Threat Research Team

Reports

<h2>Foreword&nbsp;</h2>The year is over, and we can confidently conclude that 2024 was record-breaking. In Q4 alone, we successfully blocked 2.55 billion threats — equivalent to 321 attacks every second and a 9% increase compared to 2023. Social engineering threats, particularly scams, dominated the landscape, making up 86% of all attacks.&nbsp;

Some of you might recall what we <a href="https://decoded.avast.io/threatresearch/avast-q321-threat-report/" target="_blank" rel="noreferrer noopener">mentioned back in 2021</a>, when we launched this series: the threat landscape is highly dynamic and constantly evolving. At that time, we were witnessing one of the major shifts – the move beyond <a href="https://www.avast.com/c-malware">malware</a> and attacks on devices (e.g., exploits, droppers, banking trojans) to more human-centric attacks. While malware threats remain as we enter 2025 and continue to require robust defenses, today’s scam-related threats are far more dangerous, both technically and psychologically.&nbsp;As we step into the new year, we see new threats on the horizon. Rapid advancements in AI and large language models (LLMs), such as <a href="https://openai.com/index/introducing-operator/" target="_blank" rel="noreferrer noopener">OpenAI’s Operator</a>, capable of automating our daily online tasks (e.g., paying invoices, placing online orders), are being eyed by attackers as the next frontier. Imagine the risks when malicious actors attack or manipulate these AI agents. It’s a shift that would redefine the threat landscape yet again.&nbsp;But before we look forward, let’s review the key developments in the final quarter of 2024. Our featured story, The Dark Side of Social Media, delves into how cybercriminals target billions of users across social platforms. Social media threats have evolved beyond traditional malware, with scams such as malvertising, fake e-shops, and phishing becoming prevalent. Facebook emerges as the dominant source of these attacks, followed by YouTube. We also showcase how each platform faces different types of threats, influenced by their unique purposes and user bases, with cybercriminals tailoring their tactics accordingly.&nbsp;The social media threat landscape is closely linked to campaigns targeting personal data, which grew in complexity and scale in the last quarter. Campaigns like ClickFix and FakeCaptcha – what we call “Scam-Yourself Attacks” - continued to psychologically manipulate users. We safeguarded over 4.2 million unique users from FakeCaptcha scams alone, a staggering 130% increase compared to the previous quarter. To help protect people from this growing threat, we introduced a <a href="https://www.gendigital.com/blog/news/family-of-brands/clipboard-protection" target="_blank" rel="noreferrer noopener">Clipboard Protection feature</a> that blocks clipboard-based threats before execution. The attackers linked to these scams deployed the NetSupport remote access trojan (RAT) with iterative improvements to its script, reportedly developed using AI tools like ChatGPT, highlighting the dual role of AI in cybersecurity.&nbsp;While scams dominated the quarter, <a href="https://www.avast.com/c-what-is-ransomware">ransomware</a> threats continued to escalate, with attacks surging by 50% in Q4/2024 building on a staggering 100% increase in Q3/2024. Magniber emerged as the most prevalent ransomware family, accounting for 62% of all detected cases. We observed notable increases in regions such as Mexico (+230%), Japan (+180%), and parts of Europe (e.g., Austria and France, both +100%). Furthermore, Advanced Persistent Threats (APTs) also remained a critical concern, as groups like Lazarus Group employed zero-day exploits and sophisticated social engineering tactics to steal sensitive information from high-value targets.&nbsp;Financial threats demonstrated both persistence and innovation in the fourth quarter, with mobile banking trojans like DroidBot and ToxicPanda targeting EU users across advanced techniques such as NFC relay attacks and the disabling of system monitoring. The BankBot banker also saw a 236% increase in protected users compared to Q3/2024. In India, attackers used WhatsApp to distribute trojans disguised as utility payment apps. Unfortunately, they left the database unsecured, allowing access to thousands of stolen victim credentials. <a href="https://www.avg.com/en/signal/what-is-spyware">Spyware</a> threats also surged, with SpyLoans campaigns causing spikes in several regions, despite law enforcement crackdowns. Furthermore, Crypto scams evolved further, with campaigns like CryptoCore leveraging high-profile events and deepfake technology to defraud victims of millions. The CryptoCore attackers targeted individuals through fake investment schemes tied to newsworthy subjects including the U.S. presidential election and Elon Musk announcements. These deepfakes and manipulated narratives enabled attackers to gain victims’ trust and convince them to transfer funds. This marked the attackers' largest campaign to date, stealing over $7 million in Q4/2024 alone.&nbsp;Scams remained widespread, demonstrating remarkable adaptability. Fake e-shops, for instance, were particularly active during Black Friday and Christmas, using poisoned search results, social media ads, and phishing emails to deceive shoppers. Beyond financial losses, these scams often led to compromised personal data, resulting in identity theft and financial fraud or long-term credit damage. Dating scams also gained momentum, particularly in Nordic countries, preying on individuals’ emotions and trust. Meanwhile, technical support scams surged in localized areas, such as Switzerland and Japan, with attackers adjusting their methods to align with local preferences and contexts. Malvertising continued to serve as a major vector for scams and malware, comprising 41% of all blocked attacks this quarter, the largest share of any single threat type.&nbsp;As we enter 2025, these findings highlight three critical areas that are evolving within the threat landscape: APTs and ransomware, scams and fraud, and attacks on AI systems and AI-driven attacks. Threat actors are constantly refining their tactics to exploit vulnerabilities, both human and technological, across each of these areas.&nbsp;Wishing you an enjoyable read and a safe year ahead in 2025, with security both online and off.&nbsp;Jakub Křoustek, Malware Research Director&nbsp;<h2 class="text-align-justify">Methodology&nbsp;</h2>This report is structured into three main sections: Desktop-related threats, where we detail our intelligence on attacks targeting the Windows, Linux and Mac operating systems, specifically emphasizing web-related threats; and Mobile-related threats, where we describe the attacks focusing on Android and iOS operating systems.&nbsp;We use the term “risk ratio” in this report to denote the severity of specific threats. It is calculated as a monthly average of the formula: “Number of attacked users / Number of active users in a given country.” Unless stated otherwise, risk ratios are only reported for countries with more than 10,000 active users per month.&nbsp;A blocked attack is defined as a unique combination of a protected user and a blocked threat identifier within a specified time frame.&nbsp;Our quarterly threat reports provide insights about the threat landscape as observed from the Gen family of Cyber Safety brands. We continuously improve our threat telemetry and anticipate further refinements in future reports.&nbsp;<h2 class="text-align-justify">Scams, Threats and Cybercrime&nbsp;</h2><h3 class="text-align-justify">A closer look at how cybercriminals target billions of people through social media platforms&nbsp;</h3>The world is evolving. Today’s threats have moved beyond malware, with new forms of scams arising daily, plaguing our digital world and aiming to defraud unsuspecting victims. The days of <a href="https://us.norton.com/blog/malware/what-is-a-trojan">trojans</a> and worms being the biggest security concerns for people online are gone. Make no mistake, these threats still exist and we need to remain protected against them, but today’s threats are far more dangerous, both technically and psychologically.&nbsp;&nbsp;Adding to this complexity is the rise of Artificial Intelligence (AI), which has recently become a game-changer for cybercriminals. AI-powered tools allow scammers to create highly convincing and adaptive attacks, from <a href="https://www.avast.com/c-deepfake">deepfake videos</a> and voice synthesis to personalized phishing messages crafted to deceive even the most cautious people. This technological edge makes today’s scams much more effective and harder to detect than ever before.&nbsp;One of the most dangerous playgrounds for today’s cybercriminals is social media. It encompasses a wide range of platforms, including traditional social media, video-sharing platforms and messaging apps. These platforms serve different purposes, from connecting friends to sharing content, and their demographics vary significantly.&nbsp;From a security perspective, it’s not just the platforms’ user content and functionality that make them unique, it’s also the nature of the attacks they attract. Each platform’s distinct features and audience shape the strategies cybercriminals use to exploit them. From phishing links on messaging apps to fake profiles on traditional social networks, the variety of scams reflects the diversity of the platforms themselves. In this article, we’ll take a look at these threats, specifically pertaining to Facebook, YouTube, Instagram, TikTok, X, LinkedIn and Messenger platforms.&nbsp;<h3 class="text-align-justify">The Latest in Social Scamming&nbsp;</h3>Scammers have found fertile ground in social media, exploiting their massive user bases and diverse functionalities to target unsuspecting individuals. One prominent example is the "<a href="https://www.gendigital.com/blog/insights/research/tiktok-elonmusk-scam" target="_blank" rel="noreferrer noopener">TikTok Elon Musk Scam</a>", where fraudsters impersonated the tech billionaire to promote fake cryptocurrency giveaways, enticing people to send funds with the promise of doubling their returns. Particularly, the sophistication of the impersonation made it effective, preying on Musk’s real-world influence and TikTok’s younger, tech-curious demographic. Meanwhile, fraudulent job offers have surged under the guise of "<a href="https://www.gendigital.com/blog/insights/research/part-time-job-scams" target="_blank" rel="noreferrer noopener">Part-Time Job Scams</a>", luring individuals with promises of easy income, but ultimately compromising personal information or demanding upfront payments.&nbsp;&nbsp;Another case, the "<a href="https://www.gendigital.com/blog/insights/research/how-a-skype-notification-turned-into-a-costly-lesson" target="_blank" rel="noreferrer noopener">Skype Notification Scam</a>", demonstrates how even old-fashioned messaging apps can lead people into costly traps, showcasing the many ways cybercriminals manipulate trust and digital habits. Additionally, phishing attacks often use social media to harvest account credentials, <a href="https://x.com/GenThreatLabs/status/1854565018177597786" target="_blank" rel="noreferrer noopener">spreading malicious campaigns</a> within the same ecosystem they exploit.&nbsp;However, beyond the specific stories and articles discussing the general risks and threats in social media,&nbsp;many questions remain unanswered. What are the chances of encountering an attack on social media? Which platforms are the most "dangerous"? What are the actual types of threats we can find there? Our researchers set out to answer these questions.&nbsp;<h3 class="text-align-justify">Threats Across Social Media&nbsp;</h3>When analyzing threats detected across social media platforms, Facebook emerges as the dominant source of detected threats, accounting for an alarming 56.19% of the total. YouTube follows with 25.92%, while platforms like X, Reddit, and Instagram contribute 6.91%, 4.65%, and 3.79%, respectively. The remaining threats are scattered across other platforms. This distribution highlights the disproportionate risk posed by some platforms due to their user base size, engagement patterns, and platform-specific characteristics.&nbsp;&nbsp;Interestingly, we have blocked six times more threats on Telegram than on WhatsApp, despite WhatsApp having a significantly larger user base. This aligns with previous observations, where scammers often redirect victims to continue conversations on Telegram, leveraging its unique features to further their schemes. The chart below provides a visualization of these figures, highlighting how cybercriminals capitalize on the distinct dynamics of each platform to target users effectively.&nbsp;

What are the threats that are targeting people on social media? There is a wide range, including:&nbsp;<ol><li>Malvertising (26.95%): Cybercriminals spread malware or redirects users to malicious websites through deceptive online advertising. These ads often distribute harmful content disguised as legitimate advertisements.&nbsp;</li><li>E-shop Scam (23.47%): Attackers create fake online shops (e-shops) to trick users into making purchases. Victims either receive counterfeit goods or nothing at all, losing money and potentially exposing personal data.&nbsp;</li><li>Phishing (18.07%): Scammers use deceptive messages, emails or websites to steal sensitive information such as credit card numbers, banking credentials or passwords. These campaigns often mimic legitimate communications.&nbsp;</li><li>Financial Scam (10.68%): Attackers trick people into giving money or sensitive financial information. Common examples include fake investment opportunities and fraudulent loan offers.&nbsp;</li><li>Generic Scam (10.24%): This broad category includes scams where attackers aim to deceive victims into sharing personal information or money, without fitting into the more specific categories above.&nbsp;</li><li>Tech Scam (5.43%): Scammers impersonate legitimate technical support providers to gain access to victims' computers and data. These scams typically start with fake error messages or unsolicited calls offering help.&nbsp;</li><li>Dating Scam (2.93%): Cybercriminals establish fake romantic relationships to trick victims into sending money or sharing personal information, typically on dating platforms or social media using fake profiles.&nbsp;</li><li>Others (2.24%): A collection of less common, but still significant, threat types that exploit social media in various ways.&nbsp;</li></ol>

These figures show the diverse strategies used by cybercriminals to exploit users on social media. <a href="https://us.norton.com/blog/malware/malvertising">Malvertising</a> remains the dominant threat at 26.95%, targeting large user bases with scalable attack methods within advertising ecosystems. E-shop scams, accounting for 23.47% of threats, reflect how attackers exploit shopping-centric platforms like Facebook and Instagram to take advantage of users’ trust and urgency during transactions. Phishing, at 18.07%, continues to deceive unsuspecting users into revealing sensitive information through deceptive links and messages. Financial scams (10.68%) and generic scams (10.24%) demonstrate the diversity of tactics cybercriminals employ to target victims.&nbsp;&nbsp;The last quarter of 2024 saw a spike in online shopping activity, and cybercriminals were quick to take advantage of the increased traffic. Platforms like Facebook and Instagram, which promote shopping through integrated features, saw a notable rise in e-shop scams during this period. The urgency of holiday deals and the allure of discounts create the perfect conditions for scammers to thrive.&nbsp;Each platform is unique, with different types of users and content shared, reflected in the threats that are prevalent in each one. Let’s take a closer look at the five social media with more threats detected.&nbsp;Facebook&nbsp;The high prevalence of e-shop <a href="https://lifelock.norton.com/learn/fraud/facebook-scams">scams on Facebook</a>, accounting for 26% of all threats, contrasts sharply with their lower representation on other platforms. This is largely due to Facebook’s Marketplace and its community-based interactions, which scammers exploit through fake listings and impersonated sellers. Unlike YouTube's ad-centric threats, Facebook's focus on local commerce and its older demographics makes it an ideal ground for e-shop scams, particularly targeting less tech-savvy users.&nbsp;YouTube&nbsp;Malvertising dominates YouTube, accounting for 54% of the platform’s threats. This is driven by YouTube’s platform’s ad-based revenue model, which scammers exploit to deliver malicious ads to a vast, engaged audience. Unlike Instagram’s visually curated content, YouTube’s reliance on long video engagement provides more opportunities for malicious ads to appear, making it a prime target for malvertising campaigns.&nbsp;X (formerly Twitter)&nbsp;The overwhelming prevalence of generic scams on X, making up 62% of blocked attacks, reflects the platform's open nature and lack of stringent verification. Unlike Reddit’s community-focused structure, X’s fast-paced environment and trending hashtags provide scammers with the opportunity to inject fraudulent content, such as cryptocurrency giveaways and donation scams, into high-visibility discussions.&nbsp;

Reddit&nbsp;Malvertising (66%) and phishing (29%) are the dominant threats on Reddit. Unlike Instagram’s shopping-centric scams, Reddit’s reliance on user-generated content creates opportunities for malicious actors to embed harmful links in posts and comments. The decentralized nature of Reddit communities amplifies these threats, as scammers target niche audiences with tailored phishing schemes.&nbsp;Instagram&nbsp;E-shop scams dominate Instagram, accounting for 42% of threats on the platform. Unlike YouTube’s ad-driven ecosystem, Instagram’s visual-first design and integrated shopping features make it a prime target for scammers. The ability to create polished, fake product galleries and targeted ads enables fraudulent e-commerce to thrive on the platform, particularly during seasonal shopping periods like Q4.&nbsp;<h3 class="text-align-justify">Conclusion&nbsp;</h3>Social media platforms have evolved into bustling hubs for interaction, commerce and entertainment. However, their growth has also created fertile ground for cybercriminals. The interplay platform-specific features and seasonal trends, such as Black Friday and Christmas shopping frenzies, highlights the adaptability of modern scams.&nbsp;Looking ahead, the evolving nature of cybercrime on social media calls for innovative and adaptive approaches to security. As platforms integrate more features and users continue to share more of their lives online, finding the right balance between functionality and safety will be crucial. Only through collaboration between platforms, users and security experts can the growing tide of digital threats be effectively countered.&nbsp;Luis Corrons, Security Evangelist&nbsp; Patrik Holop, Researcher<h2 class="text-align-justify">Desktop-Related Threats&nbsp;</h2><h3 class="text-align-justify">Advanced Persistent Threats (APTs): From Fake Interviews to Zero-Day Exploits&nbsp;</h3>An Advanced Persistent Threat (APT) is a type of cyberattack that is conducted by highly skilled and determined hackers who have the resources and expertise to penetrate a target's network and maintain a long-term presence undetected.&nbsp;This quarter, the Lazarus Group, a North Korean advanced persistent threat (APT) actor, continued their stream of attacks by integrating both established and novel malware into its infection chains. In Q4/2024, the group continued to target individuals using compromised archive files masquerading as skill assessment tests for IT professionals, spread by Lazarus through LinkedIn messages. Additionally, Lazarus continues to abuse GitHub repositories to deliver JavaScript-based infostealers and leverage zero-day vulnerabilities to deploy the next stage of the attack chain. One notable example involved a fake job offer shared via a LinkedIn message, which directed recipients to a malicious website “willointerview[.]com”. This campaign targeted young IT and cybersecurity professionals who were looking for work.&nbsp;&nbsp;

The infection sequence employed by Lazarus is intricate, utilizing multiple malware components to establish a foothold within targeted systems. Through our research, combined with insights from Kaspersky, we have identified a new downloader and loader named CookiePlus, which is capable of downloading malicious shellcodes and DLLs. We have also observed Lazarus reusing a loader from a previous campaign, referred to as RollMid.&nbsp;In another recent campaign, Lazarus targeted cryptocurrency investors by creating a fake multiplayer online battle arena game called detankzone (hosted at "detankzone[.]com"), which it claimed to incorporate both decentralized finance and non-fungible token features.&nbsp; The website of the detankzone game, appearing as a legitimate game, contained hidden scripts that exploited a zero-day vulnerability in Google Chrome (CVE-2024-4947), enabling remote code execution upon visiting the site. After the remote code execution, Lazarus used another exploit to bypass V8 sandboxing.&nbsp;

This campaign highlights the Lazarus Group's consistent use of advanced tactics, such as zero-day exploits and deceptive lures, to infiltrate systems and steal sensitive information. Their operations remain focused on targeting IT professionals and individuals employed by organizations of strategic interest to the attackers.&nbsp;Luigino Camastra, Malware Researcher&nbsp;<h2>Data-Stealing Threats: Scam-Yourself Attacks Continue to Enable Data Theft&nbsp;</h2>Data-Stealing Threats are dedicated to stealing anything of value from the victim’s device. Typically, they focus on stored credentials, cryptocurrencies, browser sessions/cookies, browser passwords and private documents.&nbsp;The fourth quarter of 2024 saw a number of good-news headlines in the world of cyber gang takedowns. One of the biggest stories was <a href="https://www.operation-magnus.com/" target="_blank" rel="noreferrer noopener">Operation Magnus</a>, a joint effort by the Dutch National Police, the FBI and other partners, resulting in the take down of RedLine and META information stealers.&nbsp;While the protectors saw success in taking down malicious actors, new data theft threats emerged. <a href="https://www.gendigital.com/blog/insights/research/glove-stealer" target="_blank" rel="noreferrer noopener">Glove Stealer</a> is a newly discovered information stealer written in .NET. In addition to stealing browser data (cookies, autofill information, etc.), it also heavily focuses on cryptocurrency wallets, 2FA authenticators, password managers, email clients, and other sensitive data. This stealer also follows the trend of bypassing App-Bound Encryption, introduced in Google Chrome, using the IElevator service bypass. Note that we described many existing bypasses for the App-Bound Encryption in the previous <a href="https://www.gendigital.com/blog/insights/reports/threat-report-q3-2024" target="_blank" rel="noreferrer noopener">Q3/2024 report</a>.&nbsp;Furthermore, we continued to see many FakeCaptcha campaigns, distributing mostly information stealers and RATs. During Q4/2024, attackers introduced multiple <a href="https://x.com/GenThreatLabs/status/1854127111285375392" target="_blank" rel="noreferrer noopener">new adaptations</a> of well-known CAPTCHA designs, including CloudFlare.&nbsp;

Because of the high prevalence of ClickFix and FakeCaptcha campaigns (we will break down the statistics separately below), Gen introduced a brand-new <a href="https://www.gendigital.com/blog/news/family-of-brands/clipboard-protection" target="_blank" rel="noreferrer noopener">Clipboard Protection feature</a>, available in products across the Norton, Avast and AVG brands. This additional defense layer in our protection stack allows us to better address clipboard threats, including Scam-Yourself Attacks. Ultimately, this protection allows us to eradicate the threat before it even has the chance of being downloaded to the users’ systems.&nbsp;By analyzing content being copied from websites via FakeCaptcha scams, we <a href="https://www.gendigital.com/blog/insights/research/cybercriminals-leveraging-chatgpt-to-create-malicious-payloads" target="_blank" rel="noreferrer noopener">uncovered an attack chain</a> used for deploying the remote access trojan (RAT) NetSupport. This chain was orchestrated by a script iteratively developed by the attacker using ChatGPT. Findings like these not only highlight a growing trend of enabling low-skill actors to achieve high-impact outcomes, but they also prove that inventions like Clipboard Protection are key in helping make the world a safer place.&nbsp;ClearFake, one of the many notoriously known Fake Update actors, continued to <a href="https://x.com/GenThreatLabs/status/1849110244221243643" target="_blank" rel="noreferrer noopener">use ClickFix to deliver malware</a>. With the assistance of the EtherHiding technique for delivery, we observed the DarkGate information stealer with vast RAT capabilities being distributed.&nbsp;

Finally, in Q4/2024 we observed a 17% increase in the activity of AtomicStealer, also known as AMOS, one of the most advanced information stealers targeting macOS. This sophisticated malware is designed to steal a variety of personal information, enabling <a href="https://www.lifelock.com/how-it-works/what-is-identity-theft/">identity theft</a>, monetization of stolen data, and facilitating more targeted attacks. A rising trend for threats on this platform is the usage of PyInstallers. These provide a way of executing Python scripts even on devices with no Python installed, effectively simplifying the malware distribution.&nbsp;<h3 class="text-align-justify">Statistics&nbsp;</h3>We happily reported a significant 60% decrease in detections of Lumma Stealer in Q4/2024. This was a welcomed break following the previous quarter where Lumma Stealer spiked dramatically and increased its malware share by massive 1154% with data-stealing malware increasing in risk ratio by 32% in general. Additionally, after the aforementioned Operation Magnus, RedLine and META stealers ceased to operate. Even though it might seem like data theft is cooling in terms of the sheer numbers, we need to have a closer look at the threat landscape to understand the changes better.&nbsp;According to our data and estimations, the decrease of Lumma Stealer and thus information stealer activity overall is due to the protection against typical distribution methods for information stealers, including FakeCaptcha. This is further supported by introducing Clipboard Protection feature to our products. This naturally influences our statistics because we completely eliminate the delivery method at its very origin and thus sooner than the final payload would be delivered to infect the victims’ systems.&nbsp;As described in the previous quarter’s featured story, Scam-Yourself Attacks, such as ClickFix and FakeCaptcha, have taken off, launching massive campaigns all around the world. This trend continued in Q4/2024, where we protected more than 4.2M unique users against FakeCaptcha attacks. The risk ratio of encountering FakeCaptcha scams increased by +130% compared to the previous quarter.&nbsp;

The highest risk ratio of stumbling upon FakeCaptcha was in the Balkan states, including:&nbsp;<ul><li>Montenegro (9.76%)&nbsp;</li><li>Serbia (8.94%)&nbsp;</li><li>North Macedonia (8.92%)&nbsp;</li><li>Kosovo (8.51%)&nbsp;</li></ul>Other countries with a high-risk ratio were:&nbsp;<ul><li>Egypt (8.31%)&nbsp;</li><li>The Philippines (5.14%)&nbsp;</li><li>Argentina (2.91%)&nbsp;</li><li>Spain (2.17%)&nbsp;</li><li>Italy (2.66%)&nbsp;</li><li>India (1.69%)&nbsp;</li><li>Brazil (1.13%)&nbsp;</li><li>France (1.15%)&nbsp;</li></ul>Compared to the previous quarter, the overall risk ratio for information stealers decreased by 32% in Q4/2024.&nbsp;

Conversely, the risk ratio in Indonesia experienced a slight increase of 1.53%, while in Turkey, the risk ratio increased by 10%.&nbsp;

After losing 60% of its malware share, Lumma Stealer is, according to our data, in the second place in terms of information stealer share behind AgentTesla. However, AgentTesla also lost some presence, decreasing its malware share by 9%.&nbsp; Because of this shift in proportion, every other information stealer increased its malware share in Q4/2024. One of them stands out, however, as MassLogger increased its malware share by massive 437%, ranking amongst the top 10 stealers now.&nbsp;The most common information stealers with their malware shares in Q4/2024 were:&nbsp;<ul><li>AgentTesla (16%)&nbsp;</li><li>Lumma (12%)&nbsp;</li><li>FormBook (12%)&nbsp;</li><li>Ramnit (11%)&nbsp;</li><li>Fareit (7%)&nbsp;</li><li>SnakeKeylogger (5%)&nbsp;</li><li>MassLogger (4%)&nbsp;</li><li>Vidar (3%)&nbsp;</li><li>Lokibot (2%)&nbsp;</li><li>ViperSoftX (2%)&nbsp;</li></ul><h2 class="text-align-justify">Ransomware: Third Consecutive Quarter of Growth&nbsp;</h2>Ransomware is any type of extorting malware. The most common subtype is the one that encrypts documents, photos, videos, databases, and other files on the victim’s PC. Those files become unusable without decrypting them first. To decrypt the files, attackers demand money, “ransom”, hence the term ransomware.&nbsp;LockBit, one of the biggest players in the ransomware scene, went through some interesting changes in the latter half of 2024, with a significant decrease in the number of (published) attacks over the last 6 months:&nbsp;

Furthermore, the U.S. Department of Justice <a href="https://www.justice.gov/usao-nj/pr/us-charges-dual-russian-and-israeli-national-developer-lockbit-ransomware-group" target="_blank" rel="noreferrer noopener">announced</a> that they officially charged Rostislav Panev, a LockBit malware developer who was arrested in Israel and is currently awaiting extradition to the USA.&nbsp;&nbsp;

Panev was a key part of the LockBit gang, contributing to their path of destruction which has included attacking children’s hospitals amongst other organizations across industries. It seems, though, that the rest of LockBit has moved on from Panev after announcing that an updated version – LockBit 4.0 - is expected to launch in February.&nbsp;

<h3>Trigona Reemerges with Deceptive Strategy&nbsp;&nbsp;</h3>Trigona ransomware resurfaced in the summer of 2024, but this time with a change in tactics designed to hide its identity. Earlier attacks referenced their own leak site, but recent ransom notes avoid mentioning it altogether. Instead, they point to leak sites belonging to other ransomware groups such as KillSec, Hunters, and DragonForce. However, our analysis has not found any evidence of Trigona victims appearing on these other leak sites, making it unlikely that these groups are actually collaborating. The ransomware group also uses a slightly modified cryptor, which led to it being misclassified as part of a different malware family. Analysis of configuration data inside the binary files confirmed that it is the same Trigona ransomware with some adjustments. This new approach has been observed since June 2024, with additional samples appearing throughout the remainder of the year.&nbsp;

<h3 class="text-align-justify">Statistics&nbsp;</h3>For the third consecutive quarter, ransomware has continued its alarming upward trend, with a notable 50% increase in Q4/2024. This follows a staggering 100% rise in Q3/2024 and a 24% jump in Q2/2024. The sustained growth in ransomware activity highlights an ongoing, escalating threat to both individuals and organizations globally.&nbsp;According to our telemetry, Magniber is still the most prevalent ransomware (62% of malware share). Its high counts come from the <a href="https://www.gendigital.com/blog/insights/reports/threat-report-q3-2024" target="_blank" rel="noreferrer noopener">previous quarter</a>:&nbsp;

Countries with the highest increases in risk ratio are in South America, including:&nbsp;<ul><li>Colombia (+400%)&nbsp;</li><li>Uruguay (+400%)&nbsp;</li><li>Brazil (+370%)&nbsp;</li><li>Argentina (+300%)&nbsp;</li><li>Venezuela (+290%)&nbsp;</li><li>Peru (+270%)&nbsp;</li></ul>Risk ratios also increased in Mexico (+230%), Japan (+180%), Austria (+100%), France (+100%), and Canada (+100%).&nbsp;Absolute risk ratios per country are depicted in the following map:&nbsp;

Ladislav Zezula, Malware Researcher&nbsp; Samuel Vojtáš, Malware Researcher&nbsp; Jakub Křoustek, Malware Research Director&nbsp;<h2>Remote Access Trojans (RATs): Remcos Slowing Down&nbsp;</h2>A Remote Access Trojan (RAT) is a type of malicious software that allows unauthorized individuals to gain remote control over a victim's computer or device. RATs are typically spread through social engineering techniques, such as phishing emails or infected file downloads. Once installed, RATs grant the attacker complete access to the victim's device, enabling them to execute various malicious activities, such as spying, data theft, remote surveillance and even taking control of the victim's webcam and microphone.&nbsp;After a substantial increase in Q3/2024, the activity level of RATs remained consistent throughout Q4/2024. Interestingly compared to what we have seen in previous years, this year there was seemingly no decrease in RAT prevalence towards the end of the year.&nbsp;

Countries with the largest increases in risk ratio were:&nbsp;<ul><li>Algeria +37% (mostly driven by HWorm and njRAT)&nbsp;</li><li>Belgium +33% (AsyncRat, Remcos)&nbsp;</li><li>Netherlands +29% (Remcos, QuasarRAT)&nbsp;</li></ul>Largest decreases in risk ratio:&nbsp;<ul><li>Czechia -35%&nbsp;</li><li>Hungary -31%&nbsp;</li><li>Romania -25%&nbsp;</li></ul>The list of safest countries includes France, Sweden and Japan. France and Sweden kept their place among the top 3 countries least impacted by RATs from Q3/2024.&nbsp;

QuasarRAT saw its malware share surge by over 70%, with Turkey, Bulgaria, and Egypt being the most affected countries. Other strains, such as NanoCore and DarkComet, also experienced significant gains, each rising by approximately 30%.&nbsp;We have seen Remcos decrease in activity mostly in Europe, the United States and Canada losing some of its malware share to other strains in Q4/2024. However, Remcos remains the top strain globally in terms of overall share. Additionally, Remcos has been recently updated to version 6.0 - new features are aimed at operators, mostly simplifying the organization of remote (infected) computers. The update also contains some minor bug fixes. From a defender's perspective, the changes are not significant.&nbsp;In the Q3/2024 report, we observed that the online shop which previously sold the XWorm RAT had gone inactive. As far as we can tell, it has not been replaced with another one. We also have not seen a more recent version of XWorm following 5.6 which launched in September 2024 and was the last to be advertised on the now defunct site. However, XWorm is not slowing down as its activity remains at approximately the same level as in the previous quarter.&nbsp;Lesser known RATs are also making their mark, with the FBI issuing a warning regardingHiatusRAT at the end of 2024. Threat actors have been scanning web cameras and DVRs for vulnerabilities using HiatusRAT. Targeted vulnerabilities include CVE-2017-7921, CVE-2018-9995, CVE-2020-25078, CVE-2021-33044 and CVE-2021-36260. While HiatusRAT is not a new threat, being first discovered in early 2023, this warning serves as a reminder of the importance of regularly updating all connected devices, especially those often overlooked like web cameras and DVRs.&nbsp;

Ondřej Mokoš, Malware Researcher<h2>Vulnerabilities and Exploits: Chained Exploits and Sandbox Escapes &nbsp;</h2>Exploits take advantage of flaws in legitimate software to perform actions that should not be allowed. They are typically categorized into remote code execution (RCE) exploits, which allow attackers to infect another machine, and local privilege escalation (LPE) exploits, which allow attackers to take more control of a partially infected machine.&nbsp;In Q4, two significant local privilege escalation vulnerabilities in Windows were discovered to be actively exploited in the wild. These vulnerabilities underscore the need for robust sandboxing mechanisms. Additionally, recent findings have linked some of these exploits to advanced threat actors, further emphasizing the sophistication of modern cyberattacks.&nbsp;The first vulnerability, CVE-2024-49138, was found in the Windows Common Log File System Driver (CLFS.sys) and reported by CrowdStrike. This vulnerability allowed attackers to escalate their privileges, potentially compromising system security. While CrowdStrike did not provide specific details about the nature of the vulnerability or the identity of the actors exploiting it, the fact that it targeted a core Windows driver underscores its severity.&nbsp;&nbsp;Google reported the second vulnerability, identified as CVE-2024-49039, which involved an escape from the Windows AppContainer sandbox. This security feature in Windows is designed to provide a sandboxed environment for applications, running them with minimal privileges to isolate them from critical system components and each other, thereby reducing the risk of malware or malicious behavior affecting the broader system. However, this vulnerability allowed a low-privileged user to execute code at a medium integrity level, effectively bypassing AppContainer's protections. The discovery of this vulnerability underscores the ongoing challenges in maintaining robust application isolation.&nbsp;ESET later discovered that CVE-2024-49039 was being exploited in the wild. Attackers were observed chaining this vulnerability with a remote code execution flaw in Firefox, identified as CVE-2024-9680. According to ESET’s analysis, the attackers leveraged CVE-2024-49039 to escape the sandbox from the untrusted process level of Firefox’s content process to a medium integrity level. This chain of exploits demonstrates the sophistication of modern attacks, where multiple vulnerabilities are combined to achieve a specific goal.&nbsp;The technical details of CVE-2024-49039 reveal that the vulnerability relied on calling functions from an undocumented Remote Procedure Call (RPC) endpoint. This endpoint allowed the creation of a scheduled task, a function that should not have been callable from the untrusted process level. By exploiting this flaw, attackers were able to create a scheduled task that executed arbitrary applications at a medium integrity level. This action enabled them to elevate their privileges on the system and break out of the sandbox, effectively bypassing the intended security boundaries of the AppContainer.&nbsp;Adding to this complexity, ESET researchers uncovered a previously unknown vulnerability in Mozilla products that was being exploited in the wild by the Russia-aligned group RomCom. This marks at least the second time that RomCom has been caught exploiting a significant zero-day vulnerability in the wild. Earlier in June 2023, RomCom was linked to the exploitation of CVE-2023-36884 through Microsoft Word. The group’s involvement in exploiting CVE-2024-49039 highlights their capability to adapt and weaponize zero-day vulnerabilities for targeted attacks.&nbsp;The exploitation of these vulnerabilities underscores the importance of continuous monitoring and improvement in security mechanisms. The chaining of CVE-2024-49039 with CVE-2024-9680, along with RomCom’s exploitation of Mozilla products, illustrates how advanced threat actors can combine weaknesses in different components to achieve their objectives. Addressing such threats requires a multi-faceted approach, including rigorous patching practices, comprehensive vulnerability assessments, and robust application isolation mechanisms.&nbsp;In Q4/2024, we continued evaluating the main exploitation and post-exploitation frameworks targeting our users. While our telemetry indicated that the use of frameworks was on a downward trend for this quarter, Cobalt Strike was again the most prevalent strain, occupying 31% of the hits in this category.&nbsp;

To confirm whether the downward trend that marked this quarter is temporary or significative in time, we will continue to evaluate and monitor the evolution of the exploitation and post-exploitation frameworks in Q1/2025.&nbsp;&nbsp;Luigino Camastra, Malware Researcher&nbsp; David Álvarez, Malware Analyst&nbsp; Michal Salát, Threat Intelligence Director&nbsp;<h2 class="text-align-justify">Web Threats&nbsp;</h2>Web threats remain a key focus for our analysts, encompassing numerous sub-categories of scams. Despite attackers continuously introducing modified variations of old scams, the overall downward trend towards the end of the year persisted. The last quarter of the year saw an even further decline, with a 13% drop compared to Q3/2024. This decline was observed in most countries, although there are some exceptions, which we will cover later in the text.&nbsp;<h2 class="text-align-justify">Scams: A Worldwide Challenge&nbsp;</h2>A scam is a type of threat that aims to trick people into giving an attacker their personal information or money. We track diverse types of scams which are listed below.&nbsp;Despite a downward trend, we observe that certain detections have increased compared to the previous quarter. These detections primarily highlight the main reason for the success of today's scam threats: malvertising.&nbsp;For our regular readers, the concept of malvertising is well-known. However, it’s worth reiterating that the key factor in malvertising is its ability to target specific audiences. When advertisements are presented on social networks, for example, this targeting can be particularly effective because these platforms have access to more accurate and comprehensive user data. Additionally, many users perceive these platforms as safe, which can result in reduced awareness of potential threats. For example, our data indicates that some blocked scams originate from users who have been redirected from Meta's social networks.&nbsp;

In the below screenshot, you can see a notorious landing page. This illustration nicely shows the type of page to which users are redirected by some ads, sometimes resembling a tabloid article. This particular example is a financial scam. The right side of the screenshot shows another way such scams are spread: through push notifications, an increasing threat which we’ve highlighted in numerous reports and blogs. The screenshot also shows that this is a financial scam.&nbsp;

If we take a closer look at the chart below, Q4/2024 was the most active quarter for financial scams in 2024.&nbsp;

Financial scams come in many different packages; this constantly recycled social engineering attack can be presented to people, for example, with a narrative of weight loss advice or as medical scams – the ways in which scammers entice their victims is almost endless.&nbsp;If you look at the global heat map, you’ll see there is almost no place in the world that is not impacted by scams as 2024 comes to an end.&nbsp;&nbsp;

When examining the areas with highest chance of encountering a scam, Slovakia stands out with a risk ratio of 21.30%, although it experienced a slight decrease of 2% compared to the previous quarter. Vietnam follows closely with a risk ratio of 20.69%, showing a significant increase of 6%. Meanwhile, Czechia has a risk ratio of 19.87%, also seeing a 2% decrease from the previous quarter.&nbsp;Beyond the list of countries with the highest risk, several other countries experienced significant quarter-over-quarter changes. South Korea saw the most substantial increase, with a 20% increase to a final risk ratio of 7.51%. Australia also experienced a notable rise, with a risk ratio of 15.24%, increasing by 6%. The United Kingdom saw a significant increase, with a risk ratio of 14.26%, up by 3%.&nbsp;<h3 class="text-align-justify">CryptoCore Exploits U.S. Election and Elon Musk's Statements – $7M Stolen&nbsp;</h3>A crypto scam is a cyber threat designed to trick individuals into surrendering their cryptocurrency. These scams exploit the anonymity and irreversibility of blockchain transactions, often targeting those with a limited understanding of how cryptocurrency works.&nbsp;The <a href="https://decoded.avast.io/martinchlumecky1/cryptocore-unmasking-the-sophisticated-cryptocurrency-scam-operations/" target="_blank" rel="noreferrer noopener">CryptoCore scam group</a> continued its operations in Q4/2024 with the same modus operandi of abusing high-profile events in the media, luring victims with promises of easy profits using deepfake videos. These attackers also leverage statements and actions by Elon Musk to make their scams appear more legitimate. In Q4/2024, their primary focus, as expected, was the U.S. presidential elections, further amplified by the involvement of Elon Musk.&nbsp;

The CryptoCore activity around the presidential election increased throughout October. The highest threat peak was on November 9, 2024, when Donald Trump won the presidential election in Arizona, completing a clean sweep of all seven battleground states and locking in a decisive electoral college victory over the Democratic Vice President Kamala Harris.&nbsp;If we compare the activities of CryptoCore across 2024, the presidential campaign was the most dangerous since we began <a href="https://decoded.avast.io/martinchlumecky1/cryptocore-unmasking-the-sophisticated-cryptocurrency-scam-operations/" target="_blank" rel="noreferrer noopener">tracking the group</a>. The presidential campaign was even more significant than the highly destructive campaigns abusing the topics of the total solar eclipse and SpaceX flight.&nbsp;

The United States remains the country most affected by CryptoCore Scams, followed by the United Kingdom and Germany.&nbsp;&nbsp;

The deepfake videos used as CryptoCore lures used messages emphasizing Donald Trump as a visionary leader who understands innovation and the future of finance, particularly cryptocurrency. They claimed that Trump supports a platform for doubling cryptocurrency investments, presenting it as part of his vision for empowering individuals and revolutionizing financial systems. These scams touted Trump as an advocate for blockchain technology, cryptocurrency adoption, and deregulation to legitimize the fraudulent scheme.&nbsp;&nbsp;

Victims are targeted through hijacked YouTube accounts, which prioritize attackers' videos in search results using specific keywords. These videos typically contain a QR code, which redirects the victim to a well-designed fraudulent website featuring motifs of Elon Musk and Donald Trump.&nbsp;

As CryptoCore's activities escalated dramatically throughout the quarter, and our telemetry captured 3,500 cryptocurrency transactions linked to 500 crypto wallets with a total value of an estimated $7,000,000 in October through December alone. While this figure is a rough estimate, the actual amount could be higher, given the complexity of tracking illicit crypto wallets and abused platforms. Additionally, the sharp rise in the value of most cryptocurrencies used by CryptoCore has significantly increased the group's overall profit in this quarter.&nbsp;

An interesting event exploited by the attackers in Q4/2024 was Elon Musk's promise of a $1 million giveaway per day during the presidential election. Musk's himself added credibility to the CryptoCore scam, because if a real Musk is handing out <a href="https://www.vox.com/politics/378912/musk-trump-voting-contest-million-dollars-swing-state-lottery-pennsylvania" target="_blank" rel="noreferrer noopener">$1 million checks daily</a>, why couldn’t his "official event" be giving away hundreds of thousands in cryptocurrency? The attackers quickly seized the opportunity, creating a fake video based on the official giveaway event. This demonstrates how adept the attackers are at abusing media events to mislead people.&nbsp;We will repeat ourselves again: Always verify the legitimacy of such claims through official channels and avoid making any financial transactions without confirming the offer's authenticity.&nbsp;If it sounds too good to be true, it probably is.&nbsp;<h3 class="text-align-justify">Dating Scams: Love's Illusion&nbsp;</h3>Dating scams, also known as romance scams or online dating scams, involve fraudsters deceiving individuals into fake romantic relationships. Scammers adopt fake online identities to gain the victim's trust, with the ultimate goal of obtaining money or enough personal information to commit identity theft.&nbsp;When examining the risk ratios for dating scams, several countries have shown significant quarter-over-quarter changes. Iceland experienced the largest increase, with a risk ratio of 5.37%, up by 51%. This substantial rise indicates a growing concern for dating scams in the region.&nbsp;

Hungary and Czechia both saw notable increases of 7%, with risk ratios of 4.42% and 3.98%, respectively. Belgium also experienced a significant rise, with a risk ratio of 3.67%, up by 5%.&nbsp;&nbsp;In contrast, Germany and Norway had minimal changes in their risk ratios, with Germany remaining stable at 4.28% and Norway seeing a slight increase to 4.26%.&nbsp;

Overall, these statistics underscore the varying impact of dating scams across different regions.&nbsp;

<h3 class="text-align-justify">Tech Support Scams: Deceptive Assistance&nbsp;</h3>Tech support scam threats involve fraudsters posing as legitimate technical support representatives who attempt to gain remote access to victims' devices or obtain sensitive personal information, such as credit card or banking details. These scams rely on confidence tricks to gain victims' trust and often involve convincing them to pay for unnecessary services or purchase expensive gift cards. It's important for internet users to be vigilant and to verify the credentials of anyone claiming to offer technical support services.&nbsp;Japan remains a top target for tech support scams, with a risk ratio of 1.51%, up 14% from the previous quarter.&nbsp;

However, the most significant surge in tech support scams this quarter has been observed in Switzerland, where the risk ratio skyrocketed by 114% to 1.05%. This dramatic increase highlights a new hotspot for these scams.&nbsp;Austria also experienced a substantial rise, with a risk ratio of 1.06%, up by 68%. Similarly, Hong Kong saw a 43% increase, bringing its risk ratio to 0.96%, and Canada recorded a 35% rise, reaching a risk ratio of 0.80%.&nbsp;France continues to be a notable target, with a risk ratio of 1.07%, reflecting a 22% increase from the previous quarter.&nbsp;&nbsp;

Overall, while Japan remains a consistent hotspot, the significant increases in Switzerland, Austria, Hong Kong, Canada, and France indicate a broader and more dynamic threat landscape for tech support scams.&nbsp;

<h3>Email Threats: Unwrapping Christmas Email Scams&nbsp;</h3>The Email threats section tends to cover a wide range of scams targeting almost anyone with an email address. These scams take various forms, including fake invoices designed to mimic legitimate brands and trick recipients into making payments to the attackers. Extortion emails attempt to coerce victims into sending cryptocurrency by falsely claiming to have recorded compromising webcam footage. Lottery scams lure users to websites that offer deals too good to be true, while classic phishing emails falsely inform recipients that their password has expired in an attempt to steal credentials. This section will explore the common email scams that can land in your inbox and the tactics used by cybercriminals to exploit unsuspecting users.&nbsp;Christmas is always a fruitful period, not only for retailers but also for malicious actors. Regarding <a href="https://us.norton.com/blog/online-scams/phishing-email-examples">email scams</a>, the threat intensity remains relatively constant throughout the last quarter of 2024, maintaining a steady threat level. The only notable spike occurs in the weeks preceding Christmas, followed by a slight uptrend toward the end of the year. Attackers take advantage of this period to amplify their efforts, primarily because the end of the year is stressful for many people. As a result, individuals often let their guard down when checking their mailboxes, making them more susceptible to scams. This targeted approach likely makes attackers’ efforts more effective.&nbsp;&nbsp;

As shown on the below map, the red glow is most significant in North America, indicating that the United States and Canada are most affected by email scams. These countries also experienced a notable quarterly increase of 13%. Australia follows this trend closely, with a 10% quarterly rise. The Benelux countries also reported substantial numbers, reflecting high risk ratios. Furthermore, South Africa, France, and the United Kingdom have been significantly impacted.&nbsp;

Apple is one of the most targeted brands by email scams, notably iCloud. The reason for this is simple: scammers aim to exploit services that the majority of users rely on. By using notable cloud providers like Microsoft 365 or Google Drive, they increase their chances of success. The example shown below claims that users will lose their cherished data, incorporating a few prominent red flags. Below are three obvious key red flags in the email:&nbsp;<ol><li>Suspicious Email Address - The sender's email address (no-reply@781[.]qebsjbg...) does not match Apple's official domain (e.g., @apple.com or @icloud.com). A legitimate company like Apple always uses its verified domain.&nbsp;</li><li>Urgent and Threating language - The subject line and content use panic-inducing phrases like "LAST ALERT: ALL YOUR PHOTOS WILL BE DELETED!" and "Your photos and videos will be deleted!!". Scammers often use fear to pressure victims into acting quickly without verifying details.&nbsp;</li><li>Poor Grammar - The phrase "Failed to attempt payment" is grammatically incorrect. Professional emails from Apple or any major company are carefully crafted and free of errors. Additionally, the design feels inconsistent, with mismatched fonts, overly bright colors (e.g., "FULL" in red), and unpolished presentation.&nbsp;</li></ol>

Furthermore, the email code reveals additional issues that are not immediately apparent.&nbsp;<ol start="4"><li>DKIM Signature Failure - The DKIM signature in the email headers shows an error: dkim=permerror (no key for signature) and the domain 602.qunipameoxsp.us is not a verified or trusted sender. This suggests the email's integrity cannot be verified, which is a common sign of phishing emails.&nbsp;</li><li>Malformed Links - The hyperlink in the code (&lt;a href="https://storage[.]googleapis[.]com/loblaman996655/lobla.html#..."&gt;) redirects to a Google storage link instead of an Apple domain. Legitimate companies do not host critical account-related actions on third-party services like Google Storage.&nbsp;</li><li>Excessive Inline Styling and Obfuscation - The email contains overly complex and excessive inline CSS, such as numerous gradient styles and unnecessary hover effects (e.g., .divv:hover, .ligne:hover). These are often used by scammers to disguise malicious content and create a more "professional" appearance.&nbsp;</li></ol>This quarter, we conducted a deeper analysis of the scams our customers receive in their email inboxes. From a collection of malicious emails that we analyzed, we assessed the type of scams using the AI scam type classifiers based on the email displayed to the customer.&nbsp;&nbsp;Interestingly, the most prevalent type of scam was the e-shop scam, where the attackers try to lure people to fake shopping websites. These sites either take payments and never deliver the goods or collect data from users to sell or exploit in other ways. E-shop scams accounted for 51% of all scam emails in Q4/2024.&nbsp;

The second most prevalent category was gambling scams, where attackers trick people into placing bets on fake gambling platforms but refuse to pay out winnings. The third most prevalent category was investment scams, where attackers advertise fake investments promising high returns or guaranteed profits in stocks, forex, property, cryptocurrencies and other assets. Finally, the fourth category was political scams, where attackers take advantage of campaigns and elec21tions to scam people, for example by convincing them to contribute to fake campaigns.&nbsp;&nbsp;&nbsp;The statistics above represent the view for the whole quarter, however, towards the end of 2024, investment scams were on the rise and, in the last days of the year, there 15-25% of the daily analyzed samples were classified as investment scams.&nbsp;&nbsp;

A good example of an investment scam is displayed below. The scam in this case is luring people to click on the link to reveal the name of the cryptocurrency that is going to increase 150 times in the future. This is a common tactic used in scam emails, as the user can be redirected directly to a malicious website or asked to register and transfer funds that would never be retrieved.&nbsp;&nbsp;

<h3>Hidden Dangers of Fake E-Shops: Financial and Health Risks&nbsp;</h3>Fake shop scams involve fraudsters creating imitation online stores that appear legitimate and trustworthy. These fake shops often mimic well-known brands or use professional-looking websites to deceive customers. Victims are lured into making purchases, believing they are buying genuine products. However, the goods never arrive after payment or are of inferior quality.&nbsp;Fake e-shops, also known as scam shopping websites, pose significant consumer risks. A particularly alarming risk is to victim´s financial and physical health. Fake e-shops selling medications, supplements, or other health-related products may distribute unregulated or counterfeit drugs, which can be extremely dangerous. Additionally, falling victim to these scams often leads to financial losses and identity theft.&nbsp;The largest category of fake e-shops consists of stores selling clothing and pharmaceuticals. In terms of medications, the most requested products are drugs for male erectile dysfunction, which require a prescription. Using these medications without consulting a doctor can lead to serious health complications. Moreover, the origin of these drugs is uncertain, and they may be faked substitutes with dangerous side effects.&nbsp;The detected e-shops have been flagged as malicious due to several warning signs, such as the absence of a cookies consent popup, offering huge discounts, lack of clear contact information, and offering suspicious payment methods.&nbsp;&nbsp;

The payment gateways of fake e-shops are typically hosted on separate domains with valid certificates signed by untrustworthy certification authorities. Therefore, it isn't easy to immediately recognize that sensitive data is in danger since the certificate is valid from a technical perspective. However, this ensures the victim's data is securely delivered directly to the attackers. Additionally, the attackers often enhance the legitimacy of secure data transfer by using logos of reputable security companies.&nbsp;

Victims typically end up on fraudulent websites by searching for specific medications, often prescription drugs, and encountering fake sites offering enticingly low prices among the search results. Another standard method to distribute fake e-shops is through advertisements on Facebook, YouTube, and Instagram, amongst other platforms. Finally, the third most frequent method is through unsolicited emails and spam.&nbsp;In Q4/2024, we observed an increase in the activity of fake e-shops, which is an expected phenomenon during the holiday season as people are looking for attractive discounts and offers. The correlation between high-profile sales events, such as Black Friday and Christmas shopping, and the increase in scam incidents underscores the danger of online fraud during peak shopping seasons.&nbsp;

The dangers of fake e-shops go beyond financial loss. These sites can compromise personal data, leading to identity theft, unauthorized transactions, and long-term damage to credit scores. Recognizing the signs of a fake e-shop and understanding the risks involved are crucial for safe online shopping.&nbsp;<h3 class="text-align-justify">Phishing: A Year in Review&nbsp;</h3>Phishing is a type of online scam where fraudsters attempt to obtain sensitive information including passwords or credit card details by posing as a trustworthy entity in an electronic communication, such as an email, text message, or instant message. The fraudulent message usually contains a link to a fake website that looks like the real one, where the victim is asked to enter their sensitive information.&nbsp;In Q4/2024, we protected 14% more users against <a href="https://www.avg.com/en/signal/what-is-phishing">phishing</a> than in the previous quarter. Our data shows a diverse range of phishing activities, with some abused brands experiencing substantial increases in phishing attempts.&nbsp;

Let’s start with phishing attempts targeting Amazon. We saw a dramatic increase, with a malware share of 2.42%, up by 509% from the previous quarter. This surge highlights the growing exploitation of Amazon's brand to lure unsuspecting users. Some of this increase could also be related to attackers trying to take advantage of discount shoppers, which tends to be higher towards the end of the year.&nbsp;Despite a slight decrease of 1% in phishing activity for the brand, Microsoft remains a common target, with a malware share of 0.99%. This indicates a persistent threat level for users of Microsoft services.&nbsp;Phishing attempts targeting Facebook increased by 36%, resulting in a malware share of 0.68%.&nbsp;Financial institutions continue to be prime targets, with phishing attempts particularly for Chase increasing by 295%, leading to a malware share of 0.52%.&nbsp;&nbsp;The most notable increase in brands imitated for phishing purposes was observed with Wix, which saw an astounding 2840% rise in phishing activity, resulting in a malware share of 0.39%. This spike indicates a new focus on exploiting website-building platforms. We observed similar behavior last year with Weebly, but this time, Wix is the primary target.&nbsp;

Phishing attempts on Netflix also saw a substantial increase, with a 375% rise, leading to a malware share of 0.12%.&nbsp;&nbsp;Alexej Savčin, Malware Analyst&nbsp; Branislav Bošanský, Scientist&nbsp; Martin Chlumecký, Malware Research&nbsp;&nbsp; Matěj Krčma, Malware Analyst&nbsp; Nikola Groverová, Data Scientist&nbsp;<h2 class="text-align-justify">Mobile-Related Threats&nbsp;</h2>Mobile threats continues their evolution in Q4/2024 with several new strains and updates to existing ones. MobiDash adware made a resurgence fueled by a new Facebook campaign, distributing the ad-ridden threat to users worldwide by hiding in when installed and displaying out-of-context ads.&nbsp;New bankers join the fray, with DroidBot utilizing its RAT capabilities to go after banking details and cryptowallets, targeting several EU countries. The newcomer ToxicPanda also made its mark, disguised as Visa, dating apps and Chrome. With its ability to disable system monitoring used by banking apps, it can act on behalf of the user to initiate payments. Lastly, the NGate banker mentioned in the previous report was spotted in new countries, utilizing the same NFC relay technique to siphon money away from users.&nbsp;In the Spyware sphere, we saw a new strain sneak onto the Amazon app store, a rather novel distribution method. With its ability to record the screen and spy on victim’s SMS messages, it posed a threat until its prompt removal by Amazon. SpyLoans continue to be a persistent threat to users worldwide, harvesting private and personal information that is later used to extort victims. Several law enforcement agencies have made inroads in tackling this nefarious threat.&nbsp;<h3 class="text-align-justify">Web Threat Data within the Mobile Landscape&nbsp;</h3>Most blocked attacks on mobile devices in Q4/2024 were web-based, mirroring the previous quarter. Consumers are much more likely to encounter phishing websites, scams, malvertising and other web threats on their mobile devices than ever before. These threats can come in a variety of formats such as private messages, SMS and emails but also redirects on less reputable sites, unwanted pop ups and through other avenues.&nbsp;In contrast to these types of mobile scams, traditional on-device malware requires a more complex infection vector where the consumer must also install the malware. For proper functionality of most mobile malware, permissions need to be granted by the consumer first, which again lowers the chances of malicious activity being triggered.&nbsp;Hence, blocking web-threat based attacks is beneficial for the security of mobile devices, as malware actors often use them as an entry point to get the payload onto the mobile device of their victims.&nbsp;

The Dark Side of Social Media, CryptoCore Deepfakes Stole $7 Million, and More than 4 Million Users Protected from Scam-Yourself-Attacks 

Gen Q4/2024 Threat Report 

<h2 class="text-align-justify">Foreword&nbsp;</h2>The Gen Q3/2024 Threat Report is here, offering an in-depth look at the forces reshaping the threat landscape. Scams continued to dominate, while other serious threats—including malvertising, ransomware, droppers, and data-stealing malware—surged ahead. Many of these threats remain closely linked to scams, underscoring the relentless evolution of cybercriminal tactics.&nbsp;

One of the most alarming trends is the rise of “Scam-Yourself Attacks”—an advanced <a href="https://us.norton.com/blog/emerging-threats/what-is-social-engineering">social engineering</a> tactic that tricks users into compromising their own systems. This quarter alone, we protected over 2 million users from a variant called FakeCaptcha, which mimics CAPTCHA prompts to deliver malware. With a staggering 614% increase of these Scam-Yourself attacks quarter-over-quarter; social engineering, psychological manipulation tactics, continues to be one of the most dangerous tools in the cybercriminal arsenal.&nbsp;In addition, <a href="https://www.avast.com/c-what-is-ransomware">ransomware</a> threats escalated following a 24% increase in Q2/2024, with a further 100% rise in the risk ratio and number of protected users this quarter. This surge was primarily driven by the AliGater campaign, which delivered the Magniber ransomware. Remote Access Trojans (RATs) also saw a 26% increase, largely due to the spread of XWorm. Our researchers once again uncovered and disclosed a zero-day vulnerability, in the AFD.sys Windows driver, which was exploited in the wild by the Lazarus APT group and specifically targeted a nuclear power plant.&nbsp;Also, among the most significant changes this quarter, information stealer activity rose by 39% quarter over quarter, fueled by the rise of Lumma Stealer. This malware-as-a-service has rapidly gained prominence, fueled by the ultimate objective of data theft, employing various delivery methods like fake YouTube tutorials and abused GitHub repositories. Its ability to bypass protections has made it one of the most formidable threats this quarter.&nbsp;In other social engineering news, malvertising, one of the most persistent types of social engineering, grew this quarter by 18%. Crypto scams, particularly those orchestrated by groups like CryptoCore, have spiked, using deepfake technology to exploit media events and lure victims into fraudulent cryptocurrency schemes. Additionally, malicious browser push notifications surged by 166% in some regions such as Italy.&nbsp;Data stealing <a href="https://www.avg.com/en/signal/what-is-malware">malware</a> also increased on mobile devices in Q3/2024. Financial data theft by banking malware saw a 60% surge, with attacks like Rocinante targeting users in Brazil, while new threats like TrickMo and Octo2 emerged in Europe. <a href="https://us.norton.com/blog/malware/spyware">Spyware</a> also rose sharply, with a 166% spike driven by NGate, an advanced spyware targeting NFC data for ATM withdrawals. A common denominator for the main mobile threats seen this quarter is their delivery via malicious SMS messages. As part of our mobile section, we will also showcase the most prevalent scam types identified through our Norton Genie visibility in 2024 so far.&nbsp;As we look back on the quarter, it’s evident that the cybersecurity landscape is evolving rapidly, with new and sophisticated threats emerging across the board. From the growing impact of social engineering scams to the resurgence of malware, the challenges we face continue to escalate. We encourage you to explore the full scope of insights provided in this report to gain a clearer understanding of these threats and their implications.Jakub Křoustek, Malware Research Director<h2 class="text-align-justify">Methodology&nbsp;</h2>This report is structured into three main sections: Desktop-related threats, where we describe our intelligence around attacks targeting the Windows, Linux and Mac operating systems, with a specific emphasis on web-related threats and Mobile-related threats, where we describe the attacks focusing on Android and iOS operating systems.&nbsp;We use the term “risk ratio” in this report to denote the severity of specific threats. It is calculated as a monthly average of “Number of attacked users / Number of active users in a given country.” Unless stated otherwise, calculated risks are only available for countries with more than 10,000 active users per month.&nbsp;A blocked attack is defined as a unique combination of the protected user and a blocked threat identifier within the specified time frame.&nbsp;Our quarterly threat reports inform about the threat landscape situation as seen from the Gen family of Cyber Safety brands. We continuously enhance our threat telemetry and anticipate further refinements in our future reports.&nbsp;<h2 class="text-align-justify">Featured Story: "Scam-Yourself Attacks” Peak, Tricking Users Into Compromising Their Own Devices&nbsp;</h2>Picture this: You're at your desk, staring at a frustrating error message or a stalled software installation. In a hurry to find a solution, you turn to the Internet. There it is: a YouTube tutorial or an easy step-by-step guide, seemingly offering the perfect fix. With a few clicks, you're on your way to solving the problem. But instead of a solution, what you’ve really done is opened the door to a hidden threat, following a path laid out by cybercriminals.&nbsp;These types of attacks—what Gen has termed “Scam-Yourself Attacks”—are evolving faster than ever, and they’re proving highly effective. In fact, this quarter alone, we’ve seen a staggering 614% increase in these attacks. The term encompasses a variety of threats, from Fake Tutorials to ClickFix scams, FakeCaptcha tricks, and Fake Updates. Together, they form a broader web of deception that’s catching millions of users off guard.&nbsp;<h3 class="text-align-justify">A New Age of Cyber Trickery: Guiding Victims to Perform Their Own Attacks&nbsp;</h3>The landscape of cyberattacks has shifted. Gone are the days when malware simply hid in a suspicious email attachment or shady download. Now, attackers are using your curiosity, and your urgency to fix an issue, against you. They’ve weaponized what seem like harmless instructions to lure you in, and by the time you realize what’s happening, it’s already too late. Whether it’s through seemingly helpful tutorials or fake update prompts, cybercriminals are making you their accomplice.&nbsp;Let’s take a closer look at the different tactics that fall under the umbrella of “Scam-Yourself Attacks”, illustrating how they all work together to deceive.&nbsp;<h4>Fake Tutorials: The Trap Disguised as Help&nbsp;</h4>Imagine a cracked software installer you found online. Along with the software, there's a README file guiding you through the installation. It looks innocent enough, but buried in those instructions is a deadly line: "Disable your antivirus for this software to work properly". What you think is a helpful guide is, in fact, a direct invitation for malware to slip through your defenses.&nbsp;<ul><li>Cracked Software and README Files: These often come with hidden dangers. Cybercriminals cleverly disguise malicious steps within seemingly helpful guides. You follow the instructions, thinking it’s necessary for the installation, only to find you’ve opened the door for malware.&nbsp;</li></ul>

<ul><li>YouTube Tutorials: Another trick in the cybercriminals' playbook involves video tutorials. The video walks you through the process of installing software, but when you click the link in the comments to download it, you’re downloading malware instead. What started as a guide to help you ends with your device compromised. The worst part? You’re the one who clicked, copied, and executed the threat.&nbsp;</li></ul>&nbsp;

But there’s good news: whether you downloaded it from an unofficial website, YouTube, or even GitHub, security vendors like us don’t care where it came from. If it’s malicious, we detect it.&nbsp;<h4>ClickFix: The Illusion of Control&nbsp;</h4>Now imagine you’re trying to fix a problem on your computer—an annoying Windows error code, perhaps. You find what appears to be a genuine solution online. It asks you to copy a script to your clipboard, paste it into the command prompt, and hit Enter. You follow along, thinking you’re resolving the issue, but, in reality, you’ve just run a piece of malware that opens the floodgates to attackers.&nbsp;This is ClickFix, a specific form of so-called Fake Tutorial campaigns where users are misled into performing steps that ultimately compromise their own devices.&nbsp;

The illusion here is control—cybercriminals know you’ll follow the steps because they seem like a straightforward fix. &nbsp;<h4>FakeCaptcha: When Familiarity Breeds Danger&nbsp;</h4>Think about how often you’ve encountered CAPTCHA’s, the little “I’m not a robot” checkboxes. We’ve become so used to them that we rarely question their legitimacy. Cybercriminals know this, and they’re taking advantage. They’ve created <a href="https://www.gendigital.com/blog/news/innovation/global-surge-in-fake-captcha-attacks" target="_blank" rel="noreferrer noopener">FakeCaptcha</a>—a variant of ClickFix—designed to resemble a real CAPTCHA, tricking you into following steps that lead straight to infection.&nbsp;<ul><li>How It Works: You land on a compromised website or a malicious page, and a CAPTCHA pops up. After clicking “I am not a robot” a script is quietly copied to your clipboard, and you’re prompted to run it. Following these instructions results in malware silently taking over your system.&nbsp;</li></ul>

It’s a perfect example of how attackers exploit familiarity. The CAPTCHA looks real, but the consequences are all too dangerous. What’s happening behind the scenes is that the script acts as a dropper—downloading further malware onto your system, often the infamous <a href="https://www.gendigital.com/blog/news/innovation/lumma-stealer-github" target="_blank" rel="noreferrer noopener">Lumma Stealer</a>, one of the most advanced information stealers out there today. In Q3/2024, we observed a surge in Lumma Stealer campaigns, which are discussed in more detail in the Information Stealers section of this report.&nbsp;<h4 class="text-align-justify">ClearFake and Fake Updates: Changing Strategies&nbsp;</h4>ClearFake is a threat actor primarily known for using the Fake Update tactic, where users are tricked into downloading malware disguised as a browser update. This quarter we saw something interesting – ClearFake adapted. They started using the ClickFix tactic in certain campaigns, showing that threat actors are willing to shift strategies when one method proves more effective than another.&nbsp;Typically, ClearFake presents users with what looks like a legitimate browser update page. Once users download the "update," they end up with malware instead. But, this quarter, they also employed ClickFix, guiding users to copy and paste scripts, much like other Fake Tutorials.&nbsp;The Fake Update screens can take many, and often truly legitimate-looking, forms. As an example, in <a href="https://x.com/GenThreatLabs/status/1840762181668741130" target="_blank" rel="noreferrer noopener">this campaign</a> we spotted WarmCookie backdoor being distributed, allowing the adversaries to execute a variety of commands on the victim’s PC.&nbsp;

In a new twist, ClearFake’s latest adaptation combines elements of both Fake Updates and ClickFix. Users encounter a familiar update prompt, suggesting a necessary browser update. However, instead of a one-click download, users are instructed to follow steps: copying a malicious script to their clipboard and pasting it into a PowerShell prompt, effectively giving the script administrator privileges. This approach requires users to feel fully involved in the update process, making them unknowingly complicit in infecting their own devices. It’s a deceptive blend of familiarity and manipulation, designed to take advantage of users’ reliance on routine updates.&nbsp;

<h4>How Big Is This Problem?&nbsp;</h4>In Q3/2024, we protected over 2.1 million users from FakeCaptcha attacks alone. Think about that—millions of people almost fell for it. This is just one piece of a much larger puzzle. The risk ratio for the entire “Scam-Yourself Attacks” category surged by over 614%, demonstrating just how widespread and global these attacks have become. Countries like Italy, Argentina, the Philippines, France, Spain, and Indonesia are among those facing the highest risk ratios for these attacks.&nbsp;

<h4>Conclusion: The Hidden Dangers of "Scam-Yourself Attacks"&nbsp;</h4>In a world where we rely on quick fixes and familiar online prompts, Scam-Yourself Attacks have become a cybercriminal’s dream. Users are unknowingly following instructions that do the attackers’ bidding for them, whether through fake CAPTCHAs, misleading YouTube tutorials, or cleverly disguised README files. &nbsp;What’s more troubling is how effortlessly these scams blend into our daily digital lives. We’ve grown so used to CAPTCHAs and quick-fix guides that we often forget to stop and question them. Also, almost every application needs to be up-to date and if it isn’t, users commonly see screens and dialogues prompting the (mandatory) update. In the hands of cybercriminals, our trust in these familiar formats becomes their most powerful weapon.&nbsp;As these campaigns evolve, one constant remains: they thrive on user deception and manipulation. The question isn’t whether these fake tutorials will persist, but how we will recognize and navigate them before it’s too late.&nbsp;&nbsp;Jan Rubín, Malware Researcher Luis Corrons, Security Evangelist<h2 class="text-align-justify">Desktop-Related Threats&nbsp;</h2><h3 class="text-align-justify">Advanced Persistent Threats (APTs): Evolution of FudModule&nbsp;</h3>An Advanced Persistent Threat (APT) is a type of cyberattack that is conducted by highly skilled and determined hackers who have the resources and expertise to penetrate a target's network and maintain a long-term presence undetected.&nbsp;Over the past quarter, the Lazarus group has once again demonstrated its expertise in stealth and innovation, proving its status as one of the most dangerous cybercriminal organizations. Among the various APTs we’ve been tracking, Lazarus has leveraged sophisticated tools like the FudModule rootkit and has also been using zero-day vulnerabilities to evade detection while orchestrating their cyberattacks.&nbsp;In early June, we identified that Lazarus was exploiting a new zero-day vulnerability in the Winsock driver (CVE-2024-38193). This vulnerability allowed attackers to achieve local privilege escalation (LPE), granting them the ability to deploy the FudModule v3.0 rootkit on targeted systems.&nbsp;On August 19, 2024, <a href="https://www.microsoft.com/en-us/security/blog/2024/08/30/north-korean-threat-actor-citrine-sleet-exploiting-chromium-zero-day/" target="_blank" rel="noreferrer noopener">Microsoft identified</a> two additional zero-day vulnerabilities that are actively being exploited in the wild. The first of these vulnerabilities is a remote code execution (RCE) flaw in Chromium, designated as CVE-2024-7971. This RCE exploit allows attackers to execute code within the sandboxed Chromium renderer process.&nbsp;Once the exploit is triggered, it deploys shellcode that contains a Windows sandbox escape exploit (CVE-2024-38106). This sequence of events ultimately leads to the download and loading of the FudModule rootkit directly into memory.&nbsp;The sandbox escape exploit specifically targets a vulnerability in the Windows kernel. By leveraging this weakness, the Lazarus Group can successfully load the FudModule rootkit into memory, thereby enhancing their capabilities in executing further attacks.&nbsp;The FudModule rootkit itself has undergone significant evolution in its latest version. In addition to its standard arsenal of tools for evading detection and disabling security measures, <a href="https://www.gendigital.com/blog/news/innovation/lazarus-fudmodule-v3" target="_blank" rel="noreferrer noopener">FudModule v3.0</a> now includes new capabilities designed to complicate incident response efforts. One of the most notable features is its ability to disable crash dumps, which are often critical for post-incident analysis. By blocking this functionality, FudModule makes it difficult for security teams to trace the root cause of an infection or reconstruct the sequence of events leading up to an attack.&nbsp;Moreover, FudModule v3.0 is more closely integrated with the payloads it seeks to protect. It injects its payload into a process secured by the Protected Process Light (PPL) framework, a feature typically used to safeguard critical system processes. This integration makes it more difficult for security solutions to detect and remove the malicious payload, as it benefits from the same protections afforded to legitimate system processes.&nbsp;Given these extensive changes, we have classified this version as FudModule v3.0, reflecting the significant advancements it embodies. It has evolved from being a standalone rootkit designed to disable security defenses into a more versatile tool that also actively protects the malicious payload from detection and removal.&nbsp;Several other advanced persistent threat (APT) groups remain highly active across Southeast Asia. One notable actor, MustangPanda, is conducting extensive operations in Myanmar, deploying various backdoors to infiltrate victims’ systems. These attacks are primarily aimed at document theft, with the stolen data being exfiltrated to MustangPanda’s command-and-control (C2) servers. Myanmar continues to be one of the most targeted nations in the region, but we’ve also observed significant APT-related activity across India, the Philippines, Hong Kong, Vietnam, and Cambodia.&nbsp;In addition, several government websites in various Asian countries have been compromised and infected with a JavaScript (JS) backdoor. This backdoor is capable of gathering information from victims and executing encrypted JS modules sent from its C2 server. The malware attempts to exploit a vulnerability in WPS Office, similar to one previously detailed in an ESET report, to achieve remote code execution on targeted machines.&nbsp;We have reported multiple vulnerabilities to Kingsoft, the developer of WPS Office, to address these vulnerabilities.&nbsp;Luigino Camastra, Malware Researcher Igor Morgenstern, Malware Researcher<h3>Bots: Distributed Mess of IoT</h3>Bots are threats mainly interested in securing long-term access to devices with the aim of utilizing their resources, be it remote control, spam distribution, or denial-of-service (DoS) attacks. &nbsp;While this quarter was significantly less rich in terms of law enforcement agency activities compared to the last quarter, it wasn’t eventless. The FBI attempted to take down the Raptor Train botnet that was using SOHO routers, IP cameras, NAS storages and other similar devices as proxies for further attacks. According to their <a href="https://www.justice.gov/opa/pr/court-authorized-operation-disrupts-worldwide-botnet-used-peoples-republic-china-state" target="_blank" rel="noreferrer noopener">report</a>, this botnet was maintained by People’s Republic of China state-sponsored hackers working for the Integrity Technology Group company. The FBI dispatched a command that used the malware's native functionality to disable the malware. This was also noticed by the threat actor who unsuccessfully tried to interfere with these remediation efforts by launching a DDoS on the operational infrastructure.&nbsp;We will use DDoS as a segue to another new botnet that was discovered in September and has been dubbed Gorilla Botnet. Unsurprisingly, the Gorilla Botnet also consists of breached vulnerable IoT devices and is based on a modifier Mirai source code. Coincidentally, Cloudflare reported that it was hit by a world record 3.8 Tbps DDoS attack during September. As if that wasn’t enough for September, a new vulnerability in a common Linux software (Common UNIX Printing System – CUPS) with a huge amplification factor of 600 was discovered.&nbsp;But it’s not all bad news in the world of Bots: the NoName057 group that is behind the DDosia project is still in stagnation. This quarter they came out of hiding to target European banks but, thankfully, the targeted banks were successful in mitigating these attacks. The group presumably tried to improve their success rate by targeting websites of small and usually regional institutions (e.g. regional road maintenance companies). While these attacks were often successful, their impact has been very limited due to the website’s relative irrelevance. The only significant deviation followed the Ukrainian incursion into the Kursk Oblast, when DDosia switched targeting to Ukrainian targets for a few days before returning to their usual operation. We have also noticed that NoName057 is more frequently cooperating with other groups such as CyberArmyofRussia, HackNeT, CyberDragon, and KaliHunt/Russia to coordinate their DDoS attacks.&nbsp;Another prolific botnet, Twizt, &nbsp;underwent frequent updates during September in comparison to the previous month. No significant changes were observed in these updates neither in design nor modulus used to decrypt messages.&nbsp;

<h3 class="text-align-justify">Information Stealers: Lumma is Everywhere&nbsp;</h3>Information stealers are dedicated to stealing anything of value from the victim’s device. Typically, they focus on stored credentials, cryptocurrencies, browser sessions/cookies, browser passwords and private documents.&nbsp;When it comes to information stealers, this quarter was wild. In particular, we observed Lumma Stealer, one of today’s most advanced stealers, being spread globally – and fast. New GitHub campaign? Lumma. Fake tutorial YouTube videos? Lumma. Requests on Steam accounts usernames? Lumma. The numbers are staggering: Lumma increased its information stealers malware share by a massive 1154% this quarter. Let’s dive into some of the campaigns in more detail to explain why this isn’t a typo but rather the effect of broad and varied campaigning.&nbsp;&nbsp;Everything started with a <a href="https://www.gendigital.com/blog/news/innovation/global-surge-in-fake-captcha-attacks" target="_blank" rel="noreferrer noopener">surge of FakeCaptcha</a> campaigns, which we also described in our Featured Story in this quarterly issue. These campaigns, usually <a href="https://x.com/GenThreatLabs/status/1827007175627010077" target="_blank" rel="noreferrer noopener">carried over by malvertising</a>, executed more than 2.1 million attacks on our customers &nbsp;in &nbsp;Q3/2024 alone. According to our observations, in most of the cases, these campaigns were spreading Lumma Stealer. The copied PowerShell script to clipboard, which is supposed to be executed in the Run prompt (Win+R), is usually either downloading Lumma Stealer directly in a form of an archive or uses a variety of different intermediary loaders to do the job. Most of the time, we observed HijackLoader (/IDAT Loader) being used to load Lumma.&nbsp;We’ve seen FakeCaptcha being utilized by many different actors with many of those changing the CAPTCHA appearance just a little, as could be observed during the <a href="https://www.gendigital.com/blog/news/innovation/aligater" target="_blank" rel="noreferrer noopener">AliGater malvertising</a> campaigns. These campaigns were spreading Lumma Stealer Magniber ransomware. An interested reader can find more information about this threat in the Vulnerabilities and Exploits section of this issue.&nbsp;We also observed quite a few GitHub campaigns, both in the form of polluting repositories with pull requests containing links to malware (= Lumma, again) and <a href="https://www.gendigital.com/blog/news/innovation/lumma-stealer-github" target="_blank" rel="noreferrer noopener">directly in the comments</a>. Thankfully, these dangerous comments are frequently written in poor English, alerting some to the potential risk. This red flag, however, might become less common in the near future with better availability and common adaptation of generative AI.&nbsp;

Finally, Lumma Stealer has launched another interesting approach, rotating C&amp;C addresses in the form of <a href="https://x.com/GenThreatLabs/status/1826232224179687468" target="_blank" rel="noreferrer noopener">account usernames on Steam</a>. These usernames are usually encrypted by a simple Caesar substitution cipher. In an example below, the C&amp;C addresses can be decrypted by applying ROT-15. Leveraging online platforms like this has underlying positive aspects for the attackers,&nbsp; allowing them to rotate the C&amp;C just by changing the username to reflect the new address.&nbsp;

<h4 class="text-align-justify">App-Bound Encryption Bypass&nbsp;</h4>Since the adaptation of <a href="https://security.googleblog.com/2024/07/improving-security-of-chrome-cookies-on.html" target="_blank" rel="noreferrer noopener">App-Bound encryption</a>, which we discussed in the Q2/2024 report, malware developers behind various information stealers were quite busy with figuring out bypasses of this enabled-by-default hardened protection of browser cookies in Google Chrome.&nbsp;We observed many discussions, particularly on Telegram, about approaches to bypass the protection, along with some authors bragging that they already achieved the bypass.&nbsp;

Lumma Stealer is not alone in this, however; we’ve observed similar reports throughout the past quarter from PovertyStealer, Vidar, StealC, WhiteSnake and Meduza, to name a few.&nbsp;There were many different discussions by threat actors regarding how to perform the actual bypass, showcasing the urgency with which information stealer developers were trying to address this protection. For example, developers behind Vidar were considering using a <a href="https://x.com/g0njxa/status/1833894122710515954" target="_blank" rel="noreferrer noopener">TPM module for encryption</a>.&nbsp;Even though the specific bypasses might vary and are still in the testing and development phases, one method stands out and, as usual, it feels like the simplest method wins it all.&nbsp;As recently reported by <a href="https://spycloud.com/blog/infostealers-bypass-new-chrome-security-feature/" target="_blank" rel="noreferrer noopener">SpyCloud Labs in a blogpost</a>, malware can use specific parameters while starting a new instance of Chrome as described <a href="https://mango.pdf.zone/stealing-chrome-cookies-without-a-password" target="_blank" rel="noreferrer noopener">in the original Mango PDF Zone publication</a>. More specifically, malware can use “--remote-debugging-port=” parameter to listen for a debugger connection. After that, the malware can attach to Chrome via a URL dedicated for DevTools (remote debugger), create a WebSocket and send a message to retrieve the cookies. This can be combined with other common means of hiding such newly created windows, for example by using a “--window-position=” parameter to set the window position outside of the victim’s screen which also avoids the use of standard WinAPI functions.&nbsp;We can (unfortunately) confirm from our research that malware truly doesn’t need any special permissions or user interaction whatsoever. We have found traces of previous misuses, indicating that this approach might <a href="https://issues.chromium.org/issues/40050335" target="_blank" rel="noreferrer noopener">not be fully patched yet</a>.&nbsp;Another recent method, <a href="https://x.com/xaitax/status/1850500705074700298" target="_blank" rel="noreferrer noopener">reported by Alexander Hagenah</a>, for bypassing the App-Bound Encryption uses Chrome’s internal COM-based IElevator service. This bypass requires admin privileges to copy the executable into %PROGRAMFILES%\Google\Chrome\Application folder. This is required since Chrome’s App-Bound encryption is also performing path validation.&nbsp;Cases like this demonstrate that information stealers, especially the ones offered as Malware-as-a-Service, put everything on the line to keep their mass-theft campaigns going, and we can only expect this endless cat-and-mouse game to continue.&nbsp;<h4 class="text-align-justify">Statistics&nbsp;</h4>The risk ratio of getting an Information stealer increased by 39% in Q3/2024, due in large part to the vast campaigns distributed by Lumma Stealer. These campaigns also shifted the whole information stealers market quite a bit, putting Lumma Stealer on a pedestal.&nbsp;

We also observed risk ratio increase in almost all regions with a greater userbase:&nbsp;<ul><li>France: 135%&nbsp;</li><li>Japan: 128%&nbsp;</li><li>Slovakia: 127%&nbsp;</li><li>Canada: 48%&nbsp;</li><li>Spain: 34%&nbsp;</li><li>Brazil: 27%&nbsp;</li><li>United States: 22%&nbsp;</li><li>Czech Republic: 9%&nbsp;</li></ul>

Lumma Stealer now has the largest malware share with 30.95%, a 1154% increase over the previous quarter. Many of the other information stealers had an expected comparative decrease in their malware share (the shift caused by Lumma Stealer), though not all of them. SnakeKeylogger also increased its malware share, with a significant 461% increase.&nbsp;Compared to the previous quarter, in Q3/2024 AgentTesla decreased in malware share by 49%, Ramnit by 30%, and Fareit by 24%. FormBook, however, stayed the same, without any shifts in its malware share.&nbsp;Note that these shifts, especially the decreases, don’t indicate there would be less of such infections across our userbase. This only means that comparatively to each other the malware families are less common, and it doesn’t necessarily reflect they are less prevalent themselves.&nbsp;The most common information stealers with their malware shares in Q3/2024 were:&nbsp;<ul><li>Lumma Stealer (30.95%)&nbsp;</li><li>AgentTesla (17.23%)&nbsp;</li><li>FormBook (8.97%)&nbsp;</li><li>Ramnit (8.39%)&nbsp;</li><li>Fareit (5.36%)&nbsp;</li><li>SnakeKeylogger (3.95%)&nbsp;</li><li>RedLine (3.38%)&nbsp;</li><li>Lokibot (2.06%)&nbsp;</li><li>Vidar (1.58%)&nbsp;</li><li>ViperSoftX (1.43%)&nbsp;</li><li>StealC (1.17%)&nbsp;Jan Rubín, Malware Researcher</li></ul><h3>Ransomware: The Rise and Decline of Magniber&nbsp;</h3>Ransomware is any type of extorting malware. The most common subtype is the one that encrypts documents, photos, videos, databases, and other files on the victim’s PC. Those files become unusable without decrypting them first. To decrypt the files, attackers demand money, “ransom”, hence the term ransomware.&nbsp;Ransomware is a business that certainly does not go away. According to a <a href="https://www.chainalysis.com/blog/2024-crypto-crime-mid-year-update-part-1/" target="_blank" rel="noreferrer noopener">report</a> published by Chainalysis, the amount of $459,800,000 paid by ransomware victims in the first half of 2024 will set a new yearly record, should the payments continue at the same speed for the rest of the year.&nbsp;Magniber Surge&nbsp;Because most of the big ransomware groups focus on attacking corporations, trends in the consumer segment do not change much on a quarterly basis. However, the trend changed in Q2/2024 when <a href="https://www.gendigital.com/blog/news/innovation/q2-2024-threat-report" target="_blank" rel="noreferrer noopener">we noted</a> a 24% increase of ransomware threats, a trend that is continuing in Q3/2024. Further, in August there was a surprising anomaly detected by our sensors: a rapid increase in blocked URLs related to ransomware:&nbsp;

Whilst normally we block less than a hundred of such URLs per day, the number quickly escalated to about 8 thousand per day. <a href="https://www.gendigital.com/blog/news/innovation/aligater" target="_blank" rel="noreferrer noopener">We analyzed the URLs</a>, and one of the final payloads was the Magniber ransomware.&nbsp;The Magniber ransomware first emerged in 2017 and has many of the typical ransomware features:&nbsp;<ul><li>Uses known vulnerabilities (<a href="https://nvd.nist.gov/vuln/detail/CVE-2011-3402" target="_blank" rel="noreferrer noopener">CVE-2011-3402</a> in this case)&nbsp;</li><li>Runs as a code injected to other processes&nbsp;</li><li>Uses direct Windows system calls&nbsp;</li></ul>Unfortunately, Magniber ransomware is undecryptable without having the private RSA key, but there are some interesting technical details in this ransomware.&nbsp;Samples related to Magniber ransomware (not just the ransomware itself, but also droppers and downloaders) typically use system calls directly. Using of system calls by Windows applications is strongly discouraged - not only they are undocumented, but they may also change in any new build of Windows. Applications should rely on documented API (such as <a href="https://learn.microsoft.com/en-us/windows/win32/api/fileapi/nf-fileapi-createfilea" target="_blank" rel="noreferrer noopener">CreateFile()</a>) instead.&nbsp;Magniber ransomware relies on those system calls to perform tasks such as memory allocation or file modification. The reason they do this is because it is more difficult for AV solutions to detect its activity – system calls cannot be intercepted by user mode applications.&nbsp;The following two pictures show a system call in Windows and in Magniber code:&nbsp;

Magniber samples in this campaign do not directly check the Windows version; instead, the way they use system calls only makes sense in Windows 7. This means that this wave of Magniber attacks targets Windows 7 operating system – an outdated one which has only about <a href="https://gs.statcounter.com/os-version-market-share/windows/desktop/worldwide" target="_blank" rel="noreferrer noopener">4% of market share</a>.&nbsp;When Magniber encrypts user’s files, it creates a ransom note file that is highly obfuscated:&nbsp;

After deobfuscation, victims can see this message:&nbsp;

The wave of Magniber ransomware lasted about a month, concluding abruptly after September 19 and returning to the old values. However, this campaign and activity of other ransomware strains led to a 100% increase of ransomware activity quarter over quarter.&nbsp;<h4>Decrypted: Mallox ransomware&nbsp;</h4>On better news, we are happy to share that we have launched another free-decryption tool for ransomware victims this quarter. During analysis of the Mallox ransomware, we discovered a flaw in the cryptographic operations. Files encrypted by Mallox ransomware (from January of 2023 to about February 2024) can be decrypted. Files encrypted by Mallox ransomware that can be decrypted are identified by the following extensions:&nbsp;<ul><li>.bitenc&nbsp;</li><li>.ma1x0&nbsp;</li><li>.mallab&nbsp;</li><li>.malox, .mallox, .mallox, .malloxx&nbsp;</li><li>.xollam&nbsp;</li></ul>Victims of the ransomware whose files have one of the above extensions can decrypt data for free using our <a href="https://www.gendigital.com/blog/news/innovation/decrypted-mallox-ransomware" target="_blank" rel="noreferrer noopener">Mallox ransomware decryptor</a>..&nbsp;From March 2024, we have seen new variants of Mallox. Those have different file extensions (see below) and decrypted:&nbsp;<ul><li>.hmallox&nbsp;</li><li>.rmallox&nbsp;</li><li>.x60X60&nbsp;</li></ul><h4 class="text-align-justify">Statistics&nbsp;</h4>Ransomware continues to gain momentum with each passing quarter. In Q3/2024, we have seen a 100% increase in terms of risk ratio and the number of protected users:&nbsp;

We can see the same surge of Magniber that we saw in the previous part. It also impacted the overall increased risk ratio in many countries, including:&nbsp;<ul><li>Bosnia and Herzegovina (930%)&nbsp;</li><li>France and Serbia (both 900%)&nbsp;</li><li>Hungary (700%)&nbsp;</li><li>Slovakia and Greece (630%)&nbsp;</li><li>Romania (620%)&nbsp;</li><li>Poland (550%)&nbsp;</li><li>Spain (300%)&nbsp;</li><li>Germany (200%)&nbsp;</li></ul>The overall risk ratio in Q3/2024 is shown here on the map:&nbsp;

Ladislav Zezula, Malware Researcher Jakub Křoustek, Malware Research Director<h3 class="text-align-justify">Remote Access Trojans (RATs): XWorm Gone but Attacks Persist&nbsp;</h3>A Remote Access Trojan (RAT) is a type of malicious software that allows unauthorized individuals to gain remote control over a victim's computer or device. RATs are typically spread through social engineering techniques, such as <a href="https://www.avast.com/c-phishing">phishing</a> emails or infected file downloads. Once installed, RATs grant the attacker complete access to the victim's device, enabling them to execute various malicious activities, such as spying, data theft, remote surveillance and even taking control of the victim's webcam and microphone.&nbsp;While this quarter did not bring much in terms of major events in the RAT world, the overall activity and risk ratio increased considerably – by 26%. This increase can be seen in the comparison of Q2 and Q3/2024 below. It is also evident that the risk ratio, and therefore the number of protected users, is increasing towards the end of the quarter.&nbsp;

Most countries saw an increased risk ratio of RATs in Q3/2024, with the notable exception of Canada. Two strains drove the values up in the last two quarters: XWorm in Q1/2024 and Remcos in Q2/2024. This quarter, users in Canada were finally able to "catch a break" since we did not see any large-scale campaigns there, according to our data.&nbsp;The largest increase in risk ratio was observed in Serbia (+114%) followed by Indonesia (+107%) and Greece (+95%). According to our data, the most prevalent strain among RATs is Remcos and has been for some time. Its activity is the decisive factor in the risk ratio for nearly any country. However, in Serbia Remcos was joined by XWorm which saw a protected user increase of a staggering 4500%. This large increase is due to XWorm's move from a nearly non-existent threat in Serbia in previous quarters to being number two behind Remcos. In Greece, we saw an increase of 600% in the number of protected users for QuasarRAT.&nbsp;As usual, the list of countries with the highest risk ratio overall did not change, with Afghanistan in the lead, followed by Iraq and Yemen. Contrary to the previous claim about Remcos, HWorm and njRAT are the most prevalent in these regions.&nbsp;The safest countries regarding RAT infection in Q3/2024 are France, Belgium and Sweden. Interestingly, we do not see Remcos as the top threat in Sweden but rather XWorm and njRAT.&nbsp;

Compared to Q2/2024, the number of protected users from XWorm has increased by 190%. The timing of this surge coincides with XWorm going "off the grid": this RAT was previously sold via an online shop where, presumably, the developer published announcements of new versions showcasing added features. To the best of our knowledge, this shop is now inactive. We might speculate whether the development has stopped or gone private and whether XWorm moved to other sale channels.&nbsp;The most prevalent RAT strains for Q3/2024 are as follows:&nbsp;<ul><li>Remcos&nbsp;</li><li>HWorm&nbsp;</li><li>njRAT&nbsp;</li><li>AsyncRat&nbsp;</li><li>XWorm&nbsp;</li><li>QuasarRAT&nbsp;</li><li>Gh0stCringe&nbsp;</li><li>FlawedAmmyy&nbsp;</li><li>Warzone&nbsp;</li><li>NanoCore&nbsp;</li></ul>In other news, researchers from <a href="https://www.kaspersky.com/blog/new-exotic-rat-sambaspy/52179/" target="_blank" rel="noreferrer noopener">Kaspersky</a> have discovered a new RAT called SambaSpy. SambaSpy has the full feature set typical of modern RATs, including file management, the ability to steal sensitive information and remote desktop control of the infected system. Originally, SambaSpy was targeting only Italian users by checking the system language. Kaspersky suggested that it might have been for testing purposes and noted that the attackers have since removed this check. The infection vector looks fairly common for this kind of threat. An unsolicited email redirects users to a site delivering a PDF document with another link which then delivers a dropper responsible for installing the final payload. Both the dropper and the payload are written in Java.&nbsp;Ondřej Mokoš, Malware Researcher<h3 class="text-align-justify">Vulnerabilities and Exploits: Beware, AliGater Seen in Europe&nbsp;</h3>Exploits take advantage of flaws in legitimate software to perform actions that should not be allowed. They are typically categorized into remote code execution (RCE) exploits, which allow attackers to infect another machine, and local privilege escalation (LPE) exploits, which allow attackers to take more control of a partially infected machine.&nbsp;Attackers continue to exploit zero-day vulnerabilities and target unpatched systems. In this section, we explore recent findings, including multiple zero-day vulnerabilities in critical system components such as the Winsock driver (AFD.sys), Chromium’s V8 JavaScript engine, and the Windows kernel. These vulnerabilities have been leveraged by advanced persistent threat (APT) groups to deploy sophisticated rootkits like <a href="https://www.gendigital.com/blog/news/innovation/lazarus-fudmodule-v3" target="_blank" rel="noreferrer noopener">FudModule v3.0</a>. Additionally, we highlight the new AliGater campaign, which is rapidly spreading across outdated Windows systems in Europe via malicious advertising, further exposing users to dangerous malware such as Magniber Ransomware and Lumma Stealer.&nbsp;We discovered and disclosed a zero-day vulnerability (CVE-2024-38193), that was exploited in the wild, which was used to target a nuclear power plant. It is a user-after-free vulnerability found in the AFD.sys (Winsock driver), which provides kernel-mode support for the Windows socket interface used in network communication. In this instance, attackers discovered a method to exploit the vulnerability in the default driver without needing administrator privileges to interact with it. They identified a zero-day vulnerability in the AFD.sys that allowed them to gain read/write (R/W) access in kernel space.&nbsp;Microsoft recently discovered two additional zero-day vulnerabilities being actively exploited in the wild, as mentioned in the APT section. The first, CVE-2024-7971, is a type of confusion vulnerability in the V8 JavaScript and WebAssembly engine, affecting versions of Chromium prior to 128.0.6613.84. This flaw arises when a program mistakenly interprets a variable as a different data type than intended, potentially leading to memory corruption and arbitrary code execution.&nbsp;The second, CVE-2024-38106, is a use-after-free vulnerability in the Windows kernel. It is triggered by incorrect handling of timers (KTIMER2) within the Worker Factory object via the function NtSetInformationWorkerFactory. This exploit was designed to escape Chromium’s sandbox, allowing the deployment of the FudModule rootkit. Once deployed, it uses Direct Kernel Object Manipulation (DKOM) techniques to interfere with security vendors and bypass security mechanisms.&nbsp;<h4 class="text-align-justify">AliGater&nbsp;</h4>The new AliGater campaign is targeting home users in Europe who are still using outdated Windows operating systems and vulnerable versions of Google Chrome. The campaign primarily spreads through malvertising, where attackers embed malicious ads into legitimate websites to infect users’ machines with dangerous malware.&nbsp;Malicious advertisements redirect users to a fake CAPTCHA page, which is used to launch a multi-stage attack. Exploits in Chrome’s V8 JavaScript engine (CVE-2023-2033) and Windows TrueType font parsing (CVE-2011-3402) are then used to deliver the malware payload such as Magniber Ransomware and Lumma Stealer.&nbsp;Although Windows 7 represents only about 4% of the global operating system market, this still translates into millions of vulnerable machines. The consequences are severe, as AliGater spreads rapidly among outdated systems, making users easy targets for exploitation. Detailed information about the infection chain is available on <a href="https://www.gendigital.com/blog/news/innovation/aligater" target="_blank" rel="noreferrer noopener">our blog</a>.&nbsp;The campaign is focused predominantly on Eastern Europe, primarily Balkan states, and thousands of victims have already been identified in countries such as France, Poland, Italy, Spain, Turkey and Hungary.&nbsp;

To protect against the AliGater campaign and its associated malware, it is essential to use up-to-date operating systems and browsers. Home users and businesses should ensure they are running supported versions of Windows and keep their browsers patched against known vulnerabilities.&nbsp;<h4 class="text-align-justify">Cobalt Strike &nbsp;</h4>In Q3/2024, we also evaluated the main exploitation and post-exploitation frameworks targeting our users. Our telemetry indicates that <a href="https://www.cobaltstrike.com/" target="_blank" rel="noreferrer noopener">Cobalt Strike</a> was the more prevalent framework in the quarter. To be more precise, Cobalt Strike was 84.4% more prevalent than Metasploit, and&nbsp; 274.7% more prevalent than BeefProject.&nbsp;

We will continue to evaluate and monitor the evolution of Cobalt Strike, Metasploit, BeefProject, Brute Ratel, Merlin and all the rest of the frameworks targeting our users in the next quarter.&nbsp;Luigino Camastra, Malware Researcher Martin Chlumecký, Malware Researcher David Álvarez, Malware Analyst Michal Salát, Threat Intelligence Director<h2 class="text-align-justify">Web Threats&nbsp;</h2>As cybercriminals continue to adapt to the ever-changing digital landscape, web-related threats remain a dominant area of concern. From Q2 to Q3 of 2024, while we observed a 16% reduction in the overall risk ratio for scams, the landscape remained dynamic and complex. Scammers are continuously refining their methods, using techniques like malvertising and leveraging current events to make their scams appear more credible and harder to detect.&nbsp;Although there was a slight decline in general web threat activity, possibly due to seasonal variations such as the summer holidays, several categories of web threats, including Crypto Scams, Dating Scams, and Tech Support Scams, saw notable increases in specific regions via specific tactics. Push notification scams and phishing activities also remain prevalent, with certain regions showing significant upticks, as detailed in the following sections.&nbsp;As we move forward into the analysis of Q3 data, this report will highlight the evolving nature of these threats, with an emphasis on the geographic trends, the growth of specific scam tactics, and the new methods cybercriminals are using to bypass security measures and deceive users.&nbsp;<h3 class="text-align-justify">Scams: Fewer Scams, Bigger Tricks&nbsp;&nbsp;</h3>A scam is a type of threat that aims to trick people into giving an attacker their personal information or money. We track diverse types of scams which are listed below.&nbsp;In the third quarter, we observed a 16% reduction in the overall risk ratio for online scams, indicating a decline in the volume or effectiveness of these threats. While this decrease is promising, scams remain a persistent issue, with attackers constantly adapting to evade detection. Our analysis highlights shifts in targeting strategies and tactics, signaling the importance of remaining on alert &nbsp;for new methods and flavors of the online scams.&nbsp;

However, this general downturn contrasts with the ongoing rise in specific scam tactics, notably malvertising with a 17% increase quarter-over-quarter. Malvertising, which often operates in tandem with scams, has become an increasingly favored method for scammers to push scam content quickly and efficiently to users.&nbsp;&nbsp;This trend underscores a more nuanced reality: while the overall scam frequency may have declined, certain subcategories are experiencing significant growth.&nbsp;

As we emphasize frequently in our threat reports, one of the common ingredients of a successful scam campaign is the use of advertisements. Moreover, scammers know well that many users use not only AV protection but also ad blockers, which can vary in effectiveness based on their focus. As a result, scammers are constantly innovating to bypass these defenses and no longer solely rely on traditional advertising methods to deliver malicious content. Instead, they increasingly exploit current world events, embedding scams within content that appears credible, relevant and engaging to users. By aligning their campaigns with trending news or global events, scammers increase their chances of deceiving users who are seeking timely information or updates. One such campaign, described in the next section, demonstrates these tactics in action: CryptoCore.&nbsp;<h4>Escalation of CryptoCore Scams&nbsp;</h4>A crypto scam is a cyber threat designed to trick individuals into surrendering their cryptocurrency. These scams exploit the anonymity and irreversibility of blockchain transactions, often targeting those with a limited understanding of how cryptocurrency works.&nbsp;In Q3/2024, we continued investigating the <a href="https://decoded.avast.io/martinchlumecky1/cryptocore-unmasking-the-sophisticated-cryptocurrency-scam-operations/" target="_blank" rel="noreferrer noopener">CryptoCore scam group</a>. This quarter, CryptoCore's tactics evolved, with the group intensifying its use of <a href="https://us.norton.com/blog/emerging-threats/what-are-deepfakes">deepfake videos</a> and expanding its targeting to include high-profile global events, especially the U.S. election. These fraudulent campaigns leveraged well-known figures and corporations, including Elon Musk and Tesla, to reinforce their credibility and mislead potential victims. By hijacking popular social media accounts, especially on platforms like YouTube, these scammers reached millions of viewers, convincing them to invest in fake cryptocurrency schemes.&nbsp;The attackers were able to attract a massive audience via deepfake videos that are still evolving. The campaigns are becoming more refined and targeted, especially in politically sensitive regions like the U.S. which will hold its presidential election in early November. &nbsp;The following example demonstrates the use of a deep fake video with the U.S. election theme. The original video is from Tesla's 2022 Annual Meeting of Stockholders, where Elon Musk discussed several key topics, including Tesla's growth, production milestones, and future ambitions. The attackers synthesized the voice of Elon Musk and modified moving the mouth (lip sync) to match the new message.&nbsp;

CryptoCore's activities escalated dramatically after our telemetry captured 3,000 cryptocurrency transactions linked to their scams with a total value of an estimated $4,000,000. While this figure is a rough estimate, the actual amount could be higher, given the complexity of tracking illicit crypto wallets and abused platforms.&nbsp;The countries most affected by this are the United States, followed by the United Kingdom and Germany; see the map below for a reflection of global risk.&nbsp;

CryptoCore’s strategy of capitalizing on major media events is reflected in our telemetry. The following events were key moments in Q3 for CryptoCore scams:&nbsp;<ul><li>July 15: Elon Musk publicly endorsed Donald Trump during a rally in Pennsylvania, just days after an assassination attempt on the former president. This event garnered intense media attention, and CryptoCore wasted no time producing deepfake videos featuring Elon Musk.&nbsp;</li><li>July 27: Musk retweeted a parody about Kamala Harris. This incident drove traffic to YouTube, where CryptoCore’s deepfakes target the election.&nbsp;</li><li>September 1: CryptoCore exploited a legal dispute in Brazil, where Musk’s platform, X (formerly Twitter), faced a temporary suspension.&nbsp;</li></ul>The group's exploitation of real-time media events like these underscores their ability to manipulate public interest for financial gain.&nbsp;

These circumstances indicate that the CryptoCore activities and the risk of crypto fraud caused by these threat actors will increase.&nbsp;Detailed information about the modus operandi of CryptoCore can be found in <a href="https://decoded.avast.io/martinchlumecky1/cryptocore-unmasking-the-sophisticated-cryptocurrency-scam-operations/" target="_blank" rel="noreferrer noopener">this article</a>.&nbsp;<h3>Malicious Browser Push Notifications: From Helpful to Harmful&nbsp;</h3>These types of notifications are a common browser feature that allow websites to send users push notifications. They can be pretty handy so, of course, scammers have found a way to exploit them. Attackers trick users into enabling these notifications so they can then be exploited.&nbsp;The activity of push notification scams has remained relatively stable throughout the quarter, with no major fluctuations in the overall threat level. However, some countries continue to face elevated risks: Argentina, Italy, and Spain are currently the countries with the highest risk ratios for push notification scams.&nbsp;

Notably, Italy has experienced a significant surge in activity, with the risk ratio increasing by a staggering 166%. This sharp rise underscores the growing threat landscape in the region, signaling a need for increased attention from users.&nbsp;

<h3>Dating Scams: Scammers Swipe Right&nbsp;</h3>Dating scams, also known as romance scams or online dating scams, involve fraudsters deceiving individuals into fake romantic relationships. Scammers adopt fake online identities to gain the victim's trust, with the ultimate goal of obtaining money or enough personal information to commit <a href="https://www.lifelock.com/how-it-works/what-is-identity-theft/">identity theft</a>.&nbsp;The activity of dating scams has surged significantly over the past quarter, as evidenced by the rising risk ratios. Globally, we’ve seen notable increases in several countries.&nbsp;

Slovakia experienced a substantial rise, with a 17% increase in the risk ratio, while Finland mirrored this with an identical 17% increase. Denmark and Germany also saw moderate growth, with risk ratios increasing by 5% and 3% respectively.&nbsp;&nbsp;

Moreover, Thailand saw the most dramatic increase, with a staggering +154% in the risk ratio, followed by Iceland at +48% and Fiji at +60%. These sharp rises highlight how dating scams are becoming increasingly prevalent in regions that were previously less affected, signaling a shift in targeting strategies.&nbsp;

<h3>Tech Support Scams: Japan Remains the Top Target&nbsp;</h3>Tech support scam threats involve fraudsters posing as legitimate technical support representatives who attempt to gain remote access to victims' devices or obtain sensitive personal information, such as credit card or banking details. These scams rely on confidence tricks to gain victims' trust and often involve convincing them to pay for unnecessary services or purchase expensive gift cards. It's important for internet users to be vigilant and to verify the credentials of anyone claiming to offer technical support services.&nbsp;Despite a significant quarter-over-quarter decline in the risk ratio for tech support scams in Japan (60%) and Germany (33%), these countries remain among the most active in terms of scam prevalence. Japan, with a risk ratio of 1.32%, continues to lead globally, indicating a persistent threat level even amid reductions. In contrast, countries such as France and Hong Kong are experiencing notable increases. France saw a 31% rise in the risk ratio, while Hong Kong’s risk ratio surged by 86%, reflecting high success in this country for these scams. This trend is further emphasized by the increased number of protected users in France (24%) and Hong Kong (82%), signaling targeted activity in these regions.&nbsp;

The graph showing risk ratio for Q2/2024 and Q3/2024 displays a general downward trend across both quarters, suggesting a gradual decrease in tech support scam activity over this period.&nbsp;

The example below shows a TSS lading page of very prevalent campaign targeting French users. France is one of the countries that recorded one of the biggest increases in the last quarter.&nbsp;

<h3>Email Threats: How Scammers Bypass Spam Detection&nbsp;</h3>The Email threats section tends to cover a wide range of scams targeting almost anyone with an email address. These scams take various forms, including fake invoices designed to mimic legitimate brands and trick recipients into making payments to the attackers. Extortion emails attempt to coerce victims into sending cryptocurrency by falsely claiming to have recorded compromising webcam footage. Lottery scams lure users to websites that offer deals too good to be true, while classic phishing emails falsely inform recipients that their password has expired in an attempt to steal credentials. This section will explore the common email scams that can land in your inbox and the tactics used by cybercriminals to exploit unsuspecting users.&nbsp;The prevalence of email threats typically remains constant, but, at the beginning of the summer, we observed an unusual spike in detected threats which raised our concerns about evolving tactics used by cybercriminals. &nbsp;Since the spike, which occurred at the end of July, the number of protected users has again stabilized. We will explore this spike in more detail later, using a real-world example to illustrate how cybercriminals may be attempting to bypass spam filters.&nbsp;

When it comes to countries with the highest risk of encountering email threats or scams, the ratio is now quite similar across continents—a trend we haven’t observed before. Australia, Europe, and North America are currently facing comparable levels of threat risk. In the past, the majority of these risks were concentrated in North America, but now the distribution is more balanced globally. Notably, South Africa has now risen to the top of the list.&nbsp;

Let's examine the statistics of protected users on a quarter-by-quarter basis. Turkey saw the highest increase, with a remarkable 80%, which is extraordinary compared to other countries. The second-highest rise was in the Czech Republic, with a 73% increase, followed by Colombia with a 59% quarterly rise. On the other end of the spectrum, Germany experienced the largest drop at 36%, followed by Italy at 27% and Brazil at 14%. This significant contrast highlights the varied landscape of cybersecurity across regions, with some countries showing impressive improvements while others face steep declines.&nbsp;Japan is a special case, as attacks there tend to occur in spikes, while other regions remain relatively stable without significant changes to the overall trend. This behavior is illustrated in the following graph.&nbsp;

As mentioned at the beginning of this section, there was an email scam targeting users with a simple tactic: a survey that promised a physical prize at the end, likely a cell phone since the scam appeared to come from a mobile provider. What caught our attention, however, was the structure of the email. The HTML code was designed to mislead both spam filters and users. It could hide certain parts of the email from human readers while deceiving the filters.&nbsp;

Let's look at an example that we will be dissecting in this report. First, we'll examine the version that users see, and then we'll delve into the code inside the email (.eml file). There are several red flags for the user to consider:&nbsp;&nbsp;&nbsp;<ul><li>The sender's name does not match the sender's domain, which raises suspicion.&nbsp;</li><li>The subject line does not align with the actual content of the email.&nbsp;</li><li>The font used in the message is unprofessional and inconsistent with what a company of this nature would typically use.&nbsp;</li><li>There is a clear attempt to create urgency, a common tactic in scams.&nbsp;</li></ul>&nbsp;After analyzing the source code of the email (the .eml file), there are several interesting patterns that we also observe in other scam messages. First, email has multiple parts and only a small part is related to the message that is actually displayed to the users and that leads to the malicious web site.&nbsp;&nbsp;Below this message, the email contains a message that is copied from the account registration email with popular OpenAI services:&nbsp;To continue setting up your OpenAI account, please verify that this is your &nbsp; email address. Verify email address (<a href="https://auth0.openai.com/%3cREDACTED" target="_blank" rel="noreferrer noopener">https://auth0.openai.com/&lt;REDACTED</a>&gt;). This link will expire in 5 days. If you did not make this request, please disregard this email. For help, contact us through our Help center (&lt;REDACTED&gt;).&nbsp;This message is ‘hidden’ to the user as it is separated from the main text by multiple breaklines. However, the spam filters tend to extract complete message and thus, as this part closely resembles legitimate emails, it helped this scam message avoid being detected even by major email providers. This can be seen in the following graphs, where we observe the prevalence of this particular threat rising in July as it avoided &nbsp;the spam detection of popular email providers.&nbsp;

Among other methods for avoiding detections, the email contains:&nbsp;&nbsp;<ul><li>using non-standard fonts: the main message with malicious link is encoded using Unicode characters to prevent a clear extraction&nbsp;</li><li>EML file contains multiple parts, and these, while not rendered to the user, can also confuse spam filters&nbsp;</li><li>source code uses incorrect HTML tags, such as&nbsp;&nbsp;</li></ul>&lt;td&gt;&lt;td&gt;&lt;SelECT&gt;&lt;head&gt;&lt;ObjecT&gt;&nbsp;or&nbsp;&nbsp;&lt;z style="height: 24px; width: 1.27315%;"&gt; &lt;/r&gt;&nbsp;&lt;w style="height: 24px; width: 9.83796%;"&gt; &lt;/r&gt;&nbsp;<ul><li>text from other parts of the email uses multiple languages&nbsp;</li></ul>

<ul><li>Usage of reputable domains to avoid detection&nbsp;</li></ul>&lt;a href="https://t6s6h5l4o6w0u1s5b9d8r2u5a7c0.s3.amazonaws.com/4.html#qs=r-ahebkacceebfbbikagggdhehachgjdgfiafchiiafchiiafchiiabadiadfiaccadjeacjjkaefjikkadcc" target="" align="center"&gt; &lt;h1&gt; 🇦 🇷 🇪 🇾 🇴 🇺 🇴 🇳 🇱 🇮 🇳 🇪 ? 🇹 🇦 🇰 🇪 🇹 🇭 🇮 🇸 3️⃣0️⃣ 🇸 🇪 🇨 🇴 🇳 🇩 🇸 🇺 🇷 🇻 🇪 🇾 ❗&lt;/h1&gt;&lt;/a&gt;&nbsp;Using reputable domains like Amazon AWS to host malicious content allows many email threats to &nbsp;bypass domain-based spam filters. The obfuscated parameters may conceal redirects to phishing sites or malware downloads.&nbsp;The recent surge in scam emails with sophisticated spam filter evasion techniques underscores the constant need for monitoring these threats. Cybercriminals are exploiting vulnerabilities by embedding deceptive HTML code and mimicking legitimate communications to bypass detection and deceive users. This global threat shows that no region is exempt, with significant increases in countries like Singapore and South Africa. This is a persistent problem, and we are likely to see more scams of this nature in the future.&nbsp;<h3 class="text-align-justify">Phishing: DGAs Fueling Phishing Campaigns&nbsp;</h3>Phishing is a type of online scam where fraudsters attempt to obtain sensitive information including passwords or credit card details by posing as a trustworthy entity in an electronic communication, such as an email, text message, or instant message. The fraudulent message usually contains a link to a fake website that looks like the real one, where the victim is asked to enter their sensitive information.&nbsp;In comparison to previous quarters, phishing activity has shown a slow but steady decline across most regions. However, there are a few notable exceptions where activity has increased.&nbsp;&nbsp;Australia, despite experiencing a significant 22% decrease in its risk ratio, saw an 11% increase in the number of protected users, indicating ongoing targeted efforts.&nbsp;

In the previous quarter, we were able to detect several waves that could contain tens of thousands of domains, many of which were auto-generated.&nbsp; Since the names are created automatically, it can be assumed that the attackers are also operating these domains automatically, in an attempt by scammers to scale their attacks quickly.&nbsp;&nbsp;The way in which attackers are generating phishing domain names is also evolving. While it was previously most common to observe a simple addition of numbers or suffixes, domain name generation is now sometimes done by techniques such as domain generation algorithms (DGAs ), which create seemingly random but actually systematic domain names. DGAs are often employed in malware to algorithmically generate and operate domain names. These algorithms take an initial "seed" value—essentially a secret key—and use it to generate a pseudo-random sequence of domain names.&nbsp;For phishing attacks, DGAs can evade static blocklists, allowing attackers to automatically create and operate large numbers of domains. While for attackers and victim clients there is not the need to sync on the generated domains to communicate with the command-and-control (C&amp;C) server, phishing attackers algorithmically generate new domains on their end to make it harder for security measures to block or detect phishing campaigns, as new domains can continuously be created without human intervention.&nbsp;

Alexej Savčin, Malware Analyst Branislav Bošanský, Scientist Branislav Kramár, Malware Analyst David Jursa, Malware Analyst Martin Chlumecký, Malware Analyst Matěj Krčma, Malware Analyst Nikola Groverová, Data Scientist<h2 class="text-align-justify">Mobile-Related Threats&nbsp;</h2>Mobile threats keep becoming more sophisticated, as demonstrated by several new strains entering the fray this quarter. The Necro strain – part adware, part dropper – made its way onto the PlayStore in Q3/2024, displaying hidden advertisements and downloading additional payloads once installed.&nbsp;Banker evolution also continues, with Rocinante targeting users in Brazil. Inspired by Ermac, it keylogs user inputs and displays fake phishing bank pages to steal login credentials. A new version, TrickMo banker, can record the device screen and extract sensitive information, storing it in an unsecured C&amp;C server accessible by the public. A manually operated banker called BingoMod uses less sophisticated methods to extract money from victims and wipe their devices. A source code leak of Octo prompts the author to create Octo2 with updated features, which is already spreading in Europe.&nbsp;Spyware is not far behind, with a novel and advanced threat called NGate entering the scene in the last quarter. Targeting the Czech Republic, this spyware is able to steal NFC data which threat actors use to withdraw money from ATMs. We have also seen the Mandrake spyware come back to life and sneak onto the PlayStore, once again stealing victims’ login details if installed.&nbsp;<h4 class="text-align-justify">Web Threat Data within the Mobile Landscape&nbsp;</h4>Most blocked attacks on mobile devices in Q3/2024 were web-based, mirroring the previous quarter. Consumers are much more likely to encounter phishing websites, scams, malvertising and other web threats than ever before. These threats can come in a variety of formats such as private messages, SMS and emails but also redirects on less reputable sites, unwanted pop ups and through other avenues.&nbsp;In contrast to these types of mobile scams, traditional on-device malware requires a more complex infection vector where the consumer must also install the malware. For proper functionality of most mobile malware, permissions need to be granted by the consumer first, which again lowers the chances of malicious activity being triggered.&nbsp;Hence, blocking web-threat based attacks is beneficial for the security of mobile devices, as malware actors often use them as an entry point to get the payload onto the mobile device of their victims.&nbsp;

<h4>Top Threats Seen in Norton Genie in 2024&nbsp;</h4>We are excited to share &nbsp;the top threat types detected by <a href="https://www.norton.com/products/genie-scam-detector" target="_blank" rel="noreferrer noopener">Norton Genie</a>, our scam detection tool, based on telemetry from 2024 so far. As scammers evolve and adapt, they continue to find creative ways to deceive and manipulate users. These threats come in many shapes and forms, exploiting vulnerabilities and human psychology alike. Here is a breakdown of the most prevalent scams types we’ve seen via individual submissions to Norton Genie:&nbsp;&nbsp;

2 Million Users Protected from Fake CAPTCHA Scams, Ransomware Risk Doubled, and Lumma Information Stealer Surges Eleven-Fold

Gen Q3/2024 Threat Report 

<h2>Foreword</h2>The Q2/2024 Gen Threat Report is here, marking the launch of our new series under the unified Gen brand, replacing the Avast Threat Report series. As we continue integrating threat telemetry across our diverse cyber-safety solutions—including Avast, Norton, AVG, Avira, and LifeLock—we're gaining an even more comprehensive view of the evolving threat landscape, which we look forward to sharing with you in this series.This quarter—April through June 2024—continued to highlight the relentless nature of cyber threats, with a staggering 46% increase in attacks year-over-year. Although we observed a slight dip compared to the previous quarter, the overall threat landscape remains highly active, with over a billion unique attacks being blocked by us each month. Scams and malvertising continue to dominate, making up more than 87% of threats on Desktop and 93% on Mobile. Notably, attacks utilizing AI-generated techniques, such as scams via phone calls or deepfake videos, are becoming increasingly common, further complicating the threat environment. Browsers and the Web serve as the primary attack surface, accounting for 95% of all threats.

Scams remain a dominant threat this quarter, with new techniques emerging and old ones being repurposed, often with alarming sophistication. Financial scams, particularly investment scams, have surged as threat actors increasingly leverage AI-generated deepfake videos on YouTube, featuring high-profile events and celebrities to attract victims. A standout example is the CryptoCore scam, where attackers used compromised YouTube accounts and deepfake videos to steal at least $5 million globally in recent months. They lured victims into fake cryptocurrency giveaways with highly convincing content. Fortunately, we successfully blocked a significant portion of their attacks, preventing further losses. However, the sophistication of these scams underscores the growing risks to users, as attackers continue to exploit trending topics and advanced technology to enhance the reach and impact of their fraudulent schemes.Another concerning development is the rise of part-time job scams (also known as task scams). These have evolved from text-based interactions on Telegram to more sophisticated AI-generated voice communications, adding a new layer of deception and realism. Additionally, dating scams remain prevalent, particularly in Europe, while technical support scams (TSS) and fake invoice scams continue to target users in Japan, the US, and Australia. The emergence of ClearFake type of attack, where attackers convince users to run malicious scripts under the guise of fixing common Windows issues, further illustrates the growing ingenuity of scam tactics. This quarter also saw significant activity related to EchoSpoofing—a major attack that exploited email routing misconfigurations of a security solution to deliver millions of malicious emails.A worrying trend this quarter is the return of fake antivirus scan scams—a tactic many believed was a thing of the past. These scams trick users into thinking their devices are infected and are now more convincing than ever. You can read more about it in the featured story of this report.Stolen user data and personal information – the pieces used to take over identities – continues to be digital gold for threat actors. In this quarter, we’ve seen a spike in activity from various <a href="https://www.lifelock.com/how-it-works/what-is-identity-theft/">identity theft-related threats</a>, such as information stealers like AgentTesla, which remains widespread on desktops. On mobile, banking trojans like TeaBot, SoumniBot, RewardSteal, and Medusa are growing rapidly. These threats are slipping through onto the PlayStore and posing a serious risk to users.On a more positive note, law enforcement made significant strides this quarter. Operation Endgame, led by Europol, disrupted major botnet providers such as IcedID, SmokeLoader, and Trickbot resulting in several arrests and notable setbacks for malicious operations. Furthermore, the U.S. Department of Justice also played a crucial role in dismantling the notorious 911 S5 botnet, while actions against the DDoSia botnet led to multiple arrests. Additionally, efforts to combat Remote Access Trojans (RATs) have shown positive results, with operations targeting threats like Hive. It will be interesting to see how the botnet landscape evolves following these high-profile arrests. Will a new kingpin emerge to replace those who have been taken down?Despite these successes, some botnets, such as Twizt, have adapted by spreading ransomware strains like LockBit Black through email attachments. This quarter saw a notable 24% increase in blocked ransomware attacks in our telemetry, with particularly sharp spikes in the US, UK, and India. Nevertheless, there have been significant victories in disrupting ransomware operations. We’ve continued our commitment to aiding victims by providing free decryption tools, including our latest release for the DoNex ransomware.Lastly, Advanced Persistent Threat (APT) groups, particularly those linked to North Korea like Lazarus and Kimsuky, remain active, with several campaigns targeting Asia, including the GuptiMiner campaign. On mobile, we’ve seen adware sneaking into the PlayStore, designed to generate fraudulent advertising revenue through background clicks.And as we delve into these insights, we invite you to explore the full breadth of information contained in this report. With a comprehensive view of the current threat landscape, we hope this new Gen series offers even more value and clarity than its predecessor. Stay safe, avoid blue screen incidents, and enjoy diving into the report.Jakub Křoustek, Malware Research Director<h2>Methodology</h2>This report is structured into three main sections: Desktop-related threats, where we describe our intelligence around attacks targeting the Windows, Linux, and Mac operating systems, with a specific emphasis on web-related threats, and Mobile-related threats, where we describe the attacks focusing on Android and iOS operating systems.We use the term “risk ratio” in this report to denote the severity of specific threats. It is calculated as a monthly average of “Number of attacked users / Number of active users in a given country.” Unless stated otherwise, calculated risks are only available for countries with more than 10,000 active users per month.A blocked attack is defined as a unique combination of the protected user and a blocked threat identifier within the specified time frame.Moving forward, our quarterly threat reports will be informing about the threat landscape situation as seen from the suite of Gen cybersecurity brands. We continuously enhance our threat telemetry and anticipate further refinements in our future reports.<h2>Featured Story: Fake Scan Scams - A New Twist on an Old Trick</h2>For veteran internet users, the mention of fake antivirus scams might evoke memories of the early 2000s, when cybercriminals exploited fears of <a href="https://us.norton.com/blog/emerging-threats/malware">malware infections</a> with alarming effectiveness. Back then, cybercriminals tricked users into thinking their computers were infected, showing fake antivirus interfaces detecting nonexistent threats. In a panic, users purchased licenses for these fake programs, which only simulated antivirus functionality without real protection. Some even uninstalled their real antivirus software, believing the fake one was superior. These fake antivirus scams were a goldmine for cybercriminals, generating hundreds of millions in illicit profits.Fast forward to today, and we're seeing a new twist on this old trick. This time, the scammers have upped their game, making their schemes more sophisticated and harder to spot. Whether you're a seasoned user or new to these tactics, it’s crucial to understand how these scams work and how to avoid falling victim.<h4>The Evolution of Fake Antivirus Scams</h4>Back in 2008 and 2009, cybercriminals used fake antivirus (Fake AV) software to scare users into buying bogus programs. These fake programs, often referred to as scareware, would bombard users with alarming, fake virus alerts, prompting them to purchase the fake software. The scale of these scams was immense, with countless victims and hundreds of millions of dollars lost. Reports from that time highlight the scale of the problem, with numerous victims falling prey to these tactics and the total financial losses running into millions of dollars.Today, cybercriminals are rehashing this old scam, capitalizing on the public discussion about cybersecurity following numerous data breaches and cyber incidents in previous months. The criminals have now refined the fake antivirus scam with two significant changes:<ol><li>Promoting Real Antivirus Software: Instead of pushing fake software, these scams now promote well known antivirus brands like Avira, AVG, Avast, Norton, McAfee, Kaspersky and others. The renewal process occurs on the actual antivirus company’s website, adding a layer of credibility.</li><li>Abusing the Windows Notification System: Scammers exploit the Windows notification system to make their alerts look like genuine system warnings. This tactic makes the scam much more convincing, pushing users to act quickly.</li></ol><h4>How the Fake Scan Scam Works</h4>Cybercriminals use aggressive pop-up alerts that mimic the look of real antivirus programs appearing in your browser. These alerts often claim that your computer is infected with multiple viruses, urging immediate action. These messages can mimic the style of legitimate antivirus programs, prompting users to click on links that ultimately lead to real antivirus sites. They then direct you to purchase a real antivirus product, earning commissions through the referral programs of these legitimate companies.To add to the deception, these fake alerts abuse the Windows notification system. By sending alerts that appear as system messages, scammers add an extra layer of credibility, making it more likely that users will fall for the ruse. This tactic plays on the trust users have in their operating system, making the scam seem all the more real and urgent. If the victim closes the browser alerts will keep showing up in Windows, even if the computer is locked.Delivery Mechanisms: While push notifications from the browser are a common delivery method, the attack often starts with a fraudulent email. Users receive a phishing email from what looks like a legitimate antivirus brand with a link that, when clicked, initiates the Fake Scan scam process.

The following are the Fake AV Scan scam steps:<ol><li>Browser Pop-ups: The scam begins with pop-ups appearing in your web browser, claiming that your system is infected. These alerts can appear even after you close your browser, continuing to show up on your desktop and lock screen.</li><li>Varied Messages: Beyond infection warnings, scammers also use messages like "Your Google account has been hacked" to instill fear and urgency.</li><li>Fake Scanning Interface: Clicking on these alerts takes you to an interface resembling a legitimate antivirus scan, which shows multiple fake threats.</li><li>Purchase Prompt: To "remove" these threats, the interface prompts you to buy or renew a license. When you click to proceed, you are redirected to the actual antivirus company’s website to complete the purchase.</li><li>Referral Links: The URLs involved often include referral codes, showing that the scammers earn commissions through affiliate programs.</li></ol>By promoting legitimate antivirus products, cybercriminals can exploit affiliate programs to earn commissions on each sale. This not only dupes the user into buying unnecessary software but also diverts revenue to the scammers at the expense of both consumers and legitimate antivirus companies.<h4>Protecting Yourself from Fake Scan Scams</h4>To help safeguard against these sophisticated scams, follow these essential tips:<ul><li>Stay Vigilant: Be cautious of any antivirus alerts that appear while browsing. Fake Scan scams often replicate the look of legitimate programs, making them hard to distinguish.</li><li>Verify Warnings: Always check antivirus alerts through your installed antivirus software, whether that’s locally on your device or by logging into your account in the browser.</li><li>Manage Notifications: Avoid granting permission to install push notifications from untrusted websites. Only allow notifications from reputable sources to minimize the risk of malicious alerts.</li></ul><h4>The Scale of the Problem</h4>So how big of a problem are fake antivirus scams? During this quarter alone, we have protected over 1 million users from these attacks. While the attacks are occurring worldwide, they are particularly active in North America, South America and Europe, with significant incidents also reported in countries like India or Japan.To give you a clearer picture, here's a heat map showing the Fake Scan attacks blocked in Q2/2024 worldwide:

These are the top 10 countries with the most Fake Scan attacks blocked:<ol><li>Brazil</li><li>United States</li><li>France</li><li>Germany</li><li>Spain</li><li>Mexico</li><li>Italy</li><li>Poland</li><li>United Kingdom</li><li>Argentina</li></ol>The sheer volume of these attacks highlights the global scale of the problem. Cybercriminals are leveraging sophisticated tactics to target users everywhere, exploiting their fear and urgency to drive these scams. The widespread nature of these attacks, coupled with their high success rate, underscores the importance of people around the world understanding the potential threat of these scams.<h4>Conclusion</h4>The old fake antivirus scams, where cybercriminals made millions, demonstrated the effectiveness of exploiting fear and urgency. Now, with the added layer of legitimacy provided by the illegitimate promotion of real antivirus products and the Windows notification system, these scams are more convincing than ever. It is essential to remain vigilant, verify the authenticity of alerts, and only trust reputable sources to ensure you don't fall victim to these evolving threats.&nbsp;David Jursa, Malware Researcher Luis Corrons, Security Evangelist &nbsp;<h2>Desktop-Related Threats</h2><h3>Advanced Persistent Threats (APTs): Asia's Cyberfront</h3>An Advanced Persistent Threat (APT) is a type of cyberattack that is conducted by highly skilled and determined hackers who have the resources and expertise to penetrate a target's network and maintain a long-term presence undetected.Asia continues to be a hotbed for Advanced Persistent Threat (APT) activity, with various actors actively targeting countries such as South Korea, Myanmar, Vietnam, the Philippines, and Cambodia.This wave of cyberattacks highlights the growing amount of geopolitical tension and cyber espionage in Asian countries. Among the many actors involved, Mustang Panda stands out as one of the most persistent groups. Identified in operations across Mongolia, Vietnam, and Myanmar, Mustang Panda has become infamous for their heavily used sideloading techniques to deploy malicious payloads. These payloads often involve the Korplug malware, a tool primarily used to steal sensitive documents from compromised systems, illustrating the group's focus on intelligence gathering and long-term infiltration.The Sidewinder group poses yet another significant threat in the region. Traditionally associated with operations targeting Pakistan, Sidewinder has recently expanded to target countries like Sri Lanka and the Maldives. This expansion highlights the group's evolving tactics and its ability to adapt to shifting geopolitical dynamics. Sidewinder’s campaigns are notable for their ability to exploit vulnerabilities in diverse environments, demonstrating a sophisticated understanding of both technical and geopolitical landscapes.In addition to Mustang Panda and Sidewinder, the region has also seen activity from other advanced threat actors. For instance, a relatively new group has launched widespread attacks across Thailand, Vietnam, Saudi Arabia, the Philippines, and Taiwan. What sets this group apart is its use of custom malware, including advanced shellcode capable of manipulating and bypassing the security measures of well-known security vendors. Fortunately, the specific vulnerability exploited by this group was quickly reported to the vendor and has since been patched.In Q2/2024, the Lazarus group, a well-known North Korean APT, began particularly targeting freelance developers working on NFT and crypto-wallet projects. Lazarus has demonstrated a keen interest in the cryptocurrency market, leveraging legitimate platforms such as "freelancer.com" to distribute malicious JavaScript to unsuspecting developers. The group has also employed GitHub repositories to spread their malicious NPM-based packages. These packages, once installed on Windows, Linux, or macOS systems, begin by gathering basic system information. They then scan the victim's web browser for cryptocurrency wallet extensions, such as those from Binance and Coinbase, before deploying a custom Python backdoor.

This backdoor is designed for a range of malicious activities, including fingerprinting, remote control, keylogging, data exfiltration, browser credential theft, and even the downloading of remote access tools like AnyDesk. The sophistication and focus of Lazarus on the cryptocurrency sector suggest a calculated effort to exploit this growing market for financial gain.&nbsp;To add to the complexity of the Asian threat landscape in Q2/2024 <a href="https://decoded.avast.io/janrubin/guptiminer-hijacking-antivirus-updates-for-distributing-backdoors-and-casual-mining/">we reported on GuptiMiner</a>, a highly sophisticated threat with a unique infection chain. The threat actors behind GuptiMiner employed a range of advanced techniques, including DNS requests to attacker-controlled servers, sideloading, extracting payloads from seemingly innocent images, and signing their payloads with a custom trusted root anchor certification authority.The criminals running GuptiMiner have been capitalizing on an insecurity within an update mechanism of an Indian antivirus vendor to distribute the malware by performing a man-in-the-middle attack. Based on similarities between the GuptiMiner operation and the Kimsuky keylogger, we believe the campaign was orchestrated by notorious North Korean APT group Kimsuky.The main objective of GuptiMiner is to distribute backdoors within big corporate networks. We’ve encountered two different variants of these backdoors: the first is an enhanced build of PuTTY Link, providing SMB scanning of the local network and enabling lateral movement over the network to potentially vulnerable Windows 7 and Windows Server 2008 systems on the network. The second backdoor is multi-modular, accepting commands from the attacker to install more modules as well as focusing on scanning for stored private keys and cryptowallets on the local system.Interestingly, GuptiMiner also distributes XMRig on the infected devices, which is a bit unexpected for such a thought-through operation.&nbsp;Luigino Camastra, Malware Researcher Igor Morgenstern, Malware Researcher Jan Rubin, Malware Researcher&nbsp;<h3>Bots: Spring Cleanup</h3>Bots are threats mainly interested in securing long-term access to devices with the aim of utilizing their resources, be it remote control, spam distribution, or denial-of-service (DoS) attacks.The Windows botnet landscape was a wild one in Q2/2024. At the end of May, an operation dubbed Operation Endgame, coordinated by Europol, targeted various droppers and bots such as IcedID, SystemBC, Pikabot, SmokeLoader, Bumblebee, and Trickbot. The operation focused on arrests, sever takedowns, domain seizures and physical searches to disrupt popular providers many other threat actors rely on to deploy their payloads. At similar time, U.S. DOJ-led operation disrupted the 911 S5 botnet. According to the court documents, the botnet spread through various VPN programs (such as MaskVPN and DewVPN) and pay-per-install software bundles. The main aim of the botnet was to provide residential proxy to other threat actors to allow them to mask their operations.

DDoSia came rather late to the spring cleanup - Spanish Civil Guard paid a visit to three DDoSia participants recently which resulted in arrests and hardware confiscation. Arrests aside, DDoSia project seems to have hit a plateau. The cadence of new messages on their channel is more-or-less stable as is the number of participants in the project. As usual, the most frequent targets were banks. This season also brought tax period in many countries, including Ukraine, prompting the group to target various online tax return platforms. Frequently, we saw attacks on websites of various European cities such as Berlin or Krakow; nevertheless, the impact of such attacks is debatable. Interestingly in June, we saw rapid changes in C&amp;C infrastructure again which would point to issues with their infrastructure, especially since these outages impact their activity.

Unfortunately, Twizt did not participate in this spring cleanup. It has shifted its focus from a sextortion campaign to malicious spam campaign loaded with LockBit3-based ransomware, dubbed LockBit Black, in its attachment.As a whole, we’ve seen an overall decline in bot-related threats, with many notorious strains having two-digit drops in their perceived prevalence (Emotet -50%, Tofsee -22%, Twizt/Phorpiex -17%, Amadey -36%, IcedID -18%). We presume that this trend may continue in the next quarter due to the takedowns which might affect their operation.

In terms of Linux bots, the quarter started with the <a href="https://www.virustotal.com/gui/file/BB9AA33EB1F32EEFDE11FD860754D4B18A370B182CD4EFF9654C66FB632053F7">Goldoon botnet</a> exploiting CVE-2015-2051 and targeting D-Link devices. The usual plague of Mirai/Gafgyt/Xordos bots has a new companion this quarter - <a href="https://www.virustotal.com/gui/file/CF7710B7F4B351EA119DCE1D3862121835C6A3A2B7AD5A8C72A0AC6F573CB72A">V3rs3Bot</a>. Unfortunately, augmenting bots with kernel rootkits continues, leading to many yet-undetected bots in the wild. For instance, we found a <a href="https://www.virustotal.com/gui/file/d860585d57a45de20b3af42bcde474c717336faf0c167b6f3838655c130b7145/detection/f-d860585d57a45de20b3af42bcde474c717336faf0c167b6f3838655c130b7145-1719584575">malicious kernel module</a> that misleadingly uses “Netfilter core team” as an author that also contains backdoor inspired by <a href="https://www.virustotal.com/gui/file/8224F1A05CF90D912C8244CC2B0F34188268493F299A0AD84B769E4DDD310908">its reverse shell</a>.&nbsp; &nbsp;Adolf Streda, Malware Researcher David Alvarez, Malware Analyst &nbsp;<h3>Coinminers: Decrease Globally but Are Not Dead&nbsp;</h3>Coinminers are programs that use a device's hardware resources to verify cryptocurrency transactions and earn cryptocurrency as compensation. However, in the world of malware, coinminers silently hijack a victim's computer resources to generate cryptocurrency for an attacker. Regardless of whether a coinminer is legitimate or malware, it's important to follow our <a href="https://support.avast.com/en-eu/article/Threat-Lab-cryptomining-behavior-guideline/">guidelines</a>.&nbsp;Despite a continuing decline in the prevalence of coinminer malware in Q2/2024, coinminers are still leveraged by threat actors. In our <a href="https://decoded.avast.io/janrubin/guptiminer-hijacking-antivirus-updates-for-distributing-backdoors-and-casual-mining/">recent report on GuptiMiner</a>, we described that one of the stages on devices compromised by this threat was an XMRig coinminer. Although distributing a coinminer is a bit unexpected for such a thought-through campaign, it proves that threat actors still want to make a coin when they see an opportunity.&nbsp;Overall, the risk ratio dropped by an additional 18% in Q2/2024. This reduction was primarily driven by a slight decrease in the share of the XMRig coinminer malware, following a similar trend from the previous quarter.&nbsp;

The decrease is mostly due to a significant drop in the United States and Turkey where the risk ratio of getting infected by a coinminer dropped by 34% and 38%, respectively. Brazil, India, and France also experienced drops in risk ratios by 5%, 16%, and 30%, respectively. The majority of countries saw a slight decline in coinmining activity over the quarter.&nbsp;Hungary, on the other hand, bucked the trend with a 73% increase in the risk ratio in Q2/2024. This is particularly interesting because the increase is rather sporadic. The only other significant rise, among countries with a more substantial user base, is Slovakia, which saw a 14% increase in the risk ratio. Notably, Slovakia and Hungary are neighboring countries, creating an intriguing “hotspot.”&nbsp;With that said, the highest risk ratios still prevail in Madagascar (1.9% risk ratio), Pakistan (1.19%), Turkey (0.91%), and Egypt (0.89%).&nbsp;

XMRig, the long-time leader in coinminer malware, saw its malware share decrease by 9% this quarter. Despite this decline, it still dominates with 53.89% of the total coinminer market.&nbsp;Web miners, which include various JavaScript strains used for malicious background coinmining on webpages – either as raw malware or as an “alternative” to online advertising – have increased significantly by 20% compared to the previous quarter. Most other major coinminers also saw an uptick in activity. On the other hand, CoinHelper’s malware share dropped by 12% this quarter.&nbsp;The most common coinminers with their malware share in Q2/2024 were:&nbsp;<ul><li>XMRig (53.89%)&nbsp;</li><li>Web miners (24.32%)&nbsp;</li><li>CoinBitMiner (2.97%)&nbsp;</li><li>FakeKMSminer (2.12%)&nbsp;</li><li>NeoScrypt (1.81%)&nbsp;</li><li>CoinHelper (0.92%)&nbsp;</li><li>VMiner (0.84%) &nbsp;</li></ul>Jan Rubin, Malware Researcher&nbsp;<h3>Information Stealers: with AgentTesla at Its Peak&nbsp;</h3>Information stealers are dedicated to stealing anything of value from the victim’s device. Typically, they focus on stored credentials, cryptocurrencies, browser sessions/cookies, browser passwords and private documents.&nbsp;According to our data, AgentTesla saw a new all-time in Q2/2024. Before we dive into numbers in the dedicated subsection, let’s have a look at a few campaigns that we observed during a busy April through June.&nbsp;The major Information Stealer to highlight is AgentTesla. <a href="https://x.com/AvastThreatLabs/status/1783535485052174839">One of the major campaigns</a> we identified targeted Czech users via emails disguised as legitimate orders. This particular campaign was also spreading Remcos RAT along with the notorious information stealer.&nbsp;

A <a href="https://x.com/AvastThreatLabs/status/1802627745949585897">fake-tutorial campaign</a>, where attackers were distributing malicious PowerShell scripts via ClearFake, spread various information stealers including Lumma Stealer and attracted significant attention. This attack begins with social engineering, guiding the victim to follow a few simple steps to resolve a problem, in this case fixing Windows Update error 0x80070643, with the user ending up copying a script to their clipboard and pasting it into a command line or PowerShell console. After the script is executed, the victim is infected with a dropper, typically HijackLoader, distributing the aforementioned Lumma Stealer or other malware strains.&nbsp;

Interestingly, we also saw cases of the bad guys fighting for their reputation among the criminal underground – and in cases we saw, not so successfully. The author of DarkGate, using the nickname RastaFarEye, <a href="https://www.trellix.com/blogs/research/darkgate-again-but-improved/">was banned on an underground forum</a> a few months back due to some users raising complaints directed at this malware author.&nbsp;

Despite the ban and subsequent bad cybercriminal PR, we can still see new DarkGate builds with new features and continuous development. DarkGate is a long-standing information stealer with various RAT capabilities. In Q2/2024, there were multiple campaigns spreading DarkGate via malicious email attachments. The emails are crafted in such a way they lure the victim into downloading and opening the attachment, typically a MS Office document or a PDF file.&nbsp;

After the user opens the attached file, in this case a MS Excel XLSX file, they are presented with a message saying they need to “Enable Editing” and click the “Open” button to properly open the document. This effectively leads to infecting the victim with another stage of the malware, as can be seen in the image below as an IP address leading to a malware JavaScript file.&nbsp;

Now, thankfully some good news. Google is <a href="https://security.googleblog.com/2024/07/improving-security-of-chrome-cookies-on.html">improving the security of Chrome cookies on Windows</a> by implementing a new protection called Application-Bound Encryption. This Data Protection API (DPAPI) improvement effectively enhances protection against information stealers’ efforts to steal data from this popular web browser beginning with version 127. In short, for information stealers to steal the sensitive data, the malware will now need to either obtain system privileges or to inject itself into the Chrome browser, which are both noisy and more easily detectable actions by security solutions.&nbsp;<h4>Statistics&nbsp;</h4>In comparison with the previous quarter, the overall risk ratio of information stealers decreased once again in Q2/2024 by additional 11%. According to our data, this is due to a decrease in activity of mid-prevalent information stealers like Stealc, ClipBanker, or ViperSoftX. On the other hand, high-prevalent stealers like AgentTesla, Ramnit, FormBook, Vidar, Lumma, and others, increased their malware share.&nbsp;

In countries where we have a more significant userbase, the risk ratio of getting infected by an information stealer thankfully decreased:&nbsp;<ul><li>Turkey (1.86%) with 18% Q/Q decrease&nbsp;</li><li>Pakistan (1.76%) with 14% Q/Q decrease&nbsp;</li><li>Egypt (1.55%) with 12% Q/Q decrease&nbsp;</li></ul>However, there were also many countries more impacted than usual. For example, Nigeria had a risk ration increase of 130%, for a final risk ration of 2.28% risk ratio. In Ethiopia, the risk ratio increased by 48%, making 2.11% in total.&nbsp;

AgentTesla increased its malware share by 11% this quarter, further underlining its dominance in the information stealers landscape. The same goes with many other prevalent strains, like Ramnit (12% increase), FormBook (30% increase), Azorult (33 % increase), and Lokibot (59% increase). RedLine’s malware share decreased by 15%, similarly Fareit’s by 6%. ViperSoftX stayed roughly the same, with only a 2% decrease in malware share.&nbsp;The most common information stealers with their malware shares in Q2/2024 were:&nbsp;<ul><li>AgentTesla (33.84%)&nbsp;</li><li>Ramnit (12.04%)&nbsp;</li><li>FormBook (9.05%)&nbsp;</li><li>Fareit (7.10%)&nbsp;</li><li>RedLine (3.67%)&nbsp;</li><li>Vidar (2.70%)&nbsp;</li><li>Azorult (2.56%)&nbsp;</li><li>Lumma (2.44%)&nbsp;</li><li>Lokibot (2.26%)&nbsp;</li><li>ViperSoftX (2.22%)</li></ul>Jan Rubin, Malware Researcher&nbsp;<h3>Ransomware: The Wheels of Justice Turn Slowly, but Grind Exceedingly Fine&nbsp;</h3>Ransomware is any type of extorting malware. The most common subtype is the one that encrypts documents, photos, videos, databases, and other files on the victim’s PC. Those files become unusable without decrypting them first. To decrypt the files, attackers demand money, “ransom”, hence the term ransomware.&nbsp;The prevalence of <a href="https://www.avg.com/en/signal/what-is-ransomware">ransomware</a> within the consumer segment continues to be lower compared to past activity, but we have seen a significant +24% increase Q/Q with the highest increases in:&nbsp;<ul><li>India (up by 379%)&nbsp;</li><li>United States, Canada, United Kingdom (all up by 100%)&nbsp;</li><li>Australia (up by 66%)&nbsp;</li></ul>

According to telemetry from our userbase, below are the most prevalent ransomware strains. The percentage values show the total market ratio of ransomware occurrence.&nbsp;<ul><li>WannaCry (21%)&nbsp;</li><li>Cylance ransomware (9%)&nbsp;</li><li>Enigma (8%)&nbsp;</li><li>STOP (6%)&nbsp;</li><li>LockBit (5%)&nbsp;</li><li>Mallox (aka TargetCompany) (2%)&nbsp;</li></ul><h4>Justice for Ransomware Actors&nbsp;</h4>Even though ransomware operators (like other cyber-criminals) are hiding their identity as much as possible, they may end up in the hands of the law in the end.&nbsp;<h5>Example #1: Yaroslav Vasinskyi (Sodinokibi / REvil)&nbsp;</h5>On the 1st of May 2024, Yaroslav Vasinskiy, one of the hackers in the REvil ransomware gang, was sentenced to <a href="https://www.justice.gov/opa/pr/sodinokibirevil-affiliate-sentenced-role-700m-ransomware-scheme">13 years and seven months</a> in prison for his participation in the ransomware gang operation. According to the <a href="https://www.justice.gov/opa/pr/sodinokibirevil-affiliate-sentenced-role-700m-ransomware-scheme">press release</a> by the U.S. Department of Justice, Vasinskiy participated in about 2500 ransomware operations, demanding ransom payments of over $700 million. We do not know how much they actually earned, but Vasinskiy also must pay $16 million in restitution for the damage done.&nbsp;REvil ransomware was one of the most successful ransomware operations in the history of computers. The most devastating operation was the Kaseya incident (more in <a href="https://decoded.avast.io/threatresearch/avast-q321-threat-report/">Avast Threat Report Q3/2021</a>), where the attackers abused a vulnerability in the Kaseya Remote Management software and deployed the REvil encryptor to thousands of companies.&nbsp;REvil ransomware stopped their operation in 2022, and it is no longer active.&nbsp;<h5>Example #2: Dmitry Yuryevich Khoroshev (LockBit)&nbsp;</h5>6 days after the Vasinskyi’s sentence, the identity of LockBitSupp, administrator and developer of the LockBit ransomware group, was revealed to the public. He is Russian national Dmitry Yurievich Khoroshev (seen in the picture below).&nbsp;

Interestingly, two years earlier, Khoroshev was so sure of his anonymity that he offered a million-dollar reward to anyone who could send him his name and surname. Later, he increased that reward to $10 million.&nbsp;

We have been observing LockBit's activity over time and noticed that in the days immediately after the reveal of his identity, the number of attacked companies increased significantly. We can only speculate whether this was an act of revenge or pure coincidence.&nbsp;

The question is what impact the identity reveal will have. The LockBit gang may start losing affiliates, which would mean decreasing its activity. Additionally, Khoroshev is now under sanctions (asset freeze and travel ban) in the US, UK, and Australian, so anyone who pays ransom in these countries could be considered in violation of these sanctions and subsequently imposed with a fine.&nbsp;If you happen to know where he lives or can provide information leading to his arrest, <a href="https://www.state.gov/transnational-organized-crime-rewards-program-2/lockbit-ransomware-administrator-dmitry-yuryevich-khoroshev/">you may earn up a nice money</a>.&nbsp;However, hackers in Russia <a href="https://flare.io/learn/resources/dark-web-drama-lockbit-and-the-an-security-breach-saga/">are generally safe if they do not target companies belonging to Russia or any country in the Commonwealth of Independent States</a>. So, until Khoroshev leaves Russia (or until the regime in Russia changes), he is probably safe.&nbsp;<h4>Decrypted: DoNex&nbsp;</h4>During Q2/2024, we discovered a weakness in the cryptographic schema of the DoNex ransomware and began silently cooperating with law-enforcement agencies to provide a decryptor to the victims. Since the details about the weakness were published in June at the REcon Montreal conference, <a href="https://decoded.avast.io/threatresearch/decrypted-donex-ransomware-and-its-predecessors/">we released the decryptor to the public</a>.&nbsp;The DoNex decryptor is just the latest in a series of ransomware decryptors we have developed for victims to use, free of charge.&nbsp;&nbsp;Ladislav Zezula, Malware Researcher Jakub Kroustek, Malware Research Director &nbsp;<h3>Remote Access Trojans (RATs): The Takedowns Continue</h3>A Remote Access Trojan (RAT) is a type of malicious software that allows unauthorized individuals to gain remote control over a victim's computer or device. RATs are typically spread through social engineering techniques, such as phishing emails or infected file downloads. Once installed, RATs grant the attacker complete access to the victim's device, enabling them to execute various malicious activities, such as spying, data theft, remote surveillance, and even taking control of the victim's webcam and microphone.&nbsp;The dismantling of Remote Access Trojans (RATs) continued in Q2/2024, though we did not see the same high profile takedowns as we did with Warzone in the previous quarter. Although most major RAT strains seem to be hovering around or slightly below their numbers from the last quarter, Remcos picked up the pace keeping the overall risk ratio at the same level as in Q1/2024. The notable exception was Warzone, which suffered a large and expected decrease following its takedown.&nbsp;

In Q1/2024, we reported XWorm as the most prevalent strain in Canada. This quarter, the risk ratio in Canada continued to grow (+52%) despite XWorm losing its malware share again to Remcos and AsyncRat. The biggest risk ratio increase was observed in Romania (+58%) with the third largest increase in Slovenia (+41%). Remcos is the main strain in all of these countries.&nbsp;Greece (-27%), Spain (-23%) and France (-19%) saw the largest decreases in risk ration of RATs in Q2/2024. The decrease in Greece was due to AsyncRat while in Spain it was thanks to Remcos. The most interesting change was in France where we saw an increase of stopped attacks by Remcos but a decrease for all other strains such as AsyncRat, njRAT and QuasarRAT.&nbsp;The countries with the highest overall risk ration globally remained consistent in Q2.2024 with Afghanistan, Iraq and Yemen in the lead with the most active threats being HWorld and njRAT.&nbsp;&nbsp;

As mentioned, Remcos gained a significant share of the RAT market in Q2/2024 with a 34% increase, the most of all RAT strains we monitor. DarkCrystal also increased its malware share by 28% bringing it closer to the overall top 10.&nbsp;The takedown of Warzone in Q1/2024 continued to impact its share numbers with an additional loss of 39% of the market in Q2/2024, with additional decreases expected in the future.&nbsp;&nbsp;The most prevalent RAT strains for Q2/2024 are as follows:&nbsp;<ul><li>Remcos&nbsp;</li><li>HWorm&nbsp;</li><li>njRAT&nbsp;</li><li>AsyncRat&nbsp;</li><li>QuasarRAT&nbsp;</li><li>XWorm&nbsp;</li><li>FlawedAmmyy&nbsp;</li><li>Warzone&nbsp;</li><li>NanoCore&nbsp;</li><li>Gh0stCringe</li></ul><h4>Q2 Takedowns&nbsp;</h4>This quarter, an operation against two individuals involved in RAT creation and distribution was carried out jointly by the AFP (<a href="https://www.afp.gov.au/news-centre/media-release/afp-traps-alleged-rat-developer">Australian Federal Police</a>) and the FBI (<a href="https://www.justice.gov/usao-cdca/pr/socal-man-arrested-federal-charges-alleging-he-schemed-advertise-and-sell-hive">Federal Bureau of Investigation</a>). The AFP arrested an Australian man alleged to have developed and sold the Firebird RAT. The FBI then seized another US-based man suspected of advertising and selling the RAT as well as providing customer support. Firebird, later rebranded to Hive, is a RAT which has been active for several years but was never very widely spread. According to our data, only a small number of attacks were performed (and blocked) in our userbase in Q2/2024.&nbsp;Lastly, <a href="https://blog.talosintelligence.com/new-spicerat-sneakychef/">Cisco Talos</a> uncovered a new RAT called SpiceRAT which, according to their research, is used by the SneakyChef threat actor. SpiceRAT is not a full-featured RAT like Remcos or AsyncRat. Its role is to serve as an entry point for additional plugins or further attacks. The basic capabilities include fingerprinting the system, downloading and running executable binaries and executing commands.&nbsp;&nbsp;Ondrej Mokos, Malware Researcher&nbsp;<h3>Vulnerabilities and Exploits&nbsp;</h3>Exploits take advantage of flaws in legitimate software to perform actions that should not be allowed. They are typically categorized into remote code execution (RCE) exploits, which allow attackers to infect another machine, and local privilege escalation (LPE) exploits, which allow attackers to take more control of a partially infected machine.&nbsp;In Q2/2024, several significant vulnerabilities were discovered and exploited, posing serious risks to systems and users. In this section, we highlight the most prevalent for the quarter.&nbsp;<h4>Windows DWM Core Library Vulnerability CVE-2024-30051&nbsp;</h4>In early April 2024, Kaspersky discovered a peculiar document uploaded to VirusTotal. The document's file name suggested it contained information about a Windows OS vulnerability. Upon examination, they found a description of a Windows Desktop Window Manager (DWM) vulnerability and its potential for privilege escalation.&nbsp;&nbsp;What they discovered is a heap-based buffer overflow vulnerability affecting the Windows DWM Core Library that can be exploited to elevate attacker’s privileges on a targeted system. Kaspersky researchers have connected this zero-day vulnerability to Qakbot and various other types of malware.&nbsp;<h4>CrushFTP Zero-Day Vulnerability&nbsp;</h4>CrushFTP, a vendor specializing in managed file transfer solutions, disclosed a critical zero-day vulnerability. This flaw affects CrushFTP versions below 10.7.1 and 11.1.0, as well as legacy 9.x versions across all platforms.&nbsp;This vulnerability is a VFS (Virtual File System) sandbox escape. The flaw allows remote attackers with minimal privileges to read files outside of the VFS Sandbox. Exploiting this vulnerability can lead to arbitrary file reads with root privileges, bypass authentication to gain administrator access, and execute remote code. Consequently, an attacker could access and potentially exfiltrate all files stored on a CrushFTP instance.&nbsp;<h4>New trick uses old Internet Explorer vulnerabilities (CVE-2024-38112)&nbsp;</h4>Check Point Research has uncovered a clever new tactic used by attackers to trick Windows users into executing malicious code. The attackers are exploiting a vulnerability involving Windows Internet Shortcut files (.url). These files, when clicked, use the outdated Internet Explorer (IE) to visit a URL controlled by the attackers, even if the victim's computer is running modern Windows 10 or 11.&nbsp;<h4>EchoSpoofing: Unmasking a Massive Scam Campaign Exploiting Proofpoint's Email Routing Misconfiguration&nbsp;</h4>According to a Guardio Labs researcher, the recent campaign exploited an email routing loophole within Proofpoint’s infrastructure, allowing the attackers to send millions of emails daily. These emails, authenticated with Sender Policy Framework (SPF) and DomainKeys Identified Mail (DKIM) signatures, bypassed major security protections, making them appear legitimate and enabling the threat actors to steal funds and credit card details from unsuspecting recipients.&nbsp;This attack, called EchoSpoofing, involves the threat actor sending messages from an SMTP server hosted on a virtual private server (VPS). The scam's effectiveness lies in its ability to comply with security measures such as SPF and DKIM, which are designed to prevent attackers from imitating legitimate domains. These spoofed messages are routed through various adversary-controlled Microsoft 365 tenants, then relayed via Proofpoint's customer email infrastructures to reach end-users of free email providers like Yahoo!, Gmail, and GMX.&nbsp;The EchoSpoofing campaign is believed to have begun in January 2024, with the threat actor sending an average of three million emails daily. However, the volume spiked to a staggering 14 million messages per day in early June as Proofpoint started implementing countermeasures. The attackers used a cracked version of legitimate email delivery software called PowerMTA, combined with rotating VPS servers and IP addresses, to send massive bursts of emails from their SMTP servers.&nbsp;Proofpoint has acknowledged the scale of the threat, stating that it does not overlap with any known threat actors or groups.&nbsp;Luigino Camastra, Malware Researcher Michal Salat, Threat Intelligence Director &nbsp;<h2>Web Threats&nbsp;</h2>In our ongoing effort to stay ahead of the evolving threat landscape, we rapidly adapt to emerging infection vectors, which are now often web-related. Those familiar with our reports will recognize how significantly the web threats section has expanded over time. From Q4/2023 to Q2/2024, web threats have seen an approximate 17% increase in incidents compared to other cyber threats, underscoring a persistent and troubling upward trend.&nbsp;Overall, as we approach the end of Q2, a small but noticeable decline in general web threat activity can be observed. We believe that this decrease is largely attributed to the onset of summer holidays, a period when both cybercriminal activities and online engagements often reduce due to seasonal changes in user behavior and routines.&nbsp;&nbsp;At the same time, the core scam threats are still strong and very prevalent in our userbase. As we will show shortly, there was a significant increase in financial scams such as Crypto Scams fueled by CryptoCore as well as enhanced Part-Time Job Scams (aka Task Scams). Dating Scams and Technical Support Scams are also not disappearing anytime soon based on their strong Q2/2024 presence. Lastly, we will showcase an example of another prevalent threat – Fake Invoice Scams.&nbsp;<h3>Scams: Assessing the Real Risk vs. Reward&nbsp;</h3>A scam is a type of threat that aims to trick users into giving an attacker their personal information or money. We track diverse types of scams which are listed below.&nbsp;Scam threats, which are often supported by malvertising, had their highest activity at the beginning of Q2/2024. After that, we observe a slight decline in overall prevalence.&nbsp;

The small decrease in activity is only relative and often caused by threat actors switching between various scam schemas. We are continuously improving our threat insight and reflecting such changes in the threat landscape. One such situation happened within the Financial Scams in Q2/2024, which is visible on the following chart depicting our insight.&nbsp;

In terms of the Financial Scams in Q2/2024, the most impacted countries were New Zealand, Czech Republic, all the Nordic countries, but also Canada, Australia, and the UK.&nbsp;

We frequently write about the principle of this particular scams, which commonly leverages paid ads on social platforms. These advertisements are becoming increasingly innovative. As noted in our previous report, scammers are now using deepfake technology and enlisting various celebrities of the different regions in order to better target users. Additionally, they often employ sensationalist headlines to draw attention. It doesn't always have to be just about celebrities, sometimes they take advantage of the action, like the recent <a href="https://www.gendigital.com/blog/news/innovation/2024-sports">summer games in France</a>.&nbsp;

After clicking on the advertisement, the user is redirected to a prepared scam page, where the content of the ad is then supported by, for example, a fake news page or a form where the user has to fill in specific personal data.&nbsp;

Attracting users to money doesn't only work in the context of investments, this will surely only attract some people. But what about, for example, putting the possibility of making money in a different context. This is dealt with in the next section.&nbsp;<h4>Part-Time Job Scams: A Growing Threat with New Tactics&nbsp;</h4>The allure of easy money, especially during difficult economic times, can lead many into the trap of Part-Time Job Scams. These scams, often initiated through messaging platforms like WhatsApp and Telegram, have evolved into more sophisticated operations that exploit victims using social engineering techniques. Scammers promise simple online tasks in exchange for steady income, but the ultimate goal is to steal large sums of money from unsuspecting victims.&nbsp;

<h5>The New Phone Call Tactic&nbsp;</h5>A recent development in these scams is the use of phone calls to initiate contact. Scammers now employ a natural-sounding feminine voice, likely generated by AI, to inform potential victims that they have been selected for a reward, such as a $5 TikTok voucher. The victim is then instructed to add the calling number to their contacts and continue communication via WhatsApp. Here’s an example of how the conversation unfolds in WhatsApp:&nbsp;<h6>Real Example of a WhatsApp Conversation with the Scammers:&nbsp;</h6>Scammer: Hello, my name is XXXXXX. Can I talk to you for 2-3 minutes?&nbsp; Victim: Yes, of course.&nbsp; Scammer: Thank you for your response. Our company works with TikTok merchants who are willing to pay to increase subscriptions and the visibility of bloggers. Therefore, our company needs to hire many coworkers to increase subscriptions for them on the TikTok app, and they will pay you.&nbsp; Scammer: We need many people to participate in the short video promotion bonus event and like TikTok content. Each video can earn you a reward of 3 euros, and you can earn a reward of 300-800 euros every day.&nbsp; Scammer: Are you interested in working with us?&nbsp; Victim: Yes, of course.&nbsp; Scammer: How old are you? Do you have a Telegram application?&nbsp; Victim: I am 28 years old and yes, I have Telegram.&nbsp; Scammer: Okay, very well. This is the easiest part-time job, just go to the link (TikTok), like the video, take a photo, and send it to us.&nbsp; (The victim completes the task and sends the screenshot)&nbsp; Scammer: Well done. I think you already know how we work. I will give you 3 TikTok video links as a test. You don’t need to watch the entire video, just like it and send me a screenshot, and you will earn 3€.&nbsp; (Victim does the tasks and shows the screenshots)&nbsp; Scammer: Okay, I think you know how we work. Please add our business manager on Telegram:&nbsp; <a href="https://t.me/scammer_handle">https://t.me/scammer_handle</a> (link to scammer’s Telegram chat)&nbsp; Your employment code: XXXXXXX&nbsp; Scammer: Contact the recipient now, send him the code to fill out your details and you can earn 5€ for a total of 8€. Many people are in line to participate, please wait patiently, the receptionist will receive you. Please complete your information and submit it, after which you will receive a payment.&nbsp;<h6>Going Undercover: Uncovering the Scam&nbsp;</h6>To better understand the operation, we went undercover, engaging in one of these scams. We were asked to perform simple tasks, such as adding products to an eBay shopping cart and sending screenshots as proof. Initially, the scammers deposited a small amount of USDT cryptocurrency into our wallet, which we could verify in our account. This tactic is used to build trust and lend legitimacy to the scam.&nbsp;

However, the true nature of the scam was revealed when we were invited to participate in a ‘VIP’ task, promising a significant return on an upfront investment. We were added to a larger group chat that appeared to be bustling with activity—many users were requesting tasks and submitting proof of receiving payments. It quickly became evident that most of these accounts were fake, likely bots, designed to create a false sense of legitimacy.&nbsp;When victims make a significant deposit for these VIP tasks, the scammers vanish, taking the money with them. Often, they might attempt to extract even more money by inventing additional fees or taxes, all while threatening the loss of the initial investment.&nbsp;<h5>Impact and Scope&nbsp;</h5>These scams are becoming increasingly prevalent, with reports of significant financial losses. According to recent data from the Federal Trade Commission (FTC), investment-related scams saw a 14% increase in losses, amounting to over $10 billion in 2023 alone. The global reach of these scams is evident, with cases reported in multiple languages, including English, Spanish, and Czech. The use of AI-generated voices adds a new layer of deception, making these scams harder to detect.&nbsp;<h4>Crypto Scam Powered by CryptoCore&nbsp;</h4>A crypto scam is a cyber threat designed to trick individuals into surrendering their cryptocurrency. These scams exploit the anonymity and irreversibility of blockchain transactions, often targeting those with a limited understanding of how cryptocurrency works.&nbsp;Also in Q2/2024, we followed a crypto scam group, we dubbed CryptoCore, that lures individuals with promises of high returns or uses sophisticated schemes to defraud even the most cautious via deepfake videos to convince victims of unique cryptocurrency investment opportunities. These deepfake videos exploit famous personalities and brands such as Elon Musk, Michael Saylor, Donald Trump, BlackRock, and Apple to enhance trust and legitimacy. Scam videos are primarily spread on popular platforms like YouTube, X, and TikTok through hacked accounts, exploiting hundreds of accounts with many subscribers. Consequently, the total revenues from these scams amount to millions of dollars in various cryptocurrencies.&nbsp;The initial phase of the scam involves targeting widely publicized events that will be broadcast live to draw a large audience. The scammers then produce deepfake videos replicating official event footage and including QR codes directing viewers to fraudulent websites. These scam videos are disseminated through compromised accounts on major platforms, especially YouTube. The campaign's effectiveness leads to the accumulation of cryptocurrency in fraudulently obtained wallets.&nbsp;In Q2/2024, our telemetry identified three significant events related to this crypto scam. The first occurred on April 8, 2024, during the solar eclipse, when SpaceX's name was exploited. The second campaign was on June 6, 2024, during the SpaceX Starship integrated flight test (IFT-4). Within several days, nearly 50 YouTube accounts were hijacked, and we identified 500 transactions, amounting to a total value of $1.413 million, in this campaign. The last one was at the end of June 2024, when the Tesla band was abused in the crypto scam.&nbsp;The complete analysis can be <a href="https://decoded.avast.io/martinchlumecky1/cryptocore-unmasking-the-sophisticated-cryptocurrency-scam-operations/">found in our article</a>.&nbsp;

<h4>Dating Scams: Cyber Criminals Still Love Them&nbsp;</h4>Dating scams, also known as romance scams or online dating scams, involve fraudsters deceiving individuals into fake romantic relationships. Scammers adopt fake online identities to gain the victim's trust, with the ultimate goal of obtaining money or enough personal information to commit identity theft.&nbsp;The prevalence of Dating Scams has remained consistent, with no significant change in their occurrence or methodology in Q2/2024. Scammers continue to exploit emotional connections to deceive victims, employing tried and true tactics that have proven effective over time. This steadfast activity highlights the ongoing need for vigilance and education in recognizing and avoiding such deceptive practices.&nbsp;

The screenshot below shows a landing page that users reach after clicking on a push notification designed to lure them to join a fraudulent dating site. This page cleverly prompts visitors to sign up, exploiting their search for companionship with promises of easy connections and potential matches.&nbsp;&nbsp;Such pages often use engaging visuals and persuasive language to lower users' defenses and encourage registration, making it crucial to approach such sites with caution and skepticism.&nbsp;

Compared to Q1/2024, the highest increase of Dating Scam risk was seen in Japan (+51%). However, the top 10 countries at risk were all from Europe in Q2, led by Norway, Denmark, Poland, and Germany.&nbsp;<h4>Tech Support Scams: No Slowdown in Sight&nbsp;</h4>Tech support scam threats involve fraudsters posing as legitimate technical support representatives who attempt to gain remote access to victims' devices or obtain sensitive personal information, such as credit card or banking details. These scams rely on confidence tricks to gain victims' trust and often involve convincing them to pay for unnecessary services or purchase expensive gift cards. It's important for internet users to be vigilant and to verify the credentials of anyone claiming to offer technical support services.&nbsp;Tech Support Scams (TSS) have maintained their increased activity from the from Q1/2024 through a significant portion of Q2/2024. This activity, as the graph below indicates, started to decrease slightly towards the end of the quarter.&nbsp;

Japan, the United States, and Germany remain hot spots for this TSS Scam threats.&nbsp;

<h4>Refund and Invoice Scams: Persistent Presence&nbsp;</h4>Invoice scams involve fraudsters sending false bills or invoices for goods or services that were never ordered or received. Scammers rely on invoices looking legitimate, often using company logos or other branding to trick unsuspecting victims into making payments. These scams can be especially effective when targeted at businesses, as employees may assume that a colleague made the purchase or simply overlook the details of the invoice. It's important to carefully review all invoices and bills before making any payments and to verify the legitimacy of the sender if there are any suspicions of fraud.&nbsp;In Q2/2024, Invoice Scams have shown no sign of decreasing, even with the start of the summer holidays. Although the number of attacks has fluctuated slightly, the overall trend remains steady with no significant decline expected in the near future. However, a closer look at the data reveals notable changes on a country-by-country basis, with Australia and Greece experiencing the most significant quarter-on-quarter increases.&nbsp;

Overall, Australia, the United States, the Netherlands, the United Kingdom, and Canada were countries most at risk against fake Refund and Invoice Scams. Greece experienced a nearly 28% increase in the number of protected users, with Australia and Cyprus following at 24% and 17%, respectively. This signals a rise in targeted activity. Conversely, Vietnam saw the largest decrease, with a 66% decline, followed by Argentina and Egypt, both at 50%. What trends have emerged in these scams recently? Let’s examine a real-life example that could find its way into your inbox.&nbsp;

Among the numerous scams we've encountered recently is one specifically targeting a prominent antivirus company. The phishing email appears like the one shown below:&nbsp;

Here are five key red flags in the email that indicate it is likely a phishing attempt or scam:&nbsp;<ol><li>Suspicious Sender Domain: The email is sent from a domain that does not match the official product domain, instead using a questionable domain like adrenaline.xambassadors.com, which is unrelated to the company.&nbsp;</li><li>Urgent Time Pressure: The email creates a false sense of urgency, claiming your account will be deleted in "48 hours" if you don't take immediate action. This is a common tactic used in scams to pressure you into acting without thinking.&nbsp;</li><li>Poor Design and Layout: The email's design is simplistic and unprofessional, lacking the polish typically seen in legitimate company communications. The layout is awkward, with excessive use of red and bold text, which is often a hallmark of scam emails.&nbsp;</li><li>Weird Template and Content: The content and structure of the email, including phrases like "Restoration code" and odd formatting, don't align with how a legitimate antivirus company would communicate with its customers.&nbsp;</li><li>Unusual Font in the Subject Line: The subject line uses strange characters and symbols (e.g., "⚠️ Final Warning ⚠️"), which is not typical for professional emails. This is often done to grab attention but is a clear indicator of a potential scam.&nbsp;</li></ol>Now, let's explore where the rabbit hole leads. The prominent button you’re tempted to click, labeled "Activate Now" with the threat of account deletion, is a tactic to create urgency, which is entirely false. Clicking this button triggers a redirection chain, starting with the following URL. Other parameters, likely tailored based on your location and other factors, determine where you will end up.&nbsp; https://storage.googleapis[.]com/bazugza/SalXX0134.html#u8sf8ls.ETbnaSCDpu?xpxwrvtnegfg=raemsgaddlde1g3qefg004w3k002jit020330b04735080cxq&nbsp;Which will redirect you to:&nbsp;bonusmonster[.]co&nbsp;

This is the landing page you encounter if you are in the United States. The actors likely use redirection based on various factors, including your country of residence. The page bears no resemblance to the official product website, or anything related to the company. You will not obtain anything for free from this site. After conducting further investigation, we found that the domain is hosted on:&nbsp;172.67.137[.]213&nbsp;We were interested in finding out what other domains are hosted on this IP address and used VirusTotal to gain more insight into the nature of this server. Here’s what we discovered:&nbsp;

The IP address 172.67.137[.]213 is linked to several websites, including some flagged for malware like Gamehdlive[.]online, Bonusmonster[.]co, and Tv.mobiblogxx[.]com, with Bonusmonster[.]co specifically accessed through a scam email. While sites like Zieclam[.]com, Proxylite[.]com, and Gamerr[.]one seem to be clean, the high number of flagged sites indicates a significant risk of malicious activity associated with this IP address.&nbsp;The lesson here is clear: the threat of cyberattacks remains persistent, and staying vigilant is essential. Remember, legitimate companies will never demand immediate action with threats of losing your data or account. Always take your time when reviewing emails, carefully checking the sender's details and evaluating the overall legitimacy of the message. By maintaining this cautious approach, you can better protect yourself from phishing attempts and other online threats.&nbsp;<h4>Bank Phishing: A Growing Concern&nbsp;</h4>Phishing is a type of online scam where fraudsters attempt to obtain sensitive information including passwords or credit card details by posing as a trustworthy entity in an electronic communication, such as an email, text message, or instant message. The fraudulent message usually contains a link to a fake website that looks like the real one, where the victim is asked to enter their sensitive information.&nbsp;Similar to Dating Scams, the situation with <a href="https://us.norton.com/blog/online-scams/what-is-phishing">phishing threats</a> remains stable with a slight calming of activity before the end of Q2/2024.&nbsp;

One of the interesting things in the phishing category has been the growing number of new bank phishing sites. In our data, we see that not only are the most popular banks being targeted but there are more sites dedicated to lesser-known banks that were not targeted in the past. We also see increased amounts of new variants of the phishing kit.&nbsp;One notable incident from the start of the quarter involved a phishing campaign in the United States targeting Bank of America users. This operation aimed to deceive users into disclosing their personal banking information by mimicking official communications from the bank, a tactic that underscores the persistent risk in the financial sector.&nbsp;

These phishing campaigns typically show a short lifespan. According to our data, on its most successful days, this particular campaign targeting Bank of America users received high hundreds of hits per day, highlighting the possible effectiveness of these threats.&nbsp;Alexej Savcin, Malware Analyst Branislav Kramar, Malware Analyst Matej Krcma, Malware Analyst Martin Chlumecky, Malware Researcher David Jursa, Malware Researcher&nbsp;<h2>Mobile-Related Threats&nbsp;</h2>We observed several new strains of mobile malware in Q2/2024 with interesting new techniques being deployed in both delivery and functionality. Notably, a clicker adware has snuck onto the PlayStore, clicking on websites in the background and gathering fraudulent advertising revenue.&nbsp;&nbsp;In the world of bankers, a dormant PDF reader application on the PlayStore also came to life this quarter, turning into a TeaBot banker dropper and targeting Revolut accounts of its victims. A new banker called SoumniBot entered the fray, with several new obfuscation techniques and the ability to steal Korean bank certificates. An updated version of the Medusa banker used botnets in France, Spain and Italy to distribute its malicious payload, in some cases pretending to be the Avast Premium app.&nbsp;In the spyware category, we see more targeted campaigns, with XploitSpy utilising GitHub and PlayStore to target victims in India and Pakistan, stealing sensitive information. And finally, AridSpy has been seen targeting users in Egypt and Palestine with a heavily intrusive feature set capable of taking photos every hour and listening to surrounding audio.&nbsp;<h3>Web Threat Data within the Mobile Landscape</h3>Most blocked attacks on mobile devices in Q2/2024 were web-based, mirroring the previous quarter. Users are much more likely to encounter phishing websites, scams, malvertising and other web threats than ever before. These threats can come in a variety of formats such as private messages, SMS, and emails but also redirects on less reputable sites, unwanted pop ups and through other avenues.&nbsp;In contrast to these types of mobile scams, traditional on-device malware requires a more complex infection vector where the user must also install the malware. For proper functionality of most mobile malware, permissions need to be granted by the user first, which again lowers the chances of malicious activity being triggered.&nbsp;Hence, blocking web-threat based attacks is beneficial for the security of mobile devices, as malware actors often use them as an entry point to get the payload onto the mobile device of their victims. &nbsp;

<h3>Adware: Sneaky Clickers on the PlayStore&nbsp;&nbsp;</h3>Adware threats on mobile phones refer to applications that display intrusive out-of-context adverts to users with the intent of gathering fraudulent advertising revenue. This malicious functionality is often delayed until sometime after installation and coupled with stealthy features such as hiding the adware app icon to prevent removal. Adware mimics popular apps such as games, camera filters, and wallpaper apps, to name a few.&nbsp;With another quarter behind us, <a href="https://us.norton.com/blog/malware/adware">adware</a> retains its top place as on-device malware in the mobile threat ecosystem. Most prevalent for several years now, it is a threat that spreads through various forms of malvertising, third-party app stores and it occasionally manages to sneak onto the PlayStore. Once installed, it negatively affects the user experience by clogging the device with fullscreen adverts and raking in fraudulent advertising revenue.&nbsp;HiddenAds continue to be the adware with most reach in Q2/2024. As per their name, they hide their presence on the victim’s device once installed, then display intrusive full screen advertisements to the annoyance of their victims. MobiDash and FakeAdBlockers are the other prevalent strains that are often disguised as repacked popular games or paid applications but instead come with out of context adverts.&nbsp;

A new strain of <a href="https://news.drweb.com/show/?i=14860&amp;lng=en">Clicker adware</a> has made its way onto the PlayStore, disguised inside both a fitness and adult application. These apps contain two hidden modules, one which collects extensive information on the device and user, while the other simultaneously loads webpages in the background. Once the pages are loaded through a hidden WebView browser window, the Clicker injects JavaScript code downloaded from a C&amp;C so it can silence pages with videos or audio and look for advertisements to click on with the intent of gathering fraudulent advertising revenue. It is even able to take secret screenshots of the hidden webpages and determine clickable areas from these. It is curious that these advanced techniques were used to merely gather advertising revenue.&nbsp;We observe a downward trend in risk ratio of adware this quarter. All three of the most prevalent strains continue to see a decrease in risk ratio and protected users. We may see a slight increase in the next quarter if more adware slips onto the PlayStore.&nbsp;

Brazil, India and Argentina again have the most protected users quartering Q2/2024, as was the case last quarter. According to our telemetry, Egypt, Turkey and Yemen have the highest risk ratios, meaning users are most likely to encounter adware in these countries.&nbsp;

<h3>Bankers: Never-ending Evolution Continues&nbsp;</h3>Bankers are a sophisticated type of mobile malware that targets banking details, cryptocurrency wallets, and instant payments with the intent of extracting money. Generally distributed through phishing messages or fake websites, Bankers can take over a victim's device by abusing the accessibility service. Once installed and enabled, they often monitor 2FA SMS messages and may display fake bank overlays to steal login information.&nbsp;Mobile bankers continue to evolve and threat actors bring in new strains to extract money and sensitive information from victims this quarter. The TeaBot banker spreads through a dropper on the PlayStore, targeting Revolut accounts. A new contender, SoumniBot, targets Korean users with various advanced obfuscation techniques. BrokeWell is another new banker that spreads through fake Chrome update pages. Finally, we see an evolution of the Medusa banker with botnets in various countries.&nbsp;Our data shows that the RewardSteal banker takes first place this quarter, almost doubling its presence, mostly focusing on India. It is followed by Coper banker which also sees a big spike in prevalence with updates to its distribution methods. Of note is the MoqHao banker mentioned in the <a href="https://decoded.avast.io/threatresearch/avast-q1-2024-threat-report/">last report</a>, it has continued to increase its presence this quarter as well, targeting victims in Japan and Korea.&nbsp;

<a href="https://www.cleafy.com/cleafy-labs/a-stealthy-threat-uncovered-teabot-on-google-play-store">Teabot banker</a> makes a comeback with a dormant dropper going active on the PlayStore to deliver the malicious payload. Disguised as a PDF reader, the dropper went live in February with a sneaky update. It would first download an external DEX file and execute it, then perform various checks on the device to ensure it is not being emulated. It would only deliver the TeaBot payload to specific countries, such as Czech Republic, Slovakia, United Kingdom, Spain and surprisingly even Russia, which has been previously excluded by TeaBot. If it deemed the device viable, it would push a notification with a fake ‘PDF AI update available’ dialogue.

Once downloaded and installed, it would initiate device takeover through the accessibility service to extract banking details and steal money from victims. Interestingly, the banker specifically focuses on the Revolut app, querying the victim’s balance and information for further nefarious activity.&nbsp;

CryptoCore Scam Stealing Millions via AI Deepfakes on YouTube, Rising Identity Theft, 24% Spike in Ransomware, and 46% More Blocked Attacks Year Over Year

Gen Q2/2024 Threat Report

<h2 class="text-align-justify">Foreword</h2>We’re pleased to present the latest edition of our report for the first quarter of 2024, which has been nothing short of eventful. Here are some highlights.Not all heroes wear capes. Just a few weeks ago, developer <a href="https://www.openwall.com/lists/oss-security/2024/03/29/4" target="_blank" rel="noreferrer noopener">Andres Freund disrupted</a> a covert threat operation that had been running for over two years. The threat actors, who managed to insert a backdoor into the widely used open-source compression library XZ/liblzma, were stopped just in time by Andres. While the identity of the threat actors remains unknown, the potential ramifications of their actions could have been catastrophic – they were almost able to gain access to any Linux machine running an infected distribution. This incident has raised important questions about the security of open-source code and its integration into critical systems and applications.Social engineering attacks continue to be the largest threat across platforms and continue to increase their share of threats. In the mobile device landscape, more than 90% of all threats blocked in the last quarter originated from scams and similar threat types. This trend is mirrored on desktop platforms, with 87% of threats falling into the same categories. Scams, in particular, have seen a significant surge (61% on mobile and 23% on desktop), fueled by malvertising and the proliferation of malicious push notifications. The risk of falling victim to these attacks has nearly doubled in certain regions, such as Ukraine, highlighting the global reach and impact of these malicious activities. Moreover, scam authors are deploying increasingly sophisticated tactics, including the use of deepfake technology, AI-manipulated audio synchronization, and the hijacking of popular YouTube channels to disseminate fraudulent content, amplifying the potential for financial harm.

Dating scams also continue to surge, particularly in North America and Europe, with Central Europe emerging as a hotspot for such activity. Phishing remains a persistent threat, steadily increasing over the past six quarters. Prevalent phishing campaigns are detailed further in this report.On the desktop front, we’ve uncovered a sophisticated APT campaign orchestrated by the Lazarus Group, targeting individuals in Asia with deceptive job offers. Furthermore, we discovered and reported to Microsoft an in-the-wild exploit within a Windows driver, subsequently utilized by a sophisticated rootkit in this campaign. Additionally, botnet activity has been a cause for concern – with notable updates observed in the Twizt botnet which now includes brute-forcing capabilities for Server Message Block (SMB) protocol credentials – and the expansion of the malicious DDosia project. Interestingly, the DDosia project faced frequent downtimes due to countermeasures taken by unidentified individuals. Furthermore, we successfully assisted Ukrainian CERT with the remediation of the DirtyMoe botnet.The prevalence of Malware-as-a-Service (MaaS) stealers, exemplified by DarkGate and Luma, remains a significant threat. These malicious actors capitalize on every opportunity to deploy social engineering tactics to distribute malware.Ransomware incidents also experienced a slight uptick in Q1/2024, notably marked by the LockBit ransomware making headlines for its initial takedown by law enforcement units, only to resurface shortly after. Furthermore, our researchers identified a new ransomware strain named HomuWitch and promptly responded by developing decryption tools to assist affected individuals. This effort supplements our previous creation, the Rhysida decryption tool, which continues to aid victims of Rhysida in recovering their files.In the realm of remote access trojans (RATs), law enforcement units have successfully executed operations against notorious threats like the Warzone RAT, resulting in several arrests. This decisive action has already yielded tangible results, as evidenced by our telemetry data.On the mobile front, we’ve witnessed several intriguing developments, including the resurgence of adware on the PlayStore, the emergence of MoqHao, a banker strain capable of auto-starting on victim devices, and the proliferation of GoldPickaxe, which attempts to steal facial recognition biometrics for fraudulent activities. Additionally, state-sponsored spyware continues to pose a threat to citizens.Thank you for your continued trust in Avast. Stay safe and secure.Jakub Křoustek, Malware Research Director<h2 class="text-align-justify">Methodology</h2>This report is structured into two main sections: Desktop-related threats, where we describe our intelligence around attacks targeting the Windows, Linux, and Mac operating systems, with a specific emphasis on web-related threats, and Mobile-related threats, where we describe the attacks focusing on Android and iOS operating systems.We use the term “risk ratio” in this report to denote the severity of specific threats. This is calculated as a monthly average of “Number of attacked users / Number of active users in a given country.” Unless stated otherwise, calculated risks are only available for countries with more than 10,000 active users per month.A blocked attack is defined as a unique combination of the protected user and a blocked threat identifier within the specified time frame.<h2 class="text-align-justify">Featured Story: YouTube – the New Battleground for Phishing, Malvertising, and Cryptoscams&nbsp;</h2>YouTube, with its 2.5 billion users, has become a trusted and significant target for malvertising. The combination of automated advertising systems and user-generated content provides a gateway for cybercriminals to bypass conventional security measures, making YouTube a potent channel for deploying phishing and malware. Notable threats on the platform include credential stealers like Lumma and Redline, phishing and scam landing pages, and malicious software disguised as legitimate software or updates. Additionally, YouTube serves as a conduit to Traffic Distribution Systems (TDS), directing users to malicious sites and supporting scams ranging from fake giveaways to investment schemes.Our web scanning endpoints actively block thousands of HTTP requests, daily, that are redirected from YouTube as our users view content. This activity reflects a worrying trend:&nbsp;<ul><li>4 millions unique users were protected against threats on YouTube in 2023&nbsp;</li><li>Approx 500k unique users per month protected in Q1/2024</li></ul>

The rise of DeepFake videos in YouTube poses significant risks by realistically mimicking people or events, misleading viewers, and spreading disinformation. In Q1 we observed multiple compromised YouTube accounts with more than 50 million subscribers hijacked to spread Cryptoscam Deefake videos (more about this topic is described below in the Scam section).&nbsp;Threat actors frequently utilize automated uploads and Search Engine Optimization (SEO) poisoning to enhance the visibility of harmful content. Additionally, fake comments are rampant, deceiving viewers,&nbsp;promoting dangerous links, and exploiting YouTube’s algorithms and user engagement to disseminate cyber threats.There are numbers of ways in which YouTube can be exploited to disseminate threats. Observed basic Tactics and Procedures (TTP) on YouTube include:<ol><li>Phishing Campaigns Targeting Creators: Attackers send personalized emails to YouTube creators proposing fraudulent collaboration opportunities. Once trust is established, they send links to malware under the guise of software needed for collaboration, often leading to cookie theft or account compromise.&nbsp;</li><li>Compromised Video Descriptions: Attackers upload videos with descriptions containing malicious links, masquerading as legitimate software downloads related to gaming, productivity tools, or even antivirus programs, tricking users into downloading malware</li><li>Channel Hijacking for Spreading Threats: By gaining control of YouTube channels through phishing or malware, attackers repurpose these channels to promote various types of threats, such as cryptocurrency scams, often involving fake giveaways that require an initial deposit from viewers.</li><li>Exploitation of Software Brands and Legitimate-Looking Domains: Attackers create websites that mimic reputable companies and offer illegitimate downloadable software, exploiting users’ trust.</li><li>Social Engineering via Video Content: Attackers post tutorial videos or offers for cracked software, guiding users to download malware disguised as helpful tools. This tactic takes advantage of users seeking free access to otherwise paid services or software, leveraging YouTube’s search and recommendation algorithms to target potential victims.</li></ol>David Jursa, Malware Researcher Luis Corrons, Security Evangelist<h2 class="text-align-justify">Desktop-Related Threats</h2><h3 class="text-align-justify">Advanced Persistent Threats (APTs): Lazarus Group in the Spotlight</h3>An Advanced Persistent Threat (APT) is a type of cyberattack that is conducted by highly skilled and determined hackers who have the resources and expertise to penetrate a target’s network and maintain a long-term presence undetected.We discovered a Lazarus Group campaign targeting specific individuals in Asia with misleading job offers. The precise intent of the campaign remains unknown, but the selective nature of these attacks indicates a focused interest in individuals possessing technical expertise. We suspect that these technically skilled individuals might have connections to companies involved in the gambling or betting industry, aligning with Lazarus Group’s financial motivations.We believe the Lazarus Group used fabricated job offers to gain access to the personal computers of these victims who also used these devices for work purposes. It is likely that, a few days after the initial compromise, the attackers realized the victims had access to their company networks. Consequently, Lazarus employed sophisticated rootkit technologies to evade security measures and some security vendors.This approach reflects the Lazarus Group’s historical tactics of exploiting vulnerable drivers and employing advanced rootkit techniques to disrupt security systems and maintain persistent access.In this specific instance, Lazarus exploited a vulnerability in the standard Windows driver, appid.sys (CVE-2024-21338), to neutralize security software. Further details on this vulnerability can be found in our related <a href="https://decoded.avast.io/janvojtesek/lazarus-and-the-fudmodule-rootkit-beyond-byovd-with-an-admin-to-kernel-zero-day/" target="_blank" rel="noreferrer noopener">blog post</a>.The complexity of these attack chains suggests that Lazarus devoted substantial resources to their planning and execution. Before executing the attack, Lazarus carefully prepared by deploying fileless malware and encrypting their tools directly onto the hard drives, as detailed in the <a href="https://decoded.avast.io/luiginocamastra/from-byovd-to-a-0-day-unveiling-advanced-exploits-in-cyber-recruiting-scams/" target="_blank" rel="noreferrer noopener">blog post</a> and as we recently <a href="https://www.blackhat.com/asia-24/briefings/schedule/index.html%22%20%5Cl%20%22from-byovd-to-a--day-unveiling-advanced-exploits-in-cyber-recruiting-scams-37786" target="_blank" rel="noreferrer noopener">presented at Black Hat Asia 2024 conference</a>.

The careful and highly targeted choice of victims suggests that establishing some level of trust or connection was likely necessary before initiating the malware. The deployment of such a sophisticated arsenal, coupled with the exploit, highlights significant strategic foresight and resource commitment.Luigino Camastra, Malware Researcher Igor Morgenstern, Malware Researcher<h3 class="text-align-justify">Bots (With a Twist)</h3>Bots are threats mainly interested in securing long-term access to devices with the aim of utilizing their resources, be it remote control, spam distribution, or denial-of-service (DoS) attacks.To start on a lighter note, the biggest news in the botnet landscape was an unfortunate article in Swiss media outlet Aarguaer Zeitung which claimed a large-scale DDoS attack of millions of toothbrushes running Java. While the thought of a web-connected toothbrush running Java (which were also allegedly DDosing some random Swiss webpage) is really scary, it has been soon rectified as an inaccurate report and there was no such army of Pro-Russian toothbrushes, as the initial report suggested.Now, unfortunately, onto the more serious note. On the geopolitical side of the threat landscape, Ukrainian state-owned enterprises have been significantly hit with DirtMoe. Due to our <a href="https://decoded.avast.io/tag/dirtymoe/" target="_blank" rel="noreferrer noopener">extensive research on DirtMoe</a>, CERT-UA reached out to us to assist them with the remediation. Based on the experience from this successful remediation, an <a href="https://cert.gov.ua/article/6277422" target="_blank" rel="noreferrer noopener">advisory on DirtyMoe</a> was published by CERT-UA.Twizt botnet has received a new module in its update providing functionality that fuels its sextortion campaign. This module relies on the common strategy of extorting the user with fake and sensitive information that was allegedly recovered from their device or account. In the case of the former, the threat actor usually refers to a device infected with RAT, in the case of the latter, the message usually contains a fake sender header and a password to give the impression that the user’s mail account has been hacked. Nevertheless, all the sent information is fabricated, and the password was quite likely taken from one of the leaked password databases that are circulating the dark web.

Last year, Twizt started bruteforcing Virtual Network Computing (VNC) credentials. At the beginning of the year, they switched to brute-forcing SMB credentials, instead. Twizt contains a hard-coded list of username/password pairs that are tried against a randomly generated target. Successful authentications are then reported to its command-and-control (C&amp;C) server.Our usual story on DDosia has a very surprising twist this quarter. Presumably, someone was actively targeting the DDosia C&amp;C infrastructure, repeatedly causing outages in the proxy servers fronting real C&amp;C servers. This resulted in rapid infrastructure changes in this outer layer, with every new proxy C&amp;C having an approximate lifetime of 2 days before being unavailable again. Due to the absence of a client update mechanism in case of C&amp;C outage, this forced the project owners to produce new clients every few days. Later, they started distributing new clients exclusively via private messages, presumably to reduce information exposure.

The requirement to manually update DDosia’s binary with each update along with frequent C&amp;C outages resulted in a significant decrease in the impact of their attacks. This has prompted a heated backlash on the project’s Telegram channel where “patriotic activists” started complaining that these issues are seriously impacting their cash-flow.&nbsp;This was particularly notable around February 19 when eight proxy C&amp;Cs were shut down for five days. Even after this date, they were not able to return to their previous efficacy. The only peak during Q1/2024 is an attack at the end of March when DDosia targeted services associated with the Luxembourg government. While the number of successful targets seems to be rather high, it targeted infrastructure that was hosted on only 3 IP addresses with many subdomains. These turbulent changes were crowned by a move to a different Telegram group called “DDoSia Project” on March 7 with the original group being removed. While, up to that date, the original group was growing, ending with approximately 20,000 members, the new group started up with only around 12,000 members and soon continued in this downward trend.

While in the previous quarter DDosia was mostly focusing on banks, during the first quarter of 2024 DDosia focused mostly on various industry consortia, courts, press agencies, CERTs, and transport and logistic companies. The underlying logic stayed mostly the same – finding targets within countries that went against Russian interests.As for the trends in the whole botnet landscape, many of the prevalent strains have stagnated. Still, we’ve seen several bigger shifts in their prevalence, including increased activity of BetaBot (13%). On the other hand, most of the other strains seem to be in decline with the following strains seeing the biggest drops: Pikabot (-48%), Tofsee (-31%), MyKings (-21%), and Dridex (-21%).

Adolf Středa, Malware Researcher<h3 class="text-align-justify">Coinminers Continue to Decline</h3>Coinminers are programs that use a device’s hardware resources to verify cryptocurrency transactions and earn cryptocurrency as compensation. However, in the world of malware, coinminers silently hijack a victim’s computer resources to generate cryptocurrency for an attacker. Regardless of whether a coinminer is legitimate or malware, it’s important to follow our <a href="https://support.avast.com/en-eu/article/Threat-Lab-cryptomining-behavior-guideline/" target="_blank" rel="noreferrer noopener">guidelines</a>.In the previous quarter, we observed a continued decline in the prevalence of coinminers. This downward trend persisted into Q1/2024, where the risk ratio decreased by a substantial 28%. This decrease was influenced by a slight reduction in the coinminer malware share of XMRig, which had surged in the previous quarter. However, nearly all other major coinminers actually increased in activity, thereby expanding their share.

After the surge in the USA and Turkey the previous quarter, the situation calmed down a bit and we observed 39% decrease in risk ratio both countries. According to our data, more significant declines happened in India (22%), Egypt (19%), and Pakistan (13%). In total, the biggest risk of getting infected by a coinminers is still in Madagascar (2.18% risk ratio), Turkey (1.47%), Pakistan (1.35%), and Egypt (1.14%).In the graph below, we can observe a steady decline in coinmining activities.

XMRig, the long-time most popular coinminer, decreased in coinminer malware share by 6% this quarter. Yet, it still holds 60% of the total share. All other major coinminers saw an increase in their activity, including web miners (5% increase), CoinBitMiner (24%), FakeKMSminer (37%), among others. On the other hand, SilentCryptoMiner lost 58% share this quarter.The most common coinminers with their malware share in Q1/2024 were:<ul><li>XMRig (59.53%)</li><li>Web miners (20.20%)</li><li>CoinBitMiner (2.67%)</li><li>FakeKMSminer (2.03%)</li><li>NeoScrypt (1.75%)</li><li>CoinHelper (1.05%)</li><li>VMiner (0.86%)</li><li>SilentCryptoMiner (0.84%)</li></ul>Jan Rubín, Malware Researcher<h3 class="text-align-justify">Information Stealers are Still Dominated by AgentTesla</h3>Information stealers are dedicated to stealing anything of value from the victim’s device. Typically, they focus on stored credentials, cryptocurrencies, browser sessions/cookies, browser passwords and private documents.AgentTesla, traditionally the most prevalent information stealer we protect our users against, continued to attack users by leveraging email campaigns. <a href="https://twitter.com/AvastThreatLabs/status/1762082961837477891" target="_blank" rel="noreferrer noopener">One such campaign</a> targeted Czechia, spreading the stealer via malicious attachments.

<a href="https://blog.talosintelligence.com/timbrestealer-campaign-targets-mexican-users/" target="_blank" rel="noreferrer noopener">TimbreStealer</a>, targeting almost explicitly users in Mexico, is a newcomer in the information stealers landscape. The malware is quite advanced and multi-modular, containing techniques like Heaven’s gate, among many others. It also introduces many tricks for preventing execution in sandboxes and proper debugging.Malware-as-a-Service (MaaS) stealers continue to thrive, finding new distribution methods whenever possible. For example, DarkGate was <a href="https://cybersecurity.att.com/blogs/security-essentials/darkgate-malware-delivered-via-microsoft-teams-detection-and-response" target="_blank" rel="noreferrer noopener">observed</a> to be spread via Microsoft Teams, using phishing. Furthermore, from the more technical perspective, DarkGate <a href="https://www.trendmicro.com/en_us/research/24/c/cve-2024-21412--darkgate-operators-exploit-microsoft-windows-sma.html" target="_blank" rel="noreferrer noopener">was exploiting</a> Microsoft Windows SmartScreen (CVE-2024-21412).We have also observed a DarkGate campaign distributed via <a href="https://twitter.com/AvastThreatLabs/status/1758461792844443650" target="_blank" rel="noreferrer noopener">malicious PDF files</a>, abusing crypto exchange and the WebDAV server. The malware delivery was done using an InternetShortcut link (.URL file), downloading the content from an opendir.

On the other hand, Lumma Stealer, which is yet another MaaS stealer, continues to spread via <a href="https://www.fortinet.com/blog/threat-research/lumma-variant-on-youtube" target="_blank" rel="noreferrer noopener">cracked software propagated on YouTube</a>, using fake tutorials to mislead victims. This further emphasizes that such strains – and their creators – never miss an opportunity to leverage social engineering to distribute malware.With regards to macOS, AtomicStealer, also known as AMOS, saw a consistent rise in occurrences on this platform during Q1/2024. This typically obfuscated malware is known for stealing passwords, cryptocurrency wallets, and cookies. It often infiltrates systems via counterfeit applications or through Google Ads poisoning. The existence of multiple generations of this threat suggests that it is likely to persist in the future, which is further underlined by its <a href="https://www.malwarebytes.com/blog/threat-intelligence/2024/01/atomic-stealer-rings-in-the-new-year-with-updated-version" target="_blank" rel="noreferrer noopener">new version</a>that was carried by a malvertising campaign in the beginning of the year.In terms of Linux, Python information stealers were the more prevalent strains of this type with well-known malware families like Spidey, Creal, Wasp or PirateStealer. Additionally, in this quarter we uncovered a new malware strain identified as <a href="https://www.virustotal.com/gui/file/1168e97ccf61600536e93e9c371ee7671bae4198d4bf566550328b241ec52e89" target="_blank" rel="noreferrer noopener">PassSniff/Putin</a> and written in C++ that, instead of stealing the passwords from disk, steals the passwords by sniffing the HTTP traffic using both, generic rules and specific rules targeting popular services and applications.<h4 class="text-align-justify">Statistics</h4>Overall, the global risk ratio decreased by 8% in Q1/2024 for information stealers. However, many popular stealers further increased their reach, including AgentTesla, Stealc, Fareit, and ViperSoftX.

Each of the countries where we observe the risk ratio with regards to information stealers and where we have more significant userbase thankfully experienced a decrease in activity compared to the previous quarter:<ul><li>Turkey (2.29%) with 23% Q/Q decrease</li><li>Pakistan (2.05%) with 11% Q/Q decrease</li><li>Egypt (1.78%) with 10% Q/Q decrease</li></ul>On the other hand, we also measured increases in activity in Mexico and Czechia, following the aforementioned TimbreStealer and AgentTesla campaigns, were the risk ratio increased by 25% and 14%, respectively.

AgentTesla, the most prevalent information stealer according to our data, has increased its malware share by 17%. Its campaigns primarily target Central Europe and both North and South America. As a result, it now holds a significant 30.31% of the malware share. Notably, almost every bigger information stealer experienced an increase in activity, including Fareit (34% increase), Stealc (33%), ViperSoftX (28%), and Azorult (14%). FormBook’s share decreased by 32%, as well as Lokibot’s by 50%, balancing the scales of the overall activity of information stealers.The most common information stealers with their malware shares in Q1/2024 were:<ul><li>AgentTesla (30.31%)</li><li>Fareit (7.55%)</li><li>FormBook (6.92%)</li><li>RedLine (4.37%)</li><li>Stealc (2.81%)</li><li>ViperSoftX (2.28%)</li><li>Azorult (1.93%)</li><li>ClipBanker (1.72%)</li><li>Raccoon (1.56%)</li><li>Lokibot (1.41%)</li><li>Rhadamanthys (1.36%)</li></ul>Jan Rubín, Malware Researcher David Álvarez, Malware Analyst<h3 class="text-align-justify">Ransomware: Fighting it Back</h3>Ransomware is any type of extorting malware. The most common subtype is the one that encrypts documents, photos, videos, databases, and other files on the victim’s PC. Those files become unusable without decrypting them first. To decrypt the files, attackers demand money, “ransom”, hence the term ransomware.<h4 class="text-align-justify">The LockBit Story</h4>In the <a href="https://decoded.avast.io/threatresearch/avast-q4-2023-threat-report/" target="_blank" rel="noreferrer noopener">previous threat report</a>, we discussed new ransomware attacks. One of the top ransomware strains (or gangs, if you wish) is LockBit, which continues its encryption and extortion attacks with an undiminished intensity.Because of the notoriety of LockBit, their – albeit brief – takedown in Q1/2024 was watched closely by the public.&nbsp; On February 19, <a href="https://www.youtube.com/watch?v=-jKykhKKMZw" target="_blank" rel="noreferrer noopener">operation Cronos was announced</a>, which was a joint operation between law enforcement agencies in 10 countries. As a part of this operation, the FBI successfully breached the LockBit infrastructure, <a href="https://www.nationalcrimeagency.gov.uk/news/nca-leads-international-investigation-targeting-worlds-most-harmful-ransomware-group" target="_blank" rel="noreferrer noopener">secured about 1000 private encryption keys</a> and released a public decryptor. The following is the timeline surrounding the initiative:<ul><li>Feb 19: Operation Cronos was unveiled. LockBit leak site was replaced by a landing page from the associated law enforcement agencies:</li></ul>

<ul><li>The main panel was replaced with a version augmented by the authorities, outing the criminality of ransomware operators:</li></ul>

<ul><li>Feb 20: <a href="https://www.bleepingcomputer.com/news/security/police-arrest-lockbit-ransomware-members-release-decryptor-in-global-crackdown/" target="_blank" rel="noreferrer noopener">Two LockBit operators (Poland and Ukraine) were arrested</a>, and a few other individuals were indicted for their involvement in LockBit operations</li><li>LockBit <a href="https://twitter.com/azalsecurity/status/1759740340209172548" target="_blank" rel="noreferrer noopener">informed all their affiliates</a> about the breach</li><li>For four days, there was no information about new victims of the LockBit ransomware</li><li>Feb 24: A long message from LockBit was <a href="https://twitter.com/DarkWebInformer/status/1761505849908887567" target="_blank" rel="noreferrer noopener">published by DarkWebInformer</a>. This message explained what happened and questioned the law enforcement agencies’ success. The author of the message explains that some of his servers were running an outdated version of PHP and hence were vulnerable to <a href="https://www.cvedetails.com/cve/CVE-2023-3824/" target="_blank" rel="noreferrer noopener">CVE-2023-3824</a>.</li><li>Feb 25: The LockBit leak site was restored, with the FBI now shown as one of the victims. Additionally, the information about leaked data from <a href="https://fultoncountyga.gov/" target="_blank" rel="noreferrer noopener">Fulton County</a> was re-uploaded. Note that the Fulton County Government was <a href="https://twitter.com/FalconFeedsio/status/1757676052988699111" target="_blank" rel="noreferrer noopener">allegedly attacked by LockBit</a> on Feb 14 and the leaked data was mentioned in LockBit’s message as the reason that the FBI stopped the operation instead of silently watching the servers and exfiltrating LockBit’s data increasingly, as their criminal activities continued.</li></ul>

<ul><li>Feb 26: LockBit operators restored their cyber-attacks and <a href="https://twitter.com/FalconFeedsio/status/1762090791168823330" target="_blank" rel="noreferrer noopener">re-started attacking multiple companies daily</a>. No, this is not a story with a happy conclusion (so far).</li></ul>A tool for decrypting LockBit-encrypted data using one of 1000 seized encryption keys is. The importance of these encryption keys has been questioned by the LockBit operator himself, saying (quote) “Note that the vast majority of unprotected decryptors are from partners who encrypt brute force dedicas and spam single computers, taking $2000 ransoms” (end quote). Users attacked by LockBit ransomware may use the tool to verify if their data can be decrypted using one of the keys that were seized during the Cronos operation.Another LockBit-related incident happened at the beginning of 2024, which demonstrates some of the ransomware operators’ modus operandi. After LockBitSupp gained access to an unspecified company, encrypted their data, and received ransom payout, he that provided access to the network.This little incident shows what ransomware operators do to penetrate a company:<ol><li>Ransomware operator “buys an access” which means obtaining information about a company, its vulnerabilities and how to breach its network.</li><li>Then the operator maps the company network and eventually deploys the ransomware.</li><li>When the attacked company pays the ransom, the “access seller” gets paid for the access.</li></ol><h4 class="text-align-justify">Ransomware Decryptors</h4>As a part of the ongoing battle against ransomware, Avast released two ransomware decryptors: HomuWitch and Rhysida.<h5 class="text-align-justify">HomuWitch</h5>HomuWitch is a ransomware that stayed under the radar since July 2023, because it targets end users with smaller ransom demands (25 – 75 USD). Searching for pirated software is the most common infection vector – instead of the desired software, users may download SmokeLoader backdoor, which later installs malicious dropper for the ransomware payload.Unlike most ransomware strains that perform file encryption, HomuWitch also adds compression, so the encrypted files are smaller than their originals. When executed, HomuWitch searches local drives and user folders (Pictures, Downloads, Documents). All files of interest (.pdf, .doc, .docx, .ppt, .pptx, .xls, .py, .rar, .zip, .7z, .txt, .mp4, .JPG, .PNG, .HEIC, .csv) are encrypted and renamed to the .homuencryptedextension:

<a href="https://decoded.avast.io/threatresearch/decrypted-homuwitch-ransomware/" target="_blank" rel="noreferrer noopener">While analyzing this ransomware</a>, we found a vulnerability that allows affected users to recover their files for free. We released free decryptor that is available on <a href="https://files.avast.com/files/decryptor/avast_decryptor_homuwitch.exe" target="_blank" rel="noreferrer noopener">our website</a>.<h5 class="text-align-justify">Rhysida</h5>Rhysida is another ransomware strain defeated by the free decryption tool. This ransomware has been active since May 2023 and focuses on the enterprise sector. During summer, we discovered that this ransomware strain is decryptable without having the private RSA key, so we have been helping people who were attacked by the Rhysida ransomware.In February 2024, Korean researchers also <a href="https://thehackernews.com/2024/02/rhysida-ransomware-cracked-free.html" target="_blank" rel="noreferrer noopener">discovered that vulnerability</a>and released their <a href="https://seed.kisa.or.kr/kisa/Board/166/detailView.do" target="_blank" rel="noreferrer noopener">decryption tool</a> publicly. It is always unfortunate to publish detailed information about the details of a vulnerability – we would like to ask fellow malware researchers not to do so and focus more on helping people affected by ransomware attacks.Now that the details of the vulnerability are public, we also released a free decryption tool that is available both on <a href="https://decoded.avast.io/threatresearch/decrypted-rhysida-ransomware/" target="_blank" rel="noreferrer noopener">our website</a> and as part of the <a href="https://www.nomoreransom.org/en/decryption-tools.html" target="_blank" rel="noreferrer noopener">NoMoreRansom project</a>.<h4 class="text-align-justify">Statistics</h4>The most prevalent ransomware strains that we block in our userbase are listed below. As opposed to more popular threats like LockBit, Akira or BlackCat, you rarely read about those strains in media because – instead of attacking a large company and demanding millions of USD as ransom – these strains focus on either individual users or small businesses, and they demand ransoms that are in the thousands of dollars range.<ul><li>WannaCry (21% of ransomware share)</li><li>Enigma (12%)</li><li>STOP (12%)</li><li>Mallox (aka TargetCompany) (3%)</li><li>DarkSide (2%)</li><li>Cryptonite (1%)</li></ul>The overall ransomware risk ratio in our user base is showing an increase when compared to the previous quarter. The situation started escalating in March 2024:

The ransomware risk ratio per country is depicted on the following map. We have noticed a significant increase in Bulgaria, Japan, Czechia, and Hungary where the risk ratio more than doubled Q/Q. &nbsp;

Ladislav Zezula, Malware Researcher Jakub Křoustek, Malware Research Director<h3 class="text-align-justify">Remote Access Trojans (RATs): The End of Warzone</h3>A Remote Access Trojan (RAT) is a type of malicious software that allows unauthorized individuals to gain remote control over a victim’s computer or device. RATs are typically spread through social engineering techniques, such as phishing emails or infected file downloads. Once installed, RATs grant the attacker complete access to the victim’s device, enabling them to execute various malicious activities, such as spying, data theft, remote surveillance, and even taking control of the victim’s webcam and microphone.Similarly to Q1/2023 and the Netwire takedown, this year also begins with a takedown action against one of the major players in the RAT scene – the&nbsp; Warzone RAT was <a href="https://www.justice.gov/opa/pr/international-cybercrime-malware-service-dismantled-federal-authorities-key-malware-sales" target="_blank" rel="noreferrer noopener">taken down</a> at the beginning of February. According to our data, the effect was immediately visible as a sudden drop in the number of detected attacks by Warzone. Besides this takedown, it was a rather slow start to the year with only a few notable events in the RAT sphere.

Compared to Q4/2023, the global risk ratio in the first quarter of 2024 is following a downward trend. There are several reasons for this decline. The big players Remcos, njRAT, and AsyncRat seem to have eased off a little and the number of attacks in Q1/2024 was lower than what we typically see. The takedown action against Warzone might have caused some RAT operators to halt or pause their activities. While we see increased activity of less prevalent malware strains, this isn’t enough to compensate the overall attack numbers. &nbsp;

The top 3 countries and RATs have not changed. We still see the highest risk ratio in Afghanistan, Iraq and Yemen, with HWorm and njRAT as the most active threats there.The biggest increase in risk ratio was observed in Canada (+69%) due to increased activity of XWorm in February. This led to XWorm increasing its malware share by 378% which makes it the most prevalent RAT in Canada. The second highest share is in New Zealand (+33%) followed by Switzerland (+14%). Remcos was the dominant force in both countries. Despite this rise of risk ratio, Switzerland is still among the safest countries regarding RAT attacks.The most prevalent remote access trojan strains in our userbase are as follows:<ul><li>HWorm</li><li>Remcos</li><li>njRAT</li><li>AsyncRat</li><li>QuasarRAT</li><li>Warzone</li><li>FlawedAmmyy</li><li>XWorm</li><li>NanoCore</li><li>DarkComet</li></ul>Although the overall number of detected attacks by Remcos slightly dropped, it is still very active. We recently <a href="https://twitter.com/AvastThreatLabs/status/1752427947045093657" target="_blank" rel="noreferrer noopener">warned</a> about a campaign targeting most of Eastern Europe; this campaign was created in the Russian language and used a common lure “Invoice payment confirmation”.We already mentioned XWorm in relation to Canada, however it also managed to increase its presence in most parts of the world. We also see XWorm frequently releasing new versions.On February 7, an international operation targeted the Warzone RAT resulting in the seizure of four domains, including the primary site “warzone.ws”, and server infrastructure. One suspect was arrested in Malta and another in Nigeria. The FBI led the operation with assistance from <a href="https://www.europol.europa.eu/media-press/newsroom/news/international-cybercrime-malware-service-targeting-thousands-of-unsuspecting-consumers-dismantled" target="_blank" rel="noreferrer noopener">Europol</a>, the <a href="https://www.justice.gov/opa/pr/international-cybercrime-malware-service-dismantled-federal-authorities-key-malware-sales" target="_blank" rel="noreferrer noopener">U.S. Department of Justice</a>, and local law enforcement agencies. The suspects are accused of selling and advertising the RAT, providing support, and unauthorized damage to protected computers.

<a href="https://www.fortinet.com/blog/threat-research/vcurms-a-simple-and-functional-weapon" target="_blank" rel="noreferrer noopener">FortiGuard Labs</a> also uncovered a phishing campaign spreading a new RAT, VCURMS. The campaign uses a downloader with payloads stored on public services like AWS and GitHub. There are two known payloads – the new VCURMS and STRRAT. STRRAT is also a remote access trojan which appeared in 2020. The interesting part of VCURMS is its unusual command and control channel. It communicates using emails with a Proton Mail address. Like STRRAT, VCURMS is also coded in Java. Another notable feature is its infostealer module which looks similar to RudeStealer.<a href="https://blog.phylum.io/a-deep-dive-into-powerat-a-newly-discovered-stealer-rat-combo-polluting-pypi/" target="_blank" rel="noreferrer noopener">Phylum</a> and <a href="https://blog.sonatype.com/top-8-malicious-attacks-recently-found-on-pypi" target="_blank" rel="noreferrer noopener">Sonatype</a> discovered another supply chain attack in Q1/2024. Both teams found malicious packages in PyPI. These packages deploy a RAT that can also steal information from infected machines. Phylum named this threat “poweRAT”, because it relies on PowerShell in the early stages. Both reports mention the following packages as affected: pyrologin, easytimestamp, discorder, discord-dev, style.py and pythonstyles. Sonatype <a href="https://hackernoon.com/how-rat-mutants-in-python-steal-data-and-evade-detection" target="_blank" rel="noreferrer noopener">followed up</a> on this story, adding several more packages to the list and showing how this threat has evolved. Communication with the C&amp;C server happens via a Cloudflare Tunnel created from the infected machine, which means the malware does not need to modify any firewall settings. The features of RAT and information-stealing components are common on their own – however, when they combine, they create quite&nbsp; a dangerous threat. Phylum refers to it as a “RAT on steroids” and Sonatype as “RAT mutant”.Ondřej Mokoš, Malware Researcher<h3 class="text-align-justify">Vulnerabilities and Exploits: An Actively Exploited Admin-to-Kernel Zero-Day</h3>Exploits take advantage of flaws in legitimate software to perform actions that should not be allowed. They are typically categorized into remote code execution (RCE) exploits, which allow attackers to infect another machine, and local privilege escalation (LPE) exploits, which allow attackers to take more control of a partially infected machine.In the February Patch Tuesday update, Microsoft patched <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21338" target="_blank" rel="noreferrer noopener">CVE-2024-21338</a>, a zero-day admin-to-kernel vulnerability <a href="https://decoded.avast.io/janvojtesek/lazarus-and-the-fudmodule-rootkit-beyond-byovd-with-an-admin-to-kernel-zero-day/" target="_blank" rel="noreferrer noopener">discovered</a> by Avast researchers. This zero-day was initially exploited in the wild by the Lazarus Group, who used it to enable an updated version of their FudModule data-only rootkit. This marked a significant improvement in capabilities, as previous versions of the FudModule rootkit were enabled by targeting known vulnerable drivers for BYOVD (Bring Your Own Vulnerable Driver) attacks.&nbsp;Upgrading from BYOVD techniques to a zero-day in a built-in driver made the entire attack significantly stealthier, however, this wasn’t the only upgrade. Lazarus also revamped the rootkit functionality, targeting registry callbacks, object callbacks, process/thread/image callbacks, file system minifilters, Windows Filtering Platform, Event Tracing for Windows, and image verification callbacks. Additionally, the threat actors implemented a noteworthy handle table entry manipulation technique, attempting to suspend critical processes associated with Microsoft Defender, CrowdStrike Falcon, and HitmanPro. For a deeper understanding of this attack, we recommend reading our two technical <a href="https://decoded.avast.io/janvojtesek/lazarus-and-the-fudmodule-rootkit-beyond-byovd-with-an-admin-to-kernel-zero-day/" target="_blank" rel="noreferrer noopener">blog</a> <a href="https://decoded.avast.io/luiginocamastra/from-byovd-to-a-0-day-unveiling-advanced-exploits-in-cyber-recruiting-scams/" target="_blank" rel="noreferrer noopener">posts</a> or watching our Black Hat Asia 2024 <a href="https://www.blackhat.com/asia-24/briefings/schedule/index.html" target="_blank" rel="noreferrer noopener">talk</a>.

In other news, the open-source world was shocked by the <a href="https://www.openwall.com/lists/oss-security/2024/03/29/4" target="_blank" rel="noreferrer noopener">discovery</a> of a backdoor in the xz/liblzma compression library. This backdoor was discovered by software engineer Andres Freund, who <a href="https://x.com/AndresFreundTec/status/1774190743776866374" target="_blank" rel="noreferrer noopener">noticed</a> that failing ssh logins were consuming suspicious amounts of CPU, and did the world a huge favor by deciding to investigate the root cause. The attacker(s) went by the name Jia Tan (their exact affiliation/motivation remain unclear) and demonstrated a remarkable level of patience, slowly building up trust by contributing to the open-source project for over two years. Eventually, they decided to strike and – over a number of commits – introduced the backdoor, the ultimate goal of which was to allow remote SSH logins to those with the possession of the right private key <a href="https://nvd.nist.gov/vuln/detail/CVE-2024-3094" target="_blank" rel="noreferrer noopener">(CVE-2024-3094</a>).&nbsp;Fortunately, the backdoor was discovered relatively early, so the attackers didn’t have enough time to get the malicious code merged into major Linux distributions like Debian or Red Hat. This was a close call, however, which should be very alarming, as this could have easily been one of the biggest security incidents that we have seen in recent years. While open-source code is often regarded as more trustworthy than its closed-source counterpart, this attack demonstrates that it comes with its own challenges. Many critical open-source projects are maintained with little funding by overworked volunteers, which might unfortunately make them vulnerable to similar attacks.Another interesting discovery was related to hyperlinks in Outlook. While Outlook would, under usual circumstances, not follow “file://” protocol links to remote resources, Haifei Li of Check Point Research <a href="https://research.checkpoint.com/2024/the-risks-of-the-monikerlink-bug-in-microsoft-outlook-and-the-big-picture/" target="_blank" rel="noreferrer noopener">discovered</a> that just adding an extra exclamation mark (“!”) followed by some arbitrary characters might change this behavior completely. This vulnerability was assigned <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21413" target="_blank" rel="noreferrer noopener">CVE-2024-21413</a> and dubbed MonikerLink, as the exclamation mark essentially turns the link into a <a href="https://learn.microsoft.com/en-us/windows/win32/api/objbase/nf-objbase-mkparsedisplayname" target="_blank" rel="noreferrer noopener">composite moniker</a>. When a user received an email and clicked on such a link, the remote file would be fetched and possibly parsed in the background.&nbsp;Interestingly, the impact of this is twofold. First, following the link to load a resource from a remote SMB server represents <a href="https://github.com/Greenwolf/ntlm_theft" target="_blank" rel="noreferrer noopener">yet another way</a>to <a href="https://www.scip.ch/en/?labs.20220421" target="_blank" rel="noreferrer noopener">force NTLM authentication</a>, allowing the remote server to capture NTLMv2 hashes. Second, an attacker might use this to trigger some vulnerable code, as the fetched resource might be opened in the background, attempting to look up the item moniker (the string appended after the exclamation mark). For instance, the Check Point blog demonstrated this on an RTF file, which would get opened in Microsoft Word outside protected view, representing a very sneaky 1-click vector to deliver an RTF exploit.Jan Vojtěšek, Malware Researcher<h2 class="text-align-justify">Web Threats</h2>The significance of web threats can be well seen not only in the numerical&nbsp; statistics but also in the creativity of the scammers themselves. We see scammers trying to take advantage of different trends in different groups. These cybercriminals are using the latest technology in the field of AI, or they are not afraid to invest in their fraudulent practices to improve the sophistication of their scams through other methods.&nbsp;Last quarter, we reported that scams, together with phishing and malvertising, accounted for more than 75% of all threats blocked by Avast throughout the year. This quarter we have blocked&nbsp; over 80% for the same type of threats. This indicates a rather interesting – and very scam-ridden – start to the year.<h3 class="text-align-justify">Scams Everywhere, Including Video</h3>A scam is a type of threat that aims to trick users into giving an attacker their personal information or money. We track diverse types of scams which are listed below.In our Q4/2023 report, we pointed out that scam activity is increasing significantly. At that time, we saw that one of the main reasons was the high rate of malvertising campaigns. This trend has continued in Q1/2024, with the activity level from the previous peak.&nbsp;

Our data again shows that sites offer deals and then sending push-notifications are contributing significantly to this trend. With this in mind, we again urge everyone to always consider from which website you want to allow to send you notifications. Also remember that scammers try to disguise these offers of sending notifications as, for example, video players or as adult confirmations.If you, unfortunately, allow access to malicious notifications, you may encounter the situation shown below.&nbsp;

The increasing use of malvertising and push-notifications by scammers only confirms our predictions for 2024, when we repeatedly warned that this is a global threat with huge risk potential, especially on mobile phones.If we look at activity in specific countries, we see that Ukraine exhibited the most significant surge in risk ratio, with a concerning 97% increase (the overall risk ratio for first quarter is set at 16.51%).&nbsp;

Similarly, Kazakhstan and Uzbekistan displayed significant jumps in their risk ratios, +89% and +56% respectively, marking these countries as emerging hotspots for scam-related threats with overall risk ratios of 14.24% and 12.45%.If we look further, we see interesting data for India, which also saw an increase in scam threats The current risk ratio for India is 17.26% with a quarter-over-quarter risk ratio increase of +24%.We identified the highest scam risk ratio Georgia and Serbia in Q1/2024, with more than 30% risk ratio. In the absolute numbers, the majority of scam-targeted users were in France, Brazil, and the US.<h4 class="text-align-justify">Scam Delivery via Video</h4>In Q1/2024 we continued to witness scam authors heavily using videos as lures in their scams. Whether video made from stock footage or an elaborate deep fake video, scammers are using all video varieties in their threats. One of the most widespread techniques involved exploiting famous individuals and significant media events to attract large audiences. As a result, scammers have devised enticing schemes that capitalize on the familiarity of well-known personalities and important world events.An increasingly common feature of these campaigns is the use of deep fake videos, created by hijacking official videos from events and using AI to manipulate audio synchronization. These videos seamlessly blend altered audio with existing visuals, making it harder for the untrained eye to tell they’re anything but authentic. Moreover, scammers insert QR codes, leading to well-designed web pages, that promise exclusive opportunities, luring victims into further engagement.

Cryptocurrency scams of this type are particularly increasing. Once an individual moves from the video lure to the fraudulent website, they are presented with different scenarios for obtaining “beneficial” cryptocurrencies. Victims are fooled into believing that participating in these schemes will bring considerable profits. The scammers consistently promise victims the same profit margin, and victims receive the impression that – by sending any amount of cryptocurrency to specific wallets – they will receive double the amount in return. The websites even implement fake online wallet monitoring, imitating legitimate transaction activity. Additionally, these deceptive sites typically include images of well-known personalities and logos associated with&nbsp; authentic&nbsp; cryptocurrency-related companies, adding an air of legitimacy.

In Q1/2024, we observed several other incidents of abuse against famous individuals like <a href="https://www.microstrategy.com/investor-relations/executive-team/michael-saylor" target="_blank" rel="noreferrer noopener">Michael J. Saylor</a>, <a href="https://en.wikipedia.org/wiki/Vitalik_Buterin" target="_blank" rel="noreferrer noopener">Vitalik Buterin</a>, <a href="https://twitter.com/bgarlinghouse" target="_blank" rel="noreferrer noopener">Brad Garlinghouse</a>, and <a href="https://www.blackrock.com/corporate/about-us/leadership/larry-fink" target="_blank" rel="noreferrer noopener">Larry Fink</a>. &nbsp;

However, the most significant cryptocurrency scam incident of the quarter was the misuse of the Starship Integrated Flight Test 3 (IFT-3). The attackers used the official SpaceX All Hands meeting video to deceive viewers and get them to visit the fraudulent websites. Moreover, the attackers have hijacked several YouTube channels, which have tens of millions of subscribers, to increase the probability of displaying a fake video in the list of recommended videos.The preliminary analysis indicates that specific attackers’ wallets associated with these scams’ campaigns have cashflows reaching tens of thousands of dollars.The risk ratio of this financial scam was stable in Q1/2024, but we recorded a significant peak on March 14, 2024, related to the IFT-3 event. &nbsp;

In terms of country distribution, the leading countries affected by the scammer group are the United States, the United Kingdom, and Germany.

<h3 class="text-align-justify">Dating Scams Skyrocketing</h3>Dating scams, also known as romance scams or online dating scams, involve fraudsters deceiving individuals into fake romantic relationships. Scammers adopt fake online identities to gain the victim’s trust, with the ultimate goal of obtaining money or enough personal information to commit identity theft.The last quarter of last year was very interesting for dating scams, with several large campaigns witnessed through our data. In Q1/2024, we saw a significant increase since the middle of February.&nbsp;What is interesting is the high activity especially in Central Europe, with countries like Hungary, Slovakia, Denmark, Austria or the Czech Republic being the most affected.

Once again,&nbsp; these threats are strongly supported by advertising campaigns. We often see that the sources of these advertising campaigns are sites with adult content. On such pages, the owners often try to get as much commission as possible by trying to fit advertising on their sites with almost every interaction on the page. The user is often overwhelmed with pop-ups or new window redirects, usually to dating scam sites. &nbsp;

As you can see on the map, Hungary leads with the highest risk ratio rate at 5.06%. Following closely are Slovakia and Luxembourg, with risk ratios of 4.72% and 4.57% respectively.Germany and Austria also show significant exposure to dating scams, with risk ratio rates of 4.27% and 4.10% and lastly, Czechia, with a risk ratio of 3.94%, rounds out the list.

<h3 class="text-align-justify">Tech Support Scams (TSS): Steady Increase of Attacks&nbsp;</h3>Tech support scam threats involve fraudsters posing as legitimate technical support representatives who attempt to gain remote access to victims’ devices or obtain sensitive personal information, such as credit card or banking details. These scams rely on confidence tricks to gain victims’ trust and often involve convincing them to pay for unnecessary services or purchase expensive gift cards. It’s important for internet users to be vigilant and to verify the credentials of anyone claiming to offer technical support services.Throughout 2023, we observed a continual drop in activity related to tech support scams. In the first quarter of this year, we can say that this trend not only ended but quite the contrary – we observed an increase in tech scam activity over the quarter.

As seen on the chart above, the activity of this threat has reached the level of the beginning of Q4/2023.Looking at the data of the full quarter, a clear increase trend is visible. &nbsp;

Switzerland experienced the most dramatic surge, with a 177% increase in TSS activity—the highest observed this quarter. Austria also saw a significant rise, with a 101% increase. Germany’s increase, though lower, was still notable at 65%. Additionally, Japan, traditionally a hotspot for TSS, reported a significant increase of 153%.These escalating figures, especially notable in Europe’s wealthier nations, highlight a growing trend in cybersecurity threats in these regions.

<h3 class="text-align-justify">Refund and Invoice Scams: iCloud Data Deletion Scam</h3>Invoice scams involve fraudsters sending false bills or invoices for goods or services that were never ordered or received. Scammers rely on invoices looking legitimate, often using company logos or other branding to trick unsuspecting victims into making payments. These scams can be especially effective when targeted at businesses, as employees may assume that a colleague made the purchase or simply overlook the details of the invoice. It’s important to carefully review all invoices and bills before making any payments and to verify the legitimacy of the sender if there are any suspicions of fraud.One of the refund and invoice scams that caught our attention in Q1/2024 targeted a top-tier service, serving as a gateway to other less valuable ones, in our assessment. The targeted account was iCloud, accompanied by a TinyURL link to a payment gateway that extracts user information, including sensitive details. iCloud is undoubtedly one of the most vital accounts to protect by enabling multi-factor authentication in order to prevent malicious actors from stealing sensitive information. According to <a href="https://9to5google.com/2022/02/08/google-account-2sv/" target="_blank" rel="noreferrer noopener">9to5 Google</a>, enabling multi-factor authentication for Google users led to a 50% decrease in compromised accounts.We will delve into the campaign itself which begins with a malicious email, which may evoke early 90’s nostalgia because the attackers’ Comic Sans font choice. The aim of the email is to visually intimidate, highlighting the issue at hand: your beloved photos will be deleted unless you proceed to the fake payment gateway. As always, the loading bar creates a sense of urgency, while a missed payment statement compounds the pressure. A big red button labeled “FULL” completes the sense of urgency, signaling that immediate action is required.The email seemingly contains additional product and technical information to make it look authentic, all of which is fabricated. These include product IDs, expiration dates, and buttons for more storage. The only legitimate piece of the email is the unauthorized use of the actual iCloud logo. The subject of the email is also intriguing: we’re seeing that more cybercriminals aim to catch your attention with email subject lines using emoticons, as you see in the email sample below.

In terms of global prevalence, we can see that the English-speaking world is the most affected, along with the European Union. The countries that experienced the biggest spike in the last quarter are Belgium, up by 29%, the United Kingdom, up by 13%, and Luxembourg, up by 10%. On the other side of the spectrum, we have Australia, which experienced the largest drop, down by 29%, the United States, down by 15%, and Canada, down by 5%. &nbsp;

The graph showing risk ratio over time exhibits less volatility compared to the previous period. In Q1/2024, the risk did not significantly change over time and rose slightly by the end of the quarter. We can observe that the threat is still widely spread around the globe, and we anticipate seeing even more of these attacks in the future. &nbsp;

<h3 class="text-align-justify">Phishing: Reaching New Hights</h3>Phishing is a type of online scam where fraudsters attempt to obtain sensitive information including passwords or credit card details by posing as a trustworthy entity in an electronic communication, such as an email, text message, or instant message. The fraudulent message usually contains a link to a fake website that looks like the real one, where the victim is asked to enter their sensitive information.And now we come to the final, and most classic,&nbsp; category under web threats: Phishing. Like nearly all web threats, this category saw an increase in activity in Q1/2024, continuing the increase trend that we’ve witnessed over the last four quarter.&nbsp;

We’ve also observed that attackers are continuing to make heavy use of file sharing via InterPlanetary File System (IPFS) infrastructure – to spread their phishing content. &nbsp;

Our statistics show that the most frequently targeted brand on IPFS is Microsoft, which currently accounts for up to 20% of blocked attacks. At the same time, we see that these threats were most visible at the end of Q1/2024.

One of the most interesting phishing campaigns for this quarter was the wave of Russian-language phishing PDFs targeting bank users.&nbsp;Based on the content of the PDF, this campaign was developed to target the customers of Tinkoff Bank, and from the data we can see that the most hits are registered in Latvia.

This campaign generated hundreds of PDF samples, with different names, while the appearance mostly stayed the same. All extracted URLs pointed to the same domain. &nbsp;

The main domain to which the URL is redirected is xsph[.]ru. This domain acts as a hub for many other types of malware.&nbsp; &nbsp;

A command-and-control server, such as one hosted at “the-packaging-experts[.]co.uk” could be accessed by malicious programs by abusing this event. This then redirects to “http://a0942143[.]xsph[.]ru/tin/cabinet/capcha/” and checks CAPTCHA to verify that the user is human, then potentially receives instructions or downloading additional payloads. Threat actors frequently employ this strategy to avoid being discovered by security solutions, using a genuine website as a front for criminal activity. &nbsp;

Reports

Gen Q4/2024 Threat Report

Gen Q3/2024 Threat Report

Gen Q2/2024 Threat Report

Avast Q1/2024 Threat Report

Avast Q4/2023 Threat Report

Avast Q3/2023 Threat Report

Avast Q2/2023 Threat Report

Avast Q1/2023 Threat Report

Avast Q4/2022 Threat Report

Avast Q3/2022 Threat Report

Avast Q2/2022 Threat Report

Avast Q1/2022 Threat Report