Back 
Netskope Threat Labs publishes a monthly summary blog post of the top threats we are tracking on the Netskope platform. The purpose of this post is to provide strategic, actionable intelligence on active threats against enterprise users worldwide.
Summary
- Malware downloads from SharePoint doubled, caused by a DarkGate malware campaign that lures victims into downloading and opening a malicious LNK file that starts an infection chain resulting in the final DarkGate payload.
- Attackers continue to attempt to fly under the radar by using cloud apps to deliver malware, with 55% of all malware downloads in September originating from 162 cloud apps.
- The Phobos ransomware and also the famous evasive malware RaspberryRobin were among the top malware families detected on the Netskope platform in September.
Cloud Malware Delivery
Attackers attempt to fly under the radar by delivering malicious content via popular cloud apps. Abusing cloud apps for malware delivery enables attackers to evade security controls that rely primarily on domain block lists and URL filtering, or that do not inspect cloud traffic. In September 2023, 55% of all HTTP/HTTPS malware downloads originated from popular cloud apps, 4% more when compared to August.
The total number of cloud apps from which malware downloads originated is the highest since March, with 162 distinct cloud apps used for malware download.
Attackers achieve the most success reaching enterprise users when they abuse cloud apps that are already popular in the enterprise. Microsoft OneDrive, the most popular enterprise cloud app, has held the top spot for the most cloud malware downloads for more than six months. Malware downloads from SharePoint increased significantly in September due to the recent DarkGate malware campaign, moving to the second place spot and dropping last month’s second place app (Microsoft Live Outlook) to fourth place. The top ten apps remained largely unchanged and included free software hosting sites (GitHub), free web hosting services (Weebly), cloud storage apps (Google Drive, Box, Azure Blob Storage), and document sharing apps (DocPlayer). In total, the top ten accounted for nearly three-quarters of all cloud malware downloads, with the remaining one-quarter spread over 157 other cloud apps. The top ten list is a reflection of attacker tactics, user behavior, and company policy.
DarkGate malware campaign and the rise of SharePoint
A campaign using SharePoint to distribute the DarkGate malware was observed in September, resulting in a relative increase of malware downloads from SharePoint from 7% in August to 15% in September. The infection chain starts with the victim being lured to download a ZIP file from SharePoint and clicking on a LNK file disguised as a PDF file. Both the ZIP and PDF files are named in a way to be attractive to the victim. Some examples of those names are “Company_Transformations.pdf.lnk”, “Employees_Affected_by_Transition.pdf.lnk” and “Fresh_Mission_and_Core_Values.pdf.lnk”. Once the user clicks on the LNK file, a VBS script is downloaded and executed, which downloads an AutoIt script responsible for executing the DarkGate payload. The following is an example of the commands executed by the LNK file via cmd.exe:
Top Malware File Types
Although malicious PDF files fell slightly since August, they are still in the top spot for the third consecutive month. Malicious EXE files edged out ZIP files for the second spot, while the rest of the top malicious file types remained largely unchanged from last month.
Top Malware Families
Attackers are constantly creating new malware families and new variants of existing families, either as an attempt to bypass security solutions or to update their malware’s capabilities. In September 2023, 67% of all malware downloads detected by Netskope were either new families or new variants that had not been observed in the preceding six months. The other 33% were samples that had been previously observed during the preceding six months and are still circulating in the wild.
By volume, Netskope blocks more Trojans than any other malware type. Trojans are commonly used by attackers to gain an initial foothold and to deliver other types of malware, such as infostealers, Remote Access Trojans (RATs), backdoors, and ransomware. Remaining in second place, but still rising in popularity, were malware samples related to phishing campaigns.
The following list contains the top malware and ransomware families blocked by Netskope in September 2023:
- Adware.Bundlore (a.k.a. SurfBuyer) is an OSX adware installer that has circulated in many forms including Flash player installers, hidden scripts, and browser plugins. Details