The Cybersecurity and Infrastructure Security Agency (CISA) released a new report on the top malware strains of 2021, which you can read here.

The value of this information is it identifies several key pieces of malware, and some motivations of the malware authors, as well as what can be done to mitigate.

Summary

Many of the malware that is being scene has pieces of codes that have been in use for 5 years, meaning we are seeing variations of many pieces of effective malware in the past. Additionally, much of what is being scene is trojans, information stealers, or ransomware of various forms. Staying protected from these threats can be accomplished through utilizing methods and methodologies that have been present for almost a decade at this time, but the evasive nature of threats means that there becomes an increased value in SOC / MDR services that can help identify threats quickly.

Threats

I have pulled threat information from CISA's site in order to give a glimpse of these threats / overview.

Agent Tesla

• Overview: Agent Tesla is capable of stealing data from mail clients, web browsers, and File Transfer Protocol (FTP) servers. This malware can also capture screenshots, videos, and Windows clipboard data. Agent Tesla is available online for purchase under the guise of being a legitimate tool for managing your personal computer. Its developers continue to add new functionality, including obfuscation capabilities and targeting additional applications for credential stealing.
• Active Since: 2014
• Malware Type: RAT
• Delivery Method: Often delivered as a malicious attachment in phishing emails.
• Resources: See the MITRE ATT&CK page on Agent Tesla.

AZORult

• Overview: AZORult is used to steal information from compromised systems. It has been sold on underground hacker forums for stealing browser data, user credentials, and cryptocurrency information. AZORult’s developers are constantly updating its capabilities.
• Active Since: 2016
• Malware Type: Trojan
• Delivery Method: Phishing, infected websites, exploit kits (automated toolkits exploiting known software vulnerabilities), or via dropper malware that downloads and installs AZORult.
• Resources: See the MITRE ATT&CK page on AZORult and the Department of Health and Human Services (HHS)’s AZORult brief.

FormBook

• Overview: FormBook is an information stealer advertised in hacking forums. ForrmBook is capable of key logging and capturing browser or email client passwords, but its developers continue to update the malware to exploit the latest Common Vulnerabilities and Exposures (CVS)[7], such as CVE-2021-40444 Microsoft MSHTML Remote Code Execution Vulnerability.
• Active Since: At least 2016
• Malware Type: Trojan
• Delivery Method: Usually delivered as an attachment in phishing emails.
• Resources: See Department of Health and Human Services (HHS)’s Sector Note on Formbook Malware Phishing Campaigns.

Ursnif

• Overview: Ursnif is a banking Trojan that steals financial information. Also known as Gozi, Ursnif has evolved over the years to include a persistence mechanism, methods to avoid sandboxes and virtual machines, and search capability for disk encryption software to attempt key extraction for unencrypting files.Based on information from trusted third parties, Ursnif infrastructure is still active as of July 2022.
• Active Since: 2007
• Malware Type: Trojan
• Delivery Method: Usually delivered as a malicious attachment to phishing emails.
• Resources: See the MITRE ATT&CK page on Ursnif.

LokiBot

• Overview: LokiBot is a Trojan malware for stealing sensitive information, including user credentials, cryptocurrency wallets, and other credentials. A 2020 LokiBot variant was disguised as a launcher for the Fortnite multiplayer video game.
• Active Since: 2015
• Malware Type: Trojan
• Delivery Method: Usually delivered as a malicious email attachment.
• Resources: See CISA’s LokiBot Malware alert and the MITRE ATT&CK page on LokiBot.

MOUSEISLAND

• Overview: MOUSEISLAND is usually found within the embedded macros of a Microsoft Word document and can download other payloads. MOUSEISLAND may be the initial phase of a ransomware attack.
• Active Since: At least 2019
• Malware Type: Macro downloader
• Delivery Method: Usually distributed as an email attachment.
• Resources: See 

NanoCore

• Overview: NanoCore is used for stealing victims’ information, including passwords and emails. NanoCore could also allow malicious users to activate computers’ webcams to spy on victims. Malware developers continue to develop additional capabilities as plug-ins available for purchase or as a malware kit or shared amongst malicious cyber actors.
• Active Since: 2013
• Malware Type: RAT
• Delivery Method: Has been delivered in an email as an ISO disk image within malicious ZIP files; also found in malicious PDF documents hosted on cloud storage services.
• Resources: See the MITRE ATT&CK page on NanoCore and the HHS Sector Note: Remote Access Trojan Nanocore Poses Risk to HPH Sector.

Qakbot

• Overview: originally observed as a banking Trojan, Qakbot has evolved in its capabilities to include performing reconnaissance, moving laterally, gathering and exfiltrating data, and delivering payloads. Also known as QBot or Pinksliplot, Qakbot is modular in nature enabling malicious cyber actors to configure it to their needs. Qakbot can also be used to form botnets.
• Active Since: 2007
• Malware Type: Trojan
• Delivery Method: May be delivered via email as malicious attachments, hyperlinks, or embedded images.
• Resources: See the MITRE ATT&CK page on Qakbot and the Department of Health and Human Services (HHS) Qbot/Qakbot Malware brief.

Remcos

• Overview: Remcos is marketed as a legitimate software tool for remote management and penetration testing. Remcos, short for Remote Control and Surveillance, was leveraged by malicious cyber actors conducting mass phishing campaigns during the COVID-19 pandemic to steal personal data and credentials. Remcos installs a backdoor onto a target system. Malicious cyber actors then use the Remcos backdoor to issue commands and gain administrator privileges while bypassing antivirus products, maintaining persistence, and running as legitimate processes by injecting itself into Windows processes.
• Active Since: 2016
• Malware Type: RAT
• Delivery Method: Usually delivered in phishing emails as a malicious attachment.
• Resources: See the MITRE ATT&CK page on Remcos.

TrickBot

• Overview: TrickBot malware is often used to form botnets or enabling initial access for the Conti ransomware or Ryuk banking trojan. TrickBot is developed and operated by a sophisticated group of malicious cyber actors and has evolved into a highly modular, multi-stage malware. In 2020, cyber criminals used TrickBot to target the Healthcare and Public Health (HPH) Sector and then launch ransomware attacks, exfiltrate data, or disrupt healthcare services. Based on information from trusted third parties, TrickBot’s infrastructure is still active in July 2022.[23][24][25][26]
• Active Since: 2016
• Malware Type: Trojan
• Delivery Method: Usually delivered via email as a hyperlink.
• Resources: See the MITRE ATT&CK page on Trickbot and the Joint CSA on TrickBot Malware.

GootLoader

• Overview: GootLoader is a malware loader historically associated with the GootKit malware. As its developers updated its capabilities, GootLoader has evolved from a loader downloading a malicious payload into a multi-payload malware platform. As a loader malware, GootLoader is usually the first-stage of a system compromise. By leveraging search engine poisoning, GootLoader’s developers may compromise or create websites that rank highly in search engine results, such as Google search results.[27]
• Active Since: At least 2020
• Malware Type: Loader
• Delivery Method: Malicious files available for download on compromised websites that rank high as search engine results
• Resources: See New Jersey’s Cybersecurity & Communications Integration Cell (NJCCIC) page on GootLooader and BlackBerry’s Blog on GootLoader

Mitigation

CISA recommends (as does London Security) to use many of the methods of protection that are currently considered best practices today. Here are some examples:

• Update software, including operating systems, applications, and firmware, on IT network assets. Prioritize patching known exploited vulnerabilities and critical and high vulnerabilities that allow for remote code execution or denial-of-service on internet-facing equipment.
  • Consider using a centralized patch management system.
  • Consider signing up for CISA’s cyber hygiene services, including vulnerability scanning, to help reduce exposure to threats. CISA’s vulnerability scanning service evaluates external network presence by executing continuous scans of public, static IP addresses for accessible services and vulnerabilities.

• Enforce MFA to the greatest extent possible and require accounts with password logins, including service accounts, to have strong passwords. Do not allow passwords to be used across multiple accounts or stored on a system to which an adversary may have access. Additionally, ACSC has issued guidance on implementing multifactor authentication for hardening authentication systems.
• If you use RDP and/or other potentially risky services, secure and monitor them closely. RDP exploitation is one of the top initial infection vectors for ransomware, and risky services, including RDP, can allow unauthorized access to your session using an on-path attacker.
  • Limit access to resources over internal networks, especially by restricting RDP and using virtual desktop infrastructure. After assessing risks, if RDP is deemed operationally necessary, restrict the originating sources, and require MFA to mitigate credential theft and reuse. If RDP must be available externally, use a virtual private network (VPN) or other means to authenticate and secure the connection before allowing RDP to connect to internal devices. Monitor remote access/RDP logs, enforce account lockouts after a specified number of attempts to block brute force attempts, log RDP login attempts, and disable unused remote access/RDP ports.
  • Ensure devices are properly configured and that security features are enabled. Disable ports and protocols that are not being used for a business purpose (e.g., RDP Transmission Control Protocol Port 3389). 

• Maintain offline (i.e., physically disconnected) backups of data. Backup procedures should be conducted on a frequent, regular basis (at a minimum every 90 days). Regularly test backup procedures and ensure that backups are isolated from network connections that could enable the spread of malware.
  • Ensure the backup keys are kept offline as well, to prevent them being encrypted in a ransomware incident.
  • Ensure all backup data is encrypted, immutable (i.e., cannot be altered or deleted), and covers the entire organization’s data infrastructure with a particular focus on key data assets.
• Provide end-user awareness and training to help prevent successful targeted social engineering and spearphishing campaigns. Phishing is one of the top infection vectors for ransomware.

• • Ensure that employees are aware of potential cyber threats and delivery methods.
  • Ensure that employees are aware of what to do and whom to contact when they receive a suspected phishing email or suspect a cyber incident.
    
    

Conclusions

Understanding recurring threats that have been monitored across the past year can be a difficult task, and remaining vigilant can require a team of professionals, whereas many companies have the barest of budgets and employees to make their security function.  London Security works with businesses of all sizes to provide SOC & MDR services to help guarantee coverage of businesses 24/7/365 - and offers day to day management of security solutions in order to guarantee your business is capable of surviving a threat.

Contact us today.