June 2020’s most wanted malware

Issue 5 2020 Cyber Security

Check Point Research has published its latest Global Threat Index for June 2020. Researchers found that in the past month the Phorpiex botnet has been delivering the Avaddon ransomware, a new Ransomware-as-a-Service (RaaS) variant that emerged in early June, via malspam campaigns, causing it to jump up 13&nbp;places to second in the Top Malware listing and doubling its impact on organisations worldwide compared to May.

As reported previously by Check Point researchers, Phorpiex is known for spreading large-scale sextortion malspam campaigns, as well as distributing other malware families. The latest malspam messages distributed via Phorpiex try to entice recipients into opening a Zip file attachment by using a wink emoji in the email subject. If a user clicks on the file, the Avaddon ransomware is activated, scrambling data on the computer and demanding a ransom in return for file decryption. In its 2019 research, Check Point found over a million Phorpiex-infected Windows computers. Researchers estimated the annual criminal revenue generated by the Phorpiex botnet at approximately US$500 000.

Meanwhile, the Agent Tesla remote access trojan and info-stealer continued to have a significant impact throughout June, moving up from 2nd place in May to 1st place, while the XMRig cryptominer remains in 3rd place for the second month running.

“In the past, Phorpiex, also known as Trik, was monetised by distributing other malware such as GandCrab, Pony or Pushdo, using its hosts to mine cryptocurrency, or for sextortion scams. It’s now being used to spread a new ransomware campaign,” said Maya Horowitz, director, Threat Intelligence & Research, Products at Check Point. “Organisations should educate employees about how to identify the types of malspam that carry these threats, such as the latest campaign targeting users with emails containing a wink emoji, and ensuring they deploy security that actively prevents them from infecting their networks.”

The research team also warns that “OpenSSL TLS DTLS Heartbeat Information Disclosure” is the most common exploited vulnerability, impacting 45% of organisations globally, closely followed by “MVPower DVR Remote Code Execution” which impacts 44% of organisations worldwide. “Web Server Exposed Git Repository Information Disclosure” remains in third place, with a global impact of 38%.

Top malware families

This month Agent Tesla is the most popular malware with a global impact of 3% of organisations, closely followed by Phorpiex and XMRig affecting 2% of organisations each.

1. Agent Tesla - Agent Tesla is an advanced RAT functioning as a keylogger and information stealer, which is capable of monitoring and collecting the victim's keyboard input, system clipboard, taking screenshots, and exfiltrating credentials belonging to a variety of software installed on a victim's machine (including Google Chrome, Mozilla Firefox and Microsoft Outlook email client).

2. Phorpiex - Phorpiex is a botnet known for distributing other malware families via spam campaigns as well as fuelling large-scale sextortion campaigns.

3. XMRig - XMRig is open-source CPU mining software used for the mining process of the Monero cryptocurrency, and first seen in the wild on May 2017.

The complete list of the top 10 malware families in June can be found at.

Check Point’s Threat Prevention Resources are available at




Share this article:
Share via emailShare via LinkedInPrint this page



Further reading:

Cyber Talent: It is more about Talent than Cyber
Issue 7 2020 , Cyber Security
Four million trained workers are needed to fully bridge the skills gap in the cybersecurity field around the world and properly defend organisations against threat actors.

Read more...
Increased cloud visibility and security
Issue 7 2020 , Cyber Security
Sophos adds cloud visibility features from Cloud Optix to Intercept X Advanced for Server with EDR.

Read more...
Ransomware and customer loyalty
Issue 7 2020 , Cyber Security
Arcserve research uncovers links between ransomware, consumer purchasing behaviour and brand loyalty.

Read more...
IoT will transform industrial security
Issue 7 2020, Kaspersky , Cyber Security
55% of organisations globally are confident the Internet of Things will change the state of security in industrial control systems (ICS).

Read more...
BYOD: bring your own danger
Issue 7 2020 , Cyber Security
Five cybersecurity threats that jeopardise the security of mobile devices and the keys to optimising their protection in a connected world.

Read more...
The arms race of AI in cybersecurity
CCTV Handbook 2020, Axis Communications SA , Cyber Security
Cybersecurity goes further than network video and audio, but these are as likely to be targeted as much as any network-connected device.

Read more...
Exploiting the global pandemic
Issue 7 2020 , Cyber Security
Cyber criminals targeting remote work to gain access to enterprise networks and critical data reports FortiGuard Labs.

Read more...
Integrated security is key to Huawei Mobile Services
Issue 7 2020 , Cyber Security
To ensure sufficient mobile device security, the technology giant incorporates security into its chip, device and cloud capabilities.

Read more...
Cybersecurity becomes key enabler of sustainable business growth
Issue 7 2020 , Cyber Security
The adoption of rushed digital transformation strategies has left many facing unintended complexities and challenges.

Read more...
Africa under cyber-attack
Issue 7 2020, Kaspersky , Cyber Security
Kaspersky has reported that South Africa, Kenya and Nigeria saw millions of cyber-attacks in 2020 and the year is not over yet.

Read more...