Threat Labs Report: Manufacturing 2023

The most common malware detected by Netskope in manufacturing in the last twelve months were Trojans, which are commonly used by attackers to gain an initial foothold and deliver other types of malware, such as infostealers, remote access Trojans, backdoors, and ransomware.

The second most common type of malware were file-based exploits, which include documents used to exploit many known vulnerabilities, including CVE-2022-30190 (a.k.a. Follina), CVE-2021-40444, and other vulnerabilities that exploit unpatched versions of Adobe Acrobat, Adobe Reader, Microsoft Office, MacOS, and Linux. The third most common type of malware are downloaders, which like trojans, are also used to deliver other types of malware.

This list contains the top ten malware and ransomware families detected by Netskope in manufacturing in the last twelve months:

• Infostealer.ClipBanker is an infostealer that steals banking information, among other data, and is typically spread via emails and social media. Details
• Infostealer.Fareit (a.k.a Siplog, Pony) is both an infostealer and botnet, stealing credentials from VPNs, browsers, and more. Details
• Botnet.Emotet is one of the most prevalent botnets in the cyber threat landscape, often used to deliver other malware such as TrickBot. Details
• Infostealer.AgentTesla is a .NET-based remote access trojan with many capabilities, such as stealing browsers’ passwords, capturing keystrokes, clipboard, etc. Details
• Infostealer.QakBot (a.k.a. Quakbot, QBot) is a modular malware active since 2007 capable of stealing sensitive financial data from infected systems, often delivered via malicious documents. Details
• Trojan.Ursnif (a.k.a. Gozi) is a banking trojan and backdoor, which had its source code leaked on GitHub in 2005, allowing attackers to create and distribute many variants. Details
• RAT.NjRAT (a.k.a. Bladabindi) is a remote access trojan with many capabilities, including logging keystrokes, stealing credentials from browsers, accessing the victim’s camera, and managing files. Details
• Downloader.BanLoad is a Java-based downloader widely used to deliver a variety of malware payloads, especially banking Trojans. Details
• Ransomware.BlackBasta is a ransomware group that emerged in April 2022 with both Windows and Linux variants, targeting corporate networks. Details
• Ransomware.BlueSky is a ransomware family that emerged in 2022 with links to other groups, like Conti, and designed to use multi threads to encrypt files faster. Details