Emotet is still the world’s worst malware – but maybe not for long

by DTM | Posted on

One of the world’s most infamous trojans/malware/droppers, Emotet, seems to be running out of steam a little as the summer holidays begin.

Check Point Research’s recent Global Threat Index for July 2022 found Emotet’s global impact, compared to June, fell by 50% – but warned that it’s still the reigning champion among malware and that won’t change any time soon.

“Emotet continues to dominate our monthly top malware charts,” said Maya Horowitz, VP Research at Check Point Software. “This botnet continually evolves to maintain its persistence and evasion. Its latest developments include a credit card stealer module, meaning that enterprises and individuals must take extra care when making any online purchases. In addition, with Microsoft now confirming that it will block macros by default, we await to see how malwares, such as Snake Keylogger, may change their tactics.”

Emotet still far ahead

Last month was Emotet’s peak, the researchers further stated, adding that the trojan is now back to its standard global impact numbers. While it’s hard to determine exactly what caused this drop, the researchers are speculating it’s most likely just due to the summer holidays, and not because the threat actor is backing out. Emotet constantly introducing new features is evidence to such claims.

That being said, Emotet is still the world’s most widespread malware, with a global impact of 7%. With 3%, Formbook takes second place, followed by XMRig with a 2% global impact. Formbook is a six-year-old infostealer for Windows, marketed as malware-as-a-service, and capable of stealing data from web browsers, collecting screenshots, logging keystrokes, and downloading and executing files. 

Read more

> Google Chrome user profiles under attack from Emotet malware

> Emotet malware impersonates IRS as 2022 tax season approaches

> Keep your business safe with the best endpoint protection

XMRig, on the other hand, is a well-known cryptominer, a piece of software that mines the XMR (Monero) cryptocurrency for attackers. While XMRig isn’t exactly a virus, and doesn’t necessarily steal data or destroy the endpoint it’s installed on, it does use up the majority of the computing power, leaving the device sluggish and underperforming.