The Recycler
  • G&G Feb 24 Masthead Banner
  • Biuromax Masthead web banner March 2024
  • Katun web banner December 2022 NEW

Emotet most seen malware family in Q1

May 13, 2022

HP Inc. announced that the HP Wolf Security threat research team has identified a 27-fold increase in detections resulting from Emotet malicious spam campaigns in Q1 2022, compared to Q4 2021, when Emotet first made its reappearance.

The latest global HP Wolf Security Threat Insights Report, which provides analysis of real-world cybersecurity attacks, shows that Emotet has bolted up 36 places to become the most common malware family detected this quarter (representing 9% of all malware captured). One of these campaigns, which was targeted at Japanese organisations and involved email thread hijacking to trick recipients into infecting their PCs, was largely responsible for an 879% increase in .XLSM (Microsoft Excel) malware samples captured compared to the previous quarter.

By isolating threats that have evaded detection tools and made it to user endpoints, HP Wolf Security has specific insight into the latest techniques being used by cybercriminals.

Notable examples include:

  • Stealthy alternatives to malicious Microsoft Office documents growing popular, as macros start being phased out: As Microsoft has begun disabling macros, HP has seen a rise in non-office-based formats, including malicious Java Archive files (+476%) and JavaScript files (+42%) compared to last quarter. Such attacks are harder for organizations to defend against because detection rates for these file types are often low, increasing the chance of infection.
  • Signs indicate HTML smuggling on the rise: The median file size of HTML threats grew from 3KB to 12KB, suggesting a rise in the use of HTML smuggling, a technique where cybercriminals embed malware directly into HTML files to bypass email gateways and evade detection, before gaining access and stealing critical financial information. Recent campaigns were seen targeting Latin American and African banks.
  • “Two for One” malware campaign leads to multiple RAT infections: A Visual Basic script attack was found being used to kick start a kill chain resulting in multiple infections on the same device, giving attackers persistent access to victims’ systems with VW0rm, NjRAT and AsyncRAT.

“Our Q1 data shows this is by far the most activity we’ve seen from Emotet since the group was disrupted early in 2021 – a clear signal its operators are regrouping, building back their strength and investing in growing the botnet. Emotet was once described by CISA as among the most destructive and costly malware to remediate and its operators often collaborate with ransomware groups, a pattern we can expect to continue. So their re-emergence is bad news for businesses and public sector alike,” explained Alex Holland, Senior Malware Analyst, HP Wolf Security threat research team, HP Inc. “Emotet also continued to favour macro-enabled attacks – perhaps to get attacks in before Microsoft’s April deadline, or simply because people still have macros enabled and can be tricked into clicking on the wrong thing.”

The findings are based on data from many millions of endpoints running HP Wolf Security. HP Wolf Security tracks malware by opening risky tasks in isolated, micro-virtual Machines (micro-VMs) to protect the user and understand and capture the full attempted infection chain, mitigating threats that have slipped past other security tools. To date, HP customers have clicked on over 18 billion email attachments, web pages, and downloads with no reported breaches. This data provides unique insights into how threat actors use malware in the wild.

Further key findings in the report include:

  • 9% of threats hadn’t been seen before at the time they were isolated, with 14% of email malware isolated having bypassed at least one email gateway scanner.
  • It took over 3 days (79 hours), on average, to be known by hash to other security tools.
  • 45% of malware isolated by HP Wolf Security were Office file formats.
  • Threats used 545 different malware families in their attempts to infect organizations, with Emotet, AgentTesla and Nemucod being the top three.
  • A Microsoft Equation Editor exploit (CVE-2017-11882) accounted for 18% of all malicious samples captured.
  • 69% of malware detected was delivered via email, while web downloads were responsible for 18%. The most common attachments used to deliver malware were documents (29%), archives (28%), executables (21%), spreadsheets (20%).
  • The most common attachments used to deliver malware were spreadsheets (33%), executables and scripts (29%), archives (22%), and documents (11%).
  • The most common phishing lures were business transactions such as “Order”, “Payment”, “Purchase”, “Request” and “Invoice”.

“This quarter we saw a significant 27% rise in the volume of threats captured by HP Wolf Security. As cybercriminals tweak their approaches in response to changes in the IT landscape, the volume and variety of attacks continues to increase, and it becomes harder for conventional tools to detect attacks,” commented Dr. Ian Pratt, Global Head of Security for Personal Systems, HP Inc. “With an uptake in alternative file types and techniques being used to bypass detection, organisations need to change course and take a layered approach to endpoint security. By applying the principle of least privilege and isolating the most common threat vectors – from email, browsers, or downloads – rendering malware delivered via these vectors harmless. This dramatically reduces organisations’ risk exposure to cyber threats.”

By isolating threats that have evaded detection tools and made it to user endpoints, HP Wolf Security has specific insight into the latest techniques being used by cybercriminals.

Categories : Around the Industry

Tags : Cybersecurity HP Inc Malware Threats Wolf Security Report

  • Biuromax March 2024 Banner
  • Mito Web advert July 2023
  • IR Italiana Web ad January 2021
  • G&G Big & Bold Web banner January 2024
  • Cartridge Web April 2024 Web Banner
  • Ink Tank April 2024 Web Ads
  • GM Technology Web Ad March 2024
  • TN Core April 2024 Web Banner
  • Apex Web Banner April 2024
  • Static Control June 2022 Big & Bold Ad
  • Altkin Web ad March 2024
  • HYB Web banner Jan 2024
  • Denner Feb 2024 Web Ad
  • PCL April 2024 Web Banner
  • Zhono Web ad March 2024
  • ITP Web ad January 2021
  • CET Web ad December 2023
  • PCL April 2024 Web Banner
  • Altkin Web ad March 2024
  • Zhono Web ad March 2024
  • ITP Web ad January 2021
  • Denner Feb 2024 Web Ad
  • CET Web ad December 2023
  • HYB Web banner Jan 2024
  • HYB Web banner Jan 2024
  • Denner Feb 2024 Web Ad
  • CET Web ad December 2023
  • Altkin Web ad March 2024
  • PCL April 2024 Web Banner
  • ITP Web ad January 2021
  • Zhono Web ad March 2024

The Recycler, Wittas House, Two Rivers, Station Lane, Witney, OX28 4BH, United Kingdom | Tel: +44 (0) 1993 899800 | Fax : +44 (0) 1993 226899
©2006-2023 The Recycler - Terms & Conditions - Privacy Policy including cookie use

Web design Dorset | Websites by Mark

The Recycler Subscribe Web ad January 2021
The Recycler Subscribe Web ad January 2021