- IT threat evolution in Q2 2023
- IT threat evolution in Q2 2023. Non-mobile statistics
- IT threat evolution in Q2 2023. Mobile statistics
These statistics are based on detection verdicts of Kaspersky products and services received from users who consented to providing statistical data.
Quarterly figures
According to Kaspersky Security Network, in Q2 2023:
- Kaspersky solutions blocked 801,934,281 attacks from online resources across the globe.
- A total of 209,716,810 unique links were detected by Web Anti-Virus components.
- Attempts to run malware for stealing money from online bank accounts were stopped on the computers of 95,546 unique users.
- Ransomware attacks were defeated on the computers of 57,612 unique users.
- Our File Anti-Virus detected 39,624,768 unique malicious and potentially unwanted objects.
Financial threats
Financial threat statistics
In Q2 2023, Kaspersky solutions blocked malware designed to steal money from bank accounts on the computers of 95,546 unique users.
Number of unique users attacked by financial malware, Q2 2023 (download)
Geography of financial malware attacks
To evaluate and compare the risk of being infected by banking Trojans and ATM/POS malware worldwide, for each country and territory we calculated the share of Kaspersky users who faced this threat during the reporting period as a percentage of all users of our products in that country or territory.
TOP 10 countries and territories by share of attacked users
Country or territory*
%**
1
Afghanistan
3.7
2
Turkmenistan
3.6
3
Tajikistan
3.2
4
China
2.1
5
Switzerland
2.0
6
Yemen
1.8
7
Egypt
1.7
8
Venezuela
1.6
9
Azerbaijan
1.5
10
Spain
1.4
* Excluded are countries and territories with relatively few Kaspersky users (under 10,000).
** Unique users whose computers were targeted by financial malware as a percentage of all unique users of Kaspersky products in the country/territory.
TOP 10 banking malware families
Name
Verdicts
%*
1
Ramnit/Nimnul
Trojan-Banker.Win32.Ramnit
30.0
2
Zbot/Zeus
Trojan-Banker.Win32.Zbot
25.3
3
Emotet
Trojan-Banker.Win32.Emotet
11.9
4
CliptoShuffler
Trojan-Banker.Win32.CliptoShuffler
5.9
5
Trickster/Trickbot
Trojan-Banker.Win32.Trickster
5.5
6
Danabot
Trojan-Banker.Win32.Danabot
1.7
7
SpyEyes
Trojan-Spy.Win32.SpyEye
1.4
8
Tinba
Trojan-Banker.Win32.Tinba
1.4
9
Qbot/Qakbot
Trojan-Banker.Win32.Qbot
1.4
10
IcedID
Trojan-Banker.Win32.IcedID
0.6
* Unique users who encountered this malware family as a percentage of all users attacked by financial malware.
Ransomware programs
Quarterly trends and highlights
MOVEit Transfer vulnerabilities exploited
The Cl0p ransomware gang began heavily exploiting vulnerabilities in MOVEit Transfer, a secure file transfer software solution used by organizations around the world. In late May, the cybercriminals took advantage of what at the time were zero-day vulnerabilities in the application, successfully compromising the networks of numerous companies and gaining access to confidential data. The vulnerabilities in MOVEit Transfer exploited by the attackers in that series of incidents were later assigned the identifiers CVE-2023-34362, CVE-2023-35708, and CVE-2023-35036.
Attacks on municipal organizations, educational and healthcare establishments
Q2 saw a considerable number of reports about ransomware attacks on municipal organizations, hospitals, and colleges. Among those organizations who had their networks compromised and data stolen, were Louisiana’s Office of Motor Vehicles (OMV) and the Oregon Driver and Motor Vehicle Services Division (DMV). The Cl0p group, which claimed responsibility for the attacks, leveraged the aforementioned MOVEit vulnerability.
The City of Augusta, Georgia was hit by BlackByte; Dallas, Texas, by Royal; Bluefield University, Virginia, by Avos; and the Open University of Cyprus, by Medusa.
According to the FBR, the Bl00dy group attacked educational organizations in May by taking advantage of the CVE-2023-27350 vulnerability in PaperCut, print management software used by tens of thousands of businesses.
Certain ransomware gangs had said they would not target this kind of organizations, but many cybercriminals obviously failed to stick to their declared moral principles.
Most prolific groups
This section looks at ransomware groups that engage in so-called “double extortion”, that is stealing and encrypting confidential data. Most of these groups target large companies, and often maintain a DLS (data leak site), where they publish a list of organizations they have attacked. The list of the busiest ransomware gangs in Q2 2023 looked as follows.
The most prolific ransomware gangs, Q2 2023 (download)
The diagram shows each group’s share in the total number of victims published on all the groups’ DLSs.
Number of new modifications
In Q2 2023, we detected 15 new ransomware families and 1917 new modifications of this malware type.
Number of new ransomware modifications, Q2 2022 — Q2 2023 (download)
Number of users attacked by ransomware Trojans
In Q2 2023, Kaspersky products and technologies protected 57,612 users from ransomware attacks.
Number of unique users attacked by ransomware Trojans, Q2 2023 (download)
Geography of attacked users
TOP 10 countries and territories attacked by ransomware Trojans
Country or territory*
%**
1
Bangladesh
1.38
2
South Korea
1.25
3
Yemen
1.18
4
Taiwan
1.07
5
Mozambique
0.55
6
Pakistan
0.41
7
Iraq
0.33
8
Mainland China
0.29
9
Nigeria
0.27
10
Libya
0.26
* Excluded are countries and territories with relatively few Kaspersky users (under 50,000).
** Unique users whose computers were attacked by ransomware Trojans as a percentage of all unique users of Kaspersky products in the country/territory.
TOP 10 most common families of ransomware Trojans
Name
Verdicts*
Share of attacked users**
1
WannaCry
Trojan-Ransom.Win32.Wanna
13.67
2
Magniber
Trojan-Ransom.Win64.Magni / Trojan-Ransom.Win32.Magni
13.58
3
(generic verdict)
Trojan-Ransom.Win32.Encoder
11.74
4
Stop/Djvu
Trojan-Ransom.Win32.Stop
6.91
5
(generic verdict)
Trojan-Ransom.Win32.Phny
6.01
6
(generic verdict)
Trojan-Ransom.Win32.Crypren
5.58
7
PolyRansom/VirLock
Trojan-Ransom.Win32.PolyRansom / Virus.Win32.PolyRansom
2.88
8
(generic verdict)
Trojan-Ransom.Win32.Agent
2.49
9
CryFile
Trojan-Ransom.Win32.CryFile
1.33
10
Lockbit
Trojan-Ransom.Win32.Lockbit
1.27
* Statistics are based on detection verdicts of Kaspersky products. The information was provided by Kaspersky product users who consented to providing statistical data.
** Unique Kaspersky users attacked by specific ransomware Trojan families as a percentage of all unique users attacked by ransomware Trojans.
Miners
Number of new miner modifications
In Q2 2023, Kaspersky solutions detected 2184 new miner modifications.
Number of new miner modifications, Q2 2023 (download)
Number of users attacked by miners
In Q2, we detected attacks using miners on the computers of 384,063 unique users of Kaspersky products worldwide.
Number of unique users attacked by miners, Q2 2023 (download)
Geography of miner attacks
TOP 10 countries and territories attacked by miners
Country or territory*
%**
1
Tajikistan
3.06
2
Kazakhstan
2.14
3
Kyrgyzstan
1.97
4
Uzbekistan
1.89
5
Venezuela
1.81
6
Mozambique
1.68
7
Belarus
1.54
8
Ukraine
1.47
9
Rwanda
1.28
10
Ethiopia
1.28
* Excluded are countries and territories with relatively few users of Kaspersky products (under 50,000).
** Unique users attacked by miners as a percentage of all unique users of Kaspersky products in the country/territory.
Vulnerable applications used by criminals during cyberattacks
Quarterly highlights
Q2 2023 was notable for the discovery of a series of vulnerabilities that impacted a fairly large number of organizations. The most resonant ones were the aforementioned vulnerabilities in MOVEit Transfer: CVE-2023-34362, CVE-2023-35036, and CVE-2023-35708. To exploit these, attackers used SQL injection to get access to the database and execute code on the server side.
The PaperCut print management application was plagued by a similar critical issue: a vulnerability designated as CVE-2023-27350. Attackers can use it to run a command in the operating system with System permissions with a specially crafted request. The vulnerability has been used by criminals as well.
New vulnerabilities in Google Chrome, Microsoft Windows, and Microsoft Office were discovered while detecting attacks on user systems. Google Chrome was found to contain two type confusion vulnerabilities (CVE-2023-2033 and CVE-2023-3079 ) and one integer overflow vulnerability (CVE-2023-2136). The above vulnerabilities, detected while they were being exploited, allowed an attacker to escape the browser sandbox. Developers’ patches for the relevant software are available.
Zero-day vulnerabilities were found in Windows while preventing attacks on users, with one of these (CVE-2023-28252) discovered by Kaspersky researchers. CVE-2023-29336, a Win32k subsystem flaw that allowed attackers to gain System privileges, and CVE-2023-24932 a Secure Boot bypass vulnerability that malicious actors could leverage to replace any system files, were discovered in Q2 as well. Microsoft fixes for each of the vulnerabilities are out, and we strongly encourage you to install all the relevant patches.
Vulnerability statistics
Kaspersky products detected roughly 300,000 exploitation attempts in Q2. Most of the detects, as always, were associated with Microsoft Office applications. Their share (75.53%) of the total was almost 3 pp below the previous period’s figure.
The most frequently exploited vulnerabilities were as follows:
- CVE-2017-11882 and CVE-2018-0802: Equation Editor vulnerabilities that allow corrupting application memory during formula processing to then run arbitrary code in the system
- CVE-2017-0199 allows using MS Office to load malicious scripts.
- CVE-2017-8570 allows loading malicious HTA scripts into the system.
The next most common category was browser exploits (8.2% of the total, or 1 pp below the Q1 figure).
This was followed by exploits for the Java platform (4.83%), Android (4.33%), and Adobe Flash (4.10%).
Distribution of exploits used by cybercriminals, by type of attacked application, Q2 2023 (download)
The online threats in Q2 2023, as before, consisted of MSSQL and RDP brute-force attacks. EternalBlue and EternalRomance remained popular exploits for operating system vulnerabilities. Notable numbers of attacks and scans that targeted log4j-type vulnerabilities (CVE-2021-44228) were recorded.
Attacks on macOS
A version of the Lockbit for macOS was discovered in Q2. This ransomware used to target Linux, but now the operators have extended its reach.
The JokerSpy Python backdoor deployed modified TCC databases to the target device during an attack to bypass restrictions when starting applications on that device.
TOP 20 threats for macOS
Verdict
%*
1
AdWare.OSX.Agent.ai
8.90
2
AdWare.OSX.Agent.gen
8.54
3
AdWare.OSX.Pirrit.ac
7.44
4
AdWare.OSX.Amc.e
6.65
5
AdWare.OSX.Bnodlero.ax
6.44
6
Monitor.OSX.HistGrabber.b
6.20
7
AdWare.OSX.Agent.ap
4.62
8
AdWare.OSX.Pirrit.j
4.62
9
Trojan.OSX.Agent.gen
4.33
10
Hoax.OSX.MacBooster.a
4.12
11
AdWare.OSX.Pirrit.ae
3.28
12
Trojan-Downloader.OSX.Agent.h
2.90
13
AdWare.OSX.Bnodlero.bg
2.80
14
AdWare.OSX.Agent.ao
2.78
15
Downloader.OSX.InstallCore.ak
2.46
16
Monitor.OSX.Agent.a
2.20
17
AdWare.OSX.Pirrit.aa
2.06
18
Backdoor.OSX.Twenbc.g
1.89
19
Backdoor.OSX.Twenbc.h
1.77
20
Hoax.OSX.IOBooster.gen
1.75
* Unique users who encountered this malware as a percentage of all users of Kaspersky security solutions for macOS who were attacked.
In Q2, macOS users mainly encountered adware and “system optimizers” that asked money for fixing problems that did not exist.
Geography of threats for macOS
TOP 10 countries and territories by share of attacked users
Country or territory*
%**
1
Hong Kong
1.40
2
Mainland China
1.19
3
Italy
1.16
4
France
1.06
5
United States
1.04
6
Mexico
0.98
7
Spain
0.96
8
Australia
0.86
9
United Kingdom
0.81
10
Russian Federation
0.81
* Excluded from the rankings are countries and territories with relatively few users of Kaspersky security solutions for macOS (under 10,000).
** Unique attacked users as a percentage of all users of Kaspersky macOS security products in the country/territory.
Hong Kong and mainland China had the largest shares of attacked macOS users: 1.4% and 1.19%, respectively. The frequency of attacks in Italy, Spain, France, Russia, Mexico, and Canada was down. Other countries saw insignificant changes.
IoT attacks
IoT threat statistics
In Q2 2023, most devices that attacked Kaspersky honeypots again used the Telnet protocol.
Telnet
75.49%
SSH
24.51%
Distribution of attacked services by number of unique IP addresses of attacking devices, Q2 2023
In terms of session numbers, Telnet accounted for the absolute majority.
Telnet
95.63%
SSH
4.37%
Distribution of cybercriminal working sessions with Kaspersky traps, Q2 2023
Attacks on IoT honeypots
The main sources of SSH attacks in Q2, as usual, were the United States (11.5%) and Asia and the Pacific. The increase in mainland China’s share was especially notable: from 6.80% to 12.63%.
TOP 10 countries/territories as sources of SSH attacks
Country/territory
%*
Q1 2023
Q2 2023
Mainland China
6.80
12.63
United States
12.05
11.50
South Korea
7.64
6.21
Singapore
3.63
5.32
India
4.45
5.01
Taiwan
12.13
4.85
Brazil
5.08
4.57
Germany
4.00
4.21
Russian Federation
3.36
3.73
Vietnam
3.95
3.39
Other
36.91
41.96
* Unique IP addresses located in a country/territory as a percentage of all unique IP addresses where SSH attacks on Kaspersky honeypots originated.
The share of both SSH and Telnet attacks originating on the island of Taiwan decreased noticeably. The share of Telnet attacks coming from mainland China dropped to 35.38%, but that country is still the leader. Vietnam’s share, on the contrary, rose significantly, from 0.88% to 5.39%. India (14.03%) and Brazil (6.36%) maintained second and third place, respectively.
TOP 10 countries/territories as sources of Telnet attacks
Country/territory
%*
Q1 2023
Q2 2023
Mainland China
39.92
35.38
India
12.06
14.03
Brazil
4.92
6.36
Vietnam
0.88
5.39
United States
4.30
4.41
Russian Federation
4.82
4.33
Taiwan
7.51
2.79
South Korea
2.59
2.51
Argentina
1.08
2.24
Pakistan
1.41
2.17
Other
19.58
20.40
* Unique IP addresses located in a country/territory as a percentage of all unique IP addresses where Telnet attacks on Kaspersky honeypots originated.
TOP 10 threats delivered to IoT devices via Telnet
Verdict
%*
1
Trojan-Downloader.Linux.NyaDrop.b
53.82
2
Backdoor.Linux.Mirai.b
40.72
3
Backdoor.Linux.Mirai.ew
2.31
4
Backdoor.Linux.Mirai.ek
0.85
5
Backdoor.Linux.Mirai.es
0.47
6
Backdoor.Linux.Mirai.fg
0.32
7
Backdoor.Linux.Mirai.cw
0.22
8
Backdoor.Linux.Mirai.gen
0.17
9
Trojan-Downloader.Shell.Agent.p
0.14
10
Backdoor.Linux.Gafgyt.gi
0.13
* Share of each threat delivered to infected devices as a result of a successful Telnet attack out of the total number of delivered threats.
Attacks via web resources
The statistics in this section are based on Web Anti-Virus, which protects users when malicious objects are downloaded from malicious/infected web pages. Cybercriminals create these sites on purpose; they can infect hacked legitimate resources as well as web resources with user-created content, such as forums.
Countries and territories that serve as sources of web-based attacks: TOP 10
The following statistics show the distribution by country or territory of the sources of internet attacks blocked by Kaspersky products on user computers (web pages with redirects to exploits, sites hosting malicious programs, botnet C&C centers, etc.). Any unique host could be the source of one or more web-based attacks.
To determine the geographic source of web attacks, the GeoIP technique was used to match the domain name to the real IP address at which the domain is hosted.
In Q2 2023, Kaspersky solutions blocked 801,934,281 attacks launched from online resources across the globe. A total of 209,716,810 unique links were detected by Web Anti-Virus components.
Distribution of web-attack sources by country/territory, Q2 2022 (download)
Countries and territories where users faced the greatest risk of online infection
To assess the risk of online infection faced by users in various countries/territories, we calculated the percentage of Kaspersky users on whose computers Web Anti-Virus was triggered at least once during the quarter in each country/territory. The resulting data provides an indication of the aggressiveness of the environment in which computers operate in different countries and territories.
Note that these rankings only include attacks by malicious objects that fall under the Malware class; they do not include Web Anti-Virus detections of potentially dangerous or unwanted programs, such as RiskTool or adware.
Country or territory*
%**
1
Greece
13.65
2
Turkey
13.62
3
Taiwan
13.02
4
Algeria
12.97
5
Albania
12.89
6
Serbia
12.72
7
Qatar
12.41
8
Palestine
12.05
9
Sri Lanka
11.97
10
Nepal
11.96
11
Tunisia
11.74
12
Portugal
11.71
13
Bangladesh
11.47
14
Hungary
11.44
15
Belarus
11.29
16
Bulgaria
11.03
17
Panama
10.99
18
Yemen
10.87
19
Slovakia
10.80
20
UAE
10.67
* Excluded are countries and territories with relatively few Kaspersky users (under 10,000).
** Unique users targeted by Malware-class attacks as a percentage of all unique users of Kaspersky products in the country/territory.
On average during the quarter, 8.68% of internet users’ computers worldwide were subjected to at least one Malware-class web attack.
Local threats
In this section, we analyze statistical data obtained from the OAS and ODS modules of Kaspersky products. It takes into account malicious programs that were found directly on users’ computers or removable media connected to them (flash drives, camera memory cards, phones, external hard drives), or which initially made their way onto the computer in non-open form (for example, programs in complex installers, encrypted files, etc.).
In Q2 2023, our File Anti-Virus detected 39,624,768 malicious and potentially unwanted objects.
Countries and territories where users faced the highest risk of local infection
For each country and territory, we calculated the percentage of Kaspersky product users on whose computers File Anti-Virus was triggered during the reporting period. These statistics reflect the level of personal computer infection in different countries/territories.
These rankings only include attacks by malicious programs that fall under the Malware class; they do not include File Anti-Virus triggerings in response to potentially dangerous or unwanted programs, such as RiskTool or adware.
Country or territory*
%**
1
Turkmenistan
43.95
2
Afghanistan
43.39
3
Yemen
40.68
4
Tajikistan
40.20
5
Myanmar
36.25
6
Burundi
36.23
7
Syria
35.70
8
Benin
35.50
9
Burkina Faso
35.15
10
Rwanda
34.76
11
Chad
34.23
12
Cameroon
33.98
13
South Sudan
33.91
14
Democratic Republic of the Congo
33.90
15
Guinea
33.82
16
Republic of the Congo
33.55
17
Bangladesh
33.42
18
Algeria
33.36
19
Niger
33.28
20
Mali
33.14
* Excluded are countries and territories with relatively few Kaspersky users (under 10,000).
** Unique users on whose computers Malware-class local threats were blocked, as a percentage of all unique users of Kaspersky products in the country/territory.
On average worldwide, Malware-class local threats were registered on 15.74% of users’ computers at least once during Q2. Russia scored 16.49% in these rankings.
Source:: Securelist