Emotet returns to top the malware charts after a five month break

Following a five month absence, Emotet has returned to number one spot in the malware charts in the latest Global Threat Index for July from Check Point Research.

Since February 2020, Emotet's activities -- primarily sending waves of malspam campaigns -- started to slow down and eventually stopped, until re-emerging in July. This pattern echoes 2019 when the Emotet botnet ceased activity during the summer months but resumed in September.

In July, Emotet was spreading spam campaigns, infecting its victims with TrickBot and Qbot, which are used to steal banking credentials and spread inside networks. Some of the campaigns contained malicious doc file with names like 'form.doc' or 'invoice.doc'. According to researchers, the malicious document launches a PowerShell to pull the Emotet binary from remote websites and infect machines, adding them to the botnet. The resumption of Emotet's activities highlights the scale and power of the botnet globally.

"It's interesting that Emotet was dormant for several months earlier this year, repeating a pattern we first observed in 2019," says Maya Horowitz, director, threat intelligence and research, products at Check Point. "We can assume that the developers behind the botnet were updating its features and capabilities. But as it is active again, organizations should educate employees about how to identify the types of malspam that carry these threats and warn about the risks of opening email attachments or clicking on links from external sources. Businesses should also look at deploying anti-malware solutions that can prevent such content reaching end-users."

While Emotet is the most popular malware with a global impact of five percent of organizations, it's closely followed by the Dridex Trojan and Agent Tesla RAT affecting four percent of organizations each.

Topping the mobile charts is xHelper, a malicious application seen in the wild since March 2019, used for downloading other malicious apps and display advertisements. Second is the Necro Android Trojan Dropper and third PreAMo which generates income by clicking on ad banners.

You can see the full top 10 along with the most exploited vulnerabilties on the Check Point blog.

Photo Credit: Balefire / Shutterstock