FutureFive New Zealand logo
Consumer technology news from the future
Story image

Most wanted malware Dridex remains in top position amidst global surge in ransomware attacks

By Shannon Williams
Fri 14 May 2021
FYI, this story is more than a year old

The Dridex trojan is the most prevalent malware for the second month running, according to Check Point Research.

The trojan is often used in the initial stages of ransomware attacks.

Check Point Research has published its latest Global Threat Index for April 2021. Researchers report that for the first time, AgentTesla has ranked second in the Index. 

This month, Dridex, a Trojan that targets the Windows platform, spread via QuickBooks Malspam Campaign. The phishing emails used QuickBooks branding and were trying to lure the user with fake payment notifications and invoices. The email content asked to download a malicious Microsoft Excel attachment that could cause the system to be infected with Dridex.

According to CPR, this malware is often used as the initial infection stage in ransomware operations where hackers will encrypt an organisation's data and demand a ransom in order to decrypt it. 

Increasingly, these hackers are using double extortion methods, where they will steal sensitive data from an organisation and threaten to release it publicly unless a payment is made. 

CPR reported in March that ransomware attacks had seen a 57% increase in the beginning of 2021, but this trend has continued to spike and has completed a 107% increase from the equivalent period last year. Most recently, Colonial Pipeline, a major US fuel company, was the victim of such an attack and in 2020, it is estimated that ransomware cost businesses worldwide around $20 billion - a figure that is nearly 75% higher than in 2019.

For the first time, AgentTesla ranked in 2nd place in the top malware list. AgentTesla is an advanced RAT (remote access Trojan) that has been active since 2014 and functions as a keylogger and password stealer. This RAT can monitor and collect the victim's keyboard input and system clipboard, and can record screenshots and exfiltrate credentials entered for a variety of software installed on the victim's machine (including Google Chrome, Mozilla Firefox and Microsoft Outlook email client).

This month there is an increase in AgentTesla campaigns, which spread via malspam. The email content is asking to download a file (it can be any file type) that could cause the system to be infected with Agent Tesla. 

"While we are witnessing a huge increase in ransomware attacks worldwide, it is no surprise that this month's top malware is related to the trend," says Maya Horowitz, director, Threat Intelligence & Research, Products at Check Point.

"On average every 10 seconds globally, an organisation becomes a victim of ransomware. 

"Recently there have been calls for governments to do more about this growing threat, but it is showing no signs of slowing down," she says. 

"All organisations need to be aware of the risks and ensure adequate anti-ransomware solutions are in place. Comprehensive training for all employees is also crucial, so they are equipped with the skills needed to identify the types of malicious emails that spread Dridex and other malwares, as this is how many ransomware exploits start."

CPR also revealed that Web Server Exposed Git Repository Information Disclosure is the most common exploited vulnerability, impacting 46% of organizations globally, followed by HTTP Headers Remote Code Execution (CVE-2020-13756) which impact 45.5% of organizations worldwide. MVPower DVR Remote Code Execution ranks in third place in the top exploited vulnerabilities list, with a global impact of 44%.

Top malware families

This Month, Dridex is still the most popular malware with a global impact of 15% of organisations, followed by Agent Tesla and Trickbot impacting 12% and 8% of organisations worldwide respectively.

Dridex - Dridex is a Trojan that targets the Windows platform, distributed mostly via malicious spam attachments. Dridex contacts a remote server, sends information about the infected system and can also download and execute arbitrary modules on command. Dridex infections often serve as initial footholds in company-wide ransomware attacks.

Agent Tesla - Agent Tesla is an advanced RAT functioning as a keylogger and information stealer, which is capable of monitoring and collecting the victims keyboard input, system keyboard, taking screenshots, and exfiltrating credentials to a variety of software installed on a victims machine, including Google Chrome, Mozilla Firefox and the Microsoft Outlook email client.

Trickbot - Trickbot is a modular Botnet and Banking Trojan constantly being updated with new capabilities, features and distribution vectors. This enables Trickbot to be a flexible and customisable malware that can be distributed as part of multi-purpose campaigns.

Top exploited vulnerabilities

This month, Web Server Exposed Git Repository Information Disclosure is the most common exploited vulnerability, impacting 46% of organisations globally, followed by HTTP Headers Remote Code Execution (CVE-2020-13756) which impacts 45.5% of organisations worldwide. MVPower DVR Remote Code Execution takes third place in the top exploited vulnerabilities list, with a global impact of 44%.

1. Web Server Exposed Git Repository Information Disclosure - information disclosure vulnerability has been reported in Git Repository. Successful exploitation of this vulnerability could allow an unintentional disclosure of account information.

2. HTTP Headers Remote Code Execution (CVE-2020-10826,CVE-2020-10827,CVE-2020-10828,CVE-2020-13756) - HTTP headers let the client and the server pass additional information with an HTTP request. A remote attacker may use a vulnerable HTTP Header to run arbitrary code on the victim machine.

3. MVPower DVR Remote Code Execution - remote code execution vulnerability exists in MVPower DVR devices. A remote attacker can exploit this weakness to execute arbitrary code in the affected router via a crafted request.

Top mobile malwares

This month xHelper takes first place in the most prevalent mobile malware, followed by Triada and Hiddad.

  • xHelper - A malicious application seen in the wild since March 2019, used for downloading other malicious apps and display advertisement. The application is capable of hiding itself from the user, and can reinstall itself in case it was uninstalled.      
  • Triada - Modular Backdoor for Android which grants superuser privileges to downloaded malware.
  • Hiddad - Hiddad is an Android malware which repackages legitimate apps and then releases them to a third-party store. Its main function is to display ads, but it can also gain access to key security details built into the OS.

 

Related stories
Top stories
Story image
Malware
Research shows attacks on the gaming industry are getting worse
Web application attacks in the gaming sector have grown by 167% from Q1 2021 to Q1 2022, according to new research from Akamai.
Story image
Phishing
Norton research finds NZ threat landscape diversifying on social media
Norton's quarterly report has highlighted the seriousness of the threat landscape in New Zealand.
Story image
Tablets & laptops
Hands-on review: Xencelabs Graphic Display Tablet
Xencelabs seemed to show up out of nowhere on the market. I had no idea who they were or what they were about, but I was very intrigued.
Story image
Tablets & laptops
Chromebook and tablet shipments see another rapid decline for the year
According to research from Canalys PC Analysis, Chromebook and tablet shipments have fallen for the fourth quarter in a row for Q2 of 2022.
Story image
Gaming
Chorus announces Hyperfibre sponsorship deal with NZ Esports
Chorus has put its support behind New Zealand's Esports community with a newly announced three-year Hyperfibre sponsorship deal with NZ Esports.
Story image
Wireless
Hands-on review: James Donkey RS4 Knight Wireless Gaming Keyboard
I have always liked mechanical keyboards, and this is no exception. I find the action much easier to use than the modern keyboards with limited travel.
Story image
Printers
Comedy legend Jimeoin fronts Epson advertising campaign in NZ and Australia
According to Epson the company’s EcoTank models now account for 74% of all printers sold in the category in New Zealand, alone.
Story image
Gaming
Logitech G’s new Aurora collection looks to help change gaming stereotypes
The company’s new Aurora collection is designed to be gender inclusive, not gender exclusive, addressing the needs and wants of women gamers while also still appealing to a wider general audience.
Story image
Internet
InternetNZ appoints new chief executive. Will take over in October
InternetNZ has announced the appointment of its new chief executive, with Vivien Maidaborn taking over the role from interim chief Andrew Cushen in October.
Story image
Cryptocurrency
Freelance tech jobs boom, NFTs and crypto plunge following crash
"Jobs for NFTs and crypto have dominated the past few quarters of our Fast 50 report, but as you can see they're now falling sharply."
Story image
Planning
Digital key for smart investment in public infrastructure for NZ cities
Major public infrastructure projects can better manage risks of cost overruns and delays if they deploy data and digital tools at the earliest planning stages.
Story image
Cloud
Microsoft and Auckland Transport announce new cloud agreement
Auckland Transport (AT) and Microsoft have announced a new cloud agreement aimed at promoting innovation, reducing costs and improving sustainability in transport services.
Story image
Virtual Reality / VR
Virtual reality app reduces phobias through NZ trial
"With this VR app treatment, trialists had increased control in exposure to their fears, as well as control over when and where exposure occurs."
Story image
Gaming
Game review: Klonoa Phantasy Reverie Series
If there's something missing in today's gaming industry, it's the wonderful discovery of finding new games for hire at your local video rental store. I remember my family hired out the first Klonoa game for the PSOne back in 1997, and it was a blast to play as a kid.
Story image
Netsafe
Major media companies sign new online safety framework for Aotearoa
A new joint development between Netsafe and some of the world's leading social media companies is set to provide Kiwis with safer online experiences.
Story image
Fibre
Orcon brings faster fibre to Christchurch with Hyperfibre offering
Orcon has today launched the next generation of fibre speeds in Christchurch, bringing its Hyperfibre offering to the city.
Story image
i-PRO
I-Pro officially marks launch of brand in Australia and New Zealand
I-Pro has officially launched in Australia and New Zealand, following a series of new releases as an entity that started in early April.
Story image
Gaming
Hands-on impressions with PlayStation Plus Deluxe
Finally, the new PlayStation Plus subscription tiers are available now to both New Zealand and Australian PS5 and PS4 gamers.
Story image
VPN
Hands-on review: Norton Secure VPN
Norton is obviously serious about your privacy. They have a “No-log” policy, which simply means that they do not track or store any of your on-line activities.
Story image
Review
Hands-on review: Logitech Astro A10 Gen 2 wired headset
We get our hands on this incredibly good value for money headset for use in wired environments.
Story image
Phone
Hands-on review: Obsbot Me AI-powered mobile phone mount
The Obsbot Me is an independently controlled portable mobile phone mount that can track its target without the need for software or a connection to a phone.
Story image
Dark web
Deep web vs dark web: NortonLifeLock explains the difference
NortonLifeLock managing director for APAC Mark Gorrie explains what you need to know about the deep and dark web and the pros and cons of both.
Story image
Cryptocurrency
Crypto app downloads down as market crashes - report
It appears the mass FOMO around crypto investing may be wearing thin with new data revealing a noticeable drop in crypto app downloads this year.
Story image
Gaming
Game review: Disgaea 6 Complete
Disgaea 6: Defiance of Destiny originally came out in 2021, and more than a year later, the game has now been re-released.
Story image
Tablets & laptops
Hands-on review: HP Evo Spectre X360 Flip Ultrabook 13.5” laptop
The Spectre comes with a keyboard that makes working for long hours something to be looked forward to. It has to be one of the best keyboards I have seen on a 13.5” laptop.
Story image
Gaming
Hands-on review: SteelSeries Apex Pro Mini Keyboard
SteelSeries has taken the design of its range of Apex keyboards to create a smaller version, the Apex Pro Mini. Techday’s Darren Price checks it out.
Story image
Gaming
Game review: The Elder Scrolls Online: High Isle
This year's major expansion to The Elder Scrolls Online, Zenimax Online's acclaimed massively multiplayer online role-playing game, takes players to the land of the Bretons: High Isle.
Story image
Malware
Minors using Discord servers to spread malware for cash
Avast has discovered an online community of minors constructing, exchanging and spreading malware, including ransomware and a mix of information stealers and cryptominers.
Story image
Networks
2degrees launches 13 new 5G coverage areas, network upgrades
2degrees has announced it has launched 13 new 5G areas in June, as the company continues its 5G rollout and investment.
Story image
ASB
New ASB campaign helps young people better understand money
ASB is helping 18 to 24-year-olds take advantage of financial possibilities and better understand the world of money.
Story image
Cybersecurity
Online bullying, harassment skyrockets since COVID outbreak
Harmful content reports have risen by over 25% since the outbreak of the COVID pandemic, according to Netsafe.
Story image
Wireless
Wave Audio spices up portfolio with first ever party speaker
Australian-based pioneers Wave Audio are enhancing their extensive range of groundbreaking new audio products by adding one of the most versatile speakers on the market to their growing portfolio.
Story image
STM
Hands-on review: STM ChargeTreeGo portable wireless charger
We get our hands on the ultimate charging accesory for roadwarriors with a bunch of Apple devices.
Story image
Gaming
Game review: Wreckfest (Nintendo Switch)
Wreckfest is a fun racing game that came out for multiple different gaming platforms a few years ago. One of the best things about the game is that it's relatively cheap to buy if you own a PS4 or Xbox One console.
Story image
Gaming
Hands-on review - Xbox Cloud Gaming
I've had the opportunity not just to access the game pass but also its new shiny feature, Xbox Cloud Gaming. In this review, we'll be deep-diving into just what Xbox Cloud Gaming is, how it works and, well, if it works.
Story image
Wireless
Hands-on review: Jabra Engage 55 wireless headset
We get our hands on a German design professional headset that many knowledge workers could benefit from.
Story image
Projector
Hands-on review: BenQ GV30 portable projector
The BenQ GV30 is a portable projector that excels in many aspects but comes up short in a couple of others.
Story image
Gaming
Hands-on review: SteelSeries Arctis Nova Pro gaming headset
SteelSeries, being no stranger to creating premium gaming peripherals, sent over its Arctis Nova Pro wired headset kit for us to take a look at.
Story image
Gaming
Everything we know so far about NBA 2K23
As excitement for the next iteration of 2K Games’ NBA basketball series builds, some new information on the upcoming game, NBA 2K23, has been released.
Story image
Review
Hands-on review: TCL 30 SE mobile phone
TCL continues to provide consumers with budget phones that still pack a punch with the TCL 30 SE mobile phone. 
Story image
Wireless
Wave Audio delivers ultimate immersion with new wireless earbuds
Wave Audio, one of Australia's best new audio brands, has recently released a set of landmark noise-cancelling true wireless earbuds, the Immersive Pro.
Story image
Smartphone
Xreart Studio - Turning old masterpieces into new ones
Xreart now specialises in transforming pre-loved smartphones, smartwatches and handheld game consoles into artistic conversation starters for your office, studio or man cave.