{"id":37921,"date":"2020-03-13T10:37:36","date_gmt":"2020-03-13T02:37:36","guid":{"rendered":"http:\/\/www.upgrademag.com\/web\/?p=37921"},"modified":"2020-03-13T10:42:52","modified_gmt":"2020-03-13T02:42:52","slug":"february-2020s-most-wanted-malware-rise-in-exploits-spreading-mirai-botnet-to-iot-devices","status":"publish","type":"post","link":"http:\/\/www.upgrademag.com\/web\/2020\/03\/13\/february-2020s-most-wanted-malware-rise-in-exploits-spreading-mirai-botnet-to-iot-devices\/","title":{"rendered":"February 2020\u2019s most wanted malware: Rise in exploits spreading Mirai botnet to IoT devices"},"content":{"rendered":"

February saw a large increase in exploits targeting a vulnerability to spread the Mirai botnet, which is notorious for infecting IoT devices and conducting massive DDoS attacks, according to Check Point Research, the Threat Intelligence arm of Check Point Software Technologies Ltd.<\/a>, provider of cyber security solutions.<\/p>\n

The vulnerability, known as the \u201cPHP php-cgi Query String Parameter Code Execution\u201d exploit, ranked 6th in the top exploited vulnerabilities and impacted 20% of organisations worldwide, compared to just 2% in January 2020.<\/p>\n

The research team is also warning organizations that Emotet, the second most popular malware this month and the most widespread botnet operating currently, has been spreading using two new vectors during February.\u00a0 The first vector was an SMS Phishing (smishing) campaign targeting users in the U.S.: the SMS impersonates messages from popular banks, luring victims to click a malicious link which downloads Emotet to their device. The second vector is Emotet detecting and leveraging nearby Wi-Fi networks to spread via brute force attacks using a range of commonly-used Wi-Fi passwords.\u00a0 Emotet is primarily used as a distributor of ransomware or other malicious campaigns.<\/p>\n

Emotet impacted 7% of organizations globally in February, down from 13% in January, when it was being spread via spam campaigns including Coronavirus-themed campaigns.\u00a0 This highlights how quickly cyber-criminals change the themes of their attacks to try and maximize infection rates.<\/p>\n

\u201cAs we saw in January, the most impactful threats and exploits during February were versatile malware such as XMRig and Emotet.\u00a0 Criminals seem to be aiming to build the largest possible networks of infected devices, which they can then exploit and monetize in a range of different ways, from ransomware delivery to launching DDoS attacks,\u201d said Maya Horowitz, Director, Threat Intelligence & Research, Products at Check Point. \u201cAs the main infection vectors are emails and SMS messages, organizations should ensure their employees are educated about how to identify different types of malicious spam, and deploy security that actively prevents these threats from infecting their networks.\u201d<\/p>\n

Top malware families<\/b><\/p>\n

*The arrows relate to the change in rank compared to the previous month.<\/i><\/p>\n

This month, XMRig<\/b> moved up to first place, impacting 7% of organizations globally, followed by Emotet <\/b>and Jsecoin <\/b>impacting 6% and 5% of organizations worldwide respectively.<\/p>\n

1 \u2191 XMRig <\/b>– XMRig is an open-source CPU mining software used for mining the Monero cryptocurrency, and was first seen in-the-wild on May 2017.<\/p>\n

2 \u2193 Emotet<\/b> \u2013 Emotet is an advanced, self-propagating and modular Trojan. Emotet used to be primarily a banking Trojan, but recently has been used as a distributor of other malware or malicious campaigns. It uses multiple methods for maintaining persistence, and evasion techniques to avoid detection. In addition, it can be spread through phishing spam emails containing malicious attachments or links.<\/p>\n

3 \u2191Jsecoin <\/b>– Jsecoin is a web-based crypto-miner designed to perform online mining of Monero cryptocurrency when a user visits a particular web page. The implanted JavaScript uses a large amount of the end user machines\u00bf computational resources to mine coins, thus impacting the system performance.<\/p>\n

Top exploited vulnerabilities<\/b><\/p>\n

This month, the \u201cMVPower DVR Remote Code Execution\u201d remained the most common exploited vulnerability, impacting 31% of organizations globally, closely followed by \u201cOpenSSL TLS DTLS Heartbeat Information Disclosure\u201d with a global impact of 28%.\u00a0 In the 3rd place \u201cPHP DIESCAN information disclosure\u201d vulnerability impacting 27% of organizations worldwide.<\/p>\n

1 ↔ MVPower DVR Remote Code Execution<\/b> – A remote code execution vulnerability exists in MVPower DVR devices. A remote attacker can exploit this weakness to execute arbitrary code in the affected router via a crafted request.<\/p>\n

2 \u2191 OpenSSL TLS DTLS Heartbeat Information Disclosure (CVE-2014-0160; CVE-2014-0346)<\/b> – An information disclosure vulnerability exists in OpenSSL. The vulnerability is due to an error when handling TLS\/DTLS heartbeat packets. An attacker can leverage this vulnerability to disclose memory contents of a connected client or server.<\/p>\n

3 ↔<\/b> PHP DIESCAN information disclosure <\/b>– An information disclosure vulnerability has been reported in the PHP pages. Successful exploitation could lead to the disclosure of sensitive information from the server.<\/p>\n

Top malware families- Mobile<\/b><\/p>\n

This month xHelper<\/b> retained the 1st place in the most prevalent mobile malware, followed by Hiddad <\/b>and Guerrilla<\/b>.<\/p>\n

1 ↔<\/b>\u00a0 xHelper- <\/b>A malicious application seen in the wild since March 2019, used for downloading other malicious apps and display advertisement. The application is capable of hiding itself from the user and reinstall itself in case it was uninstalled.<\/p>\n

2 \u2191<\/b>\u00a0 Hiddad <\/b>– Hiddad is an Android malware which repackages legitimate apps and then releases them to a third-party store. Its main function is to display ads, but it can also gain access to key security details built into the OS.<\/p>\n

3 \u2193<\/b>\u00a0 Guerrilla<\/b>– Guerrilla is an Android Trojan found embedded in multiple legitimate apps and is capable of downloading additional malicious payloads. Guerrilla generates fraudulent ad revenue for the app developers.\u00a0<\/b><\/p>\n

Check Point\u2019s Global Threat Impact Index and its ThreatCloud Map is powered by Check Point\u2019s ThreatCloud intelligence, the largest collaborative network to fight cybercrime which delivers threat data and attack trends from a global network of threat sensors. The ThreatCloud database inspects over 2.5 billion websites and 500 million files daily, and identifies more than 250 million malware activities every day.<\/p>\n","protected":false},"excerpt":{"rendered":"

February saw a large increase in exploits targeting a vulnerability to spread the Mirai botnet, which is notorious for infecting IoT devices and conducting massive DDoS attacks, according to Check Point Research, the Threat Intelligence arm of Check Point Software Technologies Ltd., provider of cyber security solutions. The vulnerability, known as the \u201cPHP php-cgi Query […]<\/p>\n","protected":false},"author":1,"featured_media":35537,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[19],"tags":[173,7071,6151,3216,6926],"class_list":["post-37921","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-headlines","tag-botnet","tag-check-point-research","tag-high-tech","tag-iot","tag-mirai"],"_links":{"self":[{"href":"http:\/\/www.upgrademag.com\/web\/wp-json\/wp\/v2\/posts\/37921","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/www.upgrademag.com\/web\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/www.upgrademag.com\/web\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/www.upgrademag.com\/web\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/www.upgrademag.com\/web\/wp-json\/wp\/v2\/comments?post=37921"}],"version-history":[{"count":0,"href":"http:\/\/www.upgrademag.com\/web\/wp-json\/wp\/v2\/posts\/37921\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"http:\/\/www.upgrademag.com\/web\/wp-json\/wp\/v2\/media\/35537"}],"wp:attachment":[{"href":"http:\/\/www.upgrademag.com\/web\/wp-json\/wp\/v2\/media?parent=37921"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/www.upgrademag.com\/web\/wp-json\/wp\/v2\/categories?post=37921"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/www.upgrademag.com\/web\/wp-json\/wp\/v2\/tags?post=37921"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}