Trickbot remains top malware impacting NZ - report

Trickbot maintains its position as the top malware impacting New Zealand organisations in September, according to the latest news from Check Point Research.

CPR observed a concerning increase of various malware impacting New Zealanders, with 16 additional malware families tied at tenth place for the month.

Top 10 Malware in New Zealand for September:

Trickbot, 1.53% (percentage of New Zealand cyber incident cases impacted by this specific malware)
Trickbot is a modular Botnet and Banking Trojan that targets the Windows platform, mostly delivered via spam campaigns or other malware families such as Emotet. Trickbot sends information about the infected system and can also download and execute arbitrary modules from a large array of available modules: from a VNC module for remote control, to an SMB module for spreading within a compromised network. Once a machine is infected, the Trickbot gang, the threat actors behind this malware, utilise this wide array of modules not only to steal banking credentials from the target PC, but also for lateral movement and reconnaissance on the targeted organisation itself, prior to delivering a company-wide targeted ransomware attack.

AgentTesla, 1.15% (percentage of New Zealand cyber incident cases impacted by this specific malware)
AgentTesla is an advanced RAT (remote access Trojan) that functions as a keylogger and password stealer. Active since 2014, AgentTesla can monitor and collect the victim's keyboard input and system clipboard, and can record screenshots and exfiltrate credentials entered for a variety of software installed on the victim's machine (including Google Chrome, Mozilla Firefox and Microsoft Outlook email client). AgentTesla is openly sold as a legitimate RAT with customers paying $15 - $69 for user licenses.

Maze, 0.76% (percentage of New Zealand cyber incident cases impacted by this specific malware)
Maze is a ransomware, discovered in mid-2019 and was the first ransomware to practice the double extortion strategy. Maze operators opened a dedicated webpage where, in addition to encrypting victim's data, they started publishing stolen sensitive data from victims who refused to pay the ransom. Many other threat groups followed this strategy.

Barys, 0.76% (percentage of New Zealand cyber incident cases impacted by this specific malware)
Barys is a Trojan Downloader - it is programmed to allow its operators to download and upload files to a victim's computer in a way that is transparent to the victim.Features of the trojan include implementation of the Dropbox online file storage service, and it can be delivered to users via spam campaigns or bundled with free program installers that are published on suspicious websites.

Lokibot, 0.76% (percentage of New Zealand cyber incident cases impacted by this specific malware)
First identified in February 2016, LokiBot is an infostealer with versions for both the Windows and Android OS. It harvests credentials from a variety of applications, web browsers, email clients, IT administration tools such as PuTTY and more. LokiBot is sold on hacking forums and it is believed that its source code was leaked, thus allowing numerous variants to appear. Since late 2017, some Android versions of LokiBot include ransomware functionality in addition to their infostealing capabilities.

Spelevoek, 0.76% (percentage of New Zealand cyber incident cases impacted by this specific malware)
The Spelevo Exploit Kit is a program that the attackers use to gain access to remote computers. The Spelevo Exploit Kit is designed to identify vulnerable computers by searching for enabled macro functionality. The hackers employ the Spelevo Exploit Kit and trigger a software vulnerability in the VBScript engine on Windows that is dubbed by security researchers as CVE-2018-15982.

Icedid, 0.38% (percentage of New Zealand cyber incident cases impacted by this specific malware)
IcedID is a banking Trojan which first emerged in September 2017. It usually uses other well-known banking Trojans, including Emotet, Ursnif and Trickbot, to help it spread. IcedID steals user financial data via both redirection attacks (installs a local proxy to redirect users to fake-clone sites) and web injection attacks (injects a browser process to present fake content overlaid on top of the original page).

Azorult, 0.38% (percentage of New Zealand cyber incident cases impacted by this specific malware)
AZORult is a Trojan that gathers and exfiltrates data from the infected system. Once the malware is installed on a system (typically delivered by an Exploit Kit such as RIG), it can send saved passwords, local files, crypto-wallet data, and computer profile information to a remote C-C server. The Gazorp builder, available on the Dark Web, allows anyone to host an Azorult C-C server with moderately low effort.

Crackonosh, 0.38% (percentage of New Zealand cyber incident cases impacted by this specific malware)
Crackonosh is a miner malware that was injected into popular software products that had been cracked and made available on distribution platforms known for hosting pirated software. In order to open up a large number of potential victims, the threat operators weaponize cracked video games. Once Crackonosh is initiated, it would replace essential Windows services. The threat is also equipped with anti-detection routines and can delete anti-malware solutions from the compromised system.

The following malware families were also tied in tenth place, each impacting 0.38% of New Zealand cyber incident cases, including: Vosteran, Dirtymoe, Dothetuk, Em, Flubot, Lockbit, Hellokitty, Sohanad, Tofsee, Yakes, Njrat, Purple Fox, Remcos, Scrinject, Seraph and Formbook.