IT Pro is supported by its audience. When you purchase through links on our site, we may earn an affiliate commission. Learn more

Decade-old malware strains top annual list of most pervasive business exploits

Allied cyber security authorities say the most active strains of 2021 have been in operation for longer than five years, and are being constantly developed

US and Australian cyber security authorities have jointly revealed the top malware strains that targeted organisations in 2021, with two of them in operation for longer than a decade.

The US’ CISA and Australia’s ACSC said the most pervasive strains included remote access trojans (RATs), banking trojans, information stealers, and ransomware.

Qakbot and Ursnif are two of the top strains that have been in operation for the longest. Both authorities said this is because they have been under active development, with operators consistently adding new capabilities and methods to evade detection.

Most strains in the list have been in operation for longer than five years and their respective codebases evolved over that time into various variations.

The most prolific of the bunch, the authorities said, were stealers of financial or personal information, and ransomware.

The top 11 malware strains of 2021

Malware strain

Type of malware

Active since

Delivery method

Agent Tesla

Information stealer, RAT

2014

Phishing (attachments)

AZORult

Information stealer

2016

Phishing, exploit kits, infected websites

Formbook

Information stealer

2016

Phishing (attachments)

Ursnif

Banking trojan

2007

Phishing (attachments)

LokiBot

Trojan, information stealer

2015

Phishing (attachments)

MOUSEISLAND

Macro downloader

2019

Phishing (attachments)

NanoCore

RAT

2013

Phishing (attachments), cloud storage

Qakbot

Multi-use trojan

2007

Phishing (attachments, hyperlinks, embedded images)

Remcos

RAT

2016

Phishing (attachments)

Trickbot

Trojan

2016

Phishing (hyperlink)

GootLoader

Malware loader

2020

Compromised websites

Overview of 2021's most pervasive malware strains

Agent Tesla

Around since 2014, the powerful tool can be used to steal information from email clients, web browsers, and file transfer protocol (FTP) servers, as well as capture screenshots and video from a desktop environment. 

AZORult

An information stealer that can be found available on underground hacking forums, AZORult is under constant development, the authorities said, and its capabilities include stealing browser data, user credentials, and cryptocurrency information.

Formbook

Formbook is a malware strain that's consistently changed, according to the latest threats published in the common vulnerabilities and exposures (CVS) list, aiming to infect systems that have been left unpatched to the latest threats.

It's capable of keylogging and capturing passwords, and has been used in a variety of attacks in the past year such as those specifically targeting corporate email inboxes.

Ursnif

The banking Trojan Ursnif has been around since 2007, tying with Qakbot as the longest-running malware strain on the list. It has evolved to adopt a persistence mechanism, meaning that it can live on a system after it has rebooted, and can also avoid sandboxes and virtual machines, the authorities said.

Lokibot

This Trojan is designed to various types of steal sensitive information, such as user credentials and those to access cryptocurrency wallets. In circulation since 2015, it had a notable variant in 2020 that disguised itself as a launcher for the popular video game Fortnite.

MOUSEISLAND

This is one that's likely to drop off the list next year now Microsoft has blocked VBA macros by default, but the macro downloader has been prolific since 2019 and is thought to be used in the initial stages of some ransomware attacks.

NanoCore

The RAT NanoCore can allow attackers to spy on victims through webcams while also doubling as a stealer of passwords and emails. It's one of the oldest strains on the list beginning operation in 2013.

Qakbot

Qakbot was originally a banking Trojan, but since its 2007 inception, its capabilities have evolved to include data exfiltration and the capacity to deliver other malicious payloads. It’s modular in nature, allowing attackers to tailor its capabilities to their needs.

Remcos

A lexical blend that’s short for Remote Control and Surveillance, Remcos is presented as a legitimate penetration testing tool but has been abused by cyber attackers, much like Cobalt Strike and more recently Brute Ratel C4. It can steal personal data and login credentials, and was used heavily in COVID-19-themed phishing campaigns.

TrickBot

This Trojan is thought to be operated and maintained by a sophisticated threat group, and has been used in the past as the initial exploit to deploy Conti and Ryuk ransomware. It has also been used against healthcare organisations to steal data and disrupt services.

Gootloader

Around since 2020 and now a multi-payload malware platform, Gootloader has evolved in recent years from a simple malware loader, typically associated with GootKit malware. It often provides attackers with the initial access exploit, usually via search engine poisoning.

What mitigations can your business deploy?

The authorities recommend reviewing and implementing all the necessary mitigations to defend against these malware strains - the ones targeting businesses the most.

The full list of instructions can be found in the complete joint advisory issued by CISA and ACSC this week, but recommendations include updating software against known vulnerabilities, enforcing the use of multi-factor authentication (MFA) across the organisations, monitor use of remote desktop protocol and maintain offline backups of data.

Featured Resources

The Total Economic Impact™ Of Turbonomic Application Resource Management for IBM Cloud® Paks

Business benefits and cost savings enabled by IBM Turbonomic Application Resource Management

Free Download

The Total Economic Impact™ of IBM Watson Assistant

Cost savings and business benefits enabled by Watson Assistant

Free Download

The field guide to application modernisation

Moving forward with your enterprise application portfolio

Free Download

AI for customer service

Discover the industry-leading AI platform that customers and employees want to use

Free Download

Recommended

Ransomware now strikes one in 40 organisations per week, Check Point finds
ransomware

Ransomware now strikes one in 40 organisations per week, Check Point finds

27 Jul 2022
Darktrace AI’s Antigena helps stop ransomware attack at Dordogne GHT
ransomware

Darktrace AI’s Antigena helps stop ransomware attack at Dordogne GHT

13 Apr 2022
Sabbath hackers are targeting US schools and hospitals
ransomware

Sabbath hackers are targeting US schools and hospitals

29 Nov 2021
US government warns of increased risk of ransomware over holiday season
ransomware

US government warns of increased risk of ransomware over holiday season

24 Nov 2021

Most Popular

Why convenience is the biggest threat to your security
Sponsored

Why convenience is the biggest threat to your security

8 Aug 2022
UK water supplier confirms hack by Cl0p ransomware gang
ransomware

UK water supplier confirms hack by Cl0p ransomware gang

16 Aug 2022
How to boot Windows 11 in Safe Mode
Microsoft Windows

How to boot Windows 11 in Safe Mode

29 Jul 2022