September 2023’s most wanted malware: Formbook takes top spot in India

Last month also saw Qbot drop from the top malware list entirely after the FBI seized control of the botnet in August.

Check Point Software Technologies Ltd, a provider of cybersecurity solutions globally, has published its Global Threat Index for September 2023. Researchers reported on a new stealth phishing campaign targeted Colombian businesses, designed to discreetly deliver the Remcos Remote Access Trojan (RAT). Meanwhile, Formbook took first place as the most prevalent malware following the collapse of Qbot, and Education remains the most targeted industry. Infact, Formbook had a 6.08% impact on India. The threat index revealed Healthcare followed by Education/Research, and Utilities became the most attacked industries in India.

In September, Check Point Research uncovered a significant phishing campaign that targeted more than 40 prominent companies across multiple industries in Colombia. The objective was to stealthily install the Remcos RAT on the victim’s computers. Remcos, which was the second most prevalent malware in September, is a sophisticated “Swiss Army Knife” RAT that grants full control over the infected computer and can be used in a variety of attacks. Common consequences of a Remcos infection include data theft, follow-up infections, and account takeover.

Last month also saw Qbot drop from the top malware list entirely after the FBI seized control of the botnet in August. This marks the end of a long run as the most prevalent malware, having topped the chart for most of 2023.

"The campaign that we uncovered in Colombia offers a glimpse into the intricate world of evasion techniques employed by attackers. It is also a good illustration of how invasive these techniques are and why we need to employ cyber resilience to guard against a variety of attack types”, said Maya Horowitz, VP Research at Check Point Software.

CPR also revealed that “Web Servers Malicious URL Directory Traversal” was the most exploited vulnerability last month, impacting 47% of organizations globally, followed by “Command Injection Over HTTP” with 42% and “Zyxel ZyWALL Command Injection” on 39%.

Top malware families

*The arrows relate to the change in rank compared to the previous month.

Formbook was the most prevalent malware last month with an impact of 3% on worldwide organizations, followed by Remcos with a global impact of 2%, and Emotet with a global impact of 2%.

1. ↑ Formbook – Formbook is an Infostealer targeting the Windows OS first detected in 2016. It is marketed as Malware as a Service (MaaS) in underground hacking forums for its strong evasion techniques and relatively low price. Formbook harvests credentials from various web browsers, collects screenshots, monitors and logs keystrokes, and can download and execute files according to orders from its C&C.

2. ↑ Remcos – Remcos is a Remote Access Trojan (RAT) that first appeared in the wild in 2016. Remcos distributes itself through malicious Microsoft Office documents, which are attached to SPAM emails, and is designed to bypass Microsoft Windows UAC security and execute malware with high-level privileges.

3. ↑ Emotet - Emotet is an advanced, self-propagating and modular Trojan. Emotet, once employed as a banking Trojan, has recently been used as a distributor of other malware or malicious campaigns. It uses multiple methods for maintaining persistence and evasion techniques to avoid detection. In addition, it can be spread through phishing spam emails containing malicious attachments or links.

Top Attacked Industries Globally

Last month Education/Research remained in first place as the most attacked industry globally, followed by Communications and Government/Military.

1. Education/Research
2. Communications
3. Government/Military

Top exploited vulnerabilities

Last month, “Web Servers Malicious URL Directory Traversal” was the most exploited vulnerability, impacting 47% of organizations globally, followed by “Command Injection Over HTTP” with 42% and “Zyxel ZyWALL Command Injection” on 39%.

1. ↑ Web Servers Malicious URL Directory Traversal (CVE-2010-4598,CVE-2011-2474,CVE-2014-0130,CVE-2014-0780,CVE-2015-0666,CVE-2015-4068,CVE-2015-7254,CVE-2016-4523,CVE-2016-8530,CVE-2017-11512,CVE-2018-3948,CVE-2018-3949,CVE-2019-18952,CVE-2020-5410,CVE-2020-8260) - There is a directory traversal vulnerability on different web servers. The vulnerability is due to an input validation error in a web server that does not properly sanitize the URI for the directory traversal patterns. Successful exploitation allows unauthenticated remote attackers to disclose or access arbitrary files on the vulnerable server.

2. ↔ Command Injection Over HTTP (CVE-2021-43936, CVE-2022-24086) - A command Injection over HTTP vulnerability has been reported. A remote attacker can exploit this issue by sending a specially crafted request to the victim. Successful exploitation would allow an attacker to execute arbitrary code on the target machine.

3. ↑ Zyxel ZyWALL Command Injection (CVE-2023-28771) - A command injection vulnerability exists in Zyxel ZyWALL. Successful exploitation of this vulnerability would allow remote attackers to execute arbitrary OS commands in the effected system.

Top Mobile Malwares

Last month Anubis remained in the top spot as the most prevalent Mobile malware, followed by AhMyth and SpinOk.

1. Anubis – Anubis is a banking Trojan malware designed for Android mobile phones. Since it was initially detected, it has gained additional functions including Remote Access Trojan (RAT) functionality, keylogger, audio recording capabilities and various ransomware features. It has been detected on hundreds of different applications available in the Google Store.

2. AhMyth - AhMyth is a Remote Access Trojan (RAT) discovered in 2017. It is distributed through Android apps that can be found on app stores and various websites. When a user installs one of these infected apps, the malware can collect sensitive information from the device and perform actions such as keylogging, taking screenshots, sending SMS messages, and activating the camera, which is usually used to steal sensitive information.

3. SpinOk - SpinOk is an Android software module that operates as spyware. It collects information about files stored on devices and is capable of transferring them to malicious threat actors. The malicious module was found present in more than 100 Android apps and was downloaded more than 421,000,000 times as of May 2023.