In July, analysts detected a massive Trojan horse campaign that was intended to steal user passwords and hack into some communication applications. Password attacks are among the most common in the Czech Republic. Malware is mainly spread via e-mail. This is according to regular statistics from ESET.
You might be interested in
Last month, users had to deal with a large-scale campaign of the Spy.Agent.CTW Trojan. This is a very sophisticated malware that was responsible for a quarter of detections. In June, it could just for the percentage of blocked attacks. Spy.Agent.CTW has several functions, but they all aim to steal credentials for specific services. "This type of malware is sometimes referred to as a stealer. Once it infects a device, it can retrieve saved passwords from the email application. Office Outlook, Foxmail and Thunderbird. It also retrieves passwords from a large number of web browsers and some applications such as Telegram or QQ Browser," describes Martin Jirkal, head of the analytical team at the Czech branch of ESET.
Some versions of the malware are able to hack into applications such as Discord, which is popular among computer gamers. The attack also comes at a time when Discord is trying to offer services to companies for remote work communication. If access is indeed gained, the attacker can send messages on behalf of the compromised account. The July Spy.Agent.CTW campaign targeted mainly Czech users, then Romania and, to a lesser extent, Greece. This malware was most often spread through infected emails with an attachment called Material requirements.exe.
Passwords are the most common target
Gallery
The second most common threat was the similar Trojan horse Spy.Agent.AES. Analysts noted a significant campaign of this malware during May and June. In May, attackers even targeted the Czech Republic specifically. “In July, the interest of the creators of this malware shifted to other countries, which is why the number of detections dropped so significantly. Spy.Agent.AES is not as sophisticated, it has significantly fewer functions – basically the only one, which is obtaining passwords from browsers, ” describes Jirkal. Spy.Agent.AES is one of the few malware that attacks in Czech. It was most often spread in infected email attachments that attackers pass off as invoices or logistics documents.
Protect your passwords, they were the most frequent target of cyber attacks during July
The Formbook backdoor also targets passwords. Analysts detected a significant campaign of this malware in May. After a decline in June, this threat strengthened again in July. According to the data, FormBook was most prominent in the countries of Southeastern Europe. "FormBook is very dangerous, it is essentially a business project. The developers offer it on the black market as a service for rent, which opens up space for criminal activity even for those who would otherwise not be able to handle cyber attacks technically. The infected emails spread by FormBook have so far been in English, making it easier for users to detect the scam," explains Jirkal.
Like the previously mentioned Trojans, FormBook also obtains passwords stored in various browsers. All of the threats mentioned target a wide range of browsers, not just the most popular ones. " User passwords are a very valuable commodity. When combined with emails, they are even more expensive. Password databases can easily be sold to other attackers. Moreover, this is not the most technically complex type of attack, which is why users encounter them so often. I would therefore appeal to users to carefully protect their passwords and definitely only store them on their devices in a sufficiently secure way, such as specialized applications, so-called password managers. Statistics show that passwords have been the target of criminals for a long time and we cannot expect this type of attack to disappear from the Internet," recommends Jirkal.
Experts recommend using strong passwords in the form of a passphrase and, if possible, using multi-factor authentication or using specialized applications to create and store passwords. Last but not least, it is necessary to update all devices and use a reliable security program.
The most common cyber threats in the Czech Republic for July 2020:
- Trojan.MSIL/Spy.Agent.CTW (24,71%)
- Trojan.MSIL/Spy.Agent.AES (9,19%)
- Trojan.Win32/Formbook (5,49%)
- Trojan.Win32/PSW.Fareit (4,55%)
- Worm.MSIL/Autorun.Spy.Agent.DF (3,97%)
- Backdoor.Java/Adwind (1,43%)
- Backdoor.Win32/Tofsee (1,26%)
- Backdoor.Win32/Agent.UAW (0,94%)
- Trojan.Win32/Spy.Socelars (0,94%)
- Trojan.MSIL/Spy.Agent.CSS (0,91%)
I have Eset and I'm in iPhone can't install?
It doesn't really matter, because if you get lucky, even antivirus won't help you. And iPhoneI would like to see Antivirus programs as battery guzzlers.