Glupteba malware, an ambitious blockchain-enabled Trojan botnet, returned to the top-ten malware threat list in December 2022 for the first time since July 2022, moving into eighth place, according to Check Point Research's (CPR) Global Threat Index for December. Qbot, a sophisticated Trojan that steals banking credentials and keystrokes, overtook Emotet to be the most prevalent malware after its return last month, impacting 7% of organizations worldwide. Meanwhile, android malware Hiddad made a comeback among two other mobile malwares. And, in December, the education/research sector remained the most attacked industry globally, followed by government/military and then healthcare.

Although Google managed to cause major disruption to Glupteba operations in December 2021, it seems to have sprung back into action. As a modular malware variant, Glupteba can achieve various objectives on an infected computer. The botnet is often used as a downloader and dropper for other malware. This means that a Glupteba infection could lead to a ransomware infection, data breach or other security incident. Glupteba is also designed to steal user credentials and session cookies from infected machines. This authentication data can be used to gain access to a user’s online accounts or other systems, enabling the attacker to steal sensitive data or take other action using these compromised accounts. Finally, the malware is commonly used to deploy cryptomining functions on its target, draining a computer’s resources by using them to mine blocks.

In December, Hiddad also made the top-three mobile malware list for the first time in 2022. Hiddad is an ad-distributing malware, targeting android devices. It repackages legitimate apps and then releases them to a third-party store. Its main function is to display ads, but it can also gain access to key security details built into the OS.

CPR also revealed that “Web Server Exposed Git Repository Information Disclosure” was the most common exploited vulnerability, impacting 46% of organizations globally, followed by “Web Servers Malicious URL Directory Traversal,” with 44% of organizations impacted worldwide. “Command Injection Over HTTP” is the third most used vulnerability, with a global impact of 43%.

Top malware families

Qbot was the most prevalent malware last month with an impact of 7% worldwide organizations, followed by Emotet with a global impact of 4% and XMRig with a global impact of 3%.

1. Qbot: Qbot, also known as Qakbot, is a banking Trojan that first appeared in 2008. It was designed to steal a user’s banking credentials and keystrokes. Often distributed via spam email, Qbot employs several anti-VM, anti-debugging and anti-sandbox techniques to hinder analysis and evade detection.

2. Emotet: Emotet is an advanced, self-propagating and modular Trojan. Emotet used to be employed as a banking Trojan and recently was used as a distributor for other malware or malicious campaigns. With multiple methods for maintaining persistence and evasion techniques to avoid detection, it can be spread through phishing spam emails containing malicious attachments or links.

3. XMRig: XMRig is an open-source CPU mining software used to mine the Monero cryptocurrency. Threat actors often abuse this open-source software by integrating it into their malware to conduct illegal mining on victims’ devices.

Top mobile malwares

Last month Anubis remained the most prevalent mobile malware, followed by Hiddad and AlienBot.

1. Anubis: Anubis is a banking Trojan malware designed for Android mobile phones. Since it was initially detected, it has gained additional functions, including remote access Trojan (RAT) functionality, keylogger and audio recording capabilities as well as various ransomware features. It has been detected on hundreds of different applications available in the Google store.

2. Hiddad: Hiddad is an Android malware that repackages legitimate apps and then releases them to a third-party store. Its main function is to display ads, but it can also gain access to key security details built into the OS.

3. AlienBot: AlienBot is a banking Trojan for Android, sold underground as Malware-as-a-Service (MaaS). It supports keylogging, dynamic overlays for credentials theft and SMS harvesting for 2FA bypass. Additional remote-control capabilities are provided using a TeamViewer module.

The complete list of the top ten malware families in December can be found here.