfect example of how attackers exploit familiarity. The CAPTCHA looks real, but the consequences are all too dangerous. What’s happening behind the scenes is that the script acts as a dropper—downloading further malware onto your system, often the infamous <a href="https://www.gendigital.com/blog/news/innovation/lumma-stealer-github" target="_blank" rel="noreferrer noopener">Lumma Stealer</a>, one of the most advanced information stealers out there today. In Q3/2024, we observed a surge in Lumma Stealer campaigns, which are discussed in more detail in the Information Stealers section of this report.&nbsp;<h4 class="text-align-justify">ClearFake and Fake Updates: Changing Strategies&nbsp;</h4>ClearFake is a threat actor primarily known for using the Fake Update tactic, where users are tricked into downloading malware disguised as a browser update. This quarter we saw something interesting – ClearFake adapted. They started using the ClickFix tactic in certain campaigns, showing that threat actors are willing to shift strategies when one method proves more effective than another.&nbsp;Typically, ClearFake presents users with what looks like a legitimate browser update page. Once users download the "update," they end up with malware instead. But, this quarter, they also employed ClickFix, guiding users to copy and paste scripts, much like other Fake Tutorials.&nbsp;The Fake Update screens can take many, and often truly legitimate-looking, forms. As an example, in <a href="https://x.com/GenThreatLabs/status/1840762181668741130" target="_blank" rel="noreferrer noopener">this campaign</a> we spotted WarmCookie backdoor being distributed, allowing the adversaries to execute a variety of commands on the victim’s PC.&nbsp;

In a new twist, ClearFake’s latest adaptation combines elements of both Fake Updates and ClickFix. Users encounter a familiar update prompt, suggesting a necessary browser update. However, instead of a one-click download, users are instructed to follow steps: copying a malicious script to their clipboard and pasting it into a PowerShell prompt, effectively giving the script administrator privileges. This approach requires users to feel fully involved in the update process, making them unknowingly complicit in infecting their own devices. It’s a deceptive blend of familiarity and manipulation, designed to take advantage of users’ reliance on routine updates.&nbsp;

<h4>How Big Is This Problem?&nbsp;</h4>In Q3/2024, we protected over 2.1 million users from FakeCaptcha attacks alone. Think about that—millions of people almost fell for it. This is just one piece of a much larger puzzle. The risk ratio for the entire “Scam-Yourself Attacks” category surged by over 614%, demonstrating just how widespread and global these attacks have become. Countries like Italy, Argentina, the Philippines, France, Spain, and Indonesia are among those facing the highest risk ratios for these attacks.&nbsp;

<h4>Conclusion: The Hidden Dangers of "Scam-Yourself Attacks"&nbsp;</h4>In a world where we rely on quick fixes and familiar online prompts, Scam-Yourself Attacks have become a cybercriminal’s dream. Users are unknowingly following instructions that do the attackers’ bidding for them, whether through fake CAPTCHAs, misleading YouTube tutorials, or cleverly disguised README files. &nbsp;What’s more troubling is how effortlessly these scams blend into our daily digital lives. We’ve grown so used to CAPTCHAs and quick-fix guides that we often forget to stop and question them. Also, almost every application needs to be up-to date and if it isn’t, users commonly see screens and dialogues prompting the (mandatory) update. In the hands of cybercriminals, our trust in these familiar formats becomes their most powerful weapon.&nbsp;As these campaigns evolve, one constant remains: they thrive on user deception and manipulation. The question isn’t whether these fake tutorials will persist, but how we will recognize and navigate them before it’s too late.&nbsp;&nbsp;Jan Rubín, Malware Researcher Luis Corrons, Security Evangelist<h2 class="text-align-justify">Desktop-Related Threats&nbsp;</h2><h3 class="text-align-justify">Advanced Persistent Threats (APTs): Evolution of FudModule&nbsp;</h3>An Advanced Persistent Threat (APT) is a type of cyberattack that is conducted by highly skilled and determined hackers who have the resources and expertise to penetrate a target's network and maintain a long-term presence undetected.&nbsp;Over the past quarter, the Lazarus group has once again demonstrated its expertise in stealth and innovation, proving its status as one of the most dangerous cybercriminal organizations. Among the various APTs we’ve been tracking, Lazarus has leveraged sophisticated tools like the FudModule rootkit and has also been using zero-day vulnerabilities to evade detection while orchestrating their cyberattacks.&nbsp;In early June, we identified that Lazarus was exploiting a new zero-day vulnerability in the Winsock driver (CVE-2024-38193). This vulnerability allowed attackers to achieve local privilege escalation (LPE), granting them the ability to deploy the FudModule v3.0 rootkit on targeted systems.&nbsp;On August 19, 2024, <a href="https://www.microsoft.com/en-us/security/blog/2024/08/30/north-korean-threat-actor-citrine-sleet-exploiting-chromium-zero-day/" target="_blank" rel="noreferrer noopener">Microsoft identified</a> two additional zero-day vulnerabilities that are actively being exploited in the wild. The first of these vulnerabilities is a remote code execution (RCE) flaw in Chromium, designated as CVE-2024-7971. This RCE exploit allows attackers to execute code within the sandboxed Chromium renderer process.&nbsp;Once the exploit is triggered, it deploys shellcode that contains a Windows sandbox escape exploit (CVE-2024-38106). This sequence of events ultimately leads to the download and loading of the FudModule rootkit directly into memory.&nbsp;The sandbox escape exploit specifically targets a vulnerability in the Windows kernel. By leveraging this weakness, the Lazarus Group can successfully load the FudModule rootkit into memory, thereby enhancing their capabilities in executing further attacks.&nbsp;The FudModule rootkit itself has undergone significant evolution in its latest version. In addition to its standard arsenal of tools for evading detection and disabling security measures, <a href="https://www.gendigital.com/blog/news/innovation/lazarus-fudmodule-v3" target="_blank" rel="noreferrer noopener">FudModule v3.0</a> now includes new capabilities designed to complicate incident response efforts. One of the most notable features is its ability to disable crash dumps, which are often critical for post-incident analysis. By blocking this functionality, FudModule makes it difficult for security teams to trace the root cause of an infection or reconstruct the sequence of events leading up to an attack.&nbsp;Moreover, FudModule v3.0 is more closely integrated with the payloads it seeks to protect. It injects its payload into a process secured by the Protected Process Light (PPL) framework, a feature typically used to safeguard critical system processes. This integration makes it more difficult for security solutions to detect and remove the malicious payload, as it benefits from the same protections afforded to legitimate system processes.&nbsp;Given these extensive changes, we have classified this version as FudModule v3.0, reflecting the significant advancements it embodies. It has evolved from being a standalone rootkit designed to disable security defenses into a more versatile tool that also actively protects the malicious payload from detection and removal.&nbsp;Several other advanced persistent threat (APT) groups remain highly active across Southeast Asia. One notable actor, MustangPanda, is conducting extensive operations in Myanmar, deploying various backdoors to infiltrate victims’ systems. These attacks are primarily aimed at document theft, with the stolen data being exfiltrated to MustangPanda’s command-and-control (C2) servers. Myanmar continues to be one of the most targeted nations in the region, but we’ve also observed significant APT-related activity across India, the Philippines, Hong Kong, Vietnam, and Cambodia.&nbsp;In addition, several government websites in various Asian countries have been compromised and infected with a JavaScript (JS) backdoor. This backdoor is capable of gathering information from victims and executing encrypted JS modules sent from its C2 server. The malware attempts to exploit a vulnerability in WPS Office, similar to one previously detailed in an ESET report, to achieve remote code execution on targeted machines.&nbsp;We have reported multiple vulnerabilities to Kingsoft, the developer of WPS Office, to address these vulnerabilities.&nbsp;Luigino Camastra, Malware Researcher Igor Morgenstern, Malware Researcher<h3>Bots: Distributed Mess of IoT</h3>Bots are threats mainly interested in securing long-term access to devices with the aim of utilizing their resources, be it remote control, spam distribution, or denial-of-service (DoS) attacks. &nbsp;While this quarter was significantly less rich in terms of law enforcement agency activities compared to the last quarter, it wasn’t eventless. The FBI attempted to take down the Raptor Train botnet that was using SOHO routers, IP cameras, NAS storages and other similar devices as proxies for further attacks. According to their <a href="https://www.justice.gov/opa/pr/court-authorized-operation-disrupts-worldwide-botnet-used-peoples-republic-china-state" target="_blank" rel="noreferrer noopener">report</a>, this botnet was maintained by People’s Republic of China state-sponsored hackers working for the Integrity Technology Group company. The FBI dispatched a command that used the malware's native functionality to disable the malware. This was also noticed by the threat actor who unsuccessfully tried to interfere with these remediation efforts by launching a DDoS on the operational infrastructure.&nbsp;We will use DDoS as a segue to another new botnet that was discovered in September and has been dubbed Gorilla Botnet. Unsurprisingly, the Gorilla Botnet also consists of breached vulnerable IoT devices and is based on a modifier Mirai source code. Coincidentally, Cloudflare reported that it was hit by a world record 3.8 Tbps DDoS attack during September. As if that wasn’t enough for September, a new vulnerability in a common Linux software (Common UNIX Printing System – CUPS) with a huge amplification factor of 600 was discovered.&nbsp;But it’s not all bad news in the world of Bots: the NoName057 group that is behind the DDosia project is still in stagnation. This quarter they came out of hiding to target European banks but, thankfully, the targeted banks were successful in mitigating these attacks. The group presumably tried to improve their success rate by targeting websites of small and usually regional institutions (e.g. regional road maintenance companies). While these attacks were often successful, their impact has been very limited due to the website’s relative irrelevance. The only significant deviation followed the Ukrainian incursion into the Kursk Oblast, when DDosia switched targeting to Ukrainian targets for a few days before returning to their usual operation. We have also noticed that NoName057 is more frequently cooperating with other groups such as CyberArmyofRussia, HackNeT, CyberDragon, and KaliHunt/Russia to coordinate their DDoS attacks.&nbsp;Another prolific botnet, Twizt, &nbsp;underwent frequent updates during September in comparison to the previous month. No significant changes were observed in these updates neither in design nor modulus used to decrypt messages.&nbsp;

<h3 class="text-align-justify">Information Stealers: Lumma is Everywhere&nbsp;</h3>Information stealers are dedicated to stealing anything of value from the victim’s device. Typically, they focus on stored credentials, cryptocurrencies, browser sessions/cookies, browser passwords and private documents.&nbsp;When it comes to information stealers, this quarter was wild. In particular, we observed Lumma Stealer, one of today’s most advanced stealers, being spread globally – and fast. New GitHub campaign? Lumma. Fake tutorial YouTube videos? Lumma. Requests on Steam accounts usernames? Lumma. The numbers are staggering: Lumma increased its information stealers malware share by a massive 1154% this quarter. Let’s dive into some of the campaigns in more detail to explain why this isn’t a typo but rather the effect of broad and varied campaigning.&nbsp;&nbsp;Everything started with a <a href="https://www.gendigital.com/blog/news/innovation/global-surge-in-fake-captcha-attacks" target="_blank" rel="noreferrer noopener">surge of FakeCaptcha</a> campaigns, which we also described in our Featured Story in this quarterly issue. These campaigns, usually <a href="https://x.com/GenThreatLabs/status/1827007175627010077" target="_blank" rel="noreferrer noopener">carried over by malvertising</a>, executed more than 2.1 million attacks on our customers &nbsp;in &nbsp;Q3/2024 alone. According to our observations, in most of the cases, these campaigns were spreading Lumma Stealer. The copied PowerShell script to clipboard, which is supposed to be executed in the Run prompt (Win+R), is usually either downloading Lumma Stealer directly in a form of an archive or uses a variety of different intermediary loaders to do the job. Most of the time, we observed HijackLoader (/IDAT Loader) being used to load Lumma.&nbsp;We’ve seen FakeCaptcha being utilized by many different actors with many of those changing the CAPTCHA appearance just a little, as could be observed during the <a href="https://www.gendigital.com/blog/news/innovation/aligater" target="_blank" rel="noreferrer noopener">AliGater malvertising</a> campaigns. These campaigns were spreading Lumma Stealer Magniber ransomware. An interested reader can find more information about this threat in the Vulnerabilities and Exploits section of this issue.&nbsp;We also observed quite a few GitHub campaigns, both in the form of polluting repositories with pull requests containing links to malware (= Lumma, again) and <a href="https://www.gendigital.com/blog/news/innovation/lumma-stealer-github" target="_blank" rel="noreferrer noopener">directly in the comments</a>. Thankfully, these dangerous comments are frequently written in poor English, alerting some to the potential risk. This red flag, however, might become less common in the near future with better availability and common adaptation of generative AI.&nbsp;

Finally, Lumma Stealer has launched another interesting approach, rotating C&amp;C addresses in the form of <a href="https://x.com/GenThreatLabs/status/1826232224179687468" target="_blank" rel="noreferrer noopener">account usernames on Steam</a>. These usernames are usually encrypted by a simple Caesar substitution cipher. In an example below, the C&amp;C addresses can be decrypted by applying ROT-15. Leveraging online platforms like this has underlying positive aspects for the attackers,&nbsp; allowing them to rotate the C&amp;C just by changing the username to reflect the new address.&nbsp;

<h4 class="text-align-justify">App-Bound Encryption Bypass&nbsp;</h4>Since the adaptation of <a href="https://security.googleblog.com/2024/07/improving-security-of-chrome-cookies-on.html" target="_blank" rel="noreferrer noopener">App-Bound encryption</a>, which we discussed in the Q2/2024 report, malware developers behind various information stealers were quite busy with figuring out bypasses of this enabled-by-default hardened protection of browser cookies in Google Chrome.&nbsp;We observed many discussions, particularly on Telegram, about approaches to bypass the protection, along with some authors bragging that they already achieved the bypass.&nbsp;

Lumma Stealer is not alone in this, however; we’ve observed similar reports throughout the past quarter from PovertyStealer, Vidar, StealC, WhiteSnake and Meduza, to name a few.&nbsp;There were many different discussions by threat actors regarding how to perform the actual bypass, showcasing the urgency with which information stealer developers were trying to address this protection. For example, developers behind Vidar were considering using a <a href="https://x.com/g0njxa/status/1833894122710515954" target="_blank" rel="noreferrer noopener">TPM module for encryption</a>.&nbsp;Even though the specific bypasses might vary and are still in the testing and development phases, one method stands out and, as usual, it feels like the simplest method wins it all.&nbsp;As recently reported by <a href="https://spycloud.com/blog/infostealers-bypass-new-chrome-security-feature/" target="_blank" rel="noreferrer noopener">SpyCloud Labs in a blogpost</a>, malware can use specific parameters while starting a new instance of Chrome as described <a href="https://mango.pdf.zone/stealing-chrome-cookies-without-a-password" target="_blank" rel="noreferrer noopener">in the original Mango PDF Zone publication</a>. More specifically, malware can use “--remote-debugging-port=” parameter to listen for a debugger connection. After that, the malware can attach to Chrome via a URL dedicated for DevTools (remote debugger), create a WebSocket and send a message to retrieve the cookies. This can be combined with other common means of hiding such newly created windows, for example by using a “--window-position=” parameter to set the window position outside of the victim’s screen which also avoids the use of standard WinAPI functions.&nbsp;We can (unfortunately) confirm from our research that malware truly doesn’t need any special permissions or user interaction whatsoever. We have found traces of previous misuses, indicating that this approach might <a href="https://issues.chromium.org/issues/40050335" target="_blank" rel="noreferrer noopener">not be fully patched yet</a>.&nbsp;Another recent method, <a href="https://x.com/xaitax/status/1850500705074700298" target="_blank" rel="noreferrer noopener">reported by Alexander Hagenah</a>, for bypassing the App-Bound Encryption uses Chrome’s internal COM-based IElevator service. This bypass requires admin privileges to copy the executable into %PROGRAMFILES%\Google\Chrome\Application folder. This is required since Chrome’s App-Bound encryption is also performing path validation.&nbsp;Cases like this demonstrate that information stealers, especially the ones offered as Malware-as-a-Service, put everything on the line to keep their mass-theft campaigns going, and we can only expect this endless cat-and-mouse game to continue.&nbsp;<h4 class="text-align-justify">Statistics&nbsp;</h4>The risk ratio of getting an Information stealer increased by 39% in Q3/2024, due in large part to the vast campaigns distributed by Lumma Stealer. These campaigns also shifted the whole information stealers market quite a bit, putting Lumma Stealer on a pedestal.&nbsp;

We also observed risk ratio increase in almost all regions with a greater userbase:&nbsp;<ul><li>France: 135%&nbsp;</li><li>Japan: 128%&nbsp;</li><li>Slovakia: 127%&nbsp;</li><li>Canada: 48%&nbsp;</li><li>Spain: 34%&nbsp;</li><li>Brazil: 27%&nbsp;</li><li>United States: 22%&nbsp;</li><li>Czech Republic: 9%&nbsp;</li></ul>

Lumma Stealer now has the largest malware share with 30.95%, a 1154% increase over the previous quarter. Many of the other information stealers had an expected comparative decrease in their malware share (the shift caused by Lumma Stealer), though not all of them. SnakeKeylogger also increased its malware share, with a significant 461% increase.&nbsp;Compared to the previous quarter, in Q3/2024 AgentTesla decreased in malware share by 49%, Ramnit by 30%, and Fareit by 24%. FormBook, however, stayed the same, without any shifts in its malware share.&nbsp;Note that these shifts, especially the decreases, don’t indicate there would be less of such infections across our userbase. This only means that comparatively to each other the malware families are less common, and it doesn’t necessarily reflect they are less prevalent themselves.&nbsp;The most common information stealers with their malware shares in Q3/2024 were:&nbsp;<ul><li>Lumma Stealer (30.95%)&nbsp;</li><li>AgentTesla (17.23%)&nbsp;</li><li>FormBook (8.97%)&nbsp;</li><li>Ramnit (8.39%)&nbsp;</li><li>Fareit (5.36%)&nbsp;</li><li>SnakeKeylogger (3.95%)&nbsp;</li><li>RedLine (3.38%)&nbsp;</li><li>Lokibot (2.06%)&nbsp;</li><li>Vidar (1.58%)&nbsp;</li><li>ViperSoftX (1.43%)&nbsp;</li><li>StealC (1.17%)&nbsp;Jan Rubín, Malware Researcher</li></ul><h3>Ransomware: The Rise and Decline of Magniber&nbsp;</h3>Ransomware is any type of extorting malware. The most common subtype is the one that encrypts documents, photos, videos, databases, and other files on the victim’s PC. Those files become unusable without decrypting them first. To decrypt the files, attackers demand money, “ransom”, hence the term ransomware.&nbsp;Ransomware is a business that certainly does not go away. According to a <a href="https://www.chainalysis.com/blog/2024-crypto-crime-mid-year-update-part-1/" target="_blank" rel="noreferrer noopener">report</a> published by Chainalysis, the amount of $459,800,000 paid by ransomware victims in the first half of 2024 will set a new yearly record, should the payments continue at the same speed for the rest of the year.&nbsp;Magniber Surge&nbsp;Because most of the big ransomware groups focus on attacking corporations, trends in the consumer segment do not change much on a quarterly basis. However, the trend changed in Q2/2024 when <a href="https://www.gendigital.com/blog/news/innovation/q2-2024-threat-report" target="_blank" rel="noreferrer noopener">we noted</a> a 24% increase of ransomware threats, a trend that is continuing in Q3/2024. Further, in August there was a surprising anomaly detected by our sensors: a rapid increase in blocked URLs related to ransomware:&nbsp;

Whilst normally we block less than a hundred of such URLs per day, the number quickly escalated to about 8 thousand per day. <a href="https://www.gendigital.com/blog/news/innovation/aligater" target="_blank" rel="noreferrer noopener">We analyzed the URLs</a>, and one of the final payloads was the Magniber ransomware.&nbsp;The Magniber ransomware first emerged in 2017 and has many of the typical ransomware features:&nbsp;<ul><li>Uses known vulnerabilities (<a href="https://nvd.nist.gov/vuln/detail/CVE-2011-3402" target="_blank" rel="noreferrer noopener">CVE-2011-3402</a> in this case)&nbsp;</li><li>Runs as a code injected to other processes&nbsp;</li><li>Uses direct Windows system calls&nbsp;</li></ul>Unfortunately, Magniber ransomware is undecryptable without having the private RSA key, but there are some interesting technical details in this ransomware.&nbsp;Samples related to Magniber ransomware (not just the ransomware itself, but also droppers and downloaders) typically use system calls directly. Using of system calls by Windows applications is strongly discouraged - not only they are undocumented, but they may also change in any new build of Windows. Applications should rely on documented API (such as <a href="https://learn.microsoft.com/en-us/windows/win32/api/fileapi/nf-fileapi-createfilea" target="_blank" rel="noreferrer noopener">CreateFile()</a>) instead.&nbsp;Magniber ransomware relies on those system calls to perform tasks such as memory allocation or file modification. The reason they do this is because it is more difficult for AV solutions to detect its activity – system calls cannot be intercepted by user mode applications.&nbsp;The following two pictures show a system call in Windows and in Magniber code:&nbsp;

Magniber samples in this campaign do not directly check the Windows version; instead, the way they use system calls only makes sense in Windows 7. This means that this wave of Magniber attacks targets Windows 7 operating system – an outdated one which has only about <a href="https://gs.statcounter.com/os-version-market-share/windows/desktop/worldwide" target="_blank" rel="noreferrer noopener">4% of market share</a>.&nbsp;When Magniber encrypts user’s files, it creates a ransom note file that is highly obfuscated:&nbsp;

After deobfuscation, victims can see this message:&nbsp;

The wave of Magniber ransomware lasted about a month, concluding abruptly after September 19 and returning to the old values. However, this campaign and activity of other ransomware strains led to a 100% increase of ransomware activity quarter over quarter.&nbsp;<h4>Decrypted: Mallox ransomware&nbsp;</h4>On better news, we are happy to share that we have launched another free-decryption tool for ransomware victims this quarter. During analysis of the Mallox ransomware, we discovered a flaw in the cryptographic operations. Files encrypted by Mallox ransomware (from January of 2023 to about February 2024) can be decrypted. Files encrypted by Mallox ransomware that can be decrypted are identified by the following extensions:&nbsp;<ul><li>.bitenc&nbsp;</li><li>.ma1x0&nbsp;</li><li>.mallab&nbsp;</li><li>.malox, .mallox, .mallox, .malloxx&nbsp;</li><li>.xollam&nbsp;</li></ul>Victims of the ransomware whose files have one of the above extensions can decrypt data for free using our <a href="https://www.gendigital.com/blog/news/innovation/decrypted-mallox-ransomware" target="_blank" rel="noreferrer noopener">Mallox ransomware decryptor</a>..&nbsp;From March 2024, we have seen new variants of Mallox. Those have different file extensions (see below) and decrypted:&nbsp;<ul><li>.hmallox&nbsp;</li><li>.rmallox&nbsp;</li><li>.x60X60&nbsp;</li></ul><h4 class="text-align-justify">Statistics&nbsp;</h4>Ransomware continues to gain momentum with each passing quarter. In Q3/2024, we have seen a 100% increase in terms of risk ratio and the number of protected users:&nbsp;

We can see the same surge of Magniber that we saw in the previous part. It also impacted the overall increased risk ratio in many countries, including:&nbsp;<ul><li>Bosnia and Herzegovina (930%)&nbsp;</li><li>France and Serbia (both 900%)&nbsp;</li><li>Hungary (700%)&nbsp;</li><li>Slovakia and Greece (630%)&nbsp;</li><li>Romania (620%)&nbsp;</li><li>Poland (550%)&nbsp;</li><li>Spain (300%)&nbsp;</li><li>Germany (200%)&nbsp;</li></ul>The overall risk ratio in Q3/2024 is shown here on the map:&nbsp;

Ladislav Zezula, Malware Researcher Jakub Křoustek, Malware Research Director<h3 class="text-align-justify">Remote Access Trojans (RATs): XWorm Gone but Attacks Persist&nbsp;</h3>A Remote Access Trojan (RAT) is a type of malicious software that allows unauthorized individuals to gain remote control over a victim's computer or device. RATs are typically spread through social engineering techniques, such as <a href="https://www.avast.com/c-phishing">phishing</a> emails or infected file downloads. Once installed, RATs grant the attacker complete access to the victim's device, enabling them to execute various malicious activities, such as spying, data theft, remote surveillance and even taking control of the victim's webcam and microphone.&nbsp;While this quarter did not bring much in terms of major events in the RAT world, the overall activity and risk ratio increased considerably – by 26%. This increase can be seen in the comparison of Q2 and Q3/2024 below. It is also evident that the risk ratio, and therefore the number of protected users, is increasing towards the end of the quarter.&nbsp;

Most countries saw an increased risk ratio of RATs in Q3/2024, with the notable exception of Canada. Two strains drove the values up in the last two quarters: XWorm in Q1/2024 and Remcos in Q2/2024. This quarter, users in Canada were finally able to "catch a break" since we did not see any large-scale campaigns there, according to our data.&nbsp;The largest increase in risk ratio was observed in Serbia (+114%) followed by Indonesia (+107%) and Greece (+95%). According to our data, the most prevalent strain among RATs is Remcos and has been for some time. Its activity is the decisive factor in the risk ratio for nearly any country. However, in Serbia Remcos was joined by XWorm which saw a protected user increase of a staggering 4500%. This large increase is due to XWorm's move from a nearly non-existent threat in Serbia in previous quarters to being number two behind Remcos. In Greece, we saw an increase of 600% in the number of protected users for QuasarRAT.&nbsp;As usual, the list of countries with the highest risk ratio overall did not change, with Afghanistan in the lead, followed by Iraq and Yemen. Contrary to the previous claim about Remcos, HWorm and njRAT are the most prevalent in these regions.&nbsp;The safest countries regarding RAT infection in Q3/2024 are France, Belgium and Sweden. Interestingly, we do not see Remcos as the top threat in Sweden but rather XWorm and njRAT.&nbsp;

Compared to Q2/2024, the number of protected users from XWorm has increased by 190%. The timing of this surge coincides with XWorm going "off the grid": this RAT was previously sold via an online shop where, presumably, the developer published announcements of new versions showcasing added features. To the best of our knowledge, this shop is now inactive. We might speculate whether the development has stopped or gone private and whether XWorm moved to other sale channels.&nbsp;The most prevalent RAT strains for Q3/2024 are as follows:&nbsp;<ul><li>Remcos&nbsp;</li><li>HWorm&nbsp;</li><li>njRAT&nbsp;</li><li>AsyncRat&nbsp;</li><li>XWorm&nbsp;</li><li>QuasarRAT&nbsp;</li><li>Gh0stCringe&nbsp;</li><li>FlawedAmmyy&nbsp;</li><li>Warzone&nbsp;</li><li>NanoCore&nbsp;</li></ul>In other news, researchers from <a href="https://www.kaspersky.com/blog/new-exotic-rat-sambaspy/52179/" target="_blank" rel="noreferrer noopener">Kaspersky</a> have discovered a new RAT called SambaSpy. SambaSpy has the full feature set typical of modern RATs, including file management, the ability to steal sensitive information and remote desktop control of the infected system. Originally, SambaSpy was targeting only Italian users by checking the system language. Kaspersky suggested that it might have been for testing purposes and noted that the attackers have since removed this check. The infection vector looks fairly common for this kind of threat. An unsolicited email redirects users to a site delivering a PDF document with another link which then delivers a dropper responsible for installing the final payload. Both the dropper and the payload are written in Java.&nbsp;Ondřej Mokoš, Malware Researcher<h3 class="text-align-justify">Vulnerabilities and Exploits: Beware, AliGater Seen in Europe&nbsp;</h3>Exploits take advantage of flaws in legitimate software to perform actions that should not be allowed. They are typically categorized into remote code execution (RCE) exploits, which allow attackers to infect another machine, and local privilege escalation (LPE) exploits, which allow attackers to take more control of a partially infected machine.&nbsp;Attackers continue to exploit zero-day vulnerabilities and target unpatched systems. In this section, we explore recent findings, including multiple zero-day vulnerabilities in critical system components such as the Winsock driver (AFD.sys), Chromium’s V8 JavaScript engine, and the Windows kernel. These vulnerabilities have been leveraged by advanced persistent threat (APT) groups to deploy sophisticated rootkits like <a href="https://www.gendigital.com/blog/news/innovation/lazarus-fudmodule-v3" target="_blank" rel="noreferrer noopener">FudModule v3.0</a>. Additionally, we highlight the new AliGater campaign, which is rapidly spreading across outdated Windows systems in Europe via malicious advertising, further exposing users to dangerous malware such as Magniber Ransomware and Lumma Stealer.&nbsp;We discovered and disclosed a zero-day vulnerability (CVE-2024-38193), that was exploited in the wild, which was used to target a nuclear power plant. It is a user-after-free vulnerability found in the AFD.sys (Winsock driver), which provides kernel-mode support for the Windows socket interface used in network communication. In this instance, attackers discovered a method to exploit the vulnerability in the default driver without needing administrator privileges to interact with it. They identified a zero-day vulnerability in the AFD.sys that allowed them to gain read/write (R/W) access in kernel space.&nbsp;Microsoft recently discovered two additional zero-day vulnerabilities being actively exploited in the wild, as mentioned in the APT section. The first, CVE-2024-7971, is a type of confusion vulnerability in the V8 JavaScript and WebAssembly engine, affecting versions of Chromium prior to 128.0.6613.84. This flaw arises when a program mistakenly interprets a variable as a different data type than intended, potentially leading to memory corruption and arbitrary code execution.&nbsp;The second, CVE-2024-38106, is a use-after-free vulnerability in the Windows kernel. It is triggered by incorrect handling of timers (KTIMER2) within the Worker Factory object via the function NtSetInformationWorkerFactory. This exploit was designed to escape Chromium’s sandbox, allowing the deployment of the FudModule rootkit. Once deployed, it uses Direct Kernel Object Manipulation (DKOM) techniques to interfere with security vendors and bypass security mechanisms.&nbsp;<h4 class="text-align-justify">AliGater&nbsp;</h4>The new AliGater campaign is targeting home users in Europe who are still using outdated Windows operating systems and vulnerable versions of Google Chrome. The campaign primarily spreads through malvertising, where attackers embed malicious ads into legitimate websites to infect users’ machines with dangerous malware.&nbsp;Malicious advertisements redirect users to a fake CAPTCHA page, which is used to launch a multi-stage attack. Exploits in Chrome’s V8 JavaScript engine (CVE-2023-2033) and Windows TrueType font parsing (CVE-2011-3402) are then used to deliver the malware payload such as Magniber Ransomware and Lumma Stealer.&nbsp;Although Windows 7 represents only about 4% of the global operating system market, this still translates into millions of vulnerable machines. The consequences are severe, as AliGater spreads rapidly among outdated systems, making users easy targets for exploitation. Detailed information about the infection chain is available on <a href="https://www.gendigital.com/blog/news/innovation/aligater" target="_blank" rel="noreferrer noopener">our blog</a>.&nbsp;The campaign is focused predominantly on Eastern Europe, primarily Balkan states, and thousands of victims have already been identified in countries such as France, Poland, Italy, Spain, Turkey and Hungary.&nbsp;

To protect against the AliGater campaign and its associated malware, it is essential to use up-to-date operating systems and browsers. Home users and businesses should ensure they are running supported versions of Windows and keep their browsers patched against known vulnerabilities.&nbsp;<h4 class="text-align-justify">Cobalt Strike &nbsp;</h4>In Q3/2024, we also evaluated the main exploitation and post-exploitation frameworks targeting our users. Our telemetry indicates that <a href="https://www.cobaltstrike.com/" target="_blank" rel="noreferrer noopener">Cobalt Strike</a> was the more prevalent framework in the quarter. To be more precise, Cobalt Strike was 84.4% more prevalent than Metasploit, and&nbsp; 274.7% more prevalent than BeefProject.&nbsp;

We will continue to evaluate and monitor the evolution of Cobalt Strike, Metasploit, BeefProject, Brute Ratel, Merlin and all the rest of the frameworks targeting our users in the next quarter.&nbsp;Luigino Camastra, Malware Researcher Martin Chlumecký, Malware Researcher David Álvarez, Malware Analyst Michal Salát, Threat Intelligence Director<h2 class="text-align-justify">Web Threats&nbsp;</h2>As cybercriminals continue to adapt to the ever-changing digital landscape, web-related threats remain a dominant area of concern. From Q2 to Q3 of 2024, while we observed a 16% reduction in the overall risk ratio for scams, the landscape remained dynamic and complex. Scammers are continuously refining their methods, using techniques like malvertising and leveraging current events to make their scams appear more credible and harder to detect.&nbsp;Although there was a slight decline in general web threat activity, possibly due to seasonal variations such as the summer holidays, several categories of web threats, including Crypto Scams, Dating Scams, and Tech Support Scams, saw notable increases in specific regions via specific tactics. Push notification scams and phishing activities also remain prevalent, with certain regions showing significant upticks, as detailed in the following sections.&nbsp;As we move forward into the analysis of Q3 data, this report will highlight the evolving nature of these threats, with an emphasis on the geographic trends, the growth of specific scam tactics, and the new methods cybercriminals are using to bypass security measures and deceive users.&nbsp;<h3 class="text-align-justify">Scams: Fewer Scams, Bigger Tricks&nbsp;&nbsp;</h3>A scam is a type of threat that aims to trick people into giving an attacker their personal information or money. We track diverse types of scams which are listed below.&nbsp;In the third quarter, we observed a 16% reduction in the overall risk ratio for online scams, indicating a decline in the volume or effectiveness of these threats. While this decrease is promising, scams remain a persistent issue, with attackers constantly adapting to evade detection. Our analysis highlights shifts in targeting strategies and tactics, signaling the importance of remaining on alert &nbsp;for new methods and flavors of the online scams.&nbsp;

However, this general downturn contrasts with the ongoing rise in specific scam tactics, notably malvertising with a 17% increase quarter-over-quarter. Malvertising, which often operates in tandem with scams, has become an increasingly favored method for scammers to push scam content quickly and efficiently to users.&nbsp;&nbsp;This trend underscores a more nuanced reality: while the overall scam frequency may have declined, certain subcategories are experiencing significant growth.&nbsp;

As we emphasize frequently in our threat reports, one of the common ingredients of a successful scam campaign is the use of advertisements. Moreover, scammers know well that many users use not only AV protection but also ad blockers, which can vary in effectiveness based on their focus. As a result, scammers are constantly innovating to bypass these defenses and no longer solely rely on traditional advertising methods to deliver malicious content. Instead, they increasingly exploit current world events, embedding scams within content that appears credible, relevant and engaging to users. By aligning their campaigns with trending news or global events, scammers increase their chances of deceiving users who are seeking timely information or updates. One such campaign, described in the next section, demonstrates these tactics in action: CryptoCore.&nbsp;<h4>Escalation of CryptoCore Scams&nbsp;</h4>A crypto scam is a cyber threat designed to trick individuals into surrendering their cryptocurrency. These scams exploit the anonymity and irreversibility of blockchain transactions, often targeting those with a limited understanding of how cryptocurrency works.&nbsp;In Q3/2024, we continued investigating the <a href="https://decoded.avast.io/martinchlumecky1/cryptocore-unmasking-the-sophisticated-cryptocurrency-scam-operations/" target="_blank" rel="noreferrer noopener">CryptoCore scam group</a>. This quarter, CryptoCore's tactics evolved, with the group intensifying its use of <a href="https://us.norton.com/blog/emerging-threats/what-are-deepfakes">deepfake videos</a> and expanding its targeting to include high-profile global events, especially the U.S. election. These fraudulent campaigns leveraged well-known figures and corporations, including Elon Musk and Tesla, to reinforce their credibility and mislead potential victims. By hijacking popular social media accounts, especially on platforms like YouTube, these scammers reached millions of viewers, convincing them to invest in fake cryptocurrency schemes.&nbsp;The attackers were able to attract a massive audience via deepfake videos that are still evolving. The campaigns are becoming more refined and targeted, especially in politically sensitive regions like the U.S. which will hold its presidential election in early November. &nbsp;The following example demonstrates the use of a deep fake video with the U.S. election theme. The original video is from Tesla's 2022 Annual Meeting of Stockholders, where Elon Musk discussed several key topics, including Tesla's growth, production milestones, and future ambitions. The attackers synthesized the voice of Elon Musk and modified moving the mouth (lip sync) to match the new message.&nbsp;

CryptoCore's activities escalated dramatically after our telemetry captured 3,000 cryptocurrency transactions linked to their scams with a total value of an estimated $4,000,000. While this figure is a rough estimate, the actual amount could be higher, given the complexity of tracking illicit crypto wallets and abused platforms.&nbsp;The countries most affected by this are the United States, followed by the United Kingdom and Germany; see the map below for a reflection of global risk.&nbsp;

CryptoCore’s strategy of capitalizing on major media events is reflected in our telemetry. The following events were key moments in Q3 for CryptoCore scams:&nbsp;<ul><li>July 15: Elon Musk publicly endorsed Donald Trump during a rally in Pennsylvania, just days after an assassination attempt on the former president. This event garnered intense media attention, and CryptoCore wasted no time producing deepfake videos featuring Elon Musk.&nbsp;</li><li>July 27: Musk retweeted a parody about Kamala Harris. This incident drove traffic to YouTube, where CryptoCore’s deepfakes target the election.&nbsp;</li><li>September 1: CryptoCore exploited a legal dispute in Brazil, where Musk’s platform, X (formerly Twitter), faced a temporary suspension.&nbsp;</li></ul>The group's exploitation of real-time media events like these underscores their ability to manipulate public interest for financial gain.&nbsp;

These circumstances indicate that the CryptoCore activities and the risk of crypto fraud caused by these threat actors will increase.&nbsp;Detailed information about the modus operandi of CryptoCore can be found in <a href="https://decoded.avast.io/martinchlumecky1/cryptocore-unmasking-the-sophisticated-cryptocurrency-scam-operations/" target="_blank" rel="noreferrer noopener">this article</a>.&nbsp;<h3>Malicious Browser Push Notifications: From Helpful to Harmful&nbsp;</h3>These types of notifications are a common browser feature that allow websites to send users push notifications. They can be pretty handy so, of course, scammers have found a way to exploit them. Attackers trick users into enabling these notifications so they can then be exploited.&nbsp;The activity of push notification scams has remained relatively stable throughout the quarter, with no major fluctuations in the overall threat level. However, some countries continue to face elevated risks: Argentina, Italy, and Spain are currently the countries with the highest risk ratios for push notification scams.&nbsp;

Notably, Italy has experienced a significant surge in activity, with the risk ratio increasing by a staggering 166%. This sharp rise underscores the growing threat landscape in the region, signaling a need for increased attention from users.&nbsp;

<h3>Dating Scams: Scammers Swipe Right&nbsp;</h3>Dating scams, also known as romance scams or online dating scams, involve fraudsters deceiving individuals into fake romantic relationships. Scammers adopt fake online identities to gain the victim's trust, with the ultimate goal of obtaining money or enough personal information to commit <a href="https://www.lifelock.com/how-it-works/what-is-identity-theft/">identity theft</a>.&nbsp;The activity of dating scams has surged significantly over the past quarter, as evidenced by the rising risk ratios. Globally, we’ve seen notable increases in several countries.&nbsp;

Slovakia experienced a substantial rise, with a 17% increase in the risk ratio, while Finland mirrored this with an identical 17% increase. Denmark and Germany also saw moderate growth, with risk ratios increasing by 5% and 3% respectively.&nbsp;&nbsp;

Moreover, Thailand saw the most dramatic increase, with a staggering +154% in the risk ratio, followed by Iceland at +48% and Fiji at +60%. These sharp rises highlight how dating scams are becoming increasingly prevalent in regions that were previously less affected, signaling a shift in targeting strategies.&nbsp;

<h3>Tech Support Scams: Japan Remains the Top Target&nbsp;</h3>Tech support scam threats involve fraudsters posing as legitimate technical support representatives who attempt to gain remote access to victims' devices or obtain sensitive personal information, such as credit card or banking details. These scams rely on confidence tricks to gain victims' trust and often involve convincing them to pay for unnecessary services or purchase expensive gift cards. It's important for internet users to be vigilant and to verify the credentials of anyone claiming to offer technical support services.&nbsp;Despite a significant quarter-over-quarter decline in the risk ratio for tech support scams in Japan (60%) and Germany (33%), these countries remain among the most active in terms of scam prevalence. Japan, with a risk ratio of 1.32%, continues to lead globally, indicating a persistent threat level even amid reductions. In contrast, countries such as France and Hong Kong are experiencing notable increases. France saw a 31% rise in the risk ratio, while Hong Kong’s risk ratio surged by 86%, reflecting high success in this country for these scams. This trend is further emphasized by the increased number of protected users in France (24%) and Hong Kong (82%), signaling targeted activity in these regions.&nbsp;

The graph showing risk ratio for Q2/2024 and Q3/2024 displays a general downward trend across both quarters, suggesting a gradual decrease in tech support scam activity over this period.&nbsp;

The example below shows a TSS lading page of very prevalent campaign targeting French users. France is one of the countries that recorded one of the biggest increases in the last quarter.&nbsp;

<h3>Email Threats: How Scammers Bypass Spam Detection&nbsp;</h3>The Email threats section tends to cover a wide range of scams targeting almost anyone with an email address. These scams take various forms, including fake invoices designed to mimic legitimate brands and trick recipients into making payments to the attackers. Extortion emails attempt to coerce victims into sending cryptocurrency by falsely claiming to have recorded compromising webcam footage. Lottery scams lure users to websites that offer deals too good to be true, while classic phishing emails falsely inform recipients that their password has expired in an attempt to steal credentials. This section will explore the common email scams that can land in your inbox and the tactics used by cybercriminals to exploit unsuspecting users.&nbsp;The prevalence of email threats typically remains constant, but, at the beginning of the summer, we observed an unusual spike in detected threats which raised our concerns about evolving tactics used by cybercriminals. &nbsp;Since the spike, which occurred at the end of July, the number of protected users has again stabilized. We will explore this spike in more detail later, using a real-world example to illustrate how cybercriminals may be attempting to bypass spam filters.&nbsp;

When it comes to countries with the highest risk of encountering email threats or scams, the ratio is now quite similar across continents—a trend we haven’t observed before. Australia, Europe, and North America are currently facing comparable levels of threat risk. In the past, the majority of these risks were concentrated in North America, but now the distribution is more balanced globally. Notably, South Africa has now risen to the top of the list.&nbsp;

Let's examine the statistics of protected users on a quarter-by-quarter basis. Turkey saw the highest increase, with a remarkable 80%, which is extraordinary compared to other countries. The second-highest rise was in the Czech Republic, with a 73% increase, followed by Colombia with a 59% quarterly rise. On the other end of the spectrum, Germany experienced the largest drop at 36%, followed by Italy at 27% and Brazil at 14%. This significant contrast highlights the varied landscape of cybersecurity across regions, with some countries showing impressive improvements while others face steep declines.&nbsp;Japan is a special case, as attacks there tend to occur in spikes, while other regions remain relatively stable without significant changes to the overall trend. This behavior is illustrated in the following graph.&nbsp;

As mentioned at the beginning of this section, there was an email scam targeting users with a simple tactic: a survey that promised a physical prize at the end, likely a cell phone since the scam appeared to come from a mobile provider. What caught our attention, however, was the structure of the email. The HTML code was designed to mislead both spam filters and users. It could hide certain parts of the email from human readers while deceiving the filters.&nbsp;

Let's look at an example that we will be dissecting in this report. First, we'll examine the version that users see, and then we'll delve into the code inside the email (.eml file). There are several red flags for the user to consider:&nbsp;&nbsp;&nbsp;<ul><li>The sender's name does not match the sender's domain, which raises suspicion.&nbsp;</li><li>The subject line does not align with the actual content of the email.&nbsp;</li><li>The font used in the message is unprofessional and inconsistent with what a company of this nature would typically use.&nbsp;</li><li>There is a clear attempt to create urgency, a common tactic in scams.&nbsp;</li></ul>&nbsp;After analyzing the source code of the email (the .eml file), there are several interesting patterns that we also observe in other scam messages. First, email has multiple parts and only a small part is related to the message that is actually displayed to the users and that leads to the malicious web site.&nbsp;&nbsp;Below this message, the email contains a message that is copied from the account registration email with popular OpenAI services:&nbsp;To continue setting up your OpenAI account, please verify that this is your &nbsp; email address. Verify email address (<a href="https://auth0.openai.com/%3cREDACTED" target="_blank" rel="noreferrer noopener">https://auth0.openai.com/&lt;REDACTED</a>&gt;). This link will expire in 5 days. If you did not make this request, please disregard this email. For help, contact us through our Help center (&lt;REDACTED&gt;).&nbsp;This message is ‘hidden’ to the user as it is separated from the main text by multiple breaklines. However, the spam filters tend to extract complete message and thus, as this part closely resembles legitimate emails, it helped this scam message avoid being detected even by major email providers. This can be seen in the following graphs, where we observe the prevalence of this particular threat rising in July as it avoided &nbsp;the spam detection of popular email providers.&nbsp;

Among other methods for avoiding detections, the email contains:&nbsp;&nbsp;<ul><li>using non-standard fonts: the main message with malicious link is encoded using Unicode characters to prevent a clear extraction&nbsp;</li><li>EML file contains multiple parts, and these, while not rendered to the user, can also confuse spam filters&nbsp;</li><li>source code uses incorrect HTML tags, such as&nbsp;&nbsp;</li></ul>&lt;td&gt;&lt;td&gt;&lt;SelECT&gt;&lt;head&gt;&lt;ObjecT&gt;&nbsp;or&nbsp;&nbsp;&lt;z style="height: 24px; width: 1.27315%;"&gt; &lt;/r&gt;&nbsp;&lt;w style="height: 24px; width: 9.83796%;"&gt; &lt;/r&gt;&nbsp;<ul><li>text from other parts of the email uses multiple languages&nbsp;</li></ul>

<ul><li>Usage of reputable domains to avoid detection&nbsp;</li></ul>&lt;a href="https://t6s6h5l4o6w0u1s5b9d8r2u5a7c0.s3.amazonaws.com/4.html#qs=r-ahebkacceebfbbikagggdhehachgjdgfiafchiiafchiiafchiiabadiadfiaccadjeacjjkaefjikkadcc" target="" align="center"&gt; &lt;h1&gt; 🇦 🇷 🇪 🇾 🇴 🇺 🇴 🇳 🇱 🇮 🇳 🇪 ? 🇹 🇦 🇰 🇪 🇹 🇭 🇮 🇸 3️⃣0️⃣ 🇸 🇪 🇨 🇴 🇳 🇩 🇸 🇺 🇷 🇻 🇪 🇾 ❗&lt;/h1&gt;&lt;/a&gt;&nbsp;Using reputable domains like Amazon AWS to host malicious content allows many email threats to &nbsp;bypass domain-based spam filters. The obfuscated parameters may conceal redirects to phishing sites or malware downloads.&nbsp;The recent surge in scam emails with sophisticated spam filter evasion techniques underscores the constant need for monitoring these threats. Cybercriminals are exploiting vulnerabilities by embedding deceptive HTML code and mimicking legitimate communications to bypass detection and deceive users. This global threat shows that no region is exempt, with significant increases in countries like Singapore and South Africa. This is a persistent problem, and we are likely to see more scams of this nature in the future.&nbsp;<h3 class="text-align-justify">Phishing: DGAs Fueling Phishing Campaigns&nbsp;</h3>Phishing is a type of online scam where fraudsters attempt to obtain sensitive information including passwords or credit card details by posing as a trustworthy entity in an electronic communication, such as an email, text message, or instant message. The fraudulent message usually contains a link to a fake website that looks like the real one, where the victim is asked to enter their sensitive information.&nbsp;In comparison to previous quarters, phishing activity has shown a slow but steady decline across most regions. However, there are a few notable exceptions where activity has increased.&nbsp;&nbsp;Australia, despite experiencing a significant 22% decrease in its risk ratio, saw an 11% increase in the number of protected users, indicating ongoing targeted efforts.&nbsp;

In the previous quarter, we were able to detect several waves that could contain tens of thousands of domains, many of which were auto-generated.&nbsp; Since the names are created automatically, it can be assumed that the attackers are also operating these domains automatically, in an attempt by scammers to scale their attacks quickly.&nbsp;&nbsp;The way in which attackers are generating phishing domain names is also evolving. While it was previously most common to observe a simple addition of numbers or suffixes, domain name generation is now sometimes done by techniques such as domain generation algorithms (DGAs ), which create seemingly random but actually systematic domain names. DGAs are often employed in malware to algorithmically generate and operate domain names. These algorithms take an initial "seed" value—essentially a secret key—and use it to generate a pseudo-random sequence of domain names.&nbsp;For phishing attacks, DGAs can evade static blocklists, allowing attackers to automatically create and operate large numbers of domains. While for attackers and victim clients there is not the need to sync on the generated domains to communicate with the command-and-control (C&amp;C) server, phishing attackers algorithmically generate new domains on their end to make it harder for security measures to block or detect phishing campaigns, as new domains can continuously be created without human intervention.&nbsp;

Alexej Savčin, Malware Analyst Branislav Bošanský, Scientist Branislav Kramár, Malware Analyst David Jursa, Malware Analyst Martin Chlumecký, Malware Analyst Matěj Krčma, Malware Analyst Nikola Groverová, Data Scientist<h2 class="text-align-justify">Mobile-Related Threats&nbsp;</h2>Mobile threats keep becoming more sophisticated, as demonstrated by several new strains entering the fray this quarter. The Necro strain – part adware, part dropper – made its way onto the PlayStore in Q3/2024, displaying hidden advertisements and downloading additional payloads once installed.&nbsp;Banker evolution also continues, with Rocinante targeting users in Brazil. Inspired by Ermac, it keylogs user inputs and displays fake phishing bank pages to steal login credentials. A new version, TrickMo banker, can record the device screen and extract sensitive information, storing it in an unsecured C&amp;C server accessible by the public. A manually operated banker called BingoMod uses less sophisticated methods to extract money from victims and wipe their devices. A source code leak of Octo prompts the author to create Octo2 with updated features, which is already spreading in Europe.&nbsp;Spyware is not far behind, with a novel and advanced threat called NGate entering the scene in the last quarter. Targeting the Czech Republic, this spyware is able to steal NFC data which threat actors use to withdraw money from ATMs. We have also seen the Mandrake spyware come back to life and sneak onto the PlayStore, once again stealing victims’ login details if installed.&nbsp;<h4 class="text-align-justify">Web Threat Data within the Mobile Landscape&nbsp;</h4>Most blocked attacks on mobile devices in Q3/2024 were web-based, mirroring the previous quarter. Consumers are much more likely to encounter phishing websites, scams, malvertising and other web threats than ever before. These threats can come in a variety of formats such as private messages, SMS and emails but also redirects on less reputable sites, unwanted pop ups and through other avenues.&nbsp;In contrast to these types of mobile scams, traditional on-device malware requires a more complex infection vector where the consumer must also install the malware. For proper functionality of most mobile malware, permissions need to be granted by the consumer first, which again lowers the chances of malicious activity being triggered.&nbsp;Hence, blocking web-threat based attacks is beneficial for the security of mobile devices, as malware actors often use them as an entry point to get the payload onto the mobile device of their victims.&nbsp;

<h4>Top Threats Seen in Norton Genie in 2024&nbsp;</h4>We are excited to share &nbsp;the top threat types detected by <a href="https://www.norton.com/products/genie-scam-detector" target="_blank" rel="noreferrer noopener">Norton Genie</a>, our scam detection tool, based on telemetry from 2024 so far. As scammers evolve and adapt, they continue to find creative ways to deceive and manipulate users. These threats come in many shapes and forms, exploiting vulnerabilities and human psychology alike. Here is a breakdown of the most prevalent scams types we’ve seen via individual submissions to Norton Genie:&nbsp;&nbsp;

2 Million Users Protected from Fake CAPTCHA Scams, Ransomware Risk Doubled, and Lumma Information Stealer Surges Eleven-Fold

Gen Q3/2024 Threat Report 

<h2>Foreword</h2>The Q2/2024 Gen Threat Report is here, marking the launch of our new series under the unified Gen brand, replacing the Avast Threat Report series. As we continue integrating threat telemetry across our diverse cyber-safety solutions—including Avast, Norton, AVG, Avira, and LifeLock—we're gaining an even more comprehensive view of the evolving threat landscape, which we look forward to sharing with you in this series.This quarter—April through June 2024—continued to highlight the relentless nature of cyber threats, with a staggering 46% increase in attacks year-over-year. Although we observed a slight dip compared to the previous quarter, the overall threat landscape remains highly active, with over a billion unique attacks being blocked by us each month. Scams and malvertising continue to dominate, making up more than 87% of threats on Desktop and 93% on Mobile. Notably, attacks utilizing AI-generated techniques, such as scams via phone calls or deepfake videos, are becoming increasingly common, further complicating the threat environment. Browsers and the Web serve as the primary attack surface, accounting for 95% of all threats.

Scams remain a dominant threat this quarter, with new techniques emerging and old ones being repurposed, often with alarming sophistication. Financial scams, particularly investment scams, have surged as threat actors increasingly leverage AI-generated deepfake videos on YouTube, featuring high-profile events and celebrities to attract victims. A standout example is the CryptoCore scam, where attackers used compromised YouTube accounts and deepfake videos to steal at least $5 million globally in recent months. They lured victims into fake cryptocurrency giveaways with highly convincing content. Fortunately, we successfully blocked a significant portion of their attacks, preventing further losses. However, the sophistication of these scams underscores the growing risks to users, as attackers continue to exploit trending topics and advanced technology to enhance the reach and impact of their fraudulent schemes.Another concerning development is the rise of part-time job scams (also known as task scams). These have evolved from text-based interactions on Telegram to more sophisticated AI-generated voice communications, adding a new layer of deception and realism. Additionally, dating scams remain prevalent, particularly in Europe, while technical support scams (TSS) and fake invoice scams continue to target users in Japan, the US, and Australia. The emergence of ClearFake type of attack, where attackers convince users to run malicious scripts under the guise of fixing common Windows issues, further illustrates the growing ingenuity of scam tactics. This quarter also saw significant activity related to EchoSpoofing—a major attack that exploited email routing misconfigurations of a security solution to deliver millions of malicious emails.A worrying trend this quarter is the return of fake antivirus scan scams—a tactic many believed was a thing of the past. These scams trick users into thinking their devices are infected and are now more convincing than ever. You can read more about it in the featured story of this report.Stolen user data and personal information – the pieces used to take over identities – continues to be digital gold for threat actors. In this quarter, we’ve seen a spike in activity from various <a href="https://www.lifelock.com/how-it-works/what-is-identity-theft/">identity theft-related threats</a>, such as information stealers like AgentTesla, which remains widespread on desktops. On mobile, banking trojans like TeaBot, SoumniBot, RewardSteal, and Medusa are growing rapidly. These threats are slipping through onto the PlayStore and posing a serious risk to users.On a more positive note, law enforcement made significant strides this quarter. Operation Endgame, led by Europol, disrupted major botnet providers such as IcedID, SmokeLoader, and Trickbot resulting in several arrests and notable setbacks for malicious operations. Furthermore, the U.S. Department of Justice also played a crucial role in dismantling the notorious 911 S5 botnet, while actions against the DDoSia botnet led to multiple arrests. Additionally, efforts to combat Remote Access Trojans (RATs) have shown positive results, with operations targeting threats like Hive. It will be interesting to see how the botnet landscape evolves following these high-profile arrests. Will a new kingpin emerge to replace those who have been taken down?Despite these successes, some botnets, such as Twizt, have adapted by spreading ransomware strains like LockBit Black through email attachments. This quarter saw a notable 24% increase in blocked ransomware attacks in our telemetry, with particularly sharp spikes in the US, UK, and India. Nevertheless, there have been significant victories in disrupting ransomware operations. We’ve continued our commitment to aiding victims by providing free decryption tools, including our latest release for the DoNex ransomware.Lastly, Advanced Persistent Threat (APT) groups, particularly those linked to North Korea like Lazarus and Kimsuky, remain active, with several campaigns targeting Asia, including the GuptiMiner campaign. On mobile, we’ve seen adware sneaking into the PlayStore, designed to generate fraudulent advertising revenue through background clicks.And as we delve into these insights, we invite you to explore the full breadth of information contained in this report. With a comprehensive view of the current threat landscape, we hope this new Gen series offers even more value and clarity than its predecessor. Stay safe, avoid blue screen incidents, and enjoy diving into the report.Jakub Křoustek, Malware Research Director<h2>Methodology</h2>This report is structured into three main sections: Desktop-related threats, where we describe our intelligence around attacks targeting the Windows, Linux, and Mac operating systems, with a specific emphasis on web-related threats, and Mobile-related threats, where we describe the attacks focusing on Android and iOS operating systems.We use the term “risk ratio” in this report to denote the severity of specific threats. It is calculated as a monthly average of “Number of attacked users / Number of active users in a given country.” Unless stated otherwise, calculated risks are only available for countries with more than 10,000 active users per month.A blocked attack is defined as a unique combination of the protected user and a blocked threat identifier within the specified time frame.Moving forward, our quarterly threat reports will be informing about the threat landscape situation as seen from the suite of Gen cybersecurity brands. We continuously enhance our threat telemetry and anticipate further refinements in our future reports.<h2>Featured Story: Fake Scan Scams - A New Twist on an Old Trick</h2>For veteran internet users, the mention of fake antivirus scams might evoke memories of the early 2000s, when cybercriminals exploited fears of <a href="https://us.norton.com/blog/emerging-threats/malware">malware infections</a> with alarming effectiveness. Back then, cybercriminals tricked users into thinking their computers were infected, showing fake antivirus interfaces detecting nonexistent threats. In a panic, users purchased licenses for these fake programs, which only simulated antivirus functionality without real protection. Some even uninstalled their real antivirus software, believing the fake one was superior. These fake antivirus scams were a goldmine for cybercriminals, generating hundreds of millions in illicit profits.Fast forward to today, and we're seeing a new twist on this old trick. This time, the scammers have upped their game, making their schemes more sophisticated and harder to spot. Whether you're a seasoned user or new to these tactics, it’s crucial to understand how these scams work and how to avoid falling victim.<h4>The Evolution of Fake Antivirus Scams</h4>Back in 2008 and 2009, cybercriminals used fake antivirus (Fake AV) software to scare users into buying bogus programs. These fake programs, often referred to as scareware, would bombard users with alarming, fake virus alerts, prompting them to purchase the fake software. The scale of these scams was immense, with countless victims and hundreds of millions of dollars lost. Reports from that time highlight the scale of the problem, with numerous victims falling prey to these tactics and the total financial losses running into millions of dollars.Today, cybercriminals are rehashing this old scam, capitalizing on the public discussion about cybersecurity following numerous data breaches and cyber incidents in previous months. The criminals have now refined the fake antivirus scam with two significant changes:<ol><li>Promoting Real Antivirus Software: Instead of pushing fake software, these scams now promote well known antivirus brands like Avira, AVG, Avast, Norton, McAfee, Kaspersky and others. The renewal process occurs on the actual antivirus company’s website, adding a layer of credibility.</li><li>Abusing the Windows Notification System: Scammers exploit the Windows notification system to make their alerts look like genuine system warnings. This tactic makes the scam much more convincing, pushing users to act quickly.</li></ol><h4>How the Fake Scan Scam Works</h4>Cybercriminals use aggressive pop-up alerts that mimic the look of real antivirus programs appearing in your browser. These alerts often claim that your computer is infected with multiple viruses, urging immediate action. These messages can mimic the style of legitimate antivirus programs, prompting users to click on links that ultimately lead to real antivirus sites. They then direct you to purchase a real antivirus product, earning commissions through the referral programs of these legitimate companies.To add to the deception, these fake alerts abuse the Windows notification system. By sending alerts that appear as system messages, scammers add an extra layer of credibility, making it more likely that users will fall for the ruse. This tactic plays on the trust users have in their operating system, making the scam seem all the more real and urgent. If the victim closes the browser alerts will keep showing up in Windows, even if the computer is locked.Delivery Mechanisms: While push notifications from the browser are a common delivery method, the attack often starts with a fraudulent email. Users receive a phishing email from what looks like a legitimate antivirus brand with a link that, when clicked, initiates the Fake Scan scam process.

The following are the Fake AV Scan scam steps:<ol><li>Browser Pop-ups: The scam begins with pop-ups appearing in your web browser, claiming that your system is infected. These alerts can appear even after you close your browser, continuing to show up on your desktop and lock screen.</li><li>Varied Messages: Beyond infection warnings, scammers also use messages like "Your Google account has been hacked" to instill fear and urgency.</li><li>Fake Scanning Interface: Clicking on these alerts takes you to an interface resembling a legitimate antivirus scan, which shows multiple fake threats.</li><li>Purchase Prompt: To "remove" these threats, the interface prompts you to buy or renew a license. When you click to proceed, you are redirected to the actual antivirus company’s website to complete the purchase.</li><li>Referral Links: The URLs involved often include referral codes, showing that the scammers earn commissions through affiliate programs.</li></ol>By promoting legitimate antivirus products, cybercriminals can exploit affiliate programs to earn commissions on each sale. This not only dupes the user into buying unnecessary software but also diverts revenue to the scammers at the expense of both consumers and legitimate antivirus companies.<h4>Protecting Yourself from Fake Scan Scams</h4>To help safeguard against these sophisticated scams, follow these essential tips:<ul><li>Stay Vigilant: Be cautious of any antivirus alerts that appear while browsing. Fake Scan scams often replicate the look of legitimate programs, making them hard to distinguish.</li><li>Verify Warnings: Always check antivirus alerts through your installed antivirus software, whether that’s locally on your device or by logging into your account in the browser.</li><li>Manage Notifications: Avoid granting permission to install push notifications from untrusted websites. Only allow notifications from reputable sources to minimize the risk of malicious alerts.</li></ul><h4>The Scale of the Problem</h4>So how big of a problem are fake antivirus scams? During this quarter alone, we have protected over 1 million users from these attacks. While the attacks are occurring worldwide, they are particularly active in North America, South America and Europe, with significant incidents also reported in countries like India or Japan.To give you a clearer picture, here's a heat map showing the Fake Scan attacks blocked in Q2/2024 worldwide:

These are the top 10 countries with the most Fake Scan attacks blocked:<ol><li>Brazil</li><li>United States</li><li>France</li><li>Germany</li><li>Spain</li><li>Mexico</li><li>Italy</li><li>Poland</li><li>United Kingdom</li><li>Argentina</li></ol>The sheer volume of these attacks highlights the global scale of the problem. Cybercriminals are leveraging sophisticated tactics to target users everywhere, exploiting their fear and urgency to drive these scams. The widespread nature of these attacks, coupled with their high success rate, underscores the importance of people around the world understanding the potential threat of these scams.<h4>Conclusion</h4>The old fake antivirus scams, where cybercriminals made millions, demonstrated the effectiveness of exploiting fear and urgency. Now, with the added layer of legitimacy provided by the illegitimate promotion of real antivirus products and the Windows notification system, these scams are more convincing than ever. It is essential to remain vigilant, verify the authenticity of alerts, and only trust reputable sources to ensure you don't fall victim to these evolving threats.&nbsp;David Jursa, Malware Researcher Luis Corrons, Security Evangelist &nbsp;<h2>Desktop-Related Threats</h2><h3>Advanced Persistent Threats (APTs): Asia's Cyberfront</h3>An Advanced Persistent Threat (APT) is a type of cyberattack that is conducted by highly skilled and determined hackers who have the resources and expertise to penetrate a target's network and maintain a long-term presence undetected.Asia continues to be a hotbed for Advanced Persistent Threat (APT) activity, with various actors actively targeting countries such as South Korea, Myanmar, Vietnam, the Philippines, and Cambodia.This wave of cyberattacks highlights the growing amount of geopolitical tension and cyber espionage in Asian countries. Among the many actors involved, Mustang Panda stands out as one of the most persistent groups. Identified in operations across Mongolia, Vietnam, and Myanmar, Mustang Panda has become infamous for their heavily used sideloading techniques to deploy malicious payloads. These payloads often involve the Korplug malware, a tool primarily used to steal sensitive documents from compromised systems, illustrating the group's focus on intelligence gathering and long-term infiltration.The Sidewinder group poses yet another significant threat in the region. Traditionally associated with operations targeting Pakistan, Sidewinder has recently expanded to target countries like Sri Lanka and the Maldives. This expansion highlights the group's evolving tactics and its ability to adapt to shifting geopolitical dynamics. Sidewinder’s campaigns are notable for their ability to exploit vulnerabilities in diverse environments, demonstrating a sophisticated understanding of both technical and geopolitical landscapes.In addition to Mustang Panda and Sidewinder, the region has also seen activity from other advanced threat actors. For instance, a relatively new group has launched widespread attacks across Thailand, Vietnam, Saudi Arabia, the Philippines, and Taiwan. What sets this group apart is its use of custom malware, including advanced shellcode capable of manipulating and bypassing the security measures of well-known security vendors. Fortunately, the specific vulnerability exploited by this group was quickly reported to the vendor and has since been patched.In Q2/2024, the Lazarus group, a well-known North Korean APT, began particularly targeting freelance developers working on NFT and crypto-wallet projects. Lazarus has demonstrated a keen interest in the cryptocurrency market, leveraging legitimate platforms such as "freelancer.com" to distribute malicious JavaScript to unsuspecting developers. The group has also employed GitHub repositories to spread their malicious NPM-based packages. These packages, once installed on Windows, Linux, or macOS systems, begin by gathering basic system information. They then scan the victim's web browser for cryptocurrency wallet extensions, such as those from Binance and Coinbase, before deploying a custom Python backdoor.

This backdoor is designed for a range of malicious activities, including fingerprinting, remote control, keylogging, data exfiltration, browser credential theft, and even the downloading of remote access tools like AnyDesk. The sophistication and focus of Lazarus on the cryptocurrency sector suggest a calculated effort to exploit this growing market for financial gain.&nbsp;To add to the complexity of the Asian threat landscape in Q2/2024 <a href="https://decoded.avast.io/janrubin/guptiminer-hijacking-antivirus-updates-for-distributing-backdoors-and-casual-mining/">we reported on GuptiMiner</a>, a highly sophisticated threat with a unique infection chain. The threat actors behind GuptiMiner employed a range of advanced techniques, including DNS requests to attacker-controlled servers, sideloading, extracting payloads from seemingly innocent images, and signing their payloads with a custom trusted root anchor certification authority.The criminals running GuptiMiner have been capitalizing on an insecurity within an update mechanism of an Indian antivirus vendor to distribute the malware by performing a man-in-the-middle attack. Based on similarities between the GuptiMiner operation and the Kimsuky keylogger, we believe the campaign was orchestrated by notorious North Korean APT group Kimsuky.The main objective of GuptiMiner is to distribute backdoors within big corporate networks. We’ve encountered two different variants of these backdoors: the first is an enhanced build of PuTTY Link, providing SMB scanning of the local network and enabling lateral movement over the network to potentially vulnerable Windows 7 and Windows Server 2008 systems on the network. The second backdoor is multi-modular, accepting commands from the attacker to install more modules as well as focusing on scanning for stored private keys and cryptowallets on the local system.Interestingly, GuptiMiner also distributes XMRig on the infected devices, which is a bit unexpected for such a thought-through operation.&nbsp;Luigino Camastra, Malware Researcher Igor Morgenstern, Malware Researcher Jan Rubin, Malware Researcher&nbsp;<h3>Bots: Spring Cleanup</h3>Bots are threats mainly interested in securing long-term access to devices with the aim of utilizing their resources, be it remote control, spam distribution, or denial-of-service (DoS) attacks.The Windows botnet landscape was a wild one in Q2/2024. At the end of May, an operation dubbed Operation Endgame, coordinated by Europol, targeted various droppers and bots such as IcedID, SystemBC, Pikabot, SmokeLoader, Bumblebee, and Trickbot. The operation focused on arrests, sever takedowns, domain seizures and physical searches to disrupt popular providers many other threat actors rely on to deploy their payloads. At similar time, U.S. DOJ-led operation disrupted the 911 S5 botnet. According to the court documents, the botnet spread through various VPN programs (such as MaskVPN and DewVPN) and pay-per-install software bundles. The main aim of the botnet was to provide residential proxy to other threat actors to allow them to mask their operations.

DDoSia came rather late to the spring cleanup - Spanish Civil Guard paid a visit to three DDoSia participants recently which resulted in arrests and hardware confiscation. Arrests aside, DDoSia project seems to have hit a plateau. The cadence of new messages on their channel is more-or-less stable as is the number of participants in the project. As usual, the most frequent targets were banks. This season also brought tax period in many countries, including Ukraine, prompting the group to target various online tax return platforms. Frequently, we saw attacks on websites of various European cities such as Berlin or Krakow; nevertheless, the impact of such attacks is debatable. Interestingly in June, we saw rapid changes in C&amp;C infrastructure again which would point to issues with their infrastructure, especially since these outages impact their activity.

Unfortunately, Twizt did not participate in this spring cleanup. It has shifted its focus from a sextortion campaign to malicious spam campaign loaded with LockBit3-based ransomware, dubbed LockBit Black, in its attachment.As a whole, we’ve seen an overall decline in bot-related threats, with many notorious strains having two-digit drops in their perceived prevalence (Emotet -50%, Tofsee -22%, Twizt/Phorpiex -17%, Amadey -36%, IcedID -18%). We presume that this trend may continue in the next quarter due to the takedowns which might affect their operation.

In terms of Linux bots, the quarter started with the <a href="https://www.virustotal.com/gui/file/BB9AA33EB1F32EEFDE11FD860754D4B18A370B182CD4EFF9654C66FB632053F7">Goldoon botnet</a> exploiting CVE-2015-2051 and targeting D-Link devices. The usual plague of Mirai/Gafgyt/Xordos bots has a new companion this quarter - <a href="https://www.virustotal.com/gui/file/CF7710B7F4B351EA119DCE1D3862121835C6A3A2B7AD5A8C72A0AC6F573CB72A">V3rs3Bot</a>. Unfortunately, augmenting bots with kernel rootkits continues, leading to many yet-undetected bots in the wild. For instance, we found a <a href="https://www.virustotal.com/gui/file/d860585d57a45de20b3af42bcde474c717336faf0c167b6f3838655c130b7145/detection/f-d860585d57a45de20b3af42bcde474c717336faf0c167b6f3838655c130b7145-1719584575">malicious kernel module</a> that misleadingly uses “Netfilter core team” as an author that also contains backdoor inspired by <a href="https://www.virustotal.com/gui/file/8224F1A05CF90D912C8244CC2B0F34188268493F299A0AD84B769E4DDD310908">its reverse shell</a>.&nbsp; &nbsp;Adolf Streda, Malware Researcher David Alvarez, Malware Analyst &nbsp;<h3>Coinminers: Decrease Globally but Are Not Dead&nbsp;</h3>Coinminers are programs that use a device's hardware resources to verify cryptocurrency transactions and earn cryptocurrency as compensation. However, in the world of malware, coinminers silently hijack a victim's computer resources to generate cryptocurrency for an attacker. Regardless of whether a coinminer is legitimate or malware, it's important to follow our <a href="https://support.avast.com/en-eu/article/Threat-Lab-cryptomining-behavior-guideline/">guidelines</a>.&nbsp;Despite a continuing decline in the prevalence of coinminer malware in Q2/2024, coinminers are still leveraged by threat actors. In our <a href="https://decoded.avast.io/janrubin/guptiminer-hijacking-antivirus-updates-for-distributing-backdoors-and-casual-mining/">recent report on GuptiMiner</a>, we described that one of the stages on devices compromised by this threat was an XMRig coinminer. Although distributing a coinminer is a bit unexpected for such a thought-through campaign, it proves that threat actors still want to make a coin when they see an opportunity.&nbsp;Overall, the risk ratio dropped by an additional 18% in Q2/2024. This reduction was primarily driven by a slight decrease in the share of the XMRig coinminer malware, following a similar trend from the previous quarter.&nbsp;

The decrease is mostly due to a significant drop in the United States and Turkey where the risk ratio of getting infected by a coinminer dropped by 34% and 38%, respectively. Brazil, India, and France also experienced drops in risk ratios by 5%, 16%, and 30%, respectively. The majority of countries saw a slight decline in coinmining activity over the quarter.&nbsp;Hungary, on the other hand, bucked the trend with a 73% increase in the risk ratio in Q2/2024. This is particularly interesting because the increase is rather sporadic. The only other significant rise, among countries with a more substantial user base, is Slovakia, which saw a 14% increase in the risk ratio. Notably, Slovakia and Hungary are neighboring countries, creating an intriguing “hotspot.”&nbsp;With that said, the highest risk ratios still prevail in Madagascar (1.9% risk ratio), Pakistan (1.19%), Turkey (0.91%), and Egypt (0.89%).&nbsp;

XMRig, the long-time leader in coinminer malware, saw its malware share decrease by 9% this quarter. Despite this decline, it still dominates with 53.89% of the total coinminer market.&nbsp;Web miners, which include various JavaScript strains used for malicious background coinmining on webpages – either as raw malware or as an “alternative” to online advertising – have increased significantly by 20% compared to the previous quarter. Most other major coinminers also saw an uptick in activity. On the other hand, CoinHelper’s malware share dropped by 12% this quarter.&nbsp;The most common coinminers with their malware share in Q2/2024 were:&nbsp;<ul><li>XMRig (53.89%)&nbsp;</li><li>Web miners (24.32%)&nbsp;</li><li>CoinBitMiner (2.97%)&nbsp;</li><li>FakeKMSminer (2.12%)&nbsp;</li><li>NeoScrypt (1.81%)&nbsp;</li><li>CoinHelper (0.92%)&nbsp;</li><li>VMiner (0.84%) &nbsp;</li></ul>Jan Rubin, Malware Researcher&nbsp;<h3>Information Stealers: with AgentTesla at Its Peak&nbsp;</h3>Information stealers are dedicated to stealing anything of value from the victim’s device. Typically, they focus on stored credentials, cryptocurrencies, browser sessions/cookies, browser passwords and private documents.&nbsp;According to our data, AgentTesla saw a new all-time in Q2/2024. Before we dive into numbers in the dedicated subsection, let’s have a look at a few campaigns that we observed during a busy April through June.&nbsp;The major Information Stealer to highlight is AgentTesla. <a href="https://x.com/AvastThreatLabs/status/1783535485052174839">One of the major campaigns</a> we identified targeted Czech users via emails disguised as legitimate orders. This particular campaign was also spreading Remcos RAT along with the notorious information stealer.&nbsp;

A <a href="https://x.com/AvastThreatLabs/status/1802627745949585897">fake-tutorial campaign</a>, where attackers were distributing malicious PowerShell scripts via ClearFake, spread various information stealers including Lumma Stealer and attracted significant attention. This attack begins with social engineering, guiding the victim to follow a few simple steps to resolve a problem, in this case fixing Windows Update error 0x80070643, with the user ending up copying a script to their clipboard and pasting it into a command line or PowerShell console. After the script is executed, the victim is infected with a dropper, typically HijackLoader, distributing the aforementioned Lumma Stealer or other malware strains.&nbsp;

Interestingly, we also saw cases of the bad guys fighting for their reputation among the criminal underground – and in cases we saw, not so successfully. The author of DarkGate, using the nickname RastaFarEye, <a href="https://www.trellix.com/blogs/research/darkgate-again-but-improved/">was banned on an underground forum</a> a few months back due to some users raising complaints directed at this malware author.&nbsp;

Despite the ban and subsequent bad cybercriminal PR, we can still see new DarkGate builds with new features and continuous development. DarkGate is a long-standing information stealer with various RAT capabilities. In Q2/2024, there were multiple campaigns spreading DarkGate via malicious email attachments. The emails are crafted in such a way they lure the victim into downloading and opening the attachment, typically a MS Office document or a PDF file.&nbsp;

After the user opens the attached file, in this case a MS Excel XLSX file, they are presented with a message saying they need to “Enable Editing” and click the “Open” button to properly open the document. This effectively leads to infecting the victim with another stage of the malware, as can be seen in the image below as an IP address leading to a malware JavaScript file.&nbsp;

Now, thankfully some good news. Google is <a href="https://security.googleblog.com/2024/07/improving-security-of-chrome-cookies-on.html">improving the security of Chrome cookies on Windows</a> by implementing a new protection called Application-Bound Encryption. This Data Protection API (DPAPI) improvement effectively enhances protection against information stealers’ efforts to steal data from this popular web browser beginning with version 127. In short, for information stealers to steal the sensitive data, the malware will now need to either obtain system privileges or to inject itself into the Chrome browser, which are both noisy and more easily detectable actions by security solutions.&nbsp;<h4>Statistics&nbsp;</h4>In comparison with the previous quarter, the overall risk ratio of information stealers decreased once again in Q2/2024 by additional 11%. According to our data, this is due to a decrease in activity of mid-prevalent information stealers like Stealc, ClipBanker, or ViperSoftX. On the other hand, high-prevalent stealers like AgentTesla, Ramnit, FormBook, Vidar, Lumma, and others, increased their malware share.&nbsp;

In countries where we have a more significant userbase, the risk ratio of getting infected by an information stealer thankfully decreased:&nbsp;<ul><li>Turkey (1.86%) with 18% Q/Q decrease&nbsp;</li><li>Pakistan (1.76%) with 14% Q/Q decrease&nbsp;</li><li>Egypt (1.55%) with 12% Q/Q decrease&nbsp;</li></ul>However, there were also many countries more impacted than usual. For example, Nigeria had a risk ration increase of 130%, for a final risk ration of 2.28% risk ratio. In Ethiopia, the risk ratio increased by 48%, making 2.11% in total.&nbsp;

AgentTesla increased its malware share by 11% this quarter, further underlining its dominance in the information stealers landscape. The same goes with many other prevalent strains, like Ramnit (12% increase), FormBook (30% increase), Azorult (33 % increase), and Lokibot (59% increase). RedLine’s malware share decreased by 15%, similarly Fareit’s by 6%. ViperSoftX stayed roughly the same, with only a 2% decrease in malware share.&nbsp;The most common information stealers with their malware shares in Q2/2024 were:&nbsp;<ul><li>AgentTesla (33.84%)&nbsp;</li><li>Ramnit (12.04%)&nbsp;</li><li>FormBook (9.05%)&nbsp;</li><li>Fareit (7.10%)&nbsp;</li><li>RedLine (3.67%)&nbsp;</li><li>Vidar (2.70%)&nbsp;</li><li>Azorult (2.56%)&nbsp;</li><li>Lumma (2.44%)&nbsp;</li><li>Lokibot (2.26%)&nbsp;</li><li>ViperSoftX (2.22%)</li></ul>Jan Rubin, Malware Researcher&nbsp;<h3>Ransomware: The Wheels of Justice Turn Slowly, but Grind Exceedingly Fine&nbsp;</h3>Ransomware is any type of extorting malware. The most common subtype is the one that encrypts documents, photos, videos, databases, and other files on the victim’s PC. Those files become unusable without decrypting them first. To decrypt the files, attackers demand money, “ransom”, hence the term ransomware.&nbsp;The prevalence of <a href="https://www.avg.com/en/signal/what-is-ransomware">ransomware</a> within the consumer segment continues to be lower compared to past activity, but we have seen a significant +24% increase Q/Q with the highest increases in:&nbsp;<ul><li>India (up by 379%)&nbsp;</li><li>United States, Canada, United Kingdom (all up by 100%)&nbsp;</li><li>Australia (up by 66%)&nbsp;</li></ul>

According to telemetry from our userbase, below are the most prevalent ransomware strains. The percentage values show the total market ratio of ransomware occurrence.&nbsp;<ul><li>WannaCry (21%)&nbsp;</li><li>Cylance ransomware (9%)&nbsp;</li><li>Enigma (8%)&nbsp;</li><li>STOP (6%)&nbsp;</li><li>LockBit (5%)&nbsp;</li><li>Mallox (aka TargetCompany) (2%)&nbsp;</li></ul><h4>Justice for Ransomware Actors&nbsp;</h4>Even though ransomware operators (like other cyber-criminals) are hiding their identity as much as possible, they may end up in the hands of the law in the end.&nbsp;<h5>Example #1: Yaroslav Vasinskyi (Sodinokibi / REvil)&nbsp;</h5>On the 1st of May 2024, Yaroslav Vasinskiy, one of the hackers in the REvil ransomware gang, was sentenced to <a href="https://www.justice.gov/opa/pr/sodinokibirevil-affiliate-sentenced-role-700m-ransomware-scheme">13 years and seven months</a> in prison for his participation in the ransomware gang operation. According to the <a href="https://www.justice.gov/opa/pr/sodinokibirevil-affiliate-sentenced-role-700m-ransomware-scheme">press release</a> by the U.S. Department of Justice, Vasinskiy participated in about 2500 ransomware operations, demanding ransom payments of over $700 million. We do not know how much they actually earned, but Vasinskiy also must pay $16 million in restitution for the damage done.&nbsp;REvil ransomware was one of the most successful ransomware operations in the history of computers. The most devastating operation was the Kaseya incident (more in <a href="https://decoded.avast.io/threatresearch/avast-q321-threat-report/">Avast Threat Report Q3/2021</a>), where the attackers abused a vulnerability in the Kaseya Remote Management software and deployed the REvil encryptor to thousands of companies.&nbsp;REvil ransomware stopped their operation in 2022, and it is no longer active.&nbsp;<h5>Example #2: Dmitry Yuryevich Khoroshev (LockBit)&nbsp;</h5>6 days after the Vasinskyi’s sentence, the identity of LockBitSupp, administrator and developer of the LockBit ransomware group, was revealed to the public. He is Russian national Dmitry Yurievich Khoroshev (seen in the picture below).&nbsp;

Interestingly, two years earlier, Khoroshev was so sure of his anonymity that he offered a million-dollar reward to anyone who could send him his name and surname. Later, he increased that reward to $10 million.&nbsp;

We have been observing LockBit's activity over time and noticed that in the days immediately after the reveal of his identity, the number of attacked companies increased significantly. We can only speculate whether this was an act of revenge or pure coincidence.&nbsp;

The question is what impact the identity reveal will have. The LockBit gang may start losing affiliates, which would mean decreasing its activity. Additionally, Khoroshev is now under sanctions (asset freeze and travel ban) in the US, UK, and Australian, so anyone who pays ransom in these countries could be considered in violation of these sanctions and subsequently imposed with a fine.&nbsp;If you happen to know where he lives or can provide information leading to his arrest, <a href="https://www.state.gov/transnational-organized-crime-rewards-program-2/lockbit-ransomware-administrator-dmitry-yuryevich-khoroshev/">you may earn up a nice money</a>.&nbsp;However, hackers in Russia <a href="https://flare.io/learn/resources/dark-web-drama-lockbit-and-the-an-security-breach-saga/">are generally safe if they do not target companies belonging to Russia or any country in the Commonwealth of Independent States</a>. So, until Khoroshev leaves Russia (or until the regime in Russia changes), he is probably safe.&nbsp;<h4>Decrypted: DoNex&nbsp;</h4>During Q2/2024, we discovered a weakness in the cryptographic schema of the DoNex ransomware and began silently cooperating with law-enforcement agencies to provide a decryptor to the victims. Since the details about the weakness were published in June at the REcon Montreal conference, <a href="https://decoded.avast.io/threatresearch/decrypted-donex-ransomware-and-its-predecessors/">we released the decryptor to the public</a>.&nbsp;The DoNex decryptor is just the latest in a series of ransomware decryptors we have developed for victims to use, free of charge.&nbsp;&nbsp;Ladislav Zezula, Malware Researcher Jakub Kroustek, Malware Research Director &nbsp;<h3>Remote Access Trojans (RATs): The Takedowns Continue</h3>A Remote Access Trojan (RAT) is a type of malicious software that allows unauthorized individuals to gain remote control over a victim's computer or device. RATs are typically spread through social engineering techniques, such as phishing emails or infected file downloads. Once installed, RATs grant the attacker complete access to the victim's device, enabling them to execute various malicious activities, such as spying, data theft, remote surveillance, and even taking control of the victim's webcam and microphone.&nbsp;The dismantling of Remote Access Trojans (RATs) continued in Q2/2024, though we did not see the same high profile takedowns as we did with Warzone in the previous quarter. Although most major RAT strains seem to be hovering around or slightly below their numbers from the last quarter, Remcos picked up the pace keeping the overall risk ratio at the same level as in Q1/2024. The notable exception was Warzone, which suffered a large and expected decrease following its takedown.&nbsp;

In Q1/2024, we reported XWorm as the most prevalent strain in Canada. This quarter, the risk ratio in Canada continued to grow (+52%) despite XWorm losing its malware share again to Remcos and AsyncRat. The biggest risk ratio increase was observed in Romania (+58%) with the third largest increase in Slovenia (+41%). Remcos is the main strain in all of these countries.&nbsp;Greece (-27%), Spain (-23%) and France (-19%) saw the largest decreases in risk ration of RATs in Q2/2024. The decrease in Greece was due to AsyncRat while in Spain it was thanks to Remcos. The most interesting change was in France where we saw an increase of stopped attacks by Remcos but a decrease for all other strains such as AsyncRat, njRAT and QuasarRAT.&nbsp;The countries with the highest overall risk ration globally remained consistent in Q2.2024 with Afghanistan, Iraq and Yemen in the lead with the most active threats being HWorld and njRAT.&nbsp;&nbsp;

As mentioned, Remcos gained a significant share of the RAT market in Q2/2024 with a 34% increase, the most of all RAT strains we monitor. DarkCrystal also increased its malware share by 28% bringing it closer to the overall top 10.&nbsp;The takedown of Warzone in Q1/2024 continued to impact its share numbers with an additional loss of 39% of the market in Q2/2024, with additional decreases expected in the future.&nbsp;&nbsp;The most prevalent RAT strains for Q2/2024 are as follows:&nbsp;<ul><li>Remcos&nbsp;</li><li>HWorm&nbsp;</li><li>njRAT&nbsp;</li><li>AsyncRat&nbsp;</li><li>QuasarRAT&nbsp;</li><li>XWorm&nbsp;</li><li>FlawedAmmyy&nbsp;</li><li>Warzone&nbsp;</li><li>NanoCore&nbsp;</li><li>Gh0stCringe</li></ul><h4>Q2 Takedowns&nbsp;</h4>This quarter, an operation against two individuals involved in RAT creation and distribution was carried out jointly by the AFP (<a href="https://www.afp.gov.au/news-centre/media-release/afp-traps-alleged-rat-developer">Australian Federal Police</a>) and the FBI (<a href="https://www.justice.gov/usao-cdca/pr/socal-man-arrested-federal-charges-alleging-he-schemed-advertise-and-sell-hive">Federal Bureau of Investigation</a>). The AFP arrested an Australian man alleged to have developed and sold the Firebird RAT. The FBI then seized another US-based man suspected of advertising and selling the RAT as well as providing customer support. Firebird, later rebranded to Hive, is a RAT which has been active for several years but was never very widely spread. According to our data, only a small number of attacks were performed (and blocked) in our userbase in Q2/2024.&nbsp;Lastly, <a href="https://blog.talosintelligence.com/new-spicerat-sneakychef/">Cisco Talos</a> uncovered a new RAT called SpiceRAT which, according to their research, is used by the SneakyChef threat actor. SpiceRAT is not a full-featured RAT like Remcos or AsyncRat. Its role is to serve as an entry point for additional plugins or further attacks. The basic capabilities include fingerprinting the system, downloading and running executable binaries and executing commands.&nbsp;&nbsp;Ondrej Mokos, Malware Researcher&nbsp;<h3>Vulnerabilities and Exploits&nbsp;</h3>Exploits take advantage of flaws in legitimate software to perform actions that should not be allowed. They are typically categorized into remote code execution (RCE) exploits, which allow attackers to infect another machine, and local privilege escalation (LPE) exploits, which allow attackers to take more control of a partially infected machine.&nbsp;In Q2/2024, several significant vulnerabilities were discovered and exploited, posing serious risks to systems and users. In this section, we highlight the most prevalent for the quarter.&nbsp;<h4>Windows DWM Core Library Vulnerability CVE-2024-30051&nbsp;</h4>In early April 2024, Kaspersky discovered a peculiar document uploaded to VirusTotal. The document's file name suggested it contained information about a Windows OS vulnerability. Upon examination, they found a description of a Windows Desktop Window Manager (DWM) vulnerability and its potential for privilege escalation.&nbsp;&nbsp;What they discovered is a heap-based buffer overflow vulnerability affecting the Windows DWM Core Library that can be exploited to elevate attacker’s privileges on a targeted system. Kaspersky researchers have connected this zero-day vulnerability to Qakbot and various other types of malware.&nbsp;<h4>CrushFTP Zero-Day Vulnerability&nbsp;</h4>CrushFTP, a vendor specializing in managed file transfer solutions, disclosed a critical zero-day vulnerability. This flaw affects CrushFTP versions below 10.7.1 and 11.1.0, as well as legacy 9.x versions across all platforms.&nbsp;This vulnerability is a VFS (Virtual File System) sandbox escape. The flaw allows remote attackers with minimal privileges to read files outside of the VFS Sandbox. Exploiting this vulnerability can lead to arbitrary file reads with root privileges, bypass authentication to gain administrator access, and execute remote code. Consequently, an attacker could access and potentially exfiltrate all files stored on a CrushFTP instance.&nbsp;<h4>New trick uses old Internet Explorer vulnerabilities (CVE-2024-38112)&nbsp;</h4>Check Point Research has uncovered a clever new tactic used by attackers to trick Windows users into executing malicious code. The attackers are exploiting a vulnerability involving Windows Internet Shortcut files (.url). These files, when clicked, use the outdated Internet Explorer (IE) to visit a URL controlled by the attackers, even if the victim's computer is running modern Windows 10 or 11.&nbsp;<h4>EchoSpoofing: Unmasking a Massive Scam Campaign Exploiting Proofpoint's Email Routing Misconfiguration&nbsp;</h4>According to a Guardio Labs researcher, the recent campaign exploited an email routing loophole within Proofpoint’s infrastructure, allowing the attackers to send millions of emails daily. These emails, authenticated with Sender Policy Framework (SPF) and DomainKeys Identified Mail (DKIM) signatures, bypassed major security protections, making them appear legitimate and enabling the threat actors to steal funds and credit card details from unsuspecting recipients.&nbsp;This attack, called EchoSpoofing, involves the threat actor sending messages from an SMTP server hosted on a virtual private server (VPS). The scam's effectiveness lies in its ability to comply with security measures such as SPF and DKIM, which are designed to prevent attackers from imitating legitimate domains. These spoofed messages are routed through various adversary-controlled Microsoft 365 tenants, then relayed via Proofpoint's customer email infrastructures to reach end-users of free email providers like Yahoo!, Gmail, and GMX.&nbsp;The EchoSpoofing campaign is believed to have begun in January 2024, with the threat actor sending an average of three million emails daily. However, the volume spiked to a staggering 14 million messages per day in early June as Proofpoint started implementing countermeasures. The attackers used a cracked version of legitimate email delivery software called PowerMTA, combined with rotating VPS servers and IP addresses, to send massive bursts of emails from their SMTP servers.&nbsp;Proofpoint has acknowledged the scale of the threat, stating that it does not overlap with any known threat actors or groups.&nbsp;Luigino Camastra, Malware Researcher Michal Salat, Threat Intelligence Director &nbsp;<h2>Web Threats&nbsp;</h2>In our ongoing effort to stay ahead of the evolving threat landscape, we rapidly adapt to emerging infection vectors, which are now often web-related. Those familiar with our reports will recognize how significantly the web threats section has expanded over time. From Q4/2023 to Q2/2024, web threats have seen an approximate 17% increase in incidents compared to other cyber threats, underscoring a persistent and troubling upward trend.&nbsp;Overall, as we approach the end of Q2, a small but noticeable decline in general web threat activity can be observed. We believe that this decrease is largely attributed to the onset of summer holidays, a period when both cybercriminal activities and online engagements often reduce due to seasonal changes in user behavior and routines.&nbsp;&nbsp;At the same time, the core scam threats are still strong and very prevalent in our userbase. As we will show shortly, there was a significant increase in financial scams such as Crypto Scams fueled by CryptoCore as well as enhanced Part-Time Job Scams (aka Task Scams). Dating Scams and Technical Support Scams are also not disappearing anytime soon based on their strong Q2/2024 presence. Lastly, we will showcase an example of another prevalent threat – Fake Invoice Scams.&nbsp;<h3>Scams: Assessing the Real Risk vs. Reward&nbsp;</h3>A scam is a type of threat that aims to trick users into giving an attacker their personal information or money. We track diverse types of scams which are listed below.&nbsp;Scam threats, which are often supported by malvertising, had their highest activity at the beginning of Q2/2024. After that, we observe a slight decline in overall prevalence.&nbsp;

The small decrease in activity is only relative and often caused by threat actors switching between various scam schemas. We are continuously improving our threat insight and reflecting such changes in the threat landscape. One such situation happened within the Financial Scams in Q2/2024, which is visible on the following chart depicting our insight.&nbsp;

In terms of the Financial Scams in Q2/2024, the most impacted countries were New Zealand, Czech Republic, all the Nordic countries, but also Canada, Australia, and the UK.&nbsp;

We frequently write about the principle of this particular scams, which commonly leverages paid ads on social platforms. These advertisements are becoming increasingly innovative. As noted in our previous report, scammers are now using deepfake technology and enlisting various celebrities of the different regions in order to better target users. Additionally, they often employ sensationalist headlines to draw attention. It doesn't always have to be just about celebrities, sometimes they take advantage of the action, like the recent <a href="https://www.gendigital.com/blog/news/innovation/2024-sports">summer games in France</a>.&nbsp;

After clicking on the advertisement, the user is redirected to a prepared scam page, where the content of the ad is then supported by, for example, a fake news page or a form where the user has to fill in specific personal data.&nbsp;

Attracting users to money doesn't only work in the context of investments, this will surely only attract some people. But what about, for example, putting the possibility of making money in a different context. This is dealt with in the next section.&nbsp;<h4>Part-Time Job Scams: A Growing Threat with New Tactics&nbsp;</h4>The allure of easy money, especially during difficult economic times, can lead many into the trap of Part-Time Job Scams. These scams, often initiated through messaging platforms like WhatsApp and Telegram, have evolved into more sophisticated operations that exploit victims using social engineering techniques. Scammers promise simple online tasks in exchange for steady income, but the ultimate goal is to steal large sums of money from unsuspecting victims.&nbsp;

<h5>The New Phone Call Tactic&nbsp;</h5>A recent development in these scams is the use of phone calls to initiate contact. Scammers now employ a natural-sounding feminine voice, likely generated by AI, to inform potential victims that they have been selected for a reward, such as a $5 TikTok voucher. The victim is then instructed to add the calling number to their contacts and continue communication via WhatsApp. Here’s an example of how the conversation unfolds in WhatsApp:&nbsp;<h6>Real Example of a WhatsApp Conversation with the Scammers:&nbsp;</h6>Scammer: Hello, my name is XXXXXX. Can I talk to you for 2-3 minutes?&nbsp; Victim: Yes, of course.&nbsp; Scammer: Thank you for your response. Our company works with TikTok merchants who are willing to pay to increase subscriptions and the visibility of bloggers. Therefore, our company needs to hire many coworkers to increase subscriptions for them on the TikTok app, and they will pay you.&nbsp; Scammer: We need many people to participate in the short video promotion bonus event and like TikTok content. Each video can earn you a reward of 3 euros, and you can earn a reward of 300-800 euros every day.&nbsp; Scammer: Are you interested in working with us?&nbsp; Victim: Yes, of course.&nbsp; Scammer: How old are you? Do you have a Telegram application?&nbsp; Victim: I am 28 years old and yes, I have Telegram.&nbsp; Scammer: Okay, very well. This is the easiest part-time job, just go to the link (TikTok), like the video, take a photo, and send it to us.&nbsp; (The victim completes the task and sends the screenshot)&nbsp; Scammer: Well done. I think you already know how we work. I will give you 3 TikTok video links as a test. You don’t need to watch the entire video, just like it and send me a screenshot, and you will earn 3€.&nbsp; (Victim does the tasks and shows the screenshots)&nbsp; Scammer: Okay, I think you know how we work. Please add our business manager on Telegram:&nbsp; <a href="https://t.me/scammer_handle">https://t.me/scammer_handle</a> (link to scammer’s Telegram chat)&nbsp; Your employment code: XXXXXXX&nbsp; Scammer: Contact the recipient now, send him the code to fill out your details and you can earn 5€ for a total of 8€. Many people are in line to participate, please wait patiently, the receptionist will receive you. Please complete your information and submit it, after which you will receive a payment.&nbsp;<h6>Going Undercover: Uncovering the Scam&nbsp;</h6>To better understand the operation, we went undercover, engaging in one of these scams. We were asked to perform simple tasks, such as adding products to an eBay shopping cart and sending screenshots as proof. Initially, the scammers deposited a small amount of USDT cryptocurrency into our wallet, which we could verify in our account. This tactic is used to build trust and lend legitimacy to the scam.&nbsp;

However, the true nature of the scam was revealed when we were invited to participate in a ‘VIP’ task, promising a significant return on an upfront investment. We were added to a larger group chat that appeared to be bustling with activity—many users were requesting tasks and submitting proof of receiving payments. It quickly became evident that most of these accounts were fake, likely bots, designed to create a false sense of legitimacy.&nbsp;When victims make a significant deposit for these VIP tasks, the scammers vanish, taking the money with them. Often, they might attempt to extract even more money by inventing additional fees or taxes, all while threatening the loss of the initial investment.&nbsp;<h5>Impact and Scope&nbsp;</h5>These scams are becoming increasingly prevalent, with reports of significant financial losses. According to recent data from the Federal Trade Commission (FTC), investment-related scams saw a 14% increase in losses, amounting to over $10 billion in 2023 alone. The global reach of these scams is evident, with cases reported in multiple languages, including English, Spanish, and Czech. The use of AI-generated voices adds a new layer of deception, making these scams harder to detect.&nbsp;<h4>Crypto Scam Powered by CryptoCore&nbsp;</h4>A crypto scam is a cyber threat designed to trick individuals into surrendering their cryptocurrency. These scams exploit the anonymity and irreversibility of blockchain transactions, often targeting those with a limited understanding of how cryptocurrency works.&nbsp;Also in Q2/2024, we followed a crypto scam group, we dubbed CryptoCore, that lures individuals with promises of high returns or uses sophisticated schemes to defraud even the most cautious via deepfake videos to convince victims of unique cryptocurrency investment opportunities. These deepfake videos exploit famous personalities and brands such as Elon Musk, Michael Saylor, Donald Trump, BlackRock, and Apple to enhance trust and legitimacy. Scam videos are primarily spread on popular platforms like YouTube, X, and TikTok through hacked accounts, exploiting hundreds of accounts with many subscribers. Consequently, the total revenues from these scams amount to millions of dollars in various cryptocurrencies.&nbsp;The initial phase of the scam involves targeting widely publicized events that will be broadcast live to draw a large audience. The scammers then produce deepfake videos replicating official event footage and including QR codes directing viewers to fraudulent websites. These scam videos are disseminated through compromised accounts on major platforms, especially YouTube. The campaign's effectiveness leads to the accumulation of cryptocurrency in fraudulently obtained wallets.&nbsp;In Q2/2024, our telemetry identified three significant events related to this crypto scam. The first occurred on April 8, 2024, during the solar eclipse, when SpaceX's name was exploited. The second campaign was on June 6, 2024, during the SpaceX Starship integrated flight test (IFT-4). Within several days, nearly 50 YouTube accounts were hijacked, and we identified 500 transactions, amounting to a total value of $1.413 million, in this campaign. The last one was at the end of June 2024, when the Tesla band was abused in the crypto scam.&nbsp;The complete analysis can be <a href="https://decoded.avast.io/martinchlumecky1/cryptocore-unmasking-the-sophisticated-cryptocurrency-scam-operations/">found in our article</a>.&nbsp;

<h4>Dating Scams: Cyber Criminals Still Love Them&nbsp;</h4>Dating scams, also known as romance scams or online dating scams, involve fraudsters deceiving individuals into fake romantic relationships. Scammers adopt fake online identities to gain the victim's trust, with the ultimate goal of obtaining money or enough personal information to commit identity theft.&nbsp;The prevalence of Dating Scams has remained consistent, with no significant change in their occurrence or methodology in Q2/2024. Scammers continue to exploit emotional connections to deceive victims, employing tried and true tactics that have proven effective over time. This steadfast activity highlights the ongoing need for vigilance and education in recognizing and avoiding such deceptive practices.&nbsp;

The screenshot below shows a landing page that users reach after clicking on a push notification designed to lure them to join a fraudulent dating site. This page cleverly prompts visitors to sign up, exploiting their search for companionship with promises of easy connections and potential matches.&nbsp;&nbsp;Such pages often use engaging visuals and persuasive language to lower users' defenses and encourage registration, making it crucial to approach such sites with caution and skepticism.&nbsp;

Compared to Q1/2024, the highest increase of Dating Scam risk was seen in Japan (+51%). However, the top 10 countries at risk were all from Europe in Q2, led by Norway, Denmark, Poland, and Germany.&nbsp;<h4>Tech Support Scams: No Slowdown in Sight&nbsp;</h4>Tech support scam threats involve fraudsters posing as legitimate technical support representatives who attempt to gain remote access to victims' devices or obtain sensitive personal information, such as credit card or banking details. These scams rely on confidence tricks to gain victims' trust and often involve convincing them to pay for unnecessary services or purchase expensive gift cards. It's important for internet users to be vigilant and to verify the credentials of anyone claiming to offer technical support services.&nbsp;Tech Support Scams (TSS) have maintained their increased activity from the from Q1/2024 through a significant portion of Q2/2024. This activity, as the graph below indicates, started to decrease slightly towards the end of the quarter.&nbsp;

Japan, the United States, and Germany remain hot spots for this TSS Scam threats.&nbsp;

<h4>Refund and Invoice Scams: Persistent Presence&nbsp;</h4>Invoice scams involve fraudsters sending false bills or invoices for goods or services that were never ordered or received. Scammers rely on invoices looking legitimate, often using company logos or other branding to trick unsuspecting victims into making payments. These scams can be especially effective when targeted at businesses, as employees may assume that a colleague made the purchase or simply overlook the details of the invoice. It's important to carefully review all invoices and bills before making any payments and to verify the legitimacy of the sender if there are any suspicions of fraud.&nbsp;In Q2/2024, Invoice Scams have shown no sign of decreasing, even with the start of the summer holidays. Although the number of attacks has fluctuated slightly, the overall trend remains steady with no significant decline expected in the near future. However, a closer look at the data reveals notable changes on a country-by-country basis, with Australia and Greece experiencing the most significant quarter-on-quarter increases.&nbsp;

Overall, Australia, the United States, the Netherlands, the United Kingdom, and Canada were countries most at risk against fake Refund and Invoice Scams. Greece experienced a nearly 28% increase in the number of protected users, with Australia and Cyprus following at 24% and 17%, respectively. This signals a rise in targeted activity. Conversely, Vietnam saw the largest decrease, with a 66% decline, followed by Argentina and Egypt, both at 50%. What trends have emerged in these scams recently? Let’s examine a real-life example that could find its way into your inbox.&nbsp;

Among the numerous scams we've encountered recently is one specifically targeting a prominent antivirus company. The phishing email appears like the one shown below:&nbsp;

Here are five key red flags in the email that indicate it is likely a phishing attempt or scam:&nbsp;<ol><li>Suspicious Sender Domain: The email is sent from a domain that does not match the official product domain, instead using a questionable domain like adrenaline.xambassadors.com, which is unrelated to the company.&nbsp;</li><li>Urgent Time Pressure: The email creates a false sense of urgency, claiming your account will be deleted in "48 hours" if you don't take immediate action. This is a common tactic used in scams to pressure you into acting without thinking.&nbsp;</li><li>Poor Design and Layout: The email's design is simplistic and unprofessional, lacking the polish typically seen in legitimate company communications. The layout is awkward, with excessive use of red and bold text, which is often a hallmark of scam emails.&nbsp;</li><li>Weird Template and Content: The content and structure of the email, including phrases like "Restoration code" and odd formatting, don't align with how a legitimate antivirus company would communicate with its customers.&nbsp;</li><li>Unusual Font in the Subject Line: The subject line uses strange characters and symbols (e.g., "⚠️ Final Warning ⚠️"), which is not typical for professional emails. This is often done to grab attention but is a clear indicator of a potential scam.&nbsp;</li></ol>Now, let's explore where the rabbit hole leads. The prominent button you’re tempted to click, labeled "Activate Now" with the threat of account deletion, is a tactic to create urgency, which is entirely false. Clicking this button triggers a redirection chain, starting with the following URL. Other parameters, likely tailored based on your location and other factors, determine where you will end up.&nbsp; https://storage.googleapis[.]com/bazugza/SalXX0134.html#u8sf8ls.ETbnaSCDpu?xpxwrvtnegfg=raemsgaddlde1g3qefg004w3k002jit020330b04735080cxq&nbsp;Which will redirect you to:&nbsp;bonusmonster[.]co&nbsp;

This is the landing page you encounter if you are in the United States. The actors likely use redirection based on various factors, including your country of residence. The page bears no resemblance to the official product website, or anything related to the company. You will not obtain anything for free from this site. After conducting further investigation, we found that the domain is hosted on:&nbsp;172.67.137[.]213&nbsp;We were interested in finding out what other domains are hosted on this IP address and used VirusTotal to gain more insight into the nature of this server. Here’s what we discovered:&nbsp;

The IP address 172.67.137[.]213 is linked to several websites, including some flagged for malware like Gamehdlive[.]online, Bonusmonster[.]co, and Tv.mobiblogxx[.]com, with Bonusmonster[.]co specifically accessed through a scam email. While sites like Zieclam[.]com, Proxylite[.]com, and Gamerr[.]one seem to be clean, the high number of flagged sites indicates a significant risk of malicious activity associated with this IP address.&nbsp;The lesson here is clear: the threat of cyberattacks remains persistent, and staying vigilant is essential. Remember, legitimate companies will never demand immediate action with threats of losing your data or account. Always take your time when reviewing emails, carefully checking the sender's details and evaluating the overall legitimacy of the message. By maintaining this cautious approach, you can better protect yourself from phishing attempts and other online threats.&nbsp;<h4>Bank Phishing: A Growing Concern&nbsp;</h4>Phishing is a type of online scam where fraudsters attempt to obtain sensitive information including passwords or credit card details by posing as a trustworthy entity in an electronic communication, such as an email, text message, or instant message. The fraudulent message usually contains a link to a fake website that looks like the real one, where the victim is asked to enter their sensitive information.&nbsp;Similar to Dating Scams, the situation with <a href="https://us.norton.com/blog/online-scams/what-is-phishing">phishing threats</a> remains stable with a slight calming of activity before the end of Q2/2024.&nbsp;

One of the interesting things in the phishing category has been the growing number of new bank phishing sites. In our data, we see that not only are the most popular banks being targeted but there are more sites dedicated to lesser-known banks that were not targeted in the past. We also see increased amounts of new variants of the phishing kit.&nbsp;One notable incident from the start of the quarter involved a phishing campaign in the United States targeting Bank of America users. This operation aimed to deceive users into disclosing their personal banking information by mimicking official communications from the bank, a tactic that underscores the persistent risk in the financial sector.&nbsp;

These phishing campaigns typically show a short lifespan. According to our data, on its most successful days, this particular campaign targeting Bank of America users received high hundreds of hits per day, highlighting the possible effectiveness of these threats.&nbsp;Alexej Savcin, Malware Analyst Branislav Kramar, Malware Analyst Matej Krcma, Malware Analyst Martin Chlumecky, Malware Researcher David Jursa, Malware Researcher&nbsp;<h2>Mobile-Related Threats&nbsp;</h2>We observed several new strains of mobile malware in Q2/2024 with interesting new techniques being deployed in both delivery and functionality. Notably, a clicker adware has snuck onto the PlayStore, clicking on websites in the background and gathering fraudulent advertising revenue.&nbsp;&nbsp;In the world of bankers, a dormant PDF reader application on the PlayStore also came to life this quarter, turning into a TeaBot banker dropper and targeting Revolut accounts of its victims. A new banker called SoumniBot entered the fray, with several new obfuscation techniques and the ability to steal Korean bank certificates. An updated version of the Medusa banker used botnets in France, Spain and Italy to distribute its malicious payload, in some cases pretending to be the Avast Premium app.&nbsp;In the spyware category, we see more targeted campaigns, with XploitSpy utilising GitHub and PlayStore to target victims in India and Pakistan, stealing sensitive information. And finally, AridSpy has been seen targeting users in Egypt and Palestine with a heavily intrusive feature set capable of taking photos every hour and listening to surrounding audio.&nbsp;<h3>Web Threat Data within the Mobile Landscape</h3>Most blocked attacks on mobile devices in Q2/2024 were web-based, mirroring the previous quarter. Users are much more likely to encounter phishing websites, scams, malvertising and other web threats than ever before. These threats can come in a variety of formats such as private messages, SMS, and emails but also redirects on less reputable sites, unwanted pop ups and through other avenues.&nbsp;In contrast to these types of mobile scams, traditional on-device malware requires a more complex infection vector where the user must also install the malware. For proper functionality of most mobile malware, permissions need to be granted by the user first, which again lowers the chances of malicious activity being triggered.&nbsp;Hence, blocking web-threat based attacks is beneficial for the security of mobile devices, as malware actors often use them as an entry point to get the payload onto the mobile device of their victims. &nbsp;

<h3>Adware: Sneaky Clickers on the PlayStore&nbsp;&nbsp;</h3>Adware threats on mobile phones refer to applications that display intrusive out-of-context adverts to users with the intent of gathering fraudulent advertising revenue. This malicious functionality is often delayed until sometime after installation and coupled with stealthy features such as hiding the adware app icon to prevent removal. Adware mimics popular apps such as games, camera filters, and wallpaper apps, to name a few.&nbsp;With another quarter behind us, <a href="https://us.norton.com/blog/malware/adware">adware</a> retains its top place as on-device malware in the mobile threat ecosystem. Most prevalent for several years now, it is a threat that spreads through various forms of malvertising, third-party app stores and it occasionally manages to sneak onto the PlayStore. Once installed, it negatively affects the user experience by clogging the device with fullscreen adverts and raking in fraudulent advertising revenue.&nbsp;HiddenAds continue to be the adware with most reach in Q2/2024. As per their name, they hide their presence on the victim’s device once installed, then display intrusive full screen advertisements to the annoyance of their victims. MobiDash and FakeAdBlockers are the other prevalent strains that are often disguised as repacked popular games or paid applications but instead come with out of context adverts.&nbsp;

A new strain of <a href="https://news.drweb.com/show/?i=14860&amp;lng=en">Clicker adware</a> has made its way onto the PlayStore, disguised inside both a fitness and adult application. These apps contain two hidden modules, one which collects extensive information on the device and user, while the other simultaneously loads webpages in the background. Once the pages are loaded through a hidden WebView browser window, the Clicker injects JavaScript code downloaded from a C&amp;C so it can silence pages with videos or audio and look for advertisements to click on with the intent of gathering fraudulent advertising revenue. It is even able to take secret screenshots of the hidden webpages and determine clickable areas from these. It is curious that these advanced techniques were used to merely gather advertising revenue.&nbsp;We observe a downward trend in risk ratio of adware this quarter. All three of the most prevalent strains continue to see a decrease in risk ratio and protected users. We may see a slight increase in the next quarter if more adware slips onto the PlayStore.&nbsp;

Brazil, India and Argentina again have the most protected users quartering Q2/2024, as was the case last quarter. According to our telemetry, Egypt, Turkey and Yemen have the highest risk ratios, meaning users are most likely to encounter adware in these countries.&nbsp;

<h3>Bankers: Never-ending Evolution Continues&nbsp;</h3>Bankers are a sophisticated type of mobile malware that targets banking details, cryptocurrency wallets, and instant payments with the intent of extracting money. Generally distributed through phishing messages or fake websites, Bankers can take over a victim's device by abusing the accessibility service. Once installed and enabled, they often monitor 2FA SMS messages and may display fake bank overlays to steal login information.&nbsp;Mobile bankers continue to evolve and threat actors bring in new strains to extract money and sensitive information from victims this quarter. The TeaBot banker spreads through a dropper on the PlayStore, targeting Revolut accounts. A new contender, SoumniBot, targets Korean users with various advanced obfuscation techniques. BrokeWell is another new banker that spreads through fake Chrome update pages. Finally, we see an evolution of the Medusa banker with botnets in various countries.&nbsp;Our data shows that the RewardSteal banker takes first place this quarter, almost doubling its presence, mostly focusing on India. It is followed by Coper banker which also sees a big spike in prevalence with updates to its distribution methods. Of note is the MoqHao banker mentioned in the <a href="https://decoded.avast.io/threatresearch/avast-q1-2024-threat-report/">last report</a>, it has continued to increase its presence this quarter as well, targeting victims in Japan and Korea.&nbsp;

<a href="https://www.cleafy.com/cleafy-labs/a-stealthy-threat-uncovered-teabot-on-google-play-store">Teabot banker</a> makes a comeback with a dormant dropper going active on the PlayStore to deliver the malicious payload. Disguised as a PDF reader, the dropper went live in February with a sneaky update. It would first download an external DEX file and execute it, then perform various checks on the device to ensure it is not being emulated. It would only deliver the TeaBot payload to specific countries, such as Czech Republic, Slovakia, United Kingdom, Spain and surprisingly even Russia, which has been previously excluded by TeaBot. If it deemed the device viable, it would push a notification with a fake ‘PDF AI update available’ dialogue.

Once downloaded and installed, it would initiate device takeover through the accessibility service to extract banking details and steal money from victims. Interestingly, the banker specifically focuses on the Revolut app, querying the victim’s balance and information for further nefarious activity.&nbsp;

CryptoCore Scam Stealing Millions via AI Deepfakes on YouTube, Rising Identity Theft, 24% Spike in Ransomware, and 46% More Blocked Attacks Year Over Year

Gen Q2/2024 Threat Report

<h3>Foreword</h3>Welcome to the new edition of our report. As we bid farewell to the year 2023, let’s briefly revisit the threat landscape that defined the past year. In 2023, the overall number of unique blocked attacks surged, reaching an unprecedented milestone of more than 10 billion attacks and a remarkable 49% increase year-over-year. This staggering figure, once considered unimaginable, now reflects the harsh reality of our digital landscape. The intensity of these attacks peaked in the final quarter, with a 17% quarter-on-quarter increase, and a monthly average exceeding 1.2 billion attacks.

Q4/2023 was an exceptionally eventful period marked by a myriad of cyber threat developments. Our featured story navigates the intricate PDF threat landscape, unveiling the surge in digital document deception. Threat actors capitalized on PDF files, weaving a complex web of attacks ranging from dating scams and phishing attempts to sophisticated password stealers exemplified by AgentTesla.In a notable turn of events, this quarter marked the (predicted by many) reappearance of Qakbot, previously dismantled by the FBI. Despite law enforcement efforts, Qakbot resurfaced in December, revealing intriguing overlaps in distribution with Pikabot. Additionally, the sextortion bot Twizt expanded its repertoire by incorporating brute forcing of VNC endpoints.In a quarter filled with significant developments, a noteworthy trend emerged in the realm of info-stealers. While these threats experienced a slight uptick, what sets this period apart is theinventive abuse of the Google OAuth API for recovering authentication cookies by Lumma, Rhadamanthys, and other stealers. This novel approach significantly amplifies the impact of their malicious activities.While there was an overall decline in coinminers, a staggering 250% quarter-on-quarter surge in malicious coinmining in the USA, propelled by the widespread dissemination of XMRig, stood out. Furthermore, adware on desktop maintained a heightened activity level, employing new tricks such as swift DNS record switches for ad servers.We also observed a subtle uptick in ransomware attacks, featuring prominent groups like LockBit and ALPHV/BlackCat in the headlines. Meanwhile, law enforcement and cybersecurity entities counteracted, exemplified by the release of free decryption tools for Babuk-Tortilla and BlackCat.Notably, a year after the takedown of the NetWire RAT, its eradication was affirmed. However, it was swiftly replaced by prominent RATs, but also new ones such as zgRAT, Krasue, or SugarGh0st.Web threats continued to dominate, with scams, phishing, and malvertising ranking as the top threat types overall. The use of malicious browser push notifications escalated, becoming a preferred tool for scammers across various domains, from adult content sites to technical support scams, and financial frauds. Deepfake videos, especially those endorsing investment scams, displayed a heightened level of sophistication, challenging the ability to distinguish between real and fabricated content. Dating and romance scams, affecting approximately one in 20 of our users every month, showcased a global reach, expanding beyond western countries to target the Arab states and Asia. With Valentine’s Day approaching, an upward trend in these scams is anticipated. Furthermore, the conclusion of the year saw a surge in fake e-shops masquerading as renowned brands, leading unsuspecting victims into phishing traps.Furthermore, the mobile threat landscape continued to evolve, witnessing the resurgence of the Chameleon banker and the insidious spread of SpyLoans on the PlayStore, posing serious threats, including physical violence blackmail.Finally, as we venture into 2024, we anticipate a dynamic year ahead. Our team has ventured into the realm of predictions for 2024, foreseeing the evolving trends in cyber threats. While we hope our predictions do not come to fruition, and the digital space becomes safer than the close of 2023, your safety remains our top priority. Thank you for your trust in Avast. Enjoy the rest of the report.Jakub Křoustek, Malware Research Director<h3>Methodology</h3>This report is structured into two main sections: Desktop-related threats, where we describe our intelligence around attacks targeting the Windows, Linux, and Mac operating systems, with a specific emphasis on web-related threats, and Mobile-related threats, where we describe the attacks focusing on Android and iOS operating systems.We use the term “risk ratio” in this report to denote the severity of specific threats. It is calculated as a monthly average of “Number of attacked users / Number of active users in a given country.” Unless stated otherwise, calculated risks are only available for countries with more than 10,000 active users per month.A blocked attack is defined as a unique combination of the protected user and a blocked threat identifier within the specified time frame.<h3>Featured Story: The PDF Threat Landscape</h3>In recent times, the cybersecurity landscape has seen a surge in sophisticated malware attacks, with cybercriminals exploiting various vectors to compromise systems and networks. One particularly concerning trend has been the expansion of malware threats through PDF files, a widely used format for document sharing and collaboration.PDF files have long been a favored medium for sharing documents due to their platform-agnostic nature and consistent formatting across different devices and operating systems. However, this ubiquity has made them an attractive vector for cybercriminals seeking to deliver malware discreetly. Furthermore, PDF attachments are often allowed by default by spam gateways, adding another layer of vulnerability. What’s more, PDF files can be seamlessly opened on both PCs and mobile devices, making them the ultimate delivery payload, further amplifying their appeal as a method for delivering malicious payloads (for example embedding a malicious Word file into a PDF file). Additionally, attackers have begun using bogus URLs, often disguising them through services like the sLinks link shortener, in an effort to bypass antivirus scanners and heighten their chances of successful deployment.Social engineering is always present in the work of cyberthreats, and we can analyze the typical behaviors used to fool users. One common example is a message that supposedly come from a known company, such as Amazon or some financial entity, with a clearly defined message, such as:<ol><li>Your account has been blocked.</li><li>You are given the means to unblock it.</li><li>If you don’t do it in 24 hours, you’ll lose access to your account forever.</li></ol>The sense of urgency is key in most scams, encouraging victims to act fast and not think twice about the situation. Some other scams are more subtle. The below example poses as Netflix, describing problems with your payment. The simple message – utilizing Netflix branding – indicates an issue with your payment and asks you to update your details:

Once you click the link, you are brought through the steps to enter your financial information, which is then taken by the malicious actors.Another common scam is the good old lottery scam. In this scam, you’ve been awarded with some lottery prize (without even participating, how lucky!) and you are asked to send some personal details to receive the money. Of course, if you contact the scammers, they will ask you for some money in advance to pay the transfer fees.Many types of attacks are suitable in PDF format – we have even seen dating scams, because… why not? But PDF-based attacks can also include malware, where the final payload will infect your device, as shown in the following example:

In recent malware campaigns, we have observed a spectrum of threats and scams, ranging from simple ones like lottery and dating scams, through phishing PDFs containing deceptiveinformation and a link to a phishing page, to complex campaigns delivering more sophisticated threats in JavaScript or embedded objects, culminating in strains such as AgentTesla, DarkGate, GuLoader, IcedID, RemcosRat, Ursnif, Qakbot or various APT groups. We have blocked more than 10 million PDF-based attacks, protecting more than 4 million users worldwide:

The proliferation of PDF-based cyber threats underscores a significant shift in the tactics of cybercriminals. These attacks, ranging from simple scams to complex malware deliveries, demonstrate the adaptability and cunning of attackers in exploiting trusted digital mediums. PDF files, due to their ubiquity and inherent trust, have become a prime vector for a variety of malicious activities. This trend not only reflects the innovative methods of cybercriminals but also highlights the vulnerabilities inherent in everyday digital interactions.The examples provided reveal a common thread: the exploitation of human psychology. The sense of urgency, the promise of rewards, and the fear of loss are leveraged to manipulate victims. Moreover, the transition from simple deception to sophisticated malware payloads like AgentTesla, DarkGate, and others, indicates a disturbing escalation in the severity of these threats.Our analysis shows that, despite the diversity of these attacks, they share a reliance on social engineering and the exploitation of trusted channels. As we have successfully blocked a sizeable number of these attacks, it’s clear that robust cybersecurity measures can be highly effective. However, the battle is not solely technological. Education and awareness play a crucial role. Users must be vigilant, question the authenticity of unsolicited communications, and be aware of the signs of phishing and scams.Luis Corrons, Security Evangelist Branislav Kramár,&nbsp;Malware Analyst<h2>Desktop-Related Threats</h2><h3>Advanced Persistent Threats (APTs)</h3>An Advanced Persistent Threat (APT) is a type of cyberattack that is conducted by highly skilled and determined hackers who have the resources and expertise to penetrate a target’s network and maintain a long-term presence undetected.The final quarter of 2023 has been marked by a series of sophisticated cyberattacks, underlining the persistent and evolving threats posed by Advanced Persistent Threat (APT) groups worldwide. These threat actors have demonstrated their capability and intent to target governmental and military entities, employing a range of techniques from spear-phishing to complex malware.<h6>Spyware Campaign Against Government Entities in the Philippines</h6>In the Philippines, government entities became the focus of a spyware campaign in Q4 2023. This operation utilized an infection chain that incorporated various techniques including spyware, PowerShell and .NET stealers, and spear-phishing as an infection vector. The complexity of this campaign was notable, with each stage employing different methods to infiltrate, monitor, and extract sensitive information from targeted systems. This demonstrates a high level of sophistication and resource investment.<h6>MustangPanda’s Diverse Geographic Targets</h6>MustangPanda, a well-known APT group, extended its operations across several countries, including Vietnam, Australia, the Philippines, Myanmar, and Taiwan. Their operations are marked using the well-known Korplug malware, demonstrating their preference for proven and effective tools in their cyber arsenal. Additionally, this group has been observed utilizing malware written in the Nim programming language. A key technique in their arsenal is the frequent use of sideloading, a method where they load malware by exploiting legitimate software processes.<h6>Attacks on the Pakistani Military</h6>Pakistan’s military was the target of multiple APT groups including groups like Donot and Bitter, signifying the critical importance of military institutions as high-value targets in cyberspace. The attackers employed a combination of spear-phishing as an infection vector, LNK files, and custom backdoors. These attacks underscore the need for heightened cybersecurity measures within military networks, given their attractiveness to a wide range of threat actors.<h6>Lebanese Government Entities Under Siege</h6>The Lebanese government also faced cyber threats, with a threat actor employing a similar range of techniques seen in other attacks, including spear-phishing, LNK files. The infection chain in these attacks was complex, starting with LNK files and moving through various stages including VBScript, BAT files, AutoIT scripts, and eventually leading to the deployment of a custom backdoor. This layered approach to infiltration reflects a strategic methodology designed to evade detection at multiple points, illustrating the lengths to which attackers are willing to go to maintain persistence and control within a targeted network.<h6>Gamaredon’s Aggressive Cyber Campaign in Ukraine</h6>Ukraine has been the target of Gamaredon group’s prolonged and aggressive cyber campaign, marked by a range of intrusive techniques. Their approach includes spear-phishing to gain initial access, followed by the deployment of obfuscated VBScripts and PowerShell scripts, complicating detection efforts. They also use document stealers to illicitly gather sensitive data. Uniquely, the group employs Telegram for disseminating Command and Control (CnC) IPs, a tactic aimed at evading traditional communication surveillance. Further, they spread malware through infected documents and LNK files. In their operations, they also utilize DNS services to acquire IP addresses directly, a technique intended to reduce detection by avoiding the use of domain names. This campaign has resulted in numerous victims, demonstrating Gamaredon’s persistent threat to Ukrainian cybersecurity.<h6>Lazarus</h6>In this quarter, we were monitoring increased activity from the Lazarus group. From our telemetry, it was evident that they continued to utilize ISO files combined with LNK files as an initialization loader for delivering payloads into systems.In early October, Microsoft observed Lazarus exploiting CVE-2023-42793, a remote-code execution vulnerability impacting various versions of JetBrains, to deploy payloads. Following a successful compromise, they utilized PowerShell to download two payloads from legitimate infrastructure.We also identified the same toolset being employed to our customers, predominantly those located in Europe.In December, Cisco Talos reported on a new campaign by Lazarus. In this instance, they were employing a new Dlang-based malware, featuring two Remote Access Trojans (RATs). One of these RATs utilized Telegram bots and channels as a means of communication with the Command-and-Control servers.This campaign targeted enterprises globally, focusing on those publicly hosting and exposing vulnerable infrastructure to n-day vulnerabilities such as CVE-2021-44228 (Log4j). The sectors primarily under attack included manufacturing, agriculture, and physical security companies.Luigino Camastra, Malware Researcher Igor Morgenstern, Malware Researcher<h3>Adware</h3>Adware is considered unwanted if installed without the user’s consent, tracks browsing behavior, redirects web traffic, or collects personal information for malicious purposes such as identity theft.The rise in popularity of adware can be attributed to its potential for monetization and the dissemination of potentially unwanted programs (PUP) and malware. Moreover, advertisements promoting legal software also employ deceptive adware practices, which verge on the boundaries of scam-like activities. We classify these techniques as annoying and protect our users against this approach. While spreading malware through adware is not the predominant method for infecting victims’ machines overall, our attention in Q4/2023 has been directed toward detecting adware to monitor this potential threat closely.Adware actors exhibit high flexibility, continuously adjusting their techniques to evade antivirus detection. As a result, it becomes imperative to remain dynamic and consistently adapt to the evolving strategies employed by these actors. The below graph illustrates adware blocks over Q3 and Q4 of 2023. These blocks consist of a diverse array of techniques we actively block and respond to effectively counter the evolving threat of adware – the ongoing cat-and-mouse game.

The global risk ratio of adware in Q4 2023 was similar to the previous quartile. Nevertheless, the prevalence of desktop adware remains significantly elevated. The most affected regions remain South America, Africa, Southeast Asia, and Southeast Europe, as the map below illustrates

<h6>Adware Share</h6>One of the more sophisticated adware techniques is switching DNS records for ad servers characterized by remarkably short TTL. Therefore, it is impossible to pinpoint the precise strain of adware. The most prevalent DNS records of ad servers in Q4/2023:<ul><li>agriculturalpraise[.]com</li><li>formationwallet[.]com</li><li>plundertentative[.]com</li><li>supportedbushesimpenetrable[.]com</li><li>nutsmargaret[.]com</li><li>facilitypestilent[.]com</li><li>suchbasementdarn[.]com</li><li>usetalentedpunk[.]com</li></ul>Consequently, a substantial percentage, 54% of adware strains, falls under the category of unknowns. The remaining shares are distributed among other adware strains in the following manner:<ul><li>SocialBar (38%)</li><li>DealPly (2%)</li><li>Neoreklami (1%)</li></ul>Martin Chlumecký,&nbsp;Malware Researcher<h3>Bots</h3>Bots are threats mainly interested in securing long-term access to devices with the aim of utilizing their resources, be it remote control, spam distribution, or denial-of-service (DoS) attacks.In comparison to the previous quarters, this quarter was roller-coaster with many changes in the landscape. The dust hadn’t even settled on Qakbot’s former infrastructure following its FBI takedown in August 2023 before we witnessed its resurgence in December. The number of our users that have been targeted by Qakbot has doubled in Q4 2023 compared to the previous quarter. While this seems to be a significant increase, it is still dwarfed by its activity before the takedown. Its binaries also went through some overhaul, embracing 64-bit architecture and relying on AES instead of XOR for string encryption. Interestingly, a rather new strain Pikabot exhibited overlaps in distribution related TTPs (thread hijacking and second-stage retrieval) with Qakbot and it was, incidentally, also gaining traction in the landscape, doubling the number of affected users compared to the previous quarter.Phorpiex’s successor, dubbed Twizt, expanded on its payloads this quarter. Aside from spam/sextortion payloads, we’ve seen previously unseen payloads that have featured code for brute-forcing credentials to VNC (remote desktop sharing protocol) endpoints in both local network and randomly generated IP address for potential publicly accessible endpoints.The overall risk ratio of bots increased at the end of 2023, partially fueled by Qakbot’s resurgence in December. As for other notable changes in the strain prevalence, we’ve seen a huge drop (-48%) in Amadey infections and a steady increase in Emotet (+14%) and Twizt (+27%) infections.

The last mention of bots goes to NoName056(16) and their DDosia project, which had a rather turbulent quarter. Presumably to hinder tracking attempts by malware researchers, the group has reworked their configuration distribution protocol, including its client authentication. Nevertheless, the first implementation was unstable and ridden with software bugs for both server and client implementations. This has dramatically reduced the project’s efficacy in the short term until these blocking issues were resolved. Shortly after the deployment, the authentication protocol was simplified, and the encryption mechanism was changed shortly due to reported problems with client-attribution statistics. These resulted in reduced rewards for the project’s participants.

As for their general operations, there were not many changes. Attacks on various European and Ukrainian banks were attempted throughout the whole quarter. While the first wave of attacks was met with some success, successive attacks rarely succeeded despite the group’s claims on their Telegram channel. The choice of targets still follows the usual modus operandi, meaning that new configurations were usually spurred by various politicians’ statements directed against Russia and their invasion of Ukraine. Unfortunately, the trend reversal in the number of DDosia project participants still holds with the number of participants linearly increasing throughout the quarter to a little over 16,000 participants. This quarter, the most affected TLDs were .cz, .de, and .fr, each having more than 10% of targeted domains.

Adolf Středa, Malware Researcher Martin Chlumecký,&nbsp;Malware Researcher<h3>Coinminers</h3>Coinminers are programs that use a device’s hardware resources to verify cryptocurrency transactions and earn cryptocurrency as compensation. However, in the world of malware, coinminers silently hijack a victim’s computer resources to generate cryptocurrency for an attacker. Regardless of whether a coinminer is legitimate or malware, it’s important to follow our <a href="https://support.avast.com/en-eu/article/Threat-Lab-cryptomining-behavior-guideline/">guidelines</a>.When compared to the previous quarter, we observed another decrease in the prevalence of coinminers in Q4/2023, with the risk ratio dropping by 14%. However, even though it is a rather significant drop, we note that it doesn’t mean coinminers are a lesser threat, unfortunately. This is because we also observed rather significant shift in the market share with a decline in web miners giving way to an extensive rise of XMRig and other executable coinminers which are, in general, more dangerous forms of coinmining.Geographically, we also observed a shift during Q4/2023 where the attacks were more prevalent in specific countries, lowering the global spread with relations to risk ratio.

First and foremost, we measured two huge increases in risk ratio in United States and Turkey by almost 250% and 200%, respectively. We measure another more significant surge in Hungary, Poland, India, and Egypt were the risk ratio increased by 85%, 52%, 50%, and 40%, respectively. On the other hand, users in France and Belgium were less prone to getting infected with coinminers the risk ratio decreased by 80% and 78%, respectively.In the graph below, we can observe the numbers skyrocket with regards to risk ratio of getting a coinminers in the United States.

As we mentioned before, this quarter shifted more towards traditional executable coinmining instead of web miners. This resulted in XMRig having a significant dominance of a total 64% malware share with a huge 169% increase this quarter. Web miners lost their malware share by 68%, holding a malware share of 19% which is a long-time lowest.In general, we denote this as a more dangerous threat opposed to the web miners since XMRig and other executable strains usually run on the background of the whole system, not only on the visited webpage. Furthermore, coinminers tend to be bundled with other malware types as well, meaning the scope of the infection might be even bigger in these cases.The most common coinminers with their malware share in Q4/2023 were:<ul><li>XMRig (63.69%)</li><li>Web miners (19.20%)</li><li>CoinBitMiner (2.14%)</li><li>SilentCryptoMiner (2.04%)</li><li>FakeKMSminer (1.47%)</li><li>NeoScrypt (1.20%)</li><li>CoinHelper (0.86%)</li></ul>Jan Rubín, Malware Researcher<h3>Information Stealers</h3>Information stealers are dedicated to stealing anything of value from the victim’s device. Typically, they focus on stored credentials, cryptocurrencies, browser sessions/cookies, browser passwords and private documents.Q4/2023 brought a new and interesting stealing capability which was rapidly adapted by information stealers – abusing Google OAuth endpoint for recovering authentication cookies. <a href="https://www.linkedin.com/posts/alon-gal-utb_an-upcoming-update-to-lumma-infostealer-is-activity-7128433924380213248-hcEG/">Lumma</a> for example, a rapidly rising malware-as-a-service (MaaS) stealer, was supposedly the first to advertise and adapt the technique.

Many big information stealer groups, including MaaS players, have already jumped on this new threat. This includes (but is not limited to) Rhadamanthys, Stealc, Meduza, and MetaStealer.The technique is abusing a Google OAuth “MultiLogin” API endpoint. This endpoint is used for synchronizing accounts across Google services. When the malware decrypts a session token and Gaia ID from the local browser files on the infected device, it is further able to perform a request to the “MultiLogin” API endpoint, recovering the authentication cookie. Note that when this “token and ID” pair is exfiltrated rather than directly used from the victim’s system, the malware authors may use this information on backends instead, trying to avoid AV and EDR monitoring.Currently, the mitigation is rather limited. According to <a href="https://www.cloudsek.com/blog/compromising-google-accounts-malwares-exploiting-undocumented-oauth2-functionality-for-session-hijacking">CloudSEK</a> researchers, the authentication cookie survives even a (sole) reset of the user’s password. <a href="https://twitter.com/e11i0t_/status/1740791905112490061">In fact</a>, if a user was affected, they need to firstly log out of their Google account to revoke the synchronization OAuth cookie (or sign-out from/kill all active sessions: <a href="http://g.co/mydevices">http://g.co/mydevices</a>), change the password, and log back in.Unfortunately, these are all reactive steps in a sense that the user needs to know that they were affected. The problem is further underlined by the fact that <a href="https://www.bleepingcomputer.com/news/security/google-malware-abusing-api-is-standard-token-theft-not-an-api-issue/">Google currently doesn’t plan</a> to rework the “MultiLogin” endpoint, or mitigate the API abuse by proactive means.<h6>DNS-based threats</h6>The Domain Name System (DNS) is a decentralized naming system that translates user-friendly domain names into numerical IP addresses for network devices to identify each other. However, this system is now becoming popular for carrying out attacks. Usually, threat actors misuse DNS for these reasons:<ul><li>The malware can receive commands and instructions, enabling two-way communication</li><li>The threat actor can deploy an additional payload onto the infected device</li><li>Information stealers can exfiltrate sensitive data from the infected device</li><li>The communication is more obfuscated, rendering it more difficult to track properly</li><li>The communication is usually enabled by default, since the traffic operates on a common port 53</li><li>The traffic may bypass traditional AVs and gateways due to the possible lack of monitoring and scanning</li></ul>Attackers can use many techniques to achieve this, for example performing DNS tunneling, DNS cache poisoning, DNS fast fluxing, or using rogue/malicious DNS servers, to name a few.We see threat actors adapting DNS-based techniques already, including notorious malware strains. This includes information stealers like <a href="https://decoded.avast.io/janrubin/vipersoftx-hiding-in-system-logs-and-spreading-venomsoftx/">ViperSoftX</a> or <a href="https://decoded.avast.io/janrubin/meh-2-2/">DarkGate</a> (also known as Meh) for more obfuscated payload delivery, multi-modular backdoor <a href="https://decoded.avast.io/martinchlumecky/dirtymoe-1/">DirtyMoe</a> for obfuscated communication, or <a href="https://decoded.avast.io/danielbenes/crackonosh-a-new-malware-distributed-in-cracked-software/">Crackonosh</a> for its update routine.For further information about DNS-based threats and how we protect our users against them, read our dedicated <a href="https://decoded.avast.io/threatintel/opening-a-new-front-against-dns-based-threats/">blog post on Decoded</a>.<h6>Statistics</h6>In Q4/2023, we observed a 6% increase in information stealer activity in comparison with the previous quarter. This increase is mostly due to&nbsp; the rise of Lumma stealer as well as Stealc and by an increase in activity of various online JavaScript scrapers.

The highest risk of information stealer infections currently exists in:<ul><li>Turkey (3.01%) with 46% Q/Q increase</li><li>Pakistan (2.32%) with 6% Q/Q decrease</li><li>Egypt (1.98%) with 3% Q/Q increase</li></ul>Thankfully, we observed a significant 12% decrease of information stealers’ activity in the United States.

Unsurprisingly, AgentTesla still holds its place&nbsp; as the most popular information stealer, capturing 26% of the global information stealers market share. However, this malware share is lower when compared to the previous quarter due to the 11% decrease. Formbook also experienced a decrease in market share by 10%, having 10% market share now. Unfortunately, various JavaScript scrapers/exfilware were also far more active this quarter, marking 6.08% market share now.According to our data, Raccoon stealer had another rough couple of months, losing its market share by additional 21%, for a current total of 1.54% market share.The most common information stealers with their malware shares in Q4/2023 were:<ul><li>AgentTesla (26%)</li><li>FormBook (10%)</li><li>Fareit (6%)</li><li>RedLine (4%)</li><li>Lokibot (3%)</li><li>Lumma (3%)</li><li>Stealc (2%)</li><li>OutSteel (2%)</li><li>ViperSoftX (2%)</li><li>Raccoon (2%)</li></ul>Jan Rubín, Malware Researcher<h3>Ransomware&nbsp;</h3>Ransomware is any type of extorting malware. The most common subtype is the one that encrypts documents, photos, videos, databases, and other files on the victim’s PC. Those files become unusable without decrypting them first. To decrypt the files, attackers demand money, “ransom”, hence the term ransomware.Hacks, breaches, stolen data. Almost every day, <a href="https://www.bleepingcomputer.com/tag/ransomware/">we can read about a new data breach</a> or data extortion campaign from one of the many ransomware gangs. The intensity and frequency are stunning; for example, the LockBit data leak site showed 65 new attacked companies in 15 days (from Oct 23 to Nov 7, 2023). That is more than 4 new companies attacked each day!

As of the time of writing this article, the site lists 217 companies that were allegedly attacked, which makes LockBit the most active ransomware gang worldwide.However, law enforcement organizations do not sleep either. In a joint operation, the Dutch Police and Cisco Talos recovered a <a href="https://blog.talosintelligence.com/decryptor-babuk-tortilla/">decryption tool</a> of the Babuk ransomware used in the <a href="https://twitter.com/VirITeXplorer/status/1448689555083780101">Tortilla malicious campaign</a>. Avast added the recovered private key into its Babuk decryptor, which is now <a href="https://decoded.avast.io/threatresearch/avast-updates-babuk-ransomware-decryptor-in-cooperation-with-cisco-talos-and-dutch-police/">available for download</a>.Furthermore, several ransomware operations were disrupted in the previous quarter, such as BlackCat / ALPHV, which is the world’s second most active gang.On Dec 7, 2023, <a href="https://twitter.com/malwrhunterteam/status/1732705297452405033">information</a> appeared that BlackCat’s leak site is down. Even though BlackCat operators looked like they were repairing the site, one day later, it appeared that the FBI was <a href="https://twitter.com/evangeorgevoug/status/1733016196717629571">behind the outage</a> of the data site:

Ten days later, the Department of Justice officially confirmed that the <a href="https://www.justice.gov/opa/pr/justice-department-disrupts-prolific-alphvblackcat-ransomware-variant">ransomware gang operation was disrupted</a>, and the site was seized. The leak site now shows information about successful law enforcement operation done by the FBI:

Good employees are a scarce resource; that applies to the dark side employers as well. Hence, as soon as the rumors about BlackCat began, LockBit operators <a href="https://twitter.com/g0njxa/status/1734510597201404361">started to recruit</a> the members of the BlackCat gang.The disruption operation did not stop BlackCat, however. New organizations have been attacked by the gang already <a href="https://twitter.com/CyberNews/status/1744716905632477222">in 2024</a>.<h6>Statistics</h6>The following stats show the most prevalent ransomware strains among our userbase. Percentages show the malware share of each strain:<ul><li>STOP (17%)</li><li>WannaCry (16%)</li><li>Enigma (9%)</li><li>TargetCompany (4%)</li><li>Cryptonite (2%)</li><li>LockBit (1%)</li></ul>This quarter, Enigma is the highest jumper, going up from 1% to over 9%. The complete world map with risk ratios is as follows:

Since the previous quarter, the risk ratio in our user base shows a slight increase:

Ladislav Zezula, Malware Researcher Jakub Křoustek, Malware Research Director<h3>Remote Access Trojans (RATs)&nbsp;</h3>A Remote Access Trojan (RAT) is a type of malicious software that allows unauthorized individuals to gain remote control over a victim’s computer or device. RATs are typically spread through social engineering techniques, such as phishing emails or infected file downloads. Once installed, RATs grant the attacker complete access to the victim’s device, enabling them to execute various malicious activities, such as spying, data theft, remote surveillance, and even taking control of the victim’s webcam and microphone.Things in the realm of remote access trojans did not change much in Q4/2023. Regarding the daily activity of RATs, the statistics show a slightly decreasing trend when compared to Q3/2023 but this might be due to the holiday season when targeted users and RAT operators alike enjoy the time off.An exciting event this year was the takedown of NetWire RAT at the beginning in Q1/2023. Let us look at what effect this takedown had on one of the bigger players at that time. Before the takedown in Q4/2022, NetWire RAT was number 7 on the most prevalent list, taking up over 4% of the malware share among RATs. In Q1/2023 its malware share went down to 3%. The takedown happened at the beginning of March, so it has not yet resulted in much impact. In Q2/2023 the share dropped further to 1.2%, and in the second half of 2023 the malware share stayed at 1% rendering NetWire RAT nearly irrelevant. We do not expect this strain to return to its earlier status.

According to our data, Remcos seems to be the deciding factor in the risk ratio of each country while other strains have much smaller effects. The only exceptions are countries where HWorm is spread which is mainly the Middle East and Afghanistan, Pakistan, and India. As usual, the highest values of risk ratio are in Afghanistan, Iraq and Yemen and the factors are the activity of HWorm and to a far lesser extent the activity of njRAT. The largest increase in risk ratio in this quarter was seen in Romania (78%, Remcos and QuasarRAT), Lithuania (49%, Remcos, njRAT and Warzone) and Czechia (46%, Remcos and njRAT). North Macedonia, Uruguay and Portugal are countries with the largest decrease in risk ratio by -50% and it correlates to decreased activity of Remcos.

We have <a href="https://x.com/AvastThreatLabs/status/1722195788758220824">tweeted</a> about one of the Remcos campaigns tricking users into installing fake Adobe Reader updates. Remcos was very active in October and then somewhat slowed down in November and December. We have also published a <a href="https://x.com/AvastThreatLabs/status/1722953843208577257">tweet</a> about another campaign using fake updates, this time pushing zgRAT, which according to our data is not very spread otherwise.AsyncRat, currently number 4 on the top prevalent list, has increased its malware share by 30%. There are also two strains which more than doubled their malware share. One of these is XWorm, which has entered the top 10 list in this quarter. The other is SectopRAT which isn’t as prevalent, however there are reports of it working together with the Lumma password stealer.The most prevalent remote access trojan strains in our userbase:<ul><li>HWorm</li><li>Remcos</li><li>njRAT</li><li>AsyncRat</li><li>QuasarRAT</li><li>Warzone</li><li>FlawedAmmyy</li><li>NanoCore</li><li>Gh0stCringe</li><li>XWorm</li></ul>The discovery of Krasue was probably the most frequent news topic in December. Krasue is a new Linux RAT discovered by <a href="https://www.group-ib.com/blog/krasue-rat/">Group-IB</a>. According to their report, this threat has been active since at least 2021 targeting organizations in Thailand. The malware holds a rootkit to hide its presence on a system, more specifically it contains 7 precompiled versions for various kernels. Another interesting feature is the use of the RTSP (Real Time Streaming Protocol) for C2 communication which is not very common.

The <a href="https://blog.talosintelligence.com/new-sugargh0st-rat/">Cisco Talos</a> team recently spotted a new customized variant of Gh0st RAT. They call this variant SugarGh0st. Gh0st RAT is an old RAT with code publicly released in 2008 and over the years it has been frequently used by Chinese-speaking actors. Talos argues that a Chinese-speaking group might be running the current campaign as well although with low confidence. Among the added features compared to the original Gh0st RAT is looking for specific ODBC (Open Database Connectivity) registry keys, loading library files and changes made to evade earlier detections as well as slight modification of the C2 communication protocol. This is interesting evidence that although there are frequent reports of new RATs, the old and reliable are here to stay.Two more strains were reported by CYFIRMA namely the <a href="https://www.cyfirma.com/outofband/unveiling-a-new-threat-the-millenium-rat/">Millenium RAT</a> and the <a href="https://www.cyfirma.com/outofband/a-gamer-turned-malware-developer-diving-into-silverrat-and-its-syrian-roots/">SilverRAT</a>. The Millenium RAT briefly appeared for sale on GitHub. It is interesting to note that the release on GitHub specified version 2.4 and version 2.5 followed shortly after. We were not able to find any reports or clues towards earlier versions. This might mean that 2.4 was the first version to go public or that it has been flying under the radar until now. CYFIRMA researchers said that this RAT is probably a derivative of the ToxicEye RAT. Regarding its features, it has the full package expected in a commodity RAT including keylogging, stealing sensitive data, and running commands.SilverRAT seems to be a continuation of the S500 RAT since according to CYFIRMA it was developed by the same authors. This RAT is not new, it was first shared in 2022, but in Q4/2023 a cracked source code was leaked.Ondřej Mokoš, Malware Researcher<h3>Rootkits</h3>Rootkits are malicious software specifically designed to gain unauthorized access to a system and obtain high-level privileges. Rootkits can operate at the kernel layer of a system, which grants them deep access and control including the ability to modify critical kernel structures. This could enable other malware to manipulate system behavior and evade detection.The year-long analysis of rootkit activities reveals a persistent stagnation with a subtle descending trend. A minor peak was found in half of Q4/2024, although its significance is minimal.

Notably, China constantly keeps its prominent position as a leader in rootkit activities.&nbsp;

Despite a consistent overall trend, an expansion in affected states is seen, particularly in Europe and Russian regions. Furthermore, a noteworthy occurrence in the Russian territory during the middle of the third quarter extended into the fourth quarter.

For several years, the dominant rootkit in the wild has been R77, a trend supported by comprehensive data displayed in a graph illustrating the prevalence of all rootkits, with a specific focus on R77.

Projections indicate that R77 will continue to be the most widespread rootkit soon. Its popularity stems from its uncomplicated implementation, operating on a user layer and offering fundamental functions akin to a classic rootkit in layer 0, consequently mitigating the risk of frequent Blue Screen of Death (BSOD) occurrences.Additionally, approximately 20% of rootkits are standard tools, often utilized as support tools for other malware:<ul><li>R77Rootkit (48%)</li><li>Pucmeloun (7%)</li><li>Alureon (5%)</li><li>Bootkor (3%)</li><li>Perkesh (3%)</li><li>Cerbu (2%)</li></ul>In terms of Linux kernel rootkits, we continue tracking the cyberweapons of APT groups. For instance, we efficiently detected <a href="https://www.virustotal.com/gui/file/ccb32eef05aa570be137c6eb597776f6242010c181eb2eb4b7f1ccd7b10ad379">new samples</a> of Mélofée Linux kernel rootkit used by Chinese APT groups.We want to highlight that we observed similar TTPs in other samples (e.g. <a href="https://www.virustotal.com/gui/file/990d33391f88ca19207c0a780ddf12c2fff72bc43d5a0a01baceb39172637112">Diamorphine kernel rootkit variant</a>) implementing simple functionality (hiding the module and the directories with the malicious content) with its hooks based on KProbes (notice that <a href="https://github.com/milabs/khook/blob/master/khook/internal.h%22%20%5Cl%20%22L12">KHook relies in KProbes</a>), compiled in Amazon Linux distributions and impersonating popular hardware manufacturer modules (e.g. Intel and Realtek).We will continue tracking lightweight Linux kernel rootkits used by APT groups in the next quarter.Martin Chlumecký, Malware Researcher David Álvarez, Malware Analyst<h3>Vulnerabilities and Exploits</h3>Exploits take advantage of flaws in legitimate software to perform actions that should not be allowed. They are typically categorized into remote code execution (RCE) exploits, which allow attackers to infect another machine, and local privilege escalation (LPE) exploits, which allow attackers to take more control of a partially infected machine.In December 2023, Kaspersky researchers <a href="https://media.ccc.de/v/37c3-11859-operation_triangulation_what_you_get_when_attack_iphones_of_researchers">presented</a> more details about <a href="https://securelist.com/trng-2023/">Operation Triangulation</a> at the 37th Chaos Communication Congress conference. This attack, targeted at Kaspersky and other entities, utilized several zero-day exploits, starting with an iMessage zero-click. As Kaspersky managed to recover the whole infection chain, this research provides fascinating insights into the techniques employed by highly sophisticated nation state attackers. We learned that the attack featured not one, but two separate validator stages. These were supposed to protect the exploits (and implants) using public-key encryption and ensure that they are only deployed in the targeted environment.&nbsp;Another interesting finding was that, when the attackers successfully exploited the kernel, they used their newfound privileges to just open Safari to run a browser exploit, essentially having to exploit the same device twice. At the first glance, dropping privileges like this doesn’t make much sense and it’s a bit of a mystery why the attack was designed like this. One theory is that the attackers had two chains and just wanted to take the best from both (the first one had the iMessage RCE, while the second one had the validators), so they decided to take the path of least resistance to connect them. However, we suspect this may also have been a deliberate attempt to protect the most expensive part of the attack: the zero-click iMessage exploit. If a victim discovered the malicious implant and attempted to trace back the infection, they would have most likely not found anything beyond the browser exploit, as no one would be crazy enough to suspect that a browser exploit chain would be initiated from the kernel. So, while the attackers would still get a lot of zero days burned, they would retain the most valuable one. Whatever the reason for the attack approach, one thing is for certain: this attacker must have no shortage of browser zero days if they are willing to risk burning one even when it’s unnecessary.&nbsp;<h6>MTE Support on Pixel 8</h6>Another interesting development happened in October, when Google’s Pixel 8 was released with <a href="https://googleprojectzero.blogspot.com/2023/11/first-handset-with-mte-on-market.html">support for MTE</a> (Memory Tagging Extensions). This represents a significant milestone, as this is the first commercially available device that supports this much-anticipated ARM mitigation.&nbsp;While it’s not enabled by default, MTE can be turned on as a developer option for testing purposes. This allows developers to test if their application behaves correctly and that MTE does not cause any unexpected errors. The main idea behind MTE is to assign 4-bit tags to allocated 16-byte memory regions. Pointers are then supposed to contain the tag so that the tag can be checked when the pointer is dereferenced. If the pointer tag does not match the expected value, an exception can be thrown. This could potentially <a href="https://googleprojectzero.blogspot.com/2023/08/mte-as-implemented-part-1.html">mitigate a number of vulnerability classes</a>, like use after frees, as the tag is supposed to be updated between allocations, so the stale pointer’s tag would be outdated at the time the vulnerability is triggered (there is still a good chance that the tag will be valid, though, since there are only 16 possible tag values).&nbsp;Currently, the actual impact of MTE on the difficulty of exploiting memory corruption vulnerabilities remains unclear; however, it seems like a promising mitigation, which might raise the bar for attackers. It’s also not clear if it will ever be enabled by default, as it will undoubtedly incur some performance overhead and the additional security might not be worth it for the average user. However, it might still come in handy for users who suspect they are targeted by zero-day capable attackers, since at a time when MTE is not widely enabled, its unexpected presence would likely catch most attackers off guard.Jan Vojtěšek, Malware Reseracher<h2>Web Threats</h2>If we look at the detection statistics for the whole of last year, web threats were the most active category for 2023. Scams of different topics, and different quality thanks to the use of malvertising, have achieved a relatively large coverage worldwide.&nbsp;Due to this, it is not surprising that scams, phishing, and malvertising formed over 75% of all threats blocked by us during the year.A powerful and dangerous combination is the scam coupled with malvertising. As we will describe in this section, scammers have started to use many innovations from the ever-developing world of AI in hopes of improving their rate of success.<h3>Scams&nbsp;</h3>A scam is a type of threat that aims to trick users into giving an attacker their personal information or money. We track diverse types of scams which are listed below.The malvertising business is booming thanks to the willingness of scammers to pay for delivery of their malicious content to victims. One could say that this willingness must come from the fact that scammers are getting their investments back from the money of the scammed users.An interesting development is the increase in the activity of the scam threat, which started on 20 December and lasted until the end of the year.

The reason for this pre-holiday surge was an unfortunately successful push notification campaign. The campaign’s design, reminiscent of the famous CAPTCHA, encouraged users to allow push notifications to be sent from a given page.

Avast consistently draws attention to the issue of scam push notifications. Last quarter, we warned about a massive increase in malvertising threats, an increase which continued in the fourth quarter of the year.

This promotion allows the scammer to take the user wherever he needs to go. From ordinary porn sites to financial scams, tech support scams, or even phishing sites.A notable example is the phishing campaign shown below, which had its origin on a similar landing page where it convinced the user to allow sending push notifications. Typically, ads for adult content were then sent from this page. But then came a seemingly authentic ad campaign targeting Spotify users.

The phishing page continued to give the impression that it was a real Spotify page, as presented on the push notification pop-up, particularly the subscription renewal. It asked the user for a username and password, but also for credit card details including the verification code.

Overall, the dividing line between phishing, scam and malvertising is very thin, and statistics are only confirming the common general growth of all these threats.<h3>Financial scams</h3>A big attraction in the world of scams for the fourth quarter was the massive deployment of AI-generated videos in ads for financial/investment scams, which we pointed out and described in more detail in our last report. These videos were initially relatively low quality, but their quality gradually rose to a quite impressive level.&nbsp;Scammers are still using known faces to lure users and entice people to click on the malicious links. Classics campaigns include the likes of Elon Musk, TV news reporters, and even presidents of countries. These advertisements use prestigious characters from the country where the advertisement is to be displayed. In the following examples, you can see a deepfake of the Czech President or Ursula von der Leyen introducing a new investment platform.&nbsp;

We have also seen advertisements that used video images of famous characters that were embedded in an edited video to create the context for the introduction of a new product, but this is a different approach. Here, the overall impression created is much more believable, thanks to the fact that these generated videos explicitly speak certain text and mention specific names of fraudulent sites.&nbsp;Peak financial scam activity was observed in mid-November. Toward the end of the year, this activity slowly started to calm down.

We have drawn attention to these ads many times. Typically, they lead to fraudulent sites that aim to promote information from ads and then redirect users to a registration form such as the one shown below.

<h3>Dating Scams</h3>Dating scams, also known as romance scams or online dating scams, involve fraudsters deceiving individuals into fake romantic relationships. Scammers adopt fake online identities to gain the victim’s trust, with the ultimate goal of obtaining money or enough personal information to commit identity theft.In comparison to the previous quarter, a significant global increase in online dating fraud was seen in Q4 2023. However, intriguing shifts in attack patterns and targeted regions have come to light. Notably, despite a temporary decline in the number of scams during the holiday season, perhaps due to individuals being preoccupied with festive celebrations and spending time with loved ones, there are now emerging trends in how and where these scams are being deployed. Attackers have shifted their focus to different countries, marking a distinctive change in their strategies.

The most substantial increase has been observed in the Arab states, including Saudi Arabia, Yemen, Oman, the United Arab Emirates, Kuwait, as well as in Indonesia, Cambodia, and Thailand. This shift in focus might be linked to a broader global trend of increased online interactions and digital connections. The evolving landscape of online socialization and communication has inadvertently created both challenges and opportunities for scammers. As people continue to engage more extensively in online platforms for various reasons, attackers are adapting their strategies and targeting different regions to exploit these shifting patterns of online activity.

Countries in Central Europe and North America continue to face dating scams most, with approximately one in 20 users encountering these threats, on average. The observed decline during the holidays has piqued our interest, and we anticipate a resurgence in scam activities, particularly in the lead-up to Valentine’s Day. The romantic nature of this occasion may make individuals more susceptible to online connections, providing an opportune moment for attackers to exploit emotions and vulnerabilities.

<h3>Tech Support Scams</h3>Tech support scam threats involve fraudsters posing as legitimate technical support representatives who attempt to gain remote access to victims’ devices or obtain sensitive personal information, such as credit card or banking details. These scams rely on confidence tricks to gain victims’ trust and often involve convincing them to pay for unnecessary services or purchase expensive gift cards. It’s important for internet users to be vigilant and to verify the credentials of anyone claiming to offer technical support services.The fourth quarter showed tech support scam activity continued its downtrend that we observed all 2023.&nbsp;

Several countries in which we typically observe significant tech support scam activity register significant declines in risk ratio. There are exceptions, one of which is Spain, which came third in our quarterly ranking. In Spain we see a 42% increase in the risk ratio in Q4 2023.

Our ranking is traditionally dominated by Japan, together with the USA, followed by Spain. Interestingly, last quarter leader, Germany, has fallen back and rounds out our top 6, just behind France.<ul><li>Japan 1.08%</li><li>United States 1.02%</li><li>Spain 0.81%</li><li>Australia 0.72%</li><li>France 0.68%</li><li>Germany 0.64%</li></ul>If we look at the activity graph of Spain. We can see that the main source of activity comes at the end of November.

The Tech Support scam landing pages changes very little. The same techniques are still used to block the user’s browser and force the user to dial the phone number offered. Therefore, the example of the most prevalent landing page shows only minor changes.

<h3>Refund and Invoice Scams</h3>Invoice scams involve fraudsters sending false bills or invoices for goods or services that were never ordered or received. Scammers rely on invoices looking legitimate, often using company logos or other branding to trick unsuspecting victims into making payments. These scams can be especially effective when targeted at businesses, as employees may assume that a colleague made the purchase or simply overlook the details of the invoice. It’s important to carefully review all invoices and bills before making any payments and to verify the legitimacy of the sender if there are any suspicions of fraud.<h6>Online Billing: New Frontier for Cybercriminals in 2024</h6>It’s common for internet users to have approximately 80-90 passwords for various services, as reported by <a href="https://www.newswire.com/news/new-research-most-people-have-70-80-passwords-21103705">LastPass</a>, and cybercriminals take advantage of a simple fact: users must keep track of an unimaginable number of subscription accounts. Additionally, many traditional companies that previously relied on manual service management processes are gradually transitioning their customers to paperless methods, such as online account billing. This shift, primarily a cost-saving measure, is likely to continue in the future, with most customer services moving to online accounts or mobile apps. Attackers are aware of this trend, which has opened new avenues for cybercrime.One fruitful strategy employed by cybercriminals is to target digital services that have widespread usage. In Q4 2023, we observed a significant increase in one particular type of scam: subscription fraud. Among these, Netflix scams emerged prominently. With Netflix’s user base soaring to <a href="https://www.statista.com/statistics/250934/quarterly-number-of-netflix-streaming-subscribers-worldwide/">over 250 million in</a> 2023, the likelihood of successfully attacking a random subscriber is quite high, especially in the US and Europe where the penetration of these services is generally higher.The typical Netflix online billing scam attack generally arrives in the form of an email, which is a little more difficult to examine on a small screen. These messages are increasingly tailored to fit the small screens of mobile devices, a trend that aligns with the growing trend of using cell phones to manage one’s entire online presence. Let’s look at what these scams look like:

There are several red flags in the email that should raise alarms. A common thread is the language scammers use, which often create a sense of urgency and sometimes include spelling and grammar mistakes (though less with the increase of AI as a tool to support in scam message creation). The color scheme of such messages is frequently tailored to enhance the sense of urgency, with a strong use of red, yellow, or a combination thereof. For a company like Netflix – which spends enormous amounts on marketing – the design, if examined closely, is not very well-executed. Additionally, companies typically do not ask you to update payment details via a link in the email. These are just the main red flags in this particular example.Geographically, the countries most affected by these online billing scams are predominantly located in Europe and North America. There are a few exceptions: Australia has the highest risk ratio of 1.52%, and New Zealand is close behind with 1.11%, ranking third.

In Q4/2023, when we examine online billing scam data on a month-by-month basis, we can identify a significant spike during the last week of November. Even the period leading up to Christmas was higher than normal, which might be attributed to the fact that, for many people, Christmas is a time when they report higher-than-usual stress levels, according to the <a href="https://www.apa.org/news/press/releases/2023/11/holiday-season-stress">American Psychological Association</a>. As we know, scammers take advantage of people’s vulnerable moments, and the holiday season can often be wrought with. Additionally, buying habits change during the holiday season, which might also contribute to the spike.The trend line we see in the graph continues to climb throughout the fourth quarter, as seen below.

As always, stay vigilant and pay close attention to the emails you receive, especially on your mobile device to help avoid these types of scams.<h3>Phishing: Post-Holiday Phishing Alert in Online Shopping</h3>Phishing is a type of online scam where fraudsters attempt to obtain sensitive information including passwords or credit card details by posing as a trustworthy entity in an electronic communication, such as an email, text message, or instant message. The fraudulent message usually contains a link to a fake website that looks like the real one, where the victim is asked to enter their sensitive information.As far as phishing is concerned, attackers did not relent in their efforts in Q4/2023. The phishing graph below highlights the overall increase in web threats.

Throughout 2023 we witnessed a wide array of phishing campaigns. During the fourth quarter, there was interesting activity in the category of fake online shops (also referred to as e-shops).Following the holiday season, a surge of <a href="https://blog.avast.com/avast-researchers-detect-surge-in-fake-e-shops">over 4,000 fake e-shops</a> imitating popular brands posed a threat to online shoppers. Scammers exploited post-holiday bargain hunters, making vigilance crucial.

The cyber criminals behind these fake e-shop attacks meticulously mimic renowned brands (including&nbsp; Nike, Adidas, Pandora, Zara, Hilfiger, The North Face and many more) luring consumers with incredibly realistic-looking websites. Their process involves phishing for personal information during a fake login, and the sites often appear amongst the top search results.

In the final stages of the scam, users are coerced into providing personal and payment details, risking exposure of sensitive information.&nbsp;Tips for safety include verifying website credibility, cautious sale shopping, watching for fraud signals, and keeping security software updated.

2023: A Year of Surging Cyber Threats

Avast Q4/2023 Threat Report

<h2>Foreword</h2>I’m thrilled to present the <code>Avast Q1/2023</code> Threat Report, which provides a comprehensive overview of the latest cyberthreats and emerging trends in the security landscape. Our Threat Labs team has analyzed extensive data to identify and block the most significant risks to people across the globe, including the growing threat of social engineering attacks. In fact, two out of three of our detections during this quarter were phishing, scams, or related online threats, as can be seen from the infographics below.&nbsp;In this edition of our Threat Report, our featured story presents the evolving tactics used by cybercriminals to infect users. We, for example, highlight the sharp increase in OneNote documents abuse by malware groups such as <code>Qakbot</code>, <code>IcedID</code>, <code>Redline</code>, and <code>Emotet</code>. These groups are continually adapting their tactics to evade detection and infect unsuspecting users with malware. Our analysis sheds light on this emerging threat landscape and provides insights on how users can protect themselves from these evolving tactics.&nbsp;Information stealers remain one of the top threats, with an overall risk of infection increasing significantly by 22% compared to <code>Q4/2022</code>. This trend is particularly evident in Japan, which experienced an 86% increase in such attacks. Our team has also protected 333% more users from <code>Raccoon Stealer</code> activity, and this information stealer is now on par with the most popular information stealers, such as <code>AgentTesla</code>. Additionally, we discovered a new malware called <code>NeedleDropper</code> that is primarily used for distribution of these stealers.&nbsp;East Asia, including Japan, Taiwan, and China, experienced a significant increase in adware activity this quarter. Additionally, the Russian <code>DDosia</code> project underwent a significant development, with 7,300 members now being involved in these malicious activities. Furthermore, coinminers continue to pose a threat in the Balkans, with a global shift from standalone miners like <code>XMRig</code> to webminers doing their dirty business in victims’ browsers.&nbsp;The report also includes our latest efforts in combating ransomware, which involved the release of two new free decryption tools for the <code>BianLian</code> and <code>MeowCorp</code> (<code>Conti</code> offspring) ransomware families. In addition, we’ve seen some positive news about cybercriminal busts, particularly in Europe, targeting groups such as <code>NetWire</code>, <code>DoppelPaymer</code>, and <code>Hive</code>. The more cybercriminals that we can bring to justice, the better.&nbsp;Moreover, several Remote Access Trojans (RATs) boosted their presence significantly, including <code>Remcos</code>, <code>AsyncRat</code>, and <code>DarkComet</code>, many of which had the help of the <code>DBatLoader</code> loader, particularly in the Czech Republic, Argentina, and Mexico, where the related risk ratio doubled this quarter.&nbsp;Our researchers have been actively identifying zero-day exploits employed by threat actors in the wild. One such exploit was discovered in the highly popular MOBA game, <code>Dota 2</code>. In addition, vulnerabilities previously reported by our team in the <a href="https://decoded.avast.io/threatresearch/avast-q4-2022-threat-report/">last Threat Report</a> have been increasingly exploited for the delivery of ransomware and spyware, both on desktop and mobile devices.&nbsp;On mobile, adware continues its dominance, and it further grew in many countries, including India, Brazil, and Argentina, with <code>MobiDash</code> adware seeing over a 100% increase in protected users this quarter. Furthermore, mobile banking trojans continue to evolve and focus on instant payments, while machine learning is used to steal crypto wallet details. &nbsp;Overall, I encourage you to read the full report to gain a deeper understanding of the latest security threats and trends. Our team is committed to providing you with the most up-to-date information and protection from these threats. Thank you for trusting <code>Avast</code> to keep you safe online.Jakub Křoustek, Malware Research Director

<h2>Methodology</h2>This report is structured into two main sections: <a href="https://decoded.avast.io/threatresearch/avast-q1-2023-threat-report/#desktop">Desktop-related threats</a>, in which we describe our intelligence around attacks targeting the <code>Windows</code>, <code>Linux</code>, and <code>Mac</code> operating systems and include a special focus on web-related threats, and <a href="https://decoded.avast.io/threatresearch/avast-q1-2023-threat-report/#mobile">Mobile-related threats</a>, in which we describe the attacks focusing on <code>Android</code> and <code>iOS</code> operating systems.&nbsp;Furthermore, we use the term risk ratio in this report to describe the severity of particular threats, calculated as a monthly average of “Number of attacked users / Number of active users in a given country.” Unless stated otherwise, calculated risks are only available for countries with more than 10,000 active users per month.&nbsp;<h2>Featured Story</h2><h3>New Malware Distribution Tactics</h3>As cybercrime continues to be a lucrative business, cybercriminals are constantly seeking new ways to distribute malware and infect users. The recent change by <code>Microsoft</code> to block macros from files coming from the internet has caused criminals to explore alternative infection methods. Two of these emerging methods are detailed here:&nbsp;<h4><a href="https://blog.avast.com/onenote-malware">New Attack Vector: Microsoft OneNote</a>&nbsp;&nbsp;</h4><code>Microsoft OneNote</code>, a note-taking application, has become a popular delivery method for malware. Cybercriminals attach disguised <code>OneNote</code> files to emails, and when a recipient opens the file, it can contain a script or code that downloads and installs malware onto their computer. Malware families spread via these campaigns include <code>Qakbot</code>, <code>Raccoon</code>, <code>IcedID</code>, <code>AsyncRAT</code>, and <code>Redline</code>, among others. The number of users that we’ve protected against these specific attacks has been increasing daily, highlighting the prevalence of this threat. We have protected more than 47,000 customers during <code>Q1/2023</code> from this type of attacks, and the trend has only continued to increase over time:&nbsp;

<h4><a href="https://blog.avast.com/adobe-acrobat-sign-malware">Innovative Technique: Abusing Adobe Acrobat Sign</a>&nbsp;&nbsp;</h4>Another original way to distribute malware was discovered through the abuse of <code>Adobe</code>‘s cloud service, <code>Acrobat Sign</code>. Cybercriminals are exploiting the email notification system by adding text with a malicious link to a document, which is then sent to the intended recipient from a legitimate Adobe email address. When the victim clicks on the link, they are redirected to a site where they are asked to download a ZIP file containing a <code>Redline</code> Trojan variant designed to steal passwords, crypto wallets, and more.&nbsp;This abuse of <code>Adobe Acrobat Sign</code> to distribute malware is a targeted and novel technique that may become more popular among cybercriminals, as it can potentially bypass anti-malware filters and reach victims more effectively.&nbsp;The ever-changing landscape of cybercrime highlights the importance of staying up–to date on the latest threats and protection strategies. Both <code>Microsoft OneNote</code> attachments and the abuse of <code>Adobe Acrobat Sign</code> demonstrate how bad actors are constantly adapting to new tactics in their efforts to infect users with malware.&nbsp;&nbsp;Luis Corrons, Security Evangelist<h2 id="desktop">Desktop-Related Threats</h2><h3>Advanced Persistent Threats (APTs)&nbsp;</h3>An Advanced Persistent Threat (APT) is a type of cyberattack that is carried out by highly skilled and determined hackers who have the resources and expertise to penetrate a target’s network and maintain a long-term presence undetected.APT groups continue to pose a significant risk to organizations and governments worldwide. One such group is <code>Gamaredon</code>, which has been known to target Ukraine. <code>Gamaredon</code> is a sophisticated cyber-espionage group that has been active since at least 2013. The group primarily targets Ukrainian government and military entities, as well as other organizations in the country. The group utilizes spear-phishing to gain initial access to their victims, and the use of <code>Telegram</code> and <code>Telegra.ph</code> services as a distribution channel for Command-and-Control IPs is a common practice for the group.&nbsp;Another APT group that has been identified as operating across multiple regions is <code>MustangPanda</code>. This group primarily targets countries in the Asian region, including Myanmar and Cambodia. The group persists in utilizing the <code>Korplug</code> malware in conjunction with various other custom tools.&nbsp;The <code>Lazarus Group</code> is a threat actor with links to the North Korean government. The group has been responsible for a range of high-profile cyberattacks in the past. Recently, they made the news with a supply chain attack through <code>3CX Phone System</code>, which leveraged malware called <code>TxrLoader</code>. <code>Avast</code> users are protected from the malware being spread in this campaign.Luigino Camastra, Malware Researcher Igor Morgenstern, Malware Researcher<h3>Adware</h3>Adware is considered unwanted if installed without the user’s consent, tracks browsing behavior, redirects web traffic, or collects personal information for nefarious purposes, such as identity theft.&nbsp;In <code>Q1/2023</code>, the trend of adware activities is stable, and we have observed no significant campaigns in this area, as the graph below illustrates.&nbsp;

The <code>DealPly</code> adware has recently built a dominant position in the adware landscape. The map below shows that <code>DealPly</code>‘s risk ratio has increased all over the world.

The risk ratio for all adware strains is slightly higher than in <code>Q4/2022</code>. The significant increase that we observed is adware activity in East Asia, namely Japan, Taiwan, and China. The complete risk ratio is illustrated in the map below.

<h4>Adware Market Share&nbsp;</h4>The clearly identified market leader is still <code>DealPly</code>, which has a 15% share. We assign orders of lower magnitude shares to other strains as follows:&nbsp;<ul><li><code>RelevantKnowledge </code>(3%)&nbsp;</li><li><code>DownloadAssistant </code>(2%)&nbsp;</li><li><code>BrowserAssistant </code>(1%)&nbsp;</li></ul>However, other unknown strains covered up 58% of the market share in <code>Q1/2023</code>. The dominant type of adware strains typically waits for a user to click on an arbitrary hyperlink and replaces the original link with one redirecting the user to advertising websites.&nbsp;The table below illustrates a distribution of ad domains in the wild for this and the last quartiles. It is evident that the ad domains are dynamically rotated for each quarter to avoid detection by ad blockers.&nbsp;

Unfortunately, the ingenuity of adware authors is getting better every quarter. Adware is often found on websites offering free software downloads or other products, and it’s a common tactic used by online spammers. We’ll describe detailed information about Web-based Adware in a <a href="https://decoded.avast.io/threatresearch/avast-q1-2023-threat-report/#web_adware">separate section</a>.&nbsp;Adware has the potential to gain control over a system and execute malicious software like ransomware, spyware, RATs, and other threats. However, it should be noted that adware is generally more bothersome for users rather than truly dangerous.&nbsp;&nbsp;&nbsp;Martin Chlumecký,&nbsp;Malware Researcher<h3>Bots</h3>Bots are threats mainly interested in securing long-term access to infected devices with the aim of utilizing their resources, be it remote control, spam distribution, or denial-of-service (DoS) attacks.&nbsp;As the war in Ukraine progresses, hacker groups that are interested in the conflict continue to evolve. Notably, the <code>DDosia</code> project maintained by the <code>NoName057(16)</code> group <a href="https://decoded.avast.io/martinchlumecky/ddosia-project-how-noname05716-is-trying-to-improve-the-efficiency-of-ddos-attacks/">underwent a significant development</a>. Presumably as a reaction to various researchers tracking the project, the group implemented an authentication mechanism for the retrieval of targets. Moreover, we suspect that they started banning IP addresses that are suspected to be snooping on the network. The number of DDosia participants has progressed steadily, reaching around 8,500 members by the end of <code>Q1/2023</code>.&nbsp;As was already mentioned in the Featured story, since Microsoft announced its intention to curtail <code>Microsoft Office</code> macros, threat actors have been unusually creative in testing other payload types. We’ve seen them using <code>ISO archives</code>, <code>Microsoft Office Template files</code>, and <code>HTML smuggling</code> during the previous two quarters. This quarter’s new target is <code>Microsoft OneNote</code>, which has become rather popular with various threat actors – both distributors (such as <code>Emotet</code>) and “consumers” (<code>Qakbot</code>, <code>IcedID</code>, <code>AsyncRAT</code> and others) appear to be rather keen on it.&nbsp;In comparison to the previous quarter with a huge <code>Emotet</code> campaign, this quarter has been rather calm, showing a slight decline in the risk ratio (-13% q/q). While many prolific families (such as <code>Amadey</code>, <code>Qakbot</code> or <code>Twizt</code>) went through notable increase in their prevalence, <code>Emotet</code> surprisingly wasn’t among those as it went through a significant decline in its activity. The open-sourced botnet <code>BlackNET</code>, whose popularity soared in the previous quarter, went through a decline bringing its prevalence closer to the numbers we were seeing half a year ago.

Adolf Středa, Malware Researcher<h3>Coinminers</h3>Coinminers are programs that use a device’s hardware resources to verify cryptocurrency transactions and earn cryptocurrency as a reward. However, in the world of malware, coinminers silently hijack a victim’s computer resources to generate cryptocurrency for an attacker. Regardless of whether a coinminer is legitimate or malware, it’s important to follow our <a href="https://support.avast.com/en-eu/article/Threat-Lab-cryptomining-behavior-guideline/">guidelines</a>.&nbsp;After crashes of <code>Silicon Valley Bank</code>, <code>Silvergate Bank</code>, and <code>Signature Bank</code> in the US and <code>Credit Suisse</code> in Switzerland, cryptocurrencies experienced a slight resurrection in <code>Q1/2023</code>. Fortunately, the same cannot be said for coinminers that continue to decline in activity and even faster than previous quarters (-15% risk ratio).

Following the last quarter, users in Serbia were once again most at risk of encountering a coinminer in <code>Q1/2023</code>, with a 7.11% risk ratio. The risk ratio of users in Montenegro was 5.94%, followed by Bosnia and Herzegovina with a 3.84% risk ratio, and Madagascar with 3.73%. In <code>Q1/2023</code>, <code>Avast</code> saw a high increase of coinminer activity in North Macedonia and Egypt, resulting in 81% and 12% increases in protected users, respectively.

Conversely, XMRig continues to drop. Its market share decreased by 13% in <code>Q1/2023</code>, now holding 16% in the total market. Similarly, <code>VMiner</code> lost 14% of its market share, making up 1.30% of the total market. On the other hand, other significant coinminers usurped more of the market – web miners (66.53% market share), <code>CoinBitMiner</code> (1.97%), <code>FakeKMSminer</code> (1.89%), and <code>CoinHelper</code> (1.27%).&nbsp;The most common coinminers in <code>Q1/2023</code> were:&nbsp;<ul><li>Web miners (various strains)&nbsp;</li><li><code>XMRig</code>&nbsp;</li><li><code>CoinBitMiner</code></li><li><code>FakeKMSminer</code>&nbsp;</li><li><code>VMiner</code>&nbsp;</li><li><code>CoinHelper</code></li></ul>&nbsp;Jan Rubín, Malware Researcher<h3>Information Stealers</h3>Information stealers are dedicated to stealing anything of value from the victim’s device. Typically, they focus on stored credentials, cryptocurrencies, browser sessions and cookies, browser passwords, private documents, and more.&nbsp;<code>Raccoon Stealer</code> activity increased significantly in <code>Q1/2023</code>. We protected 333% more users compared to the previous quarter. Furthermore, according to our statistics, <code>Raccoon</code> is now on the similar activity levels as <code>AgentTesla</code>, <code>RedLine</code>, and <code>FormBook</code>, which are the most popular information stealers of all time. Due to this significant increase, the overall risk of getting infected by information stealers also increased quite significantly – by 22%.

Similar to coin miners, information stealers were also more prevalent in Egypt, increasing the risk ratio by 53% (4.08% risk ratio). Individuals located in Yemen are still the ones with the highest risk of getting infected by information stealers (4.66% risk ratio). We also protected 149% more users in Saudi Arabia (1.45% risk ratio).&nbsp;

<code>AgentTesla</code> now holds 18.43% of the market share, increasing by 32% in comparison to the previous quarter. The activity of <a href="https://decoded.avast.io/janrubin/vipersoftx-hiding-in-system-logs-and-spreading-venomsoftx/"><code>ViperSoftX</code></a> also increased, as its market share rose by 69% and it now holds 2.21% of the information stealer market. On the other hand, <code>FormBook</code> and <code>RedLine</code> experienced a drop in activity, decreasing their market share by 40% and 28%, respectively.&nbsp;The most common information stealers in Q1/2023 were:&nbsp;<ul><li><code>AgentTesla</code></li><li><code>FormBook</code>&nbsp;</li><li><code>Raccoon</code>&nbsp;</li><li><code>RedLine</code>&nbsp;</li><li><code>Arkei</code>&nbsp;</li><li><code>Fareit</code></li><li><code>Lokibot</code>&nbsp;</li><li><code>ViperSoftX</code>&nbsp;</li></ul><a href="https://decoded.avast.io/threatresearch/needledropper/"><code>NeedleDropper</code></a> was a newly discovered dropper malware, mostly used for distributing information stealers like <code>FormBook</code> or <code>AgentTesla</code>. To avoid detection, the malware tries to hide itself by dropping many unused, invalid files and stores important data between several MB of unimportant data, and it also utilizes legitimate applications to perform the malicious activity.&nbsp;<a href="https://www.uptycs.com/blog/macstealer-command-and-control-c2-malware"><code>MacStealer</code></a> is a malware that targets <code>MacOS</code> users, primarily spreading through compromised .dmg packages. This malicious software collects personal information from various internet browsers, including passwords, cookies, credit card details, <code>KeyChain</code> database information, and cryptocurrency wallet data. The program stores this collected data in a ZIP file and sends it to remote servers, potentially exposing the victims to identity theft, financial loss, or other cyber threats.&nbsp;Jan Rubín, Malware Researcher Vladimír Žalud, Malware Analyst<h3>Ransomware</h3>Ransomware represents any type of extorting malware. The most common subtype is the one that encrypts documents, photos, videos, databases and other files on the victim’s PC. Those files become unusable without decrypting them first. For decryption tool, attackers demand money, “ransom”, hence the term ransomware.&nbsp;Unlike other threats, ransomware typically makes a point of letting the user know that they’ve been targeted by cybercriminals, often in a spectacular way – for example, by changing their desktop background or leaving ransom note text. Here is an example of such ransom note coming from <code>BianLian</code> ransomware:&nbsp;

In some cases, it may be possible to decrypt files without paying a ransom. If you ever suffer a ransomware attack, the ransom note may identify the exact ransomware strain that’s behind the attack. For example, the above-mentioned ransomware called <code>BianLian</code> can be decrypted using <a href="https://decoded.avast.io/threatresearch/decrypted-bianlian-ransomware/">decryption tool that Avast released in January of 2023</a>.&nbsp;In case the ransomware cannot be decrypted, it’s important to archive all encrypted data, as there is always a chance that encryption keys will be published after the gang closes its business. Recently, this was the case with the <a href="https://twitter.com/Amigo_A_/status/1624835941352308739"><code>MeowCorp ransomware</code></a>, which is based on the leaked sources of <code>Conti</code>. Thus, we published it as <a href="https://twitter.com/AvastThreatLabs/status/1640616057109897218">Conti Decryptor</a> in March 2023.&nbsp;Speaking of <code>Conti</code>, the leaked sources are now also being used by the <code>LockBit</code> gang. This is the second time that the <code>LockBit</code> gang changed their encryptor – first, they introduced <code>LockBit Black</code> (<a href="https://twitter.com/fwosar/status/1543700719181746182">based on BlackMatter</a>) and have now switched to <code>LockBit Green</code>, with an <a href="https://twitter.com/vxunderground/status/1618885718839001091">encryptor based on the Conti source</a>.&nbsp;Sometimes, a ransomware gang closes their business, but not on their own volition; law enforcement may score in the battle against cybercriminals and seize the operation. As a recent example, <a href="https://www.bleepingcomputer.com/news/security/hive-ransomware-disrupted-after-fbi-hacks-gangs-systems/">Hive ransomware network was infiltrated by the FBI and Europol</a>. Also, two members suspected to be members of the <code>DoppelPaymer</code> ransomware gang <a href="https://www.europol.europa.eu/media-press/newsroom/news/germany-and-ukraine-hit-two-high-value-ransomware-targets">were arrested</a> by joint forces of <code>German Regional Police</code>, <code>Ukrainian National Police</code>, and <code>Europol</code>.&nbsp;When examining the ransom note image above, one can notice instructions on how to contact the attackers and how to send the payment. Typically, it is done by sending cryptocurrency (such as <code>Bitcoin</code>, <code>Monero</code>, or <code>Ethereum</code>) to a cryptocurrency wallet that’s owned by attackers. While the wallets themselves are anonymous, it is possible to track money transfers wallet(s) known to be associated with ransomware actors. According to <a href="https://blog.chainalysis.com/reports/crypto-ransomware-revenue-down-as-victims-refuse-to-pay/">Chainalysis</a>, ransomware gangs received $457 million in 2022, a 40% drop from 2021 likely due to the fact that more companies now refuse to pay ransom.&nbsp;<h4>Statistics&nbsp;</h4>Here, we present ransomware statistics based on what we see in our userbase. <code>WannaCry</code> maintains its top position (18% market share) and is followed by <code>STOP ransomware</code> (15%). Lower in the ladder are <code>Thanatos</code> (3%), <code>Hidden Tear</code> (1%), <code>Magniber</code> (1%), and <code>LockBit</code> (1%). Overall, the absolute number of ransomware attacks bounced by <code>Avast</code> is slowly declining, as the ransomware authors are switching to targeted attacks that are less frequent than the mass attacks that we’ve seen in the past:&nbsp;

Ladislav Zezula, Malware Researcher Jakub Křoustek, Malware Research Director<h3>Remote Access Trojans (RATs)</h3>A Remote Access Trojan (RAT) is a type of malicious software that allows unauthorized individuals to gain remote control over a victim’s computer or device. RATs are typically spread through social engineering techniques, such as phishing emails or infected file downloads. Once installed, RATs grant the attacker complete access to the victim’s device, enabling them to execute various malicious activities, such as spying, data theft, remote surveillance, and even taking control of the victim’s webcam and microphone.&nbsp;After the continuous decline in the overall risk ratio observed over the second half of 2022, <code>Q1/2023</code> is on par with <code>Q4/2022</code>. This is largely due to the <code>Remcos</code> strain, which has been very active in this quarter.&nbsp;

The increased activity of <code>Remcos</code> can be observed in most parts of the world. The overall increase in its market share among other RATs was by 60%. However, in the Czech Republic, Argentina, and Mexico, the increase was by more than 100%. We have frequently seen <code>Remcos</code> being spread by the <code>DBatLoader</code> loader. <code>DBatLoader</code> was also spreading <code>Netwire RAT</code> and <code>FormBook</code> information stealer, according to our data.&nbsp;<code>AsyncRat</code>, <code>DarkComet</code>, and <code>QuasarRAT</code> also increased their market share by more than 30%. We now see <code>AsyncRat</code> and <code>QuasarRAT</code> active all over the world. <code>AsyncRat</code> is a little bit more active in Southeast Europe, Afghanistan, Pakistan, and Australia, while <code>QuasarRAT</code> is active in Latin America, Africa, and Turkey. <code>DarkComet</code>, on the other hand, seems to be limited mostly to Europe and the Middle East.

The most common RATs in Q1/2023 include:&nbsp;<ul><li><code>HWorm</code>&nbsp;</li><li><code>Remcos&nbsp;</code></li><li><code>njRAT&nbsp;</code></li><li><code>AsyncRat&nbsp;</code></li><li><code>Warzone&nbsp;</code></li><li><code>QuasarRAT&nbsp;</code></li><li><code>NanoCore&nbsp;</code></li><li><code>NetWire&nbsp;</code></li><li><code>LimeRAT&nbsp;</code></li><li><code>DarkComet&nbsp;</code></li></ul>In an international law enforcement operation carried out by the <code>FBI</code>, the <a href="https://www.justice.gov/usao-cdca/pr/federal-authorities-seize-internet-domain-selling-malware-used-illegally-control-and">United States Attorney’s Office for the Central District of California</a>, the <a href="https://policija.gov.hr/vijesti/u-sklopu-medjunarodne-policijske-akcije-hrvatska-policija-uhitila-hakera-s-podrucja-zagrebacke-zupanije/6944">Croatia Ministry of the Interior Criminal Police Directorate</a>, <code>Zurich Cantonal Police</code>, <code>Europol</code>, and the <code>Australian Federal Police</code> took down the <code>worldwiredlabs.com</code> domain. A server hosting the <code>NetWire RAT</code> infrastructure was seized in Switzerland, and a suspected administrator of the website was arrested in Croatia. <code>NetWire</code> was sold through the website for prices ranging from $10 to $1,200.

Another arrest was made by <a href="https://cyberpolice.gov.ua/news/kiberpolicziya-vykryla-zhytelya-xmelnychchyny-u-stvorenni-virusu-dlya-vykradennya-danyx-korystuvachiv-7546/">law enforcement</a> in Ukraine. The <code>Khmelnychchyna Cybercrime Department</code>, the regional police investigative department, and the <code>SBU</code> regional department arrested the developer of a RAT masked as an application for computer games. According to the report, this RAT infected more than 10,000 computers, and at the time of the search, the suspected developer had access to nearly 600 computers.&nbsp;The <a href="https://asec.ahnlab.com/en/48063/">ASEC</a> analysis team discovered that the <code>RedEyes</code> (<code>APT37</code>, <code>ScarCruft</code>) group has been distributing a new malware named <code>M2RAT</code>. <code>M2RAT</code> is able to log keystrokes, leak/upload data to the attacker’s server, run processes, and capture screenshots. The report also mentions an information stealer that can communicate with the <code>M2RAT</code>. This stealer’s task is to steal data saved on mobile phones.&nbsp;Researchers from <a href="https://blog.lumen.com/new-hiatusrat-router-malware-covertly-spies-on-victims/">Lumen</a> discovered a campaign named <code>Hiatus</code>. One of the components delivered is the <code>HiatusRAT</code> which is similar to <code>ZuoRAT</code> (also previously discovered by <code>Lumen</code>) in that it also targets SOHO routers. Another component is a modified <code>tcpdump</code> tool. <code>HiatusRAT</code> can convert the infected router into a SOCKS5 proxy for the attacker as well as allow remote access to the device.&nbsp;&nbsp;Ondřej Mokoš, Malware Researcher<h3>Rootkits</h3>Rootkits are malicious software specifically designed to gain unauthorized access to a system and obtain high-level privileges. Rootkits can operate at the kernel layer of a system, which grants them deep access and control, including the ability to modify critical kernel structures. This could enable other malware to manipulate system behavior and evade detection.&nbsp;Rootkits are gradually being replaced by other and more effective tools to control systems. For this reason, we have also observed the downward trend of rootkit activities in <code>Q1/2023</code>, as is shown in the chart below.&nbsp;

If we look at the risk ratio from the point of view of individual countries, China remains the dominant country in which the rootkit activities are the greatest.&nbsp;

Despite the downward trend in rootkit activities, the <code>R77RK</code> rootkit remains a dominant player in the rootkit market (28%) for its open-source policy and documentation. Although <code>R77RK</code> is not directly a rootkit that operates in the kernel mode, it provides the essential ability to modify the system behavior, typically hiding files, registries, processes, and so on.&nbsp;In <code>Q1/2023</code>, we noticed no new release of <code>R77RK</code> that would affect the <code>R77RK</code>’s spread, which could have caused the declining trend. We will see whether <code>R77RK</code> keeps the majority in the wild in the next quarter.&nbsp;

The market share of the remaining four rootkit strains is approximately 20%, but these strains are relatively insignificant. To provide a comprehensive overview, the rootkit strains and their corresponding market shares are listed below:&nbsp;<ul><li><code>Cerbu </code>(7%)&nbsp;</li><li><code>Alureon </code>(7%)&nbsp;</li><li><code>Perkesh </code>(6%)&nbsp;</li><li><code>ZeroAccess </code>(3%)&nbsp;</li></ul>In Linux operating systems, our data also indicates that rootkits are not a prevalent threat. On the other hand, Linux kernel rootkits are increasing in complexity. We detected Linux kernel rootkits using kernel space packers that can efficiently pass under the radar.&nbsp;As <a href="https://youtu.be/dBS_drewu7w">presented at Botconf 2023</a>, we keep tracking <code>Syslogk</code> Linux kernel rootkit and again found a new version that is integrated with a usermode bot. This is a bot that is not continuously running but stealthily started by the attacker via relatively complex magic packets. Such bot fakes a different service per sample allowing the attacker to connect to it and implements a proxy mode for sending magic packets to other infected machines faking legitimate Mozilla Firefox and Apache 2 network traffic.&nbsp;Even if not prevalent, we consider it important researching these threats to protect our users from advanced attacks.&nbsp;&nbsp;Martin Chlumecký, Malware Researcher David Álvarez, Malware Analyst<h3>Vulnerabilities and Exploits</h3>Exploits take advantage of flaws in legitimate software to perform actions that should not be allowed. They are typically categorized into remote code execution (RCE) exploits, which allow attackers to infect another machine, and local privilege escalation (LPE) exploits, which allow attackers to take more control of a partially infected machine.&nbsp;Exploits continue to represent a threat that is exceedingly difficult to protect against, with the rate of newly discovered vulnerabilities showing no signs of slowing down in <code>Q1/2023</code>. The January Patch Tuesday update fixed <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21674">CVE-2023-21674</a>, a vulnerability in <code>ALPC</code> that we discovered in the wild when it was used in an attempt to escape from the Chromium sandbox straight into the Windows kernel. A whopping number of four in-the-wild zero-days were <a href="https://blog.google/threat-analysis-group/spyware-vendors-use-0-days-and-n-days-against-popular-platforms/">discovered</a> by <code>Clement Lecigne of Google's Threat Analysis Group</code>. Two of these exploits were used by spyware vendors in sophisticated exploit chains targeting both <code>Android</code> and <code>iOS</code> devices. Interestingly, one of these chains also exploited <a href="https://chromereleases.googleblog.com/2022/10/stable-channel-update-for-desktop_27.html">CVE-2022-3723</a>, a type confusion in V8 that we reported to <code>Google</code> back in October 2022.&nbsp;This quarter also showed that financially motivated cybercriminals do sometimes possess zero-day capabilities, once again disproving the common misconception that zero-days are a privilege of stealthy APT attackers. In February, a cybercriminal group <a href="https://securelist.com/nokoyawa-ransomware-attacks-with-windows-zero-day/109483/">attempted to deploy</a> the <code>Nokoyawa</code> ransomware through a zero-day LPE exploit for <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28252">CVE-2023-28252</a>. One of the most interesting facts about this attack is that it was independently reported to <code>Microsoft</code> by three companies, indicating that there is perhaps a reason for why zero-days are not often used in such noisy attacks. Another example of financially motivated attackers stepping up their game are the <code>Magniber</code> ransomware threat actors using <a href="https://blog.google/threat-analysis-group/magniber-ransomware-actors-used-a-variant-of-microsoft-smartscreen-bypass/">CVE-2023-24880</a> to bypass <code>Microsoft SmartScreen</code>. As we have <a href="https://decoded.avast.io/janvojtesek/magnitude-exploit-kit-still-alive-and-kicking/">researched</a> <code>Magniber</code> and the <code>Magnitude</code> exploit kit <a href="https://decoded.avast.io/janvojtesek/exploit-kits-vs-google-chrome/">extensively</a> in the past, we were not in the least surprised that these attackers were able to devise such advanced bypass methods.&nbsp;Finally, our research highlighted that malware could spread even through seemingly innocent activities, such as playing video games. We <a href="https://decoded.avast.io/janvojtesek/dota-2-under-attack-how-a-v8-bug-was-exploited-in-the-game/">discovered</a> that <code>Dota 2</code>, a highly popular MOBA game, was vulnerable due to its use of an outdated version of the <code>V8 JavaScript engine</code>. We have also found that an attacker took advantage of this vulnerability and exploited a smaller number of players of certain custom game modes. We have reported this vulnerability and it was <a href="https://www.dota2.com/news/updates">fixed</a> on January 12, making the game once again safe to play. However, as we have shown in our <a href="https://decoded.avast.io/janvojtesek/dota-2-under-attack-how-a-v8-bug-was-exploited-in-the-game/">research blog</a>, such vulnerabilities could have much more dire consequences, potentially endangering the millions of active Dota players.&nbsp;&nbsp;Jan Vojtěšek, Malware Reseracher<h2>Web Threats</h2><h3>Phishing</h3>Phishing is a type of online scam where fraudsters attempt to obtain sensitive information including passwords or credit card details by posing as a trustworthy entity in an electronic communication, such as an email, text message, or instant message. The fraudulent message usually contains a link to a fake website that looks like the real one, where the victim is asked to enter their sensitive information.&nbsp;Phishing continues to be a significant threat to consumers, and 31.98% of all attacks blocked by <code>Avast</code> this quarter were phishing attempts. Besides phishing threats, scams are a major threat with a share of 33.64% out of all attacks. These numbers combined show that two out of three detections now relate to social engineering. When comparing the recent phishing attack trends over the past few quarters, we observe a consistent and concerning increase in the appearance of phishing incidents.

The most significant jump occurred between <code>Q4/2022</code> and <code>Q1/2023</code>, where the rate increased by more than 6 percentage points, from 25.91% to 31.98%, making phishing almost one out of three of all blocked threats. This upward trend highlights the growing threat that phishing poses to consumers.&nbsp;&nbsp;Cybercriminals are continuously evolving their tactics and becoming more sophisticated in their methods, as <code>Avast</code> researchers have <a href="https://blog.avast.com/online-secondhand-shopping-scams">uncovered</a> how cybercriminals are increasingly targeting users on secondhand shopping platforms like <code>Vinted</code>. In these cases, scammers posing as buyers exploit the excitement and urgency associated with making a sale to extract personal information, such as phone numbers or credit card details. They even interact in real time with their victims via WhatsApp posing as technical support agents.&nbsp;&nbsp;The prevalence of smishing attacks has also contributed to the rising rate of phishing incidents, and it is becoming increasingly popular among cybercriminals due to its high open rate and the sense of trust that people place in text messages from seemingly reliable sources, like banks or government agencies. Smishing attacks often involve urgent messages that prompt victims to click on a link or provide personal information. Common smishing attack themes include financial alerts, package delivery notifications, tax alerts, charity scams, and lottery scams.<h3>Tech Support Scams&nbsp;</h3>Tech support scam threats involve fraudsters posing as legitimate technical support representatives who attempt to gain remote access to victims’ devices or obtain sensitive personal information, such as credit card or banking details. These scams rely on confidence tricks to gain victims’ trust and often involve convincing them to pay for unnecessary services or purchase expensive gift cards. It’s important for internet users to be vigilant and to verify the credentials of anyone claiming to offer technical support services.&nbsp;In the first quarter of this year, we have observed a significant decrease in the activity of technical support scams. This is good news for internet users who may have previously fallen victim to these types of scams. According to our data, the risk ratio of technical support scams has dropped considerably, indicating that scammers may be shifting their focus to other types of online fraud, such as refund and invoice scams, as is shown below.&nbsp;

Moreover, our data shows that the risk ratios for technical support scams in the following countries are as follows: Japan with 3.64%, Germany with 2.93%, the United States with 2.59%, Canada with 2.53%, and Switzerland with 2.18%. While these countries still have a higher risk ratio compared to other countries, the overall decrease in technical support scams is a positive development.&nbsp;

As always, it’s important for internet users to remain vigilant and be aware of potential online threats. By staying informed and taking precautions, such as not sharing personal information or downloading suspicious software, we can help keep ourselves and our personal data safe from cybercriminals.&nbsp;<h3>Refund and Invoice Scams&nbsp;</h3>Invoice scams involve fraudsters sending false bills or invoices for goods or services that were never ordered or received. Scammers rely on invoices looking legitimate, often using company logos or other branding to trick unsuspecting victims into making payments. These scams can be especially effective when targeted at businesses, as employees may assume that a colleague made the purchase or simply overlook the details of the invoice. It’s important to carefully review all invoices and bills before making any payments and to verify the legitimacy of the sender if there are any suspicions of fraud.&nbsp;In <code>Q1/2023</code>, there was a significant increase in activity for invoice and refund scams. Recent data shows a 50% increase of risk ratio in Japan quarter over quarter, 26% in the United Kingdom, 21% in Canada, and 19% in the United States.&nbsp;

It’s important to note that these risk ratios may not fully capture the scope of the problem, as many scams go unreported or undetected. It’s crucial for individuals and businesses to remain vigilant when it comes to unsolicited invoices or refund requests as well as to take steps to protect themselves from these types of scams.&nbsp;

In conclusion, the increase in activity for invoice and refund scams in <code>Q1/2023</code> highlights the ongoing need for cybersecurity awareness and education as well as the importance of taking proactive measures to protect oneself against these types of scams.&nbsp;

<h3 id="web_adware">Web-based Adware&nbsp;</h3>Web-based adware refers to malicious software or web pages that display unwanted advertisements in the form of pop-ups, banners, or redirects to third-party websites. Web-based adware can slow web browsing, potentially compromising user privacy and security.&nbsp;In <code>Q1/2023</code>, web-based adware remained prevalent, with several notable examples. We have identified three basic adware types dominating this quarter.&nbsp;<h4>Adult Content&nbsp;</h4>The most significant adware type is an ad that entices users to click through video games with adult content where the users are guided via a few steps to “verify” their ages, select game characters, etc. If the user completes the verification process, the adware redirects the user to the ad server and displays questionable content.&nbsp;

<h4>Text Injection&nbsp;</h4>Another non-negligible type is adware that injects a seemingly related text into specific paragraphs. A suspicious or infected webpage hides a simple JavaScript, injecting apparently related lines into the relevant section of the original text. The injected text contains a questionable URL and also waits for the user to click; see the example below.&nbsp;

<h4>Fake Win&nbsp;</h4>The last dominant ad type is “winning pages” with different prices (cellphones, notebooks, etc.) conditioned by entering personal information, including payment cards, to “verify winners.” The victim usually has three attempts at an action like roulette or unwrapping packages. The victim always wins on the third attempt and is redirected to a page where they enter their personal data and possibly send a manipulation plot.&nbsp;

Alexej Savčin, Malware Analyst Martin Chlumecký,&nbsp;Malware Researcher Luis Corrons, Security Evangelist &nbsp;<h3 id="mobile">Mobile-Related Threats</h3>With another turbulent quarter in the mobile threats sphere behind us, we dive into an overview of our data and interesting new discoveries from across the industry. Banking trojans continue to evolve and appear to be focusing on instant payments. We also see cybercriminals using machine learning to steal crypto wallet details. Several 0-day exploits were chained together in a series of spyware attacks on both <code>iOS</code> and <code>Android</code> and a SMS stealer was made available on <code>GitHub</code> and used to target victims in Indonesia.&nbsp;&nbsp;Here are the prevalent families of malware, coupled with insights based on our data to provide you with an overview of last quarter.&nbsp;&nbsp;<h4>Adware continues its dominance&nbsp;</h4>Adware threats on mobile refer to applications that display intrusive out-of-context adverts to users with the intent of gathering fraudulent advertising revenue. This malicious functionality is often delayed until some time after installation and coupled with stealth features such as hiding the adware app icon to prevent removal. Adware mimics popular apps such as games, camera filters, and wallpaper apps, to name a few.&nbsp;As has been the case for several years, adware continues to be the top threat facing mobile users in <code>Q1/2023</code>. The intent of adware is to serve intrusive advertisements to its victims with the aim of harvesting fraudulent advertising revenue. Stealth is often a key component in ensuring the adware remains on the victim’s device for as long as possible. This quarter we observed a continuation of previously used techniques, with some new strains with different approaches added into the mix.&nbsp;<code>HiddenAds</code> continues to be the top strain affecting users worldwide. As per its name, it uses stealth to masquerade as another app or to hide its icon. Once hidden, it often waits for a preset amount of time before displaying intrusive full screen adverts to its victims. This way, victims are less likely to suspect the <code>HiddenAds</code> app. Some previous campaigns snuck back on the <code>Play Store</code> again in small numbers but were taken down shortly after their release. Some third-party app stores continue to serve older strains, such as <code>Scylla</code> or versions of <code>LiveClick</code>.&nbsp;<code>FakeAdBlockers</code> takes the second spot in the adware category. Continuing to display adverts instead of blocking them, these adwares often disappear upon installation and waste no time in displaying advertisements. We observe <code>FakeAdBlockers</code> on third-party app stores and they’re also often served by pop-up messages from less reputable sites. These adwares often imitate games, wallpaper apps, utility apps, and others, with the aim of fooling the user into installing the app.&nbsp;

Interestingly, we saw a significant rise in <code>MobiDash</code> adware this quarter, with over a 100% increase in protected users. <code>Mobidash</code> is an older strain of adware which started as an advert SDK that was added to repacked apps. Once the repacked app was installed, the <code>MobiDash</code> SDK would wait for a time and then display aggressive adverts throughout the device while in use.&nbsp;&nbsp;Since its creation, <code>MobiDash</code> has been used to repackage hundreds of thousands of apps that imitate a wide range of gaming, utility, and camera apps. These repackaged apps have been distributed through forums and third-party app stores.&nbsp;

Compared to the previous quarter, there has been a slight increase in the number of users protected from adware, with <code>Mobidash</code>‘s resurgence playing a role in this uptick. This comes even though no major adware campaigns have infiltrated the <code>Play Store</code> during the current quarter.

Asia, Europe, and America are the most likely continents to be targeted by adware. Brazil, India, Argentina, and Indonesia continue to be the countries with the most protected users. We have noticed an increase in the number of protected users across most countries. However, it is worth highlighting that in the United States, there has been a significant decrease in both the risk ratio and protected users, with a drop of over 25%.&nbsp;<h4>Evolution of Bankers&nbsp;</h4>Bankers are a sophisticated type of mobile malware that targets banking details, cryptocurrency wallets, and instant payments with the intent of extracting money. Generally distributed through phishing messages or fake websites, Bankers can take over a victim’s device by abusing the accessibility service. Once installed and enabled, they often monitor 2FA SMS messages and may display fake bank overlays to steal login information.&nbsp;Bankers continue to thrive, as they introduce several evolutions and improvements to existing strains, along with some newcomers entering the market this quarter. Despite this ongoing activity, we have seen a decline in the number of users needing protection, continuing the trend observed over the past few quarters. Cerberus/Alien and Hydra maintain their top spots, while Coper climbs to 3rd place with a significant 67% increase in protected users, surpassing <code>RoamingMantis</code> and <code>Flubot</code>.&nbsp;Instant payment platforms remain a prime target for bankers this quarter, following their misuse by <code>BrasDex</code> last quarter. <code>PixPirate</code>, a new banker strain discovered by <code>Cleafy</code>, targets Brazil and utilizes the <code>Pix</code> instant payment platform to extract money from victims. <code>Xenomorph</code> has also updated its functionality to include instant payment extraction capabilities; combined with a cookie stealer, this allows the banker to automate the entire money extraction process without operator intervention. Given the growing popularity and availability of instant payment platforms, it is likely that other banker strains will adopt these techniques in the near future.

A new banker strain worth noting, discovered by <code>TrendMicro</code>, is <code>TgToxic</code>. This strain targets Asia through an elaborate phishing campaign that employs fake websites, compromised social media groups, and instant messages from the threat actors. <code>TgToxic</code> utilizes a gesture automation framework, enabling it to read and replicate user inputs. Combined with login extraction capabilities, the malware can send crypto payments using its hijack script without requiring user interaction. Victims may face difficulties in removing <code>TgToxic</code>, as it actively attempts to prevent removal via the accessibility service.

The long-term downward trend in the banker sphere continues according to our data. Similar to last quarter, we observe a 23% decline in protected users this quarter compared to last quarter.&nbsp;

In this quarter, Turkey has moved into the top spot for the highest number of protected users, overtaking Spain, followed by France in third place and Brazil in fourth. Both Brazil and Turkey experienced a slight increase in protected users, while France saw a significant drop of over 50% and Spain lost more than 25% of protected users.&nbsp;<h4>Spyware and 0-days&nbsp;&nbsp;</h4>Spyware is used to spy on unsuspecting victims with the intent of extracting personal information such as messages, photos, location, or login details. It uses fake adverts, phishing messages, and modifications of popular applications to spread and harvest user information. State backed commercial spyware is becoming more prevalent and is used to target individuals with 0-day exploits.&nbsp;Spying on unsuspecting victims continues to be a prevalent issue, as our data indicates that spyware maintained its negative impact throughout this quarter. <code>Spymax</code> leads the pack over the last three months, accompanied by reports of trojanized messaging apps using machine learning to steal cryptocurrency, as well as multiple zero-day attacks targeting both <code>Android</code> and <code>iOS</code> devices.&nbsp;<code>Spymax</code> remains largely unaltered, primarily aiming to extract personal information such as SMS, contact lists, location, and even live streaming the screen in some newer versions. More recently, it has targeted bank details, login credentials, and even crypto wallet information, blurring the boundaries between spyware and banker families. Fake advertisements, malicious redirects, and various phishing methods continued to facilitate <code>Spymax</code>‘s distribution this quarter. Facestealer and malicious messenger mod apps followed closely behind <code>Spymax</code> in the spyware category&nbsp;<code>ESET</code> has discovered a new strain of <a href="https://www.welivesecurity.com/2023/03/16/not-so-private-messaging-trojanized-whatsapp-telegram-cryptocurrency-wallets/">trojanized messenger</a> apps that target cryptocurrency wallets and related messages, affecting both <code>Android</code> and <code>Windows</code> devices. The messenger apps contain built-in clippers that allow for extraction of sensitive information such as crypto wallet recovery phrases, in some cases using machine learning to extract text from screenshots of recovery phrases. &nbsp;Additionally, the malware can swap cryptocurrency wallet addresses in sent messages, resulting in fraudulent transactions being redirected to a different wallet than intended. Some versions were also bundled with remote access trojans. The spyware was distributed through fake messenger advertisements, which directed users to copycat websites serving the malware. As advised in the previous quarter, users should download apps from official sources and avoid using mods for messenger apps to stay safe.&nbsp;

In recent years, there has been growing awareness and coverage of government-backed attacks utilizing commercial spyware. Regrettably, this trend persists in the current quarter, as Google has reported multiple <a href="https://blog.google/threat-analysis-group/spyware-vendors-use-0-days-and-n-days-against-popular-platforms/">zero-day attacks</a> targeting both <code>iOS</code> and <code>Android</code> users. One chain of exploits was disseminated through SMS package delivery phishing, using a malicious link to trigger the exploit. On <code>iOS</code>, this led to the delivery of the <code>Predator</code> spyware payload, while on <code>Android</code>, a <a href="https://press.avast.com/en-us/avast-threat-report-consumers-plagued-with-refund-fraud-tech-support-scams-and-adware">zero-day discovered by Avast</a> was used to deliver spyware onto victims’ devices. Subsequently, users were redirected to the official page, leaving them unaware of the events that had transpired.&nbsp;Another chain of exploits targeted UAE users via the <code>Samsung</code> mobile browser, delivering C++ written spyware that focused on popular messaging apps and browser activity extraction. Users are strongly encouraged to keep their devices updated with the latest patches to mitigate the risks posed by these exploit chains.

In this quarter, Brazil had the highest number of protected users, while Turkey experienced a significant increase and secured second place. They are followed by India, the United States, and Egypt. According to the data visualized on the map, users in Yemen continue to be at the greatest risk of encountering spyware.

Spyware is experiencing a gradual decline, similar to the trend observed last quarter. Although several new strains of spyware were discovered in the previous quarter, the overall numbers do not indicate an increase. Zero-day attacks are not expected to have a significant impact on the number of protected users, as they are often used sparingly and target specific individuals.&nbsp; &nbsp;<h4>TrojanSMS Steals the Show&nbsp;</h4>TrojanSMS is a type of malware that focuses on exploiting premium SMS or subscriptions to extract money from victims, some versions may also steal SMS messages. It usually comes with stealth features with the aim of hiding on victim devices and siphoning money unnoticed. Fake app stores and pop ups often distribute this type of malware.&nbsp;In this quarter, two primary strains, <a href="https://www.zimperium.com/blog/dark-herring-android-scamware-exceeds-100m-installations/">Darkherring</a> and <a href="https://blog.avast.com/smsfactory-android-trojan">SMSFactory</a>., affected the most users. Older strains of previously prevalent <code>TrojanSMS</code> disappeared entirely last quarter, while a new <code>TrojanSMS</code> emerged this quarter, poised to evolve and expand its reach. Generic SMS stealers or senders have also increased their presence.&nbsp;The <code>TrojanSMS</code> family comprises a diverse range of malware capable of stealing SMS messages, subscribing users to fraudulent premium services, or sending premium SMS. Often featuring stealth mechanisms to avoid detection and removal, these applications can wreak havoc on a victim’s mobile bill if not discovered promptly.&nbsp;<code>Darkherring</code> is on the rise again, similar to the previous quarter when its distribution increased through third-party stores and other methods. A few applications were spotted on the <code>Play Store</code>, but they were removed shortly after being reported. In contrast, <code>SMSFactory</code> lost 50% of its impact compared to last quarter, indicating a declining strain. No significant changes to its functions were observed this quarter.&nbsp;A <code>TrojanSMS</code> stealer called <code>SMSEye</code> is worth noting, as it has its own dedicated GitHub page, enabling other malicious actors to use it. The stealer initially emerged last quarter, with its second version appearing this quarter. <code>Cyble</code> reported that it was used to <a href="https://blog.cyble.com/2022/11/15/phishing-campaign-targeting-indonesian-bri-bank-using-sms-stealer/">target an Indonesian bank</a> through a phishing campaign to distribute the malware to users. <code>SMSEye</code> sends stolen SMS messages to a <code>Telegram</code> bot, in this case targeting user login credentials. Test versions of this malware have been observed featuring other bank and delivery service logos, suggesting the likelihood of more sophisticated uses for this stealer in the future.

This quarter, we observe intriguing shifts in the distribution of <code>TrojanSMS</code> by protected users among countries. Poland claims the top spot, followed by Egypt, Brazil, and Mexico. Poland experienced a significant increase in protected users, while both Egypt and Brazil saw a decrease in protected users this quarter. As illustrated in the map below, Iraq and Jordan have the highest risk ratios for <code>TrojanSMS</code>.

Consistent with the previous quarter, we observe a steady decline in the number of affected users this quarter. The exit of <code>UltimaSMS</code> and <code>Grifthorse</code>, along with the gradual decline of <code>SMSFactory</code>, contribute to this decrease. However, the introduction of <code>SMSEye</code> may potentially help maintain these numbers in the upcoming quarter.

Jakub Vávra, Malware Analyst<h2>Acknowledgements / Credits</h2><h6>Malware researchers</h6>Adolf Středa Alexej Savčin David Álvarez Igor Morgenstern Jakub Křoustek Jakub Vávra Jan Rubín Jan Vojtěšek Ladislav Zezula Luigino Camastra Luis Corrons Martin Chlumecký Ondřej Mokoš Vladimír Žalud<h6>Data analysts</h6>Filip Husák Pavol Plaskoň<h6>Communications</h6>Emma McGowan Grace Macej Marina Ziegler

Overview of the latest cyberthreats and emerging trends in the security landscape

Avast Q1/2023 Threat Report

<h2>Foreword</h2>Welcome to the latest edition of the Avast Threat Report, which covers <code>Q4/2022</code>. As we’ve closed 2022 and have entered 2023, we look back at the challenges of the final quarter of last year and the many new threats and malware strains that emerged during it. 2022 was a challenging year for cybersecurity, and its last quarter was no exception. The threat landscape continued to evolve at a rapid pace, and individuals as well as organizations of all sizes were faced with new and increasingly sophisticated attacks. In this report, we will take a closer look at the trends and developments that took place during Q4, providing valuable insights into the current state of cybercrime.From my point of view, one of the most interesting things from <code>Q4/2022</code> wasn’t directly related to malware (at least for now). I’m referring to <code>the launch of ChatGPT</code>, a chatbot developed by <code>OpenAI</code>. Some people have already started using it as a <code>virtual assistant</code> for creating short code sequences, explanation of assembly code, or even writing a paragraph in a report foreword (wink-wink). No matter the tool’s inaccuracy or how many generic phrases or false things it produces,&nbsp; <code>ChatGPT</code> is already being analyzed by cybercriminals with malicious intentions. The <code>creation of phishing messages</code> as well as <code>generating simple code snippets</code> for script-kiddies is low-hanging fruit, but it’s too early to say how the malicious uses of <code>ChatGPT</code> will continue in the upcoming year.Within more traditional threat topics, this report will focus on awesome discoveries of my colleagues who discovered, blocked, and <code>responsibly disclosed two zero-days used in the wild</code> by advanced threat actors (<code>CVE-2022-3723</code> and <code>CVE-2023-21674</code>). Of a similar importance was a great hunt for <code>Mustang Panda</code> in Myanmar that we reported on in depth.Furthermore, we will focus on a <code>flood of DealPly adware</code> that took place in Brazil and Europe. Similarly, there was a <code>quadruple growth of the Arkei Stealer</code> prevalence worldwide and <code>triple</code> for <code>LimeRAT</code>, especially in Asia and Latin America. Next, as <code>Bitcoin was hitting its local lows in Q4/2022</code>, the situation was dramatically different with malicious coinmining activity, where the Balkan states were especially heavily targeted. Moreover, <code>technical support scams (TSS) peaked</code> in this quarter.Threat actors also demonstrated their creativity when dealing with <code>deprecation of their favorite infection vector: Office documents</code>. We already touched this topic in the <a href="https://decoded.avast.io/threatresearch/avast-q3-2022-threat-report/">Q3 Report</a>, but the malware authors continued with their effort and employed techniques such as <code>HTML smuggling, SEO poisoning, and the injection of Office templates</code> in their latest malware campaigns.The situation on mobile was also thrilling with the new <code>Bully Facestealer</code> or the <code>BrasDex banker</code> that automates fraudulent payments. At the same time, <code>adware won (by a landslide) its number one position as the most prevalent mobile threat</code>.Unfortunately, ransomware still has not been eradicated. However, the fight against it continues with particular successes; for example, one of the <code>Netwalker ransomware</code> affiliates will enjoy&nbsp; <code>well-deserved jail time</code> and we also decrypted the <code>MafiaWare666 ransomware</code> and provided a <code>free decryption tool</code> for its victims.And finally, I can also recommend the story about <code>DDosia</code>, an attack tool developed and used by a pro-russian group, which also resulted in <code>trying to interfere with the Czech presidential election</code> in early January 2023. We hope you enjoy reading the following deep dives into each of the aforementioned threats and findings.&nbsp;Jakub Křoustek, Malware Research Director&nbsp;<h2>Methodology</h2>This report is structured into two main sections: Desktop-related threats, where we describe our intelligence around attacks targeting the Windows, Linux, and Mac operating systems, including a special focus on web-related threats, and mobile-related threats, where we describe the attacks focusing on the Android and iOS operating systems.Furthermore, we use the term risk ratio in this report to describe the severity of particular threats, calculated as a monthly average of “Number of attacked users / Number of active users&nbsp; in a given country.” Unless stated otherwise, calculated risks are only available for countries with more than 10,000 active users per month.<h2>Desktop-Related Threats</h2><h3>Advanced Persistent Threats (APTs)</h3>One of the most active APT campaigns was <code>ShadowPad/ScatterBee</code>, which spread in Pakistan during <code>Q4/2022</code>. Nevertheless, there was another APT campaign discovered by our team that was even more significant and impactful: <code>A strong activity from Mustang Panda targeting Burmese government</code> institutions and Burmese human rights activists. We gained new insights into their activities and campaigns, but their operations retain a similar modus operandi and targets. We recently presented our research on “<code>Hitching a ride with Mustang Panda</code>” at the AVAR conference.<h4>Mustang Panda</h4>We <a href="https://decoded.avast.io/threatintel/apt-treasure-trove-avast-suspects-chinese-apt-group-mustang-panda-is-collecting-data-from-burmese-government-agencies-and-opposition-groups/">published a report</a> on an espionage operation in Myanmar that we attributed to <code>Mustang Panda</code>. We also presented our findings on this operation at the <a href="https://aavar.org/cybersecurity-conference/index.php/hitching-a-ride-with-mustang-panda/">AVAR conference</a> for security researchers. According to our telemetry, we found that some of Myanmar government institutions were relentlessly attacked and breached. <code>Mustang Panda</code> was exfiltrating sensitive documents, recordings, and email dumps <code>including scans of passports</code> from Asian, American, and European citizens and diplomats applying for Burmese visas, from Burmese human rights activists Burmese government institutions.The operation was identified when we discovered a distribution server linked to a malware infection in Myanmar. While the <code>primary exfiltration</code> path went through <code>Google Drive</code>, the files from Google Drive were later on moved to the distribution server. Once the threat actor retrieved the data from the distribution server, the data was deleted. This means that we could nevertheless access only a limited part of the data. Since the throughput was usually <code>gigabytes of data per day</code>, we have managed to establish a basic victimology to be able to inform affected parties.While the used tooling contained <code>Mustang Panda</code>’s staples such as <code>Korplug</code> or <code>Delphi USB installer</code>, most of the discovered tools were rather simplistic and without sophisticated obfuscation. <code>DLL side-loading</code> has been a common theme for most of the tools found during the analysis.&nbsp;Luigino Camastra, Malware Researcher Igor Morgenstern, Malware Researcher&nbsp;<h3>Adware</h3>At the end of <code>Q3/2022</code>, we recorded the rapid rise of the adware activities that were continuing into the beginning of <code>Q4/2022</code>, as the graph below illustrates.

The rise at the turn of the quarters is an effect of the <code>DealPly adware</code> that we introduced in the previous <a href="https://decoded.avast.io/threatresearch/avast-q3-2022-threat-report/">Q3/2022 Threat Report</a>. The <code>DealPly</code> family is classified as an unwanted application because it can be installed silently with some other browser extensions and free software but also via malware.In <code>Q4/2022</code>, <code>DealPly</code>’s risk ratio was higher in most countries compared to the previous quarter. The risk ratio for <code>DealPly</code> adware remained the same or slightly increased in Asia, but there are some outliers. The <code>DealPly</code> risk ratio increased in South and Southeast Asia; namely India, Myanmar, and Indonesia. A more <code>significant increase</code> in <code>DealPly</code>’s risk ratio was also observed in many European countries. As animated in the map below, we registered a most significant increase in South and North America, especially in Brazil.

The risk ratio for all adware strains is slightly higher than in <code>Q3/2022</code>, although the map below visually demonstrates a considerable spread of adware. The <code>extreme peak of the DealPly adware</code> activity explains this phenomenon. However, there’s a <code>downward year-round trend</code> of adware activity.

<h4>Adware Market Share</h4>The clearly identified <code>market leader</code> in adware remains <code>DealPly</code>, which has a <code>30% share</code>. We assign orders of lower magnitude shares to other strains as follows:<ul><li><code>BrowserAssistant</code> (5%)</li><li><code>RelevantKnowledge</code> (4%)</li><li><code>DownloadAssistant</code> (3%)</li><li><code>ICLoader</code> (2%)</li></ul>However, <code>other unknown strains covered up 30%</code> of the market share in Q4/2022. The strains have a common behavior that waits for a user to click on an arbitrary hyperlink and <code>replaces the original link</code> with one redirecting the user to advertising websites.The list of the most-seen ad servers and their percentage representation in the wild is as follows:<ul><li><code>naigristoa[.]com</code> (48%)</li><li><code>ptuvauthauxa[.]com</code> (35%)</li><li><code>oovaufty[.]com</code> (8%)</li><li><code>go[.]ad2upapp[.]com</code> (4%)</li><li><code>saumeechoa[.]com</code> (2%)</li></ul>Mostly, adware leads on websites to download free software or offer other products. It’s a business model of online spammers that isn’t particularly dangerous from a security point of view; however, it’s terribly annoying for users. What’s more, the theft of personal data, including payment cards, can be hazardous because some ads convince victims that they have won and require contact and payment information. Furthermore, there is still a not negligible group of adware loading inappropriate content with harmful scripts. Adware can then take control of the system and deploy malware, e.g., ransomware, spyware, RATs, etc. Therefore, the presence of adware is a reason to increase attention and secure one’s system with an antivirus program.&nbsp;Martin Chlumecký,&nbsp;Malware Researcher&nbsp;<h3>Bots</h3>The story of the <a href="https://decoded.avast.io/martinchlumecky/ddosia-project/">DDosia project still continues</a>. <code>DDosia</code> is the project of the Russian <code>NoName057(16)</code> hacker group that recruits volunteers to carry out <code>DDoS attacks</code>. This project marked a change in the direction of the said group, as it eventually <code>replaced the Bobik botnet with a project relying on volunteers</code>. At the beginning of December, <code>DDosia</code>’s C&amp;C server was taken down; nevertheless, the group still shares information about their attacks and promotes their project. For this reason, we presume that a new C&amp;C server was set up. Since we started tracking the project on August 1, 2022, we have seen <code>more than 2,200 DDoS targets</code> (390 of which the group referred to as successful), yielding a 17% success rate with approximately 1,000 participants.&nbsp;If we account for the related, partially coexistent <code>Bobik botnet</code>,&nbsp; we arrive at around 1,400 targets and 190 successful botnets, slashing the success rate to 13%. <code>DDosia</code> also <a href="https://twitter.com/AvastThreatLabs/status/1614174066591531008">targeted sites associated with the Czech presidential elections</a>, which took place on January 13-14, 2023. Websites of presidential candidates and others presenting the election results were found among the targets being distributed within the <code>DDosia</code> project. Fortunately, given the way the election results are calculated and distributed, even long-term unavailability of the sites wouldn’t affect the election results, and media would be notified through special channels.We’ve seen some new tricks in the world of malicious documents. If we look at <code>Emotet</code> as an example, the malware uses malicious documents to trick users into manually copying the document into a <code>Microsoft Office Template folder</code> and launching it from there. Since the folder is a trusted location, the usual <code>execution protection is disabled</code>; therefore, opening the document from this folder will trigger the execution of the macros contained within it.<code>Emotet</code> has also been productive in the <code>evasion technique</code> development. It started to <code>use timers</code> to incrementally proceed in a payload’s execution. We have also observed changes in its communication protocol that are not backward compatible with the previous version of the protocol. As if that wasn’t enough, <code>Emotet</code> has been responsible for the <code>significant peak</code> (see graph below) in the botnet-related risk ratio in early November when it launched a <code>massive spam campaign</code> that mostly utilized variants of Microsoft Excel files (XLS).<code>Qakbot</code> has also been busy this quarter. The botnet started to use so-called <code>HTML smuggling</code> to hide an encoded malicious script within email attachments. More specifically, they started to abuse SVG images to hide malicious payloads and the code used for their reassembly. Once the user opens the attachment in the browser, the browser launches the code hidden inside the SVG image which, in turn, reconstructs the payload hidden inside the SVG image. The user is then prompted to save a file by the browser and instructed by the “cover” data to open the file. Since the malicious payload is reconstructed on the device, this technique presumably <code>aims to bypass security solutions</code> relying on network traffic analysis.

As for general trends, we’ve seen a <code>significant increase in Qakbot and Amadey’s activity</code>, which has more than doubled. In spite of its massive spam campaign, <code>Emotet</code> has gone through a slight decline. Interestingly, an older .NET open-source botnet, <code>BlackNET</code>, has also seen a <code>significant rise</code> in its activity, which has doubled in comparison to the previous quarter.&nbsp;Adolf Středa, Malware Researcher&nbsp;<h3>Coinminers</h3>Cryptocurrencies experience difficult times. After turbulent events, such as the <code>bankruptcy of FTX</code> in November 2022, the <code>prices are marking similar low values</code> as at the end of 2020. The same goes for the coinminer activity, as we’ve observed a slight overall decrease (-4%) once again during <code>Q4/2022</code>.

Following the last quarter, users in Serbia were once again most at risk of encountering a coinminer in <code>Q4/2022</code>, with a massive 7.44% risk ratio. The risk ratio of users in Montenegro was 5.99%, followed by Bosnia and Herzegovina with a 3.96% risk ratio, and Madagascar with 3.90%. In <code>Q4/2022</code>, Avast saw a high increase of coinminer activity in Indonesia, resulting in a 46% increase in protected users.

Traditionally, <code>web miners</code> are still on the top of the coinmining food chain with 66% market share, followed by <code>XMRig</code> with 18.42% market share, which increased by 18% compared to the previous quarter. <code>KingMfcMiner</code> continues to grow, having increased its market share by 47% in <code>Q4/2022</code> (this resulted in a 44% increase of protected users).The most common coinminers in <code>Q4/2022</code> were:<ul><li>Web miners (various strains)</li><li>XMRig</li><li>CoinBitMiner</li><li>VMiner</li><li>SilentCryptoMiner</li><li>CoinHelper</li><li>NeoScrypt</li></ul>&nbsp;Jan Rubín, Malware Researcher&nbsp;<h3>Information Stealers</h3><code>Q4/2022</code> brought a <code>significant increase in Arkei</code> (also known as its fork <code>Vidar</code>) information stealer, where we protected a whopping 437% more of our users against this threat. We also noticed a respective 57% and 37% increase of users protected against <code>AgentTesla</code> and <code>RedLine stealers</code>. Thankfully, the <code>overall activity of infostealers decreased</code> by 6%, following the trend of the previous quarter, which was mostly due to a decrease in <code>FormBook</code> activity.

Reports

Gen Q3/2024 Threat Report

Gen Q2/2024 Threat Report

Avast Q4/2023 Threat Report

Avast Q1/2023 Threat Report

Avast Q4/2022 Threat Report

Avast Q3/2022 Threat Report

Avast Q2/2022 Threat Report

Avast Q1/2022 Threat Report

Avast Q4/21 Threat report

Avast Q3’21 Threat Report