Cybersecurity platform provider Check Point Software has published its Global Threat Index for July 2024.

Despite a significant drop in June, LockBit re-emerged last month to become the second most prevalent ransomware group, while RansomHub retained the top spot.

Meanwhile, researchers identified both a campaign distributing Remcos malware following a CrowdStrike update issue, and a series of new FakeUpdates tactics, which once again ranked first on the top malware list for July.

An issue in the CrowdStrike Falcon sensor for Windows led to cybercriminals distributing a malicious ZIP file named crowdstrike-hotfix.zip. This file contained HijackLoader, which subsequently activated Remcos malware, ranked as the seventh most wanted malware in July.

The campaign targeted businesses using Spanish-language instructions and involved the creation of fake domains for phishing attacks.

Meanwhile, researchers uncovered a series of new tactics employing FakeUpdates, which topped the malware ranking for another month.

Users visiting compromised websites encountered fake browser update prompts, leading to the installation of Remote Access Trojans (RATs) like AsyncRAT, currently ranked ninth on Check Point’s index.

Alarmingly, cyber-criminals have now started exploiting BOINC, a platform meant for volunteer computing, to gain remote control over infected systems.

“The continued persistence and resurgence of ransomware groups like Lockbit and RansomHub underscores cybercriminals’ continued focus on ransomware, a significant ongoing challenge for organisations with far-reaching implications for their operational continuity and data security,” said Maya Horowitz, VP of research at Check Point Software.

She added: “The recent exploitation of a security software update to distribute Remcos malware further highlights the opportunistic nature of cybercriminals to deploy malware, thereby further compromising organizations’ defenses.

Recommended reading

• EU AI Act: Agreement Reached On Landmark Regulation
• Big Tech Issues Open Letter Over EU AI Act
• EU Parliament Approves World’s First AI Act

“To counter these threats, organizations will need to adopt a multi-layered security strategy that includes robust endpoint protection, vigilant monitoring and user education to reduce the onslaught of these growingly massive cyber-attacks.”

Roundup of Key Malware Stats for July, 2024

• FakeUpdates was the most prevalent malware last month with an impact of 7% worldwide organisations, followed by Androxgh0st with a global impact of 5%, and AgentTesla with a global impact of 3%.
• Joker was the most prevalent Mobile malware, followed by Anubis and AhMyth.
• Top-Attacked Industries Globally Education/Research remained in first place with regards to most-attacked industries globally, followed by Government/Military and Communications.
• RansomHub was the most prevalent ransomware group responsible for 11% of the published attacks, followed by Lockbit3 with 8% and Akira with 6%.