Bitdefender Threat Debrief | December 2021

The Bitdefender Threat Debrief (BDTD) is a monthly series analyzing threat news, trends, and research from the previous month. You can find all previous debriefs here. 

Highlight of the month: Log4Shell/Log4j vulnerability

On December 9, 2021, Apache disclosed CVE-2021-44228, a remote code execution vulnerability – assigned with a severity of 10 (the highest possible risk score). 

The source of the vulnerability is Log4j, a logging library commonly used by a wide range of applications. The Log4j library is widely used by other frameworks, such as Elasticsearch, Kafka and Flink, that are foundational for many popular web sites and services, but it is also a common component in custom enterprise systems. 

We covered the impact on Bitdefender products and services, but also worked with our Bitdefender Labs to provide a deep dive overview and types of attacks in the field. 

Ransomware Report

Spear phishing attacks are often used as an initial attack vector. Ransomware infection is often the final stage of the same kill chain. For this report, we analyzed malware detections collected in November 2021 from our static anti-malware engines. Note: we only count total cases, not how monetarily significant the impact of infection is. Opportunistic adversaries and some Ransomware-as-a-Service (RaaS) groups represent a higher percentage compared to groups that are more selective about their targets, since they prefer more volume instead of higher value. 

When looking at this data, remember these are ransomware detections, not infections. 

Top 10 Ransomware Families

For this report, we analyzed 10.8 million malware detections from November 1st to November 30th. In total, we identified 222 ransomware families. Number of detected ransomware families can vary each month, depending on the current ransomware campaigns in different countries.  

Top 10 Countries

In total, we detected ransomware from 165 countries in our data set this month. Ransomware continues to be a threat that touches almost the entire world. Below is a list of the top 10 countries most impacted by ransomware. Most ransomware attacks continue to be opportunistic, and the size of population is correlated to the number of detections. 

Top 10 Industries

For our data set, we have been able to assign 20% of detections to specific industries. Telecommunications services are particularly high as their customers are included within the detections.

Android Trojans

Below are the top 10 trojans that we have seen in our telemetry for November 2021.

Android.Trojan.Downloader.DN – Repacked applications taken from Google App Store and bundled with aggressive adware. Some adware downloads other malware variants.

Android.Trojan.HiddenApp.AID - Aggressive adware that impersonates adblock applications. When running for the first time, it asks permission to display on top of other apps. With this permission, the application can hide from the launcher.

Android.Trojan.SLocker.BRM - Applications that block access to devices by displaying a screen that appears over every window, so that the user is frozen. This is a simplistic version of mobile ransomware.

Android.Trojan.Banker.XJ - Applications that drop and install encrypted modules. This trojan grants device admin privileges, and gains access to manage phone calls and text messages. After deploying, it maintains a connection with the C&C server to receive command and upload sensitive information.

Android.Trojan.Banker VF, XH - Polymorphic applications that impersonate legit apps (Google, Facebook, Sagawa Express ...). Once installed, it locates banking applications installed on the device and tries to download a trojanized version from the C&C server.

Android.Trojan.Banker.XK, XX - Applications that impersonate Korean banking applications to record audio and video, collect sensitive information and upload it to a C&C server.

Trojan.Dropper.AIF - Polymorphic applications that drop and install encrypted modules. After the first run, their icons are hidden from the launcher.

Homograph Phishing Report

Here we focus on homograph attacks that abuse international domain names (IDN). Threat actors create international domain names that spoof a target domain name. When we talk about “target” of IDN homograph phishing attacks, we refer to the domain that threat actors are trying to impersonate. You can read more about this type of attack in one of our previous reports.

Below is the list of the top 10 most common targets for phishing sites. AliExpress leads the list, probably caused by Singles Day in November (the world’s largest annual shopping event in China).

Summary

We strongly advise all customers to take immediate action on Log4j vulnerability and deploy all existing patches and mitigations recommended in advisories. This is a highly dynamic situation, and it will take a significant amount of time to understand the impact and implications of this vulnerability.

To stay ahead of attackers, keep up to date with the latest threats and best practices. Subscribe to the Business Insights blog, follow us on Twitter, and don’t miss the next BDTD release.

We hope you have found this BDTD report interesting. Leave us a comment and let us know what you think.

About Bitdefender Threat Debrief

Bitdefender provides cybersecurity solutions and advanced threat protection to hundreds of millions of endpoints worldwide. More than 150 technology brands have licensed and added Bitdefender technology to their product or service offerings. This vast OEM ecosystem complements telemetry data already collected from our business and consumer solutions. To give you some idea of the scale, Bitdefender Labs discover 400+ new threats each minute and validate 30 billion threat queries daily. This gives us one of the industry’s most extensive real-time views of the evolving threat landscape.

 

We would like to thank Bitdefenders Alin Damian, Mihai Leonte, Ioan Marculet, Andrei Mogage, Ioan Stan, Marius Tivadar, and Horia Zegheru (sorted alphabetically) for their help with putting this report together.