Netskope
Threat Labs
Report: LATAM

Le rapport Netskope Threat Labs met en lumière un segment différent chaque mois. L'objectif de cette série de rapports est de fournir des informations stratégiques et exploitables sur les menaces actives qui pèsent sur les utilisateurs dans chaque segment. Le segment mis en évidence dans ce rapport est celui des utilisateurs d'Amérique latine.

LATAM
juillet 2023

Dans ce rapport Adoption des applications Cloud

Les applications cloud les plus populaires Les meilleures applications utilisées pour les téléchargements Les meilleures applications utilisées pour les téléchargements

Utilisation abusive des applications Cloud

Diffusion de logiciels malveillants dans le cloud Applications cloud utilisées à mauvais escient pour diffuser des logiciels malveillants

Logiciels malveillants et ransomwares

Principaux types de logiciels malveillants Les meilleures familles de rançongiciels Malware &

Recommandations Netskope Threat Labs À propos de ce rapport

10 minutes de lecture

Dans ce rapport

Cloud App Adoption: OneDrive is the most popular app among users in Latin America, followed by Google Drive and Microsoft Teams. Overall, Google apps are more popular in LATAM, while Microsoft apps are more popular in other regions, with the exception of OneDrive and Outlook. Communication apps, such as WhatsApp, Google Chat, and Slack, are significantly more popular among users in Latin America when compared to other regions.

Cloud App Abuse: Attackers are increasingly abusing cloud apps as a malware delivery channel in Latin America, where cloud-delivered malware increased from 47% to 71% in the past twelve months, led by malware downloads from popular apps, including Microsoft OneDrive, Amazon S3, and Outlook.

Malware & Ransomware: The most common types of malware blocked by Netskope in Latin America were Trojans, followed by downloaders, and backdoors. Grandoreiro and Mekotio, which are banking Trojans, are among the top malware families blocked by Netskope in Latin America. LockBit and BlackCat are among the top ransomware blocked by Netskope in the same period.

test answer

Adoption des applications Cloud

Cloud app adoption continues to increase in Latin America, with enterprises using cloud apps to improve productivity and enable hybrid workforces. The number of apps a user in Latin America interacts with has increased from 22 to 25 apps over the past twelve months, ahead of other regions. The 12-month average of 23 apps in Latin America is slightly higher than the average of 22 apps in other regions. The top 1% of users in Latin America interacted with 75 apps per month, compared to 96 apps in other regions.

Average apps per user Latin America vs Other Regions - Last 12 Months

Users in Latin America downloaded data from cloud apps at almost the same rate as users throughout other regions, with 95% of users downloading data from cloud apps in Latin America each month, versus 93% in other regions. In the last 12 months, 72% of users in Latin America, on average, uploaded data to cloud apps, compared to 64% of users in other regions. Over the past 12 months, the number of users uploading to cloud apps in Latin America increased 4% between July 2022 and June 2023, growing almost at the same rate as other regions.

Percentage of users uploading data Latin America vs Other Regions - Last 12 Months

Les applications cloud les plus populaires

OneDrive is the most popular app in Latin America and other regions, with an average of 50% and 47% users per day, respectively. Google apps, such as Drive, Gmail, and Google Cloud Storage, are more popular among users in Latin America, on average, when compared to other regions. Microsoft apps, with the exception of OneDrive and Outlook, are more popular in regions other than Latin America. This is especially true for SharePoint, with 28% of users on average in other regions versus 17% of users in Latin America. YouTube and WhatsApp are also more popular among users in Latin America, especially WhatsApp, with 5.6x more usage. Facebook is also a popular app among users in LATAM, with a slightly higher average of use compared to other regions.

Overall App Popularity Latin America vs Other Regions

Les meilleures applications utilisées pour les téléchargements

In addition to being the most popular app overall, Microsoft OneDrive is also the most popular app used for uploads, with 21% of users regularly uploading data on average per day in Latin America, which is slightly lower compared to other regions. Communication apps, such as WhatsApp, Google Chat, and Slack, are more popular for uploads among users in Latin America than in other regions, especially WhatsApp, with 7.7x more usage. Mail apps, such as Google Gmail and Microsoft Outlook, are also more popular among users in Latin America than other regions.

Google Drive is also more popular in Latin America when compared to other regions, with 4.2% of users uploading data on average each day. Other popular apps for uploads in Latin America are SharePoint, Instagram, and Box, with Instagram being used 2.5x more in Latin America.

Apps Used for Uploads Latin America vs Other Regions

Les meilleures applications utilisées pour les téléchargements

OneDrive leads the most popular cloud apps for downloads by users in Latin America, with 23% of users per day on average. Communication apps, such as WhatsApp and Slack, are popular apps among users in Latin America for downloads, especially WhatsApp, with 5.8x more usage when compared to other regions. Sharepoint holds the third place, with 11% of users downloading data on average, but less popular in Latin America when compared to other regions.

Les applications cloud pour le stockage de fichiers, telles que Google Cloud Storage, Azure Blob Storage, Amazon S3 et Google Drive, sont plus populaires parmi les utilisateurs d’Amérique latine pour les téléchargements que dans d’autres régions. Les applications de messagerie, comme Google Gmail et Outlook, sont également populaires parmi les utilisateurs d’Amérique latine pour les téléchargements.

Apps Used for Downloads Latin America vs Other Regions

Utilisation abusive des applications Cloud

Diffusion de logiciels malveillants dans le cloud

The popularity of cloud malware delivery in Latin American organizations has increased significantly in the past 12 months, increasing from 47% in July 2022 to 71% in June 2023. The 12-month average in Latin American organizations is slightly higher compared to other regions, with 61% of malware downloads from users in Latin America compared to 57% in other regions. Attackers attempt to fly under the radar by delivering malicious content via popular cloud apps. Abusing cloud apps for malware delivery enables attackers to evade security controls that rely primarily on domain block lists and URL filtering, or that do not inspect cloud traffic.

Malware Delivery, Cloud vs. Web Latin America vs Other Regions - Last 12 Months

Compared to other regions, Latin America has a higher average of malware downloads from the cloud, with 61% on average, behind only Australia.

Malware Sourced from the Cloud Last 12 Months Average LATAM

Applications cloud utilisées à mauvais escient pour diffuser des logiciels malveillants

In the last 12 months, Microsoft OneDrive was the most popular cloud app abused for malware downloads in Latin American organizations, representing 21% of all cloud malware downloads. As highlighted earlier in this report, Microsoft OneDrive is also the most popular app among users in Latin America, which makes it both an useful app for attackers seeking to target a wide variety of organizations using the same toolset, and also makes it more likely that the malicious payloads would reach their targets.

Amazon S3 is the second most popular app for malware downloads in Latin American organizations, with 11% of users on average in the last 12 months, significantly above the average in other regions. Mail apps (Outlook, Gmail) are also popular for malware downloads in Latin America, especially Outlook, with 7.5% of downloads on average. GitHub is also commonly abused in Latin America for malware downloads, with a similar average when compared to other regions.

Other apps for file storing/sharing, like Azure Blob Storage, Google Drive, SharePoint, and Dropbox, are also commonly abused in Latin America for malware downloads. The free web hosting service Weebly is also popular for malware downloads in Latin American organizations, but less so than other regions.

Top Cloud Apps Abused for Malware Download Last 12 Months Latin America vs Other Regions

Logiciels malveillants et ransomwares

Principaux types de logiciels malveillants

The most common malware detected by Netskope in Latin America in the last twelve months were Trojans, which are commonly used by attackers to gain an initial foothold and deliver other types of malware, such as infostealers, remote access Trojans, backdoors, and ransomware. The second most common type of malware are downloaders, which, like Trojans, are also used to deliver other types of malware.

Rounding out the top three are backdoors. Like Trojans, some malware payloads blocked in this category can also fit other categories, because they provide not only clandestine remote access, but also keylogging, file manipulation, registry manipulation, and other malicious features. Malware in this category include Remcos, Quakbot, and NjRAT (a.k.a Bladabindi).

Most Common Types of Malware Last 12 Months Latin America vs Other Regions

Les meilleures familles de rançongiciels Malware &

Infostealer.AgentTesla est un . Cheval de Troie d’accès à distance basé sur NET avec de nombreuses capacités, telles que le vol des mots de passe des navigateurs, la capture des frappes au clavier, le presse-papiers, etc.

Botnet.Emotet is one of the most prevalent botnets in the cyber threat landscape, often used to deliver other malware such as TrickBot.

Downloader.Banload est un téléchargeur basé sur Java largement utilisé pour diffuser divers malwares, en particulier des chevaux de Troie bancaires.

Trojan.Grandoreiro is a Latin America banking trojan with the goal of stealing sensitive banking information, commonly targeting Brazil, Mexico, Spain, and Peru.

Downloader.Guloader is a small downloader known for delivering RAT and infostealers, such as AgentTesla, Formbook, and Remcos.

Trojan.Mekotio is a banking Trojan that usually targets customers of financial institutions based in Latin America.

Trojan.FormBook (alias XLoader) est un logiciel malveillant qui offre un contrôle total sur les machines infectées, offrant de nombreuses fonctionnalités telles que le vol de mots de passe et l’exécution de logiciels malveillants supplémentaires.

Infostealer.Dridex has been around since at least 2015 and has had its botnet infrastructure taken down multiple times, but continues to re-emerge with new features and new infrastructure.

Ransomware.LockBit 3.0 (a.k.a. Black) is the latest version of the LockBit ransomware, emerged in September 2019, becoming one of the most relevant RaaS groups in the world.

Ransomware.BlackCat (a.k.a. ALPHV and Noberus) is a Ransomware-as-a-Service (RaaS) group that emerged in November 2021, making headlines for being a sophisticated ransomware written in Rust.

Recommandations

This report highlighted increasing cloud adoption, including increases of data being uploaded to and downloaded from a wide variety of cloud apps. It also highlighted an increasing trend of attackers abusing a wide variety of cloud apps, especially popular enterprise apps, to deliver malware to their victims. The malware samples were primarily Trojans, but also included downloaders, backdoors, file-based exploits, ransomware, and infostealers. Netskope Threat Labs recommends organizations in Latin America review their security posture to ensure that they are adequately protected against these trends:

Inspectez tous les téléchargements HTTP et HTTPS, y compris le trafic sur le Web et le cloud, afin d'empêcher les malwares de s'infiltrer dans votre réseau. Les clients Netskope peuvent configurer leur Next Gen Secure Web GatewayNetskope avec une stratégie de protection contre les menaces qui s’applique aux téléchargements de toutes les catégories et à tous les types de fichiers.
Assurez-vous que les types de fichiers à haut risque, tels que les exécutables et les archives, sont minutieusement inspectés à l'aide d'une combinaison d'analyses statiques et dynamiques avant d'être téléchargés. Les clients de Netskope Advanced Threat Protection peuvent utiliser une politique de prévention du patient zéro pour bloquer les téléchargements jusqu’à ce qu’ils aient été entièrement inspectés.
Configurez des politiques pour bloquer les téléchargements depuis des applications et des instances qui ne sont pas utilisées dans votre organisation afin de réduire le risque aux seules applications et instances nécessaires à l'activité.
Configurez des stratégies pour bloquer les téléchargements vers des applications et des instances qui ne sont pas utilisées dans votre organisation afin de réduire le risque d’exposition accidentelle ou délibérée des données par des initiés ou d’abus par des attaquants.
Utilisez un système de prévention des intrusions (IPS) capable d'identifier et de bloquer les modèles de trafic malveillants, tels que le trafic de commande et de contrôle associé à des logiciels malveillants populaires. Le blocage de ce type de communication peut éviter de nouveaux dégâts en limitant la capacité de l'attaquant à effectuer des actions supplémentaires.

In addition to the recommendations above, Remote Browser Isolation (RBI) technology can provide additional protection when there is a need to visit websites that fall into categories that can present higher risk, like Newly Observed and Newly Registered Domains.

Netskope Threat Labs

Composé des plus grands chercheurs du secteur des menaces et des logiciels malveillants dans le cloud, Netskope Threat Labs découvre, analyse et conçoit des défenses contre les dernières menaces cloud affectant les entreprises. Nos chercheurs interviennent régulièrement et font du bénévolat lors de conférences de haut niveau sur la sécurité, notamment DefCon, BlackHat et RSA.

À propos de ce rapport

Netskope fournit une protection contre les menaces à des millions d’utilisateurs dans le monde. Les informations présentées dans ce rapport sont basées sur des données d’utilisation anonymisées collectées par la plate-forme Netskope Security Cloud concernant un sous-ensemble de clients Netskope disposant d’une autorisation préalable.

This report contains information about detections raised by Netskope’s Next Generation Secure Web Gateway (SWG), not considering the significance of the impact of each individual threat. Stats in this report are based on the period starting July 1, 2022 through June 30, 2023. Stats are reflection of attacker tactics, user behavior, and organization policy.

Rapports des laboratoires d'analyse des menaces

Dans le rapport mensuel Netskope Threat Labs, vous découvrirez les 5 domaines, malwares et applications les plus fréquemment bloqués par la plateforme Netskope Security Cloud, ainsi que nos articles récents et un tour d'horizon des menaces à ce jour.

Parcourir les rapports

Accélérez le développement de votre programme de sécurité avec le leader du SASE.

Commencez

Netskope Threat Labs Report: LATAM

LATAMjuillet 2023

Dans ce rapport

Adoption des applications Cloud

Les applications cloud les plus populaires

Les meilleures applications utilisées pour les téléchargements

Les meilleures applications utilisées pour les téléchargements

Utilisation abusive des applications Cloud

Diffusion de logiciels malveillants dans le cloud

Applications cloud utilisées à mauvais escient pour diffuser des logiciels malveillants

Logiciels malveillants et ransomwares

Principaux types de logiciels malveillants

Les meilleures familles de rançongiciels Malware &

Recommandations

Netskope Threat Labs

À propos de ce rapport

Rapports des laboratoires d'analyse des menaces

Accélérez le développement de votre programme de sécurité avec le leader du SASE.

Netskope
Threat Labs
Report: LATAM

LATAM
juillet 2023