Updated Emotet toolkit ends 2020 as most dangerous malware
The banking trojan has climbed back to the top of Check Point's Global Threat Index
The Emotet Trojan was used to target over 100,000 users per day over December, placing it at the top of a list of the most dangerous malware threats facing businesses today.
That's according to a new global index from security research firm Check Point, which revealed the malware has impacted 7% of organisations around the world during the last month of 2020, closely followed by banking trojan Trickbot and information-stealing virus Formbook, both impacting 4% of global companies.
Is mobile malware really a risk? What is malware? What is ransomware?
All three viruses made a return to the index for December, although the sudden uptake of Emotet should be a cause for concern among businesses, Check Point has warned. It was originally developed as a banking malware, sneaking onto a target's computer to steal sensitive information, but it has since evolved into one of the most costly and destructive malware variants available, according to Maya Horowitz, director of threat intelligence and research products at Check Point.
"It's imperative that organisations are aware of the threat Emotet poses and that they have robust security systems in place to prevent a significant breach of their data," said Horowitz.
Emotet was at the top of the Global Threat Index in September and October, and is best known as being a tool for opening access to infected computers for further ransomware operations. It is also thought to have been used by the criminal group known as Ryuk, said to be responsible for a number of attacks on healthcare facilities throughout the autumn.
Researchers believe that a brief lull in activity during November was the moment the Emotet malware was updated with new payloads and improved detection capabilities. The Check Point team believes the malware is now far more dangerous as a result.
The same is true for Hiddad, an Android malware variant which repackages legitimate apps and then releases them to a third-party store. Its main function is to display ads, but it can also gain access to key security details built into the operating system.
The most exploited vulnerability of the month was the MVPower DVR Remote Code Execution flaw, which affected 42% of organisations around the world during the month.
-
AI demand driving up Apple prices, says CookNews Tim Cook says that rising component costs mean consumers have to pay more
-
Kaseya unveils open AI platform as it shifts focus from acquisitions to integrationKaseya has detailed the next phase of its AI strategy, centred on an open platform designed to connect data across its portfolio, automate routine IT operations, and help MSPs deliver more value-added services
-
Ransomware cartels are fragmenting into volatile splinter groups, warns Met Police cyber chiefNews Commoditized "cyber crime bazaars" and AI data mining are forcing law enforcement to rewrite its playbook
-
New ransomware threat group, The Gentlemen, has become one of the most active ransomware operators, accounting for 10% of all attacksNews NTT researchers warn that the RaaS group is leveraging SystemBC malware to establish covert tunnelling, evade detection, and support rapid lateral movement across enterprise environments
-
Instructure chose to a pay ransom following the Canvas cyber attack – research shows more than half of security leaders would follow suitAnalysis Opting to pay ransoms creates huge risks for enterprises – you’re relying on the word of criminals
-
Ransomware negotiator sentenced for role in major cyber crime groupNews Deniss Zolotarjovs was a key player in a group associated with Conti
-
Threat actors ditch ‘spray and pray’ attacks in shift to targeted exploitationNews A dip in ransomware volumes points to a more targeted approach focused on vulnerability exploitation
-
Security leaders overconfident about ransomware recovery
News Few manage to recover all their data, and many experience business disruption
-
German authorities want your help finding the hackers behind GandCrab and REvilNews Daniil Maksimovich Shchukin and Anatoly Sergeevitsch Kravchuk are believed to have made millions from ransomware as a service schemes
-
The rise of teen hackers ‘makes for a good headline’, but cyber crime activities peak later in life
News With family responsibilities and mortgages to pay, it's not teenagers dishing out malware or carrying out cyber extortion
