November 2020’s Most Wanted Malware: Notorious Phorpiex Botnet Returns As Most Impactful Infection

By : Krishna Anindyo | Thursday, December 10 2020 - 11:00 IWST

Ilustration November Most Wanted Malware (Photo by Check Point Software)
Ilustration November Most Wanted Malware (Photo by Check Point Software)

INDUSTRY.co.id - Singapore – Check Point Research, the Threat Intelligence arm of Check Point Software Technologies Ltd. (NASDAQ: CHKP), a leading provider of cyber security solutions globally, has published its latest Global Threat Index for November 2020.

Showing a new surge in infections by the well-known Phorpiex botnet which has made it the month’s most prevalent malware, impacting 4% of organisations globally. Phorpiex was last seen in the Threat Index’s top 10 in June this year. The Phorpiex botnet was first reported in 2010, and at its peak controlled more than a million infected hosts.

Known for distributing other malware families via spam as well as fueling large-scale “sextortion” spam campaigns and cryptomining, Phorpiex has again been distributing the Avaddon ransomware, as Check Point researchers originally reported earlier this year.

Avaddon is a relatively new Ransomware-as-a-Service (RaaS) variant, and its operators have again been recruiting affiliates to distribute the ransomware for a cut of the profits. Avaddon has been distributed via JS and Excel files as part of malspam campaigns and is able to encrypt a wide range of file types.

“Phorpiex is one of the oldest and most persistent botnets, and has been used by its creators for many years to distribute other malware payloads such as GandCrab and Avaddon ransomware, or for sextortion scams. This new wave of infections is now spreading another ransomware campaign, which shows just how effective a tool Phorpiex is,” said Maya Horowitz, Director, Threat Intelligence & Research, Products at Check Point.

“Organizations should educate employees about how to identify potential malspam and to be wary of opening unknown attachments in emails, even if they appear to come from a trusted source. They should also ensure they deploy security that actively prevents them from infecting their networks,” Maya Horowitz added.

The research team also warns that “HTTP Headers Remote Code Execution (CVE-2020-13756)” is the most common exploited vulnerability, impacting 54% of organisations globally, followed by “MVPower DVR Remote Code Execution” impacted 48% of organisations worldwide and “Dasan GPON Router Authentication Bypass (CVE-2018-10561) impacted 44% of organisations globally.

Top malware families

The arrows relate to the change in rank compared to the previous month

This month, Phorpiex is the most popular malware with a global impact of 4% of organisations, closely followed by Dridex and Hiddad which both impacted 3% of organisations worldwide.

Phorpiex – Phorpiex is a botnet known for distributing other malware families via spam campaigns as well as fueling large scale Sextortion campaigns.

Dridex - Dridex is a Trojan that targets the Windows platform and is reportedly downloaded via a spam email attachment. Dridex contacts a remote server and sends information about the infected system. It can also download and execute arbitrary modules received from the remote server.

Hiddad – Hiddad is an Android malware infection which repackages legitimate mobile apps and then releases them to a third-party store. Its main function is to display ads, but it can also gain access to key security details built into the OS.

Top exploited vulnerabilities

This month “HTTP Headers Remote Code Execution (CVE-2020-13756)” is the most common exploited vulnerability, impacting 54% of organisations globally, followed by “MVPower DVR Remote Code Execution” impacted 48% of organisations worldwide and “Dasan GPON Router Authentication Bypass (CVE-2018-10561) impacted 44% of organisations globally.

HTTP Headers Remote Code Execution (CVE-2020-13756) – HTTP headers let the client and the server pass additional information with an HTTP request. A remote attacker may use a vulnerable HTTP Header to run arbitrary code on the victim machine.

MVPower DVR Remote Code Execution – remote code execution vulnerability exists in MVPower DVR devices. A remote attacker can exploit this weakness to execute arbitrary code in the affected router via a crafted request.

Dasan GPON Router Authentication Bypass (CVE-2018-10561) – An authentication bypass vulnerability that exists in Dasan GPON routers. Successful exploitation of this vulnerability would allow remote attackers to obtain sensitive information and gain unauthorised access into the affected system.

Top Mobile Malware

This month Hiddad remains the most prevalent Mobile malware, followed by xHelper and Lotoor.

Hiddad – Hiddad is an Android malware infection which repackages legitimate apps and then releases them to a third-party store. Its main function is to display ads, but it can also gain access to key security details built into the OS.

xHelper – xHelper is a malicious application seen in the wild since March 2019, used for downloading other malicious apps and display advertisement. The application is capable of hiding itself from the user and reinstalling itself in case it is uninstalled.

Lotoor – Lotoor is a hack tool that exploits vulnerabilities on Android operating system in order to gain root privileges on compromised mobile devices.

Check Point’s Global Threat Impact Index and its ThreatCloud Map is powered by Check Point’s ThreatCloud intelligence, the largest collaborative network to fight cybercrime which delivers threat data and attack trends from a global network of threat sensors.

The ThreatCloud database inspects over 2.5 billion websites and 500 million files daily, and identifies more than 250 million malware activities every day.

News Comment

Today's Industry

Citibank

Minggu, 18 April 2021 - 22:10 WIB

Citi Indonesia Reiterates Commitment to Customers During Sale Process of The Consumer Bank Business

Citi today reaffirmed there would be no immediate change to how it serves its local consumer bank customers, as it commences the sale process of its Indonesian consumer business, following the…

Indonesia Port

Sabtu, 17 April 2021 - 06:05 WIB

Indonesia's Export Value in March 2021 is Higher than February

Statistics Indonesia (BPS) released value of Indonesia's exports in March 2021 which reached US$18.35 billion, an increase of 20.31% compared to exports in February 2021, as well as compared…

Minister of Manpower Ida Fauziyah

Sabtu, 17 April 2021 - 05:10 WIB

Manpower Minister Urges BPJS Kesehatan to Speed Up Integration of JKP Beneficiaries’ Data

Minister of Manpower Ida Fauziyah has urged the Health Care and Social Security Agency (BPJS Health) to accelerate the integration of membership data for the social security program of laid-off…

Satgas COVID-19

Sabtu, 17 April 2021 - 04:19 WIB

COVID-19 Task Force Asks Regional Governments to Firmly Enforce Regulations on Eid Homecoming

The COVID-19 Handling Task Force through its spokesperson Wiku Adisasmito reminded regional governments to enforce the rules set by the Government in the Circular of Head of the COVID-19 Handling…

Minister of Villages, Development of Disadvantaged Regions and Transmigration Abdul Halim Iskandar

Sabtu, 17 April 2021 - 03:12 WIB

Gov’t Has Disbursed Village Funds to 34,053 Villages: Minister

The Government has disbursed Rp 11.361 trillion of Village Fund as of 12 April 2021, according to Minister of Villages, Development of Disadvantaged Regions and Transmigration Abdul Halim Iskandar.