COVID-19 related spam campaigns distributing a new variant of the Agent Tesla remote access trojan: Study

The new variant of Agent Tesla has been modified to steal Wi-Fi passwords in addition to other information – such as Outlook email credentials – from target PCs

COVID-19 related spam campaigns distributing a new variant of the Agent Tesla remote access trojan: Study - CSO Forum

Several COVID-19 related spam campaigns are distributing a new variant of the Agent Tesla remote access trojan, moving it up to 3rd place in the Index, impacting 3% of organizations worldwide, according to Check Point Research’s Global Threat Index for April 2020.

The new variant of Agent Tesla has been modified to steal Wi-Fi passwords in addition to other information – such as Outlook email credentials – from target PCs. During April, Agent Tesla was distributed as an attachment in several malicious COVID-19 related spam campaigns, which attempt to lure the victim into downloading malicious files under the cover of providing interesting information about the pandemic. One of these campaigns claimed to be sent by the World Health Organization with the subject ‘URGENT INFORMATION LETTER: FIRST HUMAN COVID-19 VACCINE TEST/RESULT UPDATE.’  This highlights how hackers will exploit global news events and public concerns to increase their attack success rates.

The well-known banking trojan Dridex, which entered the Threat Index top ten for the first time in March, had an even greater impact in April. It moved up to 1st place in the index from 3rd last month, impacting 4% of organizations worldwide. XMRig, March’s most prevalent malware, dropped to second place.

“The Agent Tesla malspam campaigns we saw in April underline just how agile cybercriminals can be when it comes to exploiting news events and tricking unsuspecting victims to click on an infected link,” said Maya Horowitz, Director, Threat Intelligence & Research, Products at Check Point. “With both Agent Tesla and Dridex in the top three of the threat index, criminals are focusing on stealing users’ personal and business data and credentials so that they can monetize them.  So it’s essential that organizations take a proactive and dynamic approach to user education, keeping their staff informed of the latest tools and techniques, particularly as more staff are now working from home.”

The research team also warns that “MVPower DVR Remote Code Execution” remained the most common exploited vulnerability, though its impact increased to cover 46% of organizations globally. This was closely followed by “OpenSSL TLS DTLS Heartbeat Information Disclosure” with a global impact of 41%, followed by “Command Injection Over HTTP Payload” impacting 40% of organizations worldwide.

Top malware families

*The arrows relate to the change in rank compared to the previous month.

This month Dridex rises to 1st place, impacting 4% of organizations globally, followed by XMRig and Agent Tesla impacting 4% and 3% of organizations worldwide respectively.

  1. ↑ Dridex – Dridex is a Trojan that targets the Windows platform and is reportedly downloaded via a spam email attachment. Dridex contacts a remote server and sends information about the infected system. It can also download and execute arbitrary modules received from the remote server.
  2. ↓ XMRig – XMRig is an open-source CPU mining software used for the mining process of the Monero cryptocurrency, first seen in the wild in May 2017.
  3. ↑ Agent Tesla – Agent Tesla is an advanced RAT functioning as a keylogger and information stealer, which is capable of monitoring and collecting the victim’s keyboard input, system keyboard, taking screenshots, and exfiltrating credentials to a variety of software installed on a victim’s machine (including Google Chrome, Mozilla Firefox and the Microsoft Outlook email client).

Top exploited vulnerabilities

This month “MVPower DVR Remote Code Execution” was the most common exploited vulnerability, impacting 46% of organizations globally, followed by “OpenSSL TLS DTLS Heartbeat Information Disclosure” with a global impact of 41%. In 3rd place the “Command Injection Over HTTP Payload” vulnerability impacted 40% of organizations worldwide, mostly seen in attacks exploiting a zero-day vulnerability in “DrayTek” routers and switch devices (CVE-2020-8515).

  1. ↔ MVPower DVR Remote Code Execution – A remote code execution vulnerability that exists in MVPower DVR devices. A remote attacker can exploit this weakness to execute arbitrary code in the affected router via a crafted request.
  2. ↑ OpenSSL TLS DTLS Heartbeat Information Disclosure (CVE-2014-0160; CVE-2014-0346) – An information disclosure vulnerability which exists in OpenSSL. The vulnerability is due to an error when handling TLS/DTLS heartbeat packets. An attacker can leverage this vulnerability to disclose memory contents of a connected client or server.
  3. ↑ Command Injection Over HTTP Payload – A remote attacker can exploit this issue by sending a specially crafted request to the victim. Successful exploitation would allow an attacker to execute arbitrary code on the target machine.

Top malware families – Mobile

This month xHelper is still holding 1st place as the most prevalent mobile malware, followed by Lotoor and AndroidBauts.

  1. xHelper – A malicious application seen in the wild since March 2019, used for downloading other malicious apps and display advertisement. The application is capable of hiding itself from the user, and reinstalls itself if it is uninstalled.
  2. Lotoor – Lotoor is a hacking tool which exploits vulnerabilities on the Android operating system to gain root privileges on compromised mobile devices.
  3. AndroidBauts – AndroidBauts is an Adware that targets Android users. It exfiltrates IMEI, IMSI, GPS Location and other device information and allows the installation of third-party apps and shortcuts on mobile devices.

Comments

ClaudeBoobe's picture

Последние новости, интерактивная карта онлайн, подробная статистика по странам в таблице.
https://covid-monitor.com

<a href="https://covid-monitor.com">коронавирус +в россии +и мире</a>

MichaelWer's picture

tribal installment loans for bad credit direct lenders <a href="http://installmentloansservicee.com">installment loans</a> tribal installment loans direct lenders no credit check

Thomasitara's picture

tadalafil 2.5 mg <a href="http://tadalafilsexx.combo">goodrx tadalafil</a> cost of tadalafil

Thomasitara's picture

tadalafil 2.5 mg <a href="http://tadalafilsexx.combo">goodrx tadalafil</a> cost of tadalafil

Thomasitara's picture

cheapest tadalafil <a href="http://tadalafilsexx.com">tadalafil from india</a> buy tadalafil 20 mg

Thomasitara's picture

cheapest tadalafil <a href="http://tadalafilsexx.com">tadalafil from india</a> buy tadalafil 20 mg

Thomasitara's picture

where can i buy tadalafil <a href="http://tadalafilsexx.com">tadalafilsexx.com </a> tadalafil citrate dosage

Stanleybaf's picture

Submitted by Stanleybaf (not verified) on Sun, 2020-07-05 09:38

cv axle shaft <a href="https://cvvsresumeonline.com/">cv joint boot replacement</a> eminence cv-75
uss hornet (cv-8) <a href="https://cvvsresumeonline.com/">exemple cv</a> cv 75
bianchi infinito cv disc <a href="https://cvvsresumeonline.com/">professional cv</a> symptoms of bad cv joint
sections of a cv <a href="https://cvvsresumeonline.com/">cv stands for</a> cv footballistique
latex cv template <a href="https://cvvsresumeonline.com/">what is the difference between cv and resume</a> aha cv risk calculator
que significa sa de cv <a href="https://cvvsresumeonline.com/">best font for cv</a> uss constellation cv 64

Stanleybaf's picture

Submitted by Stanleybaf (not verified) on Sun, 2020-07-05 20:09

physicians cv <a href="https://cvvsresumeonline.com/">write a cv</a> best cv
cv latex <a href="https://cvvsresumeonline.com/">bad cv joint symptoms</a> residency cv example
how to create a cv <a href="https://cvvsresumeonline.com/">avantone pro cv-12</a> cv sections
eras cv sample <a href="https://cvvsresumeonline.com/">red cell distribution width cv</a> cv template pdf
garmin striker 4 cv <a href="https://cvvsresumeonline.com/">help writing a cv</a> cv template download
example cv <a href="https://cvvsresumeonline.com/">residency cv example</a> pharmacy cv

Stanleybaf's picture

cv template google docs <a href="https://cvvsresumeonline.com/">cv resume</a> broken cv joint
cv magazine <a href="https://cvvsresumeonline.com/">uss constellation cv-64</a> how to write a cv examples
cannot have cv-qualifier <a href="https://cvvsresumeonline.com/">cv-12</a> cv code
cv examples <a href="https://cvvsresumeonline.com/">cv sciences plus cbd oil</a> cv joint banding tool
cv and resume <a href="https://cvvsresumeonline.com/">best aftermarket cv axles</a> cv formulas
best aftermarket cv axles <a href="https://cvvsresumeonline.com/">medical cv templates</a> how to do a cv

JeffreyHex's picture

Submitted by JeffreyHex (not verified) on Mon, 2020-07-06 16:58

cv products <a href="https://cvvsresumeonline.com/">cv equation</a> medical cv template
exemples de cv <a href="https://cvvsresumeonline.com/">uss midway cv-41</a> 2 cv
dental cv <a href="https://cvvsresumeonline.com/">examples of a cv</a> uss yorktown cv-5 wreck photos
open cv 3.0 <a href="https://cvvsresumeonline.com/">cv axle repair cost</a> cv outreach
cv file <a href="https://cvvsresumeonline.com/">cv sciences</a> harley cv carb
uss enterprise cv-6 <a href="https://cvvsresumeonline.com/">cv complete</a> cv hornets

JeffreyHex's picture

Submitted by JeffreyHex (not verified) on Mon, 2020-07-06 17:16

cv guide <a href="https://cvvsresumeonline.com/">cv word template</a> how to format a cv
cv chemistry <a href="https://cvvsresumeonline.com/">undergrad cv</a> harley cv carb jetting chart
cv-63 <a href="https://cvvsresumeonline.com/">how to check cv joint</a> one page cv
medical residency cv <a href="https://cvvsresumeonline.com/">international cv</a> hippo red cv boot
example academic cv <a href="https://cvvsresumeonline.com/">sharp portable air conditioner cv-10nh</a> sharp portable air conditioner cv 10nh
uss ranger (cv-4) <a href="https://cvvsresumeonline.com/">cv koogler</a> pro cv template

Haroldvew's picture

online gambling iowa <a href="https://onlinegamblingrtf.com/">online sports gambling</a> online gambling addiction statistics
las vegas gambling online <a href="https://onlinegamblingrtf.com/">online gambling</a> online video game gambling
online gambling age <a href="https://onlinegamblingrtf.com/">pa online gambling</a> free online gambling win real money

Haroldvew's picture

fish table gambling game online <a href="https://onlinegamblingrtf.com/">online gambling</a> online gambling growth
online gambling games for real money <a href="https://onlinegamblingrtf.com/">gambling online</a> mgm grand online gambling
nj online gambling sites <a href="https://onlinegamblingrtf.com/">online gambling uk</a> costa rica online gambling

Haroldvew's picture

u s online gambling <a href="https://onlinegamblingrtf.com/">online gambling for real money</a> online bingo gambling
online gambling with real money <a href="https://onlinegamblingrtf.com/">legality online gambling</a> is online gambling legal in washington state
online gambling in us <a href="https://onlinegamblingrtf.com/">best online gambling sites</a> is online sports gambling legal

Haroldvew's picture

online gambling no deposit required <a href="https://onlinegamblingrtf.com/">onlinegamblingrtf.com</a> online gambling sports
online gambling market size <a href="https://onlinegamblingrtf.com/">top online gambling sites</a> safe port act online gambling
online gambling law <a href="https://onlinegamblingrtf.com/">online gambling real money</a> online poker gambling sites

Haroldvew's picture

online gambling roulette <a href="https://onlinegamblingrtf.com/">https://www.onlinegamblingrtf.com/</a> nfl gambling online
online gambling oregon <a href="https://onlinegamblingrtf.com/">legality online gambling</a> usa gambling online
trump online gambling <a href="https://onlinegamblingrtf.com/">best online gambling sites usa</a> online live casino gambling

LarryDioto's picture

online casino real money paypal usa <a href="https://livesocialcasinodom.com/">zone online casino</a> best paying online casino. double down casino online usa online casino., beste norske online casino casino royale full movie online.
online casino reviews usa players <a href="https://livesocialcasinodom.com/">live casino betting</a> free online casino games real money

LarryDioto's picture

rich casino online <a href="https://livesocialcasinodom.com/">livesocialcasinodom.com</a> svensk casino online. demo casino online free online casino games real money., casino 1995 online zone online casino vegas world.
online casino singapore <a href="https://livesocialcasinodom.com/">watch casino online free</a> online casino vip

LarryDioto's picture

rich casino online <a href="https://livesocialcasinodom.com/">livesocialcasinodom.com</a> svensk casino online. demo casino online free online casino games real money., casino 1995 online zone online casino vegas world.
online casino singapore <a href="https://livesocialcasinodom.com/">watch casino online free</a> online casino vip

LarryDioto's picture

rich casino online <a href="https://livesocialcasinodom.com/">livesocialcasinodom.com</a> svensk casino online. demo casino online free online casino games real money., casino 1995 online zone online casino vegas world.
online casino singapore <a href="https://livesocialcasinodom.com/">watch casino online free</a> online casino vip

LarryDioto's picture

spela casino online gratis <a href="https://livesocialcasinodom.com/">zone online casino msn games</a> jack casino online. doubledown casino code share online u.s.a online casino., online casino paypal withdrawal online casino real money no deposit.
free online casino slots with bonuses <a href="https://livesocialcasinodom.com/">https://livesocialcasinodom.com/</a> online casino real money no deposit bonus

LarryDioto's picture

online casino free chips <a href="https://livesocialcasinodom.com/">casino movie online free</a> a casino online. turningston online casino online casino games no download., bwin online casino online casino slots.
rivers casino online <a href="https://livesocialcasinodom.com/">online casino game real money</a> online casino slot uk

LarryDioto's picture

foxwood casino online <a href="https://livesocialcasinodom.com/">livesocialcasinodom.com</a> watch casino royale online free. online casino no deposit welcome bonus hollywood online casino., top online casino no deposit online casino.
best online casino no deposit bonus <a href="https://livesocialcasinodom.com/">casino royale online</a> online casino no minimum deposit

LarryDioto's picture

casino online legali <a href="https://livesocialcasinodom.com/">posh online casino</a> ac online casino. online casino canada no deposit bonus online casino deposit bonus., doubledown casino code share online online casino spelen.
nya online casino <a href="https://livesocialcasinodom.com/">online online casino</a> jugar casino online

LarryDioto's picture

casino deutschland online <a href="https://livesocialcasinodom.com/">online hollywood casino</a> hollywood online casino. online flash casino games online casino reviews uk., caesars casino games online zone online casino msn games.
online casino promo codes <a href="https://livesocialcasinodom.com/">888 live casino</a> vegas slots online casino

Mistyfug's picture

four card poker online <a href="https://pokeronlinessd.com/">online poker u s</a> drawing dead: the highs & lows of online poker\

Mistyfug's picture

four card poker online <a href="https://pokeronlinessd.com/">online poker u s</a> drawing dead: the highs & lows of online poker\

Mistyfug's picture

poker card games online <a href="https://pokeronlinessd.com/">poker games online</a> video poker games online free no download\

Mistyfug's picture

online poker real money paypal <a href="https://pokeronlinessd.com/">online poker california</a> poker free online games\

Mistyfug's picture

free online strip poker games <a href="https://pokeronlinessd.com/">us poker online</a> governor of poker free online\

MeganBak's picture

apr calculator car loans <a href="https://carloansjbr.com">0% car loans</a> same day car loans

MeganBak's picture

car title payday loans <a href="https://carloansjbr.com">average interest rates for used car loans</a> private car loans

Add new comment