E-Business
Qbot Emerges Most Prevalent Malware in First Half of 2023, Mobile Trojan SpinOk Makes its Debut
Check Point® Software Technologies, a provider of cybersecurity solutions globally, has published its Global Threat Index for June 2023. Researchers found that the Trojan Qbot has been the most prevalent malware so far in 2023, ranking first in five out of the six months to date.
Meanwhile, mobile Trojan SpinOk made its way to the top of the malware list for the first time after being detected last month, and ransomware hit headlines following a zero-day vulnerability in file sharing software MOVEIt.
Qbot, which initially emerged in 2008 as a banking Trojan, has undergone consistent development, acquiring additional functionalities for the purpose of stealing passwords, emails, and credit card details.
It is commonly propagated through spam emails and employs various techniques such as anti-VM, anti-debugging, and anti-sandbox methods to impede analysis and avoid detection.
Presently, its primary role is to act as a loader for other malware and establish a presence within targeted organizations, serving as a stepping stone for ransomware group operators.
Meanwhile, researchers discovered a prolific mobile malware that has so far amassed 421 million downloads. Last month, for the first time, Trojanized Software Development Kit (SDK) SpinOk made its way to the top of the mobile malware families. Used by numerous popular apps for marketing purposes, this malicious software has infiltrated highly popular apps and games, some of which were available on the Google Play Store.
Capable of stealing sensitive information from devices and monitoring clipboard activities, SpinOk malware poses a serious threat to user privacy and security, underscoring the need for proactive measures to protect personal data and mobile devices. It also serves as a stark reminder of the devastating potential of software supply chain attacks.
Last month also saw the launch of a large-scale ransomware campaign that impacted organizations worldwide. In May 2023, Progress Software Corporation disclosed a vulnerability in MOVEit Transfer and MOVEit Cloud (CVE-2023-34362) that could allow unauthorized access to the environment.
Despite it being patched within 48 hours, cybercriminals associated with Russian-affiliated ransomware group Clop exploited the vulnerability and launched a supply chain attack against MOVEit users.
To date, 108 organizations – including seven US universities – have been listed publicly, following the incident, with hundreds and thousands of records obtained.
“The MOVEit exploit proves that 2023 is already becoming a significant year in ransomware. Prominent groups like Clop are not operating tactically to infect a single target, but instead, making their operations more efficient by exploiting software that is widely used in a corporate environment.
This approach means they can reach hundreds of victims in a single attack.” said Maya Horowitz, VP Research at Check Point Software. “This attack pattern emphasizes the importance for companies to implement a multi-layered cyber security strategy and to prioritize patching quickly when vulnerabilities are disclosed.”
CPR also revealed that “Web Servers Malicious URL Directory Traversal” was the most exploited vulnerability last month, impacting 51% of organizations globally, followed by “Apache Log4j Remote Code Execution” with 46% of organizations worldwide. “HTTP Headers Remote Code Execution” was the third most used vulnerability, with a global impact of 44%.
Top malware families
Globally, Qbot was the most prevalent malware last month with an impact of 7% worldwide organizations, followed by Formbook with a global impact of 4% and Emotet with a global impact of 3%.
In Nigeria, Qbot was the most prevalent malware last month with an impact of 19.72%, followed by Expiro with an impact of 15.49% and FormBook with an impact of 7.04%.
- Qbot – Qbot AKA Qakbot is a multipurpose malware that first appeared in 2008. It was designed to steal a user’s credentials, record keystrokes, steal cookies from browsers, spy on banking activities, and deploy additional malware. Often distributed via spam email, Qbot employs several anti-VM, anti-debugging, and anti-sandbox techniques to hinder analysis and evade detection.
- Expiro – Expiro is a polymorphic file infector first seen in 2010. It inserts its malicious code into executable files on the infected host. These files lead to new infections when they are run on other machines. Expiro steals user and system information from Windows, as well as FTP credentials.
- FormBook – FormBook is an Infostealer targeting the Windows OS and was first detected in 2016. It is marketed as Malware as a Service (MaaS) in underground hacking forums for its strong evasion techniques and relatively low price. FormBook harvests credentials from various web browsers, collects screenshots, monitors and logs keystrokes, and can download and execute files according to orders from its C&C.
Top Attacked Industries Globally
Last month, Communications remained in first place as the most exploited industry globally, followed by Utilities and Transportation.
- Communication
- Utilities
- Transportation
Top exploited vulnerabilities
Last month, “Web Servers Malicious URL Directory Traversal” was the most exploited vulnerability, impacting 51% of organizations globally, followed by “Apache Log4j Remote Code Execution” with 46% of organizations worldwide. “HTTP Headers Remote Code Execution” was the third most used vulnerability, with a global impact of 44%.
- ↔ Web Servers Malicious URL Directory Traversal – There exists a directory traversal vulnerability on different web servers. The vulnerability is due to an input validation error in a web server that does not properly sanitize the URI for the directory traversal patterns. Successful exploitation allows unauthenticated remote attackers to disclose or access arbitrary files on the vulnerable server.
- ↔ Apache Log4j Remote Code Execution (CVE-2021-44228) – A remote code execution vulnerability exists in Apache Log4j. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system.
- ↔ HTTP Headers Remote Code Execution (CVE-2020-10826, CVE-2020-10827, CVE-2020-10828, CVE-2020-13756) – HTTP headers let the client and the server pass additional information with an HTTP request. A remote attacker may use a vulnerable HTTP Header to run arbitrary code on the victim machine.
Top Mobile Malwares
Last month SpinOk rose to first place in the most prevalent Mobile malware, followed by Anubis and AhMyth.
- SpinOk – SpinOk is an Android software module that operates as spyware. It collects information about files stored on devices and is capable of transferring them to malicious threat actors. The malicious module was found present in more than 100 Android apps and downloaded more than 421,000,000 times until May 23.
- Anubis – Anubis is a banking Trojan malware designed for Android mobile phones. Since it was initially detected, it has gained additional functions including Remote Access Trojan (RAT) functionality, keylogger, audio recording capabilities and various ransomware features. It has been detected on hundreds of different applications available in the Google Store.
- AhMyth – AhMyth is a Remote Access Trojan (RAT) discovered in 2017. It is distributed through Android apps that can be found on app stores and various websites. When a user installs one of these infected apps, the malware can collect sensitive information from the device and perform actions such as keylogging, taking screenshots, sending SMS messages, and activating the camera, which usually used to steal sensitive information.
Dr Vincent Olatunji, national commissioner, Nigerian Data Protection Commission (NDPC), has emphasized that data privacy, protection, and cybersecurity are “inseparable pillars of the digital age” and must be prioritized in Nigeria’s digital transformation journey.
Dr Vincent Olatunji, national commissioner, NDPC
Dr. Olatunji made this assertion during his keynote address titled “Data Privacy and Protection: Nigeria’s Roadmap to Compliance” at the ongoing National Cybersecurity Conference in Abuja.
He underscored that while data protection focuses on safeguarding personal information from misuse, cybersecurity protects the systems that store this data. “Data privacy is a basic human right that empowers individuals to control how their personal information is collected, used, and shared,” he said.
“Strong cybersecurity is essential to maintain the confidentiality, integrity, and availability of personal data. Conversely, robust data protection frameworks help guide effective cybersecurity practices and foster a culture of privacy.”
Highlighting Nigeria’s progress, Dr. Olatunji noted the country’s recent Tier 3 (“establishing”) ranking in the 2024 Global Cybersecurity Index and its top position in Africa particularly in the area of data protection. He traced the evolution of Nigeria’s data protection journey, culminating in the signing of the Nigeria Data Protection Act (NDP Act) 2023 by President Bola Ahmed Tinubu (GCFR).
He described the NDP Act as the cornerstone of the country’s data governance framework. “The Act regulates the processing of personal data in Nigeria and guarantees the privacy rights of individuals,” he explained.
It applies to both local and international data controllers and processors handling data of Nigerian subjects and provides clear guidelines on data collection, storage, consent, data subject rights, and penalties for non-compliance.
Dr. Olatunji cited the recent ₦766.2 million fine imposed on MultiChoice for non-compliance as an example of the Commission’s enforcement capacity. He also revealed that the NDPC has generated over ₦2 billion in the last two years, with the data protection sector now valued at ₦16.2 billion alongside the creation of numerous job opportunities.
He further highlighted ecosystem growth, citing the certification of 455 Data Protection Officers (DPOs) under the National Certification Program and verification of 3,343 Data Protection Compliance Organizations (DPCOs) by 2025.
While celebrating progress, Dr. Olatunji also pointed to key areas for improvement, including building institutional capacity, enhancing data literacy and workforce development, and strengthening collaboration across sectors.
In conclusion, he urged stakeholders to “embrace a culture of data protection, implement robust cybersecurity practices, and stay attuned to the evolving regulatory landscape” in order to reduce risks, protect assets, and support long-term national growth.
In today’s digital world, QR codes are placed on almost everything – from yogurt containers and restaurant menus to museum exhibits, and even utility bills and parking lots.
People use them to open websites, download apps, collect loyalty programme points, make payments and transfer money, and even for charity donations. The accessible and practical technology is convenient for many, including cybercriminals, who have already rolled out a variety of QR-based schemes.
Kaspersky experts have identified the top security risks when scanning QR codes:
- Phishing and redirection to malicious sites: QR codes can direct users to fraudulent websites designed to steal personal or financial information, such as passwords and credit card numbers. Attackers can impersonate legitimate sites, such as banks or streaming services, and trick users into entering their credentials.
- Malware download: Some QR codes can trigger the download of malicious applications that compromise the security of the user’s device, especially if it is not protected against unauthorised installation.
- Payment fraud: During special events or sales periods like holiday sales, a fake QR code can redirect users to make payments to fraudulent accounts.
- Unsafe automatic connections: A QR code can also automatically connect the user to Wi-Fi networks controlled by cyber attackers, allowing them to intercept their communications.
“QR codes are a fertile ground for potential manipulation, especially as they appear in various everyday contexts such as receipts, flyers, and signage. Attackers have nearly endless possibilities to exploit them.
“As these codes have already become an integral part of our daily lives, it is essential for users to know how to use them safely and responsibly,” says Seifallah Jedidi, Head of Consumer Channel for META at Kaspersky.
In order to not fall for a scam when scanning a QR code, Kaspersky experts recommend:
- Verify the source: Scan QR codes only from trusted and known sources. Avoid scanning codes in public places that may have been tampered with.
- Check the URL: If you really need to scan a publicly available code, verify that the web address it directed you to is legitimate before taking any action on this website.
- Don’t share personal information: Avoid entering sensitive information if you’re not completely sure of the origin of the QR code.
- Protect your digital life: Install a cybersecurity solution with anti-phishing and anti-fraud protection, such as Kaspersky Premium, on all your devices; it will alert you to any danger timely.
Kaspersky is addressing one of the most debatable technological challenges of the coming decade: the rise of quantum computing and its potential impact on digital security.
In this context, experts have identified the main quantum threats that demand immediate action from the cybersecurity community.
As classical computers approach their physical limits, their performance growth is slowing — constraining progress in areas that depend on complex computation.
At the same time, quantum computers offer the potential to solve specific problems far faster than classical systems. For now, however, their practical use remains limited to narrow and experimental domains.
Nevertheless, experts estimate that we may see a fully fault-tolerant quantum computer within the next decade — a development that could unlock significant advances, but also unleash a new era of cybersecurity threats.
Supporting this urgency, Deloitte’s 2024 Global Future of Cyber Survey reports that 83% of organizations are already assessing or taking steps to address quantum computing risks, demonstrating growing awareness and proactive strategies in the private sector.
To better understand the scope of the evolving threat, Kaspersky has identified three of the most urgent quantum-related risks that demand action from the cybersecurity community:
The top three risks:
Quantum computers could be used to compromise the traditional encryption methods that currently protect data in countless digital systems — posing a direct threat to global cybersecurity infrastructures.
Threats include the interception and decoding of sensitive diplomatic, military, and financial communications, as well as the real-time decryption of private negotiations – something quantum systems could handle much faster than classical machines, turning secure conversations into open books.
- Store now, decrypt later: the key threat of the coming years
Threat actors are already harvesting encrypted data today, with the intention of decrypting it in the future once quantum capabilities advance. This “store now, decrypt later” tactic could expose sensitive information years after it was originally transmitted — including diplomatic exchanges, financial transactions, and private communications.
- Sabotage in blockchain and cryptocurrency
Blockchain networks are not immune to quantum threats. Bitcoin’s Elliptic Curve Digital Signature Algorithm (ECDSA), which relies on elliptic curve cryptography (ECC), is especially vulnerable.
Potential risks include forging digital signatures, which threatens Bitcoin, Ethereum, and other cryptocurrencies; attacks on ECDSA that secure crypto wallets; and tampering with blockchain transaction history, undermining trust and integrity.
- Quantum-resistant ransomware: a new front
Looking ahead, developers and operators of advanced ransomware may begin adopting post-quantum cryptography to protect their own malicious payloads. So-called “quantum-resistant” ransomware would be designed to resist decryption by both classical and quantum computers — potentially making recovery without paying a ransom nearly impossible.
At present, quantum computing does not offer a way to decrypt files locked by current ransomware. Data protection and recovery still rely on traditional security solutions and collaboration among law enforcement agencies, quantum researchers, and international organisations.
Building quantum-safe defenses
Quantum computers are not yet a direct threat — but by the time they are, it may be too late to respond. Transitioning to post-quantum cryptography will take years. Preparations must begin today.
The cybersecurity community, IT companies, and governments must coordinate to address the risks ahead. Policymakers should develop clear strategies to migrate to post-quantum algorithms. Businesses and researchers need to begin implementing new security standards now.
“The most critical risk lies not really in the future, but in the present: encrypted data with long-term value is already at risk from future decryption. The security decisions we make today will define the resilience of our digital infrastructure for decades.
“Governments, businesses, and infrastructure providers must begin adapting now, or risk systemic vulnerabilities that cannot be retroactively fixed,” states Sergey Lozhkin, Head of Kaspersky Global Research & Analysis Team for META and APAC.
MTN @ Swish Fusion Summit, Showcases 5G Rollout Strategy
Zenith Banks Leads as 8 Banks Suffer N156Bn Impairment Charges
SEC Flags FF Tiffany as Ponzi Scheme
Olatunji, NDPC Boss Calls for Integrated Strategy on Data Privacy, Cyber-Security
AccionMonie App to Empower Low-Income Households
Lebara, New Operator Enters Nigerian Telecom Arena, Sells Minutes, Not Airtime
Moniepoint Demonstrates Commitment to Nurturing Africa’s Future Leaders
AfCFTA Positions Africa to Tap into $712bn Digital Trade Market by 2035
ALTON Clarifies on Migration to End-User Billing for USSD Services
Starlink Resumes Customer Activations Across Nigeria
Broadcasting3 days agoNigeria Week Ahead: Inflation, Oil and Naira in focus
News3 days agoEFCC: Accusations Against Our Chairman Are Baseless and Misleading
Telecom2 days agoNCC Introduces N10m Licence Fee for Bulk SMS Service
Telecom2 days agoMTN Nigeria Targets $1Bn Cloud Market with Largest Modular Data Centre
General News2 days agoWoodhall Capital and Partners Launch ₦1.5Bn Fund
E-Business2 days agoFirm Highlights Top Risks of Quantum Computing
General News2 days agoBurna Boy Distances Himself from Meme Coin, Labels Crypto as Fraud
Telecom2 days agoPAT Taps Osi as CEO