blog.checkpoint.com
Open in
urlscan Pro
18.173.205.8
Public Scan
URL:
https://blog.checkpoint.com/research/august-2024s-most-wanted-malware-ransomhub-reigns-supreme-while-meow-ransomware-surges/
Submission: On November 04 via api from IN — Scanned from DE
Submission: On November 04 via api from IN — Scanned from DE
Form analysis
3 forms found in the DOM<form id="search-form">
<input type="image" src="https://www.checkpoint.com/wp-content/themes/checkpoint-theme-v2/images/search-btn.png" value="Submit" alt="Search"><input type="text" id="stq" name="stq" class="st-search-input" placeholder="Enter your keywords..."
x-webkit-speech="" x-webkit-grammar="builtin:search" autocomplete="off" aria-label="Search Term">
</form>
<form id="search-form1">
<label style="display: none;">Search</label>
<input type="image" src="https://www.checkpoint.com/wp-content/themes/checkpoint-theme-v2/images/search-btn.png" value="Submit" alt="Search"><input type="text" id="stq1" name="stq1" class="st-search-input" placeholder="Enter your keywords..."
x-webkit-speech="" x-webkit-grammar="builtin:search" autocomplete="off" aria-label="Search Term">
</form>
GET /
<form action="/" id="searchform" class="search-form" method="get">
<div class="form-group">
<input type="search" name="s" class="search-form__input" autocomplete="off" placeholder="Search ...">
<button type="submit" class="btn search-form__submit"><i class="atbs-atoms-icon-right-arrow"></i></button>
</div>
</form>
Text Content
Get a Demo Contact Us Support Log In * Search * * Geo Menu * * Choose your language... * English (English) * Spanish (Español) * French (Français) * German (Deutsch) * Italian (Italiano) * Portuguese (Português) * Japanese (日本語) * Chinese (中文) * Korean (한국어) * Taiwan (繁體中文) * Solutions * * Use Cases * Industry * Organization Size * Hybrid Cloud * Hybrid Mesh Firewall * Generative AI * Zero Trust & Least Privilege * Developer Security & Operations * IoT Security Solutions * Anti-Ransomware * SD-WAN * Threat Hunting * Compliance * Collaboration Security * Email Security SEE HOW USE CASES COME TO LIFE THROUGH CHECK POINT'S CUSTOMER STORIES. Learn More * Retail * Financial Services * Federal Government * State & Local Government * Healthcare * Telco Service Provider * Education SEE HOW USE CASES COME TO LIFE THROUGH CHECK POINT'S CUSTOMER STORIES. Learn More * Enterprise * Small & Medium Business SEE HOW USE CASES COME TO LIFE THROUGH CHECK POINT'S CUSTOMER STORIES. Learn More * Platform * * Infinity Platform * Secure the Network * Secure the Cloud * Secure the Workspace * Security Operations Explore Infinity * Platform OverviewIndustry leading AI-Powered and Cloud-Delivered cyber security platform * Infinity ServicesPrevention-first security operation, AI Copilot, ThreatCloud AI, and 24/7 managed security services, consulting, and training * Infinity PortalLearn about and sign into Check Point's unified security management platform * Infinity Platform AgreementPredictable cyber security environments through a platform agreement * See All Products > CHECK POINT NAMED A LEADER IN THE FORRESTER WAVE™: ENTERPRISE FIREWALL SOLUTIONS, Q4 2024 Get Report Explore Quantum * Next Generation Firewall (NGFW) Security GatewayIndustry leading AI-powered security gateways for modern enterprises * SD-WANSoftware-defined wide are network to converge security with networking * Security Policy and Threat ManagementManage firewall and security policy on a unified platform for on-premise and cloud networks * Internet of Things (IoT)Autonomous IoT threat prevention with zero trust profiling, virtual patching, and segmentation * Remote Access VPN Secure, seamless remote access to corporate networks * Industrial Control System Security Gateways Protect ICS, Operational Technology, and SCADA systems * See All Products > CHECK POINT NAMED A LEADER IN THE FORRESTER WAVE™: ENTERPRISE FIREWALL SOLUTIONS, Q4 2024 Get Report Explore CloudGuard * Cloud Network SecurityIndustry leading threat prevention with cloud-native firewalls * Cloud Native Application Protection PlatformCloud-native prevention-first security * Code SecurityDeveloper-centric code security * Web Application and API SecurityAutomated application and API security * See All Products > CHECK POINT NAMED A LEADER IN THE FORRESTER WAVE™: ENTERPRISE FIREWALL SOLUTIONS, Q4 2024 Get Report Explore Harmony * Email and Collaboration SecurityEmail security that includes office and collaboration applications * Endpoint SecurityComprehensive endpoint protection to prevent attacks and data compromise * Mobile SecurityComplete protection for the workforce across all mobile devices * SASEUnified security with optimized internet and network connectivity * SaaS SecurityThreat prevention management for SaaS * See All Products > CHECK POINT NAMED A LEADER IN THE FORRESTER WAVE™: ENTERPRISE FIREWALL SOLUTIONS, Q4 2024 Get Report Security Operations * External Risk ManagementProtect against threats like credential theft, fraud, and brand impersonation. * Extended Prevention & ResponseAI-powered, cloud-delivered security operations with Infinity XDR/XR * Secure Automation and CollaborationAutomate response playbooks with Infinity Playblocks * Unified Security Events and Logs as a ServiceInfinity events cloud-based analysis, monitoring, and reporting * AI Powered TeammateAutomated Security Admin & Incident Response with AI Copilot * ThreatCloud AIThe brain behind Check Point’s premier threat prevention * Managed Prevention & Response ServiceSOC operations-as-a-service with Infinity MDR/MPR * * See All Products > CHECK POINT NAMED A LEADER IN THE FORRESTER WAVE™: ENTERPRISE FIREWALL SOLUTIONS, Q4 2024 Get Report * Support & Services * * Strategy & Risk * Professional Services * Training Programs * Incident Response * Managed Security * Support Explore Strategy & Risk Services * External Risk ManagementOutsource specialized cybersecurity functions to Check Point security experts * Cyber Risk AssessmentAssess your cyber risks and plan actionable strategy * Attack Surface & Penetration TestingEvaluate security defenses against potential cyber attacks and threats * Security Controls Gap Analysis (NIST, CIS)Analyze technology gaps and plan solutions for improved security and ROI * Threat Intelligence & Brand ReputationAnalyzed data on cyber threats, aiding proactive security measures * See All Strategy & Risk Services > INFINITY GLOBAL SERVICES FIND THE RIGHT END-TO-END CYBERSECURITY SERVICE SOLUTIONS TAILORED TO MEET YOUR ORGANIZATION'S SPECIFIC NEEDS. Explore All Services Explore Professional Services * Security Deployment & OptimizationStrategic deployment and refinement of security for optimal protection * Advanced Technical Account ManagementProactive service delivered by highly skilled cyber security professionals * Lifecycle Management ServicesEffectively maintain the lifecycle of security products and services * See All Professional Services > INFINITY GLOBAL SERVICES FIND THE RIGHT END-TO-END CYBERSECURITY SERVICE SOLUTIONS TAILORED TO MEET YOUR ORGANIZATION'S SPECIFIC NEEDS. Explore All Services Explore Training Programs * Training & CertificationsComprehensive cyber security training and certification programs * CISO TrainingGlobally recognized training for Chief Information Security Officers * Security AwarenessEmpower employees with cyber security skills for work and home * Cyber Park - Cyber RangeSimulated gamification environment for security training * Mind Training HubCheck Point cyber security and awareness programs training hub * See All Training Programs > INFINITY GLOBAL SERVICES FIND THE RIGHT END-TO-END CYBERSECURITY SERVICE SOLUTIONS TAILORED TO MEET YOUR ORGANIZATION'S SPECIFIC NEEDS. Explore All Services Explore Incident Response Services * Incident ResponseManage and mitigate security incidents with systematic response services * Managed Detection and Response24/7 SOC Operations for Check Point + 3rd party solutions, 24/7 response * Digital ForensicsComprehensive investigation and analysis of cyber incidents and attacks * See All Incident Response Services > INFINITY GLOBAL SERVICES FIND THE RIGHT END-TO-END CYBERSECURITY SERVICE SOLUTIONS TAILORED TO MEET YOUR ORGANIZATION'S SPECIFIC NEEDS. Explore All Services Explore Managed Security Services * SOC-as-a-ServiceLeverage SOC expertise to monitor and manage the security solutions * Network Security and NOC-as-a-ServiceManagement of IT network and firewall infrastructure * Cloud & ITAccess to managed cloud and IT technologies, expertise, and resources * Managed Firewall as a ServiceSimplify data center workflow orchestration and scale up on demand * See All Managed Security Services > INFINITY GLOBAL SERVICES FIND THE RIGHT END-TO-END CYBERSECURITY SERVICE SOLUTIONS TAILORED TO MEET YOUR ORGANIZATION'S SPECIFIC NEEDS. Explore All Services Explore Support Services * Support ProgramsPrograms designed to help maximize security technology utilization * Check Point PROProactive monitoring of infrastructure program offerings * Contact Support OUR CUSTOMER SUPPORT TEAM IS ONLY A CLICK AWAY AND READY TO HELP YOU 24 HOURS A DAY. Visit Support Center * Solutions * Use Cases * Hybrid Cloud * Hybrid Mesh Firewall * Generative AI * Zero Trust & Least Privilege * Developer Security & Operations * IoT Security Solutions * Anti-Ransomware * SD-WAN * Threat Hunting * Compliance * Collaboration Security * Email Security * Industry * Retail * Financial Services * Federal Government * State & Local Government * Healthcare * Telco Service Provider * Education * Organization Size * Enterprise * Small & Medium Business * Platform * Infinity Platform * Platform Overview * Infinity Services * Infinity Portal * Infinity Platform Agreement * Secure the Network * Next Generation Firewall (NGFW) Security Gateway * SD-WAN * Security Policy and Threat Management * Internet of Things (IoT) * Industrial Control System Security Gateways * Remote Access VPN * Secure the Cloud * Cloud Network Security * Cloud Native Application Protection Platform * Code Security * Web Application and API Security * Secure the Workspace * Email and Collaboration Security * Endpoint Security * Mobile Security * SASE * SaaS Security * Services * External Risk Management * Managed Prevention & Response Service * Extended Prevention & Response * Secure Automation and Collaboration * Unified Security Events and Logs as a Service * AI Powered Teammate * ThreatCloud AI * Support & Services * Strategy & Risk * External Risk Management * Cyber Risk Assessment * Attack Surface & Penetration Testing * Security Controls Gap Analysis (NIST, CIS) * Threat Intelligence & Brand Reputation * Professional Services * Security Deployment & Optimization * Advanced Technical Account Management * Lifecycle Management Services * Training Programs * Training & Certifications * CISO Training * Security Awareness * Cyber Park - Cyber Range * Mind Training Hub * Incident Response * Incident Response * Managed Detection and Response * Digital Forensics * Managed Security * SOC-as-a-Service * Network Security and NOC-as-a-Service * Cloud & IT * Managed Firewall as a Service * Support * Support Programs * Check Point PRO * Contact Support * Partners * Check Point Partners * Find a Partner * Channel Partners * Technology Partners * MSSP Partners * AWS Cloud * Azure Cloud * Become a Partner * Overview * Enrolled Partners * Partner Portal * CHECK POINT IS 100% CHANNEL. GROW YOUR BUSINESS WITH US! Sign Up Now * More * Company * About Us * Leadership * Careers * Investor Relations * Newsroom * Learn * Resource Center * Customer Stories * Blog * Events & Webinars * Cyber Hub * Cyber Security Insights * Check Point Research * CheckMates Community * SEE HOW USE CASES COME TO LIFE THROUGH CHECK POINT'S CUSTOMER STORIES. Learn More * Search * Search * Geo Menu * Choose your language... * English (English) * Spanish (Español) * French (Français) * German (Deutsch) * Italian (Italiano) * Portuguese (Português) * Japanese (日本語) * Chinese (中文) * Korean (한국어) * Taiwan (繁體中文) Toggle Navigation Blog Home > Research > August 2024’s Most Wanted Malware: RansomHub Reigns Supreme While Meow Ransomware Surges Filter by: Select category Research (589) Security (958) Securing the Cloud (313) Harmony (191) Company and Culture (35) Innovation (6) Customer Stories (13) Infinity Security Operations (5) Securing the Network (13) Partners (10) Connect SASE (10) Harmony Email (96) Artificial Intelligence (25) Infinity Global Services (20) Crypto (13) Healthcare (14) Harmony SASE (7) MSSP (3) Executive Insights (230) ResearchSeptember 10, 2024 AUGUST 2024’S MOST WANTED MALWARE: RANSOMHUB REIGNS SUPREME WHILE MEOW RANSOMWARE SURGES ByCheck Point Team Share * * * * * CHECK POINT’S LATEST THREAT INDEX REVEALS RANSOMHUB’S CONTINUED DOMINANCE AND MEOW RANSOMWARE’S RISE WITH NOVEL TACTICS AND SIGNIFICANT IMPACT Check Point’s Global Threat Index for August 2024 revealed ransomware remains a dominant force, with RansomHub sustaining its position as the top ransomware group. This Ransomware-as-a-Service (RaaS) operation has rapidly expanded since its rebranding from Knight ransomware, breaching over 210 victims worldwide. Meanwhile, Meow ransomware has emerged, shifting from encryption to selling stolen data on leak marketplaces. Last month, RansomHub solidified its position as the top ransomware threat, as detailed in a joint advisory from the FBI, CISA, MS-ISAC, and HHS. This RaaS operation has aggressively targeted systems across Windows, macOS, Linux, and especially VMware ESXi environments, using sophisticated encryption techniques. August also saw the rise of Meow ransomware, which secured the second spot on the top ransomware list for the first time. Originating as a variant of the leaked Conti ransomware, Meow has shifted its focus from encryption to data extraction, transforming its extortion site into a data-leak marketplace. In this model, stolen data is sold to the highest bidder, diverging from traditional ransomware extortion tactics. RansomHub’s emergence as the top ransomware threat in August underscores the increasing sophistication of Ransomware-as-a-Service operations. Organizations need to be more vigilant than ever. The rise of Meow ransomware highlights the shift towards data-leak marketplaces, signaling method of monetization for ransomware operators, where stolen data is increasingly sold to third parties, rather than simply published online. As these threats evolve, businesses must stay alert, adopt proactive security measures, and continuously enhance their defenses against increasingly sophisticated attacks. Top malware families *The arrows relate to the change in rank compared to the previous month. FakeUpdates is the most prevalent malware this month with an impact of 8% worldwide organizations, followed by Androxgh0st with a global impact of 5%, and Phorpiex with a global impact of 5%. 1. ↔ FakeUpdates – FakeUpdates (AKA SocGholish) is a downloader written in JavaScript. It writes the payloads to disk prior to launching them. FakeUpdates led to further compromise via many additional malware, including GootLoader, Dridex, NetSupport, DoppelPaymer, and AZORult. 2. ↔ Androxgh0st – Androxgh0st is a botnet that targets Windows, Mac, and Linux platforms. For initial infection, Androxgh0st exploits multiple vulnerabilities, specifically targeting- the PHPUnit, Laravel Framework, and Apache Web Server. The malware steals sensitive information such as Twilio account information, SMTP credentials, AWS key, etc. It uses Laravel files to collect the required information. It has different variants which scan for different information. 3. ↑ Phorpiex – Phorpiex is a botnet known for distributing other malware families via spam campaigns as well as fueling large scale Sextortion campaigns. 4. ↑ Qbot – Qbot AKA Qakbot is a multipurpose malware that first appeared in 2008. It was designed to steal a user’s credentials, record keystrokes, steal cookies from browsers, spy on banking activities, and deploy additional malware. Often distributed via spam email, Qbot employs several anti-VM, anti-debugging, and anti-sandbox techniques to hinder analysis and evade detection. Commencing in 2022, it emerged as one of the most prevalent Trojans. 5. ↓ AgentTesla – AgentTesla is an advanced RAT functioning as a keylogger and information stealer, which is capable of monitoring and collecting the victim’s keyboard input, system keyboard, taking screenshots, and exfiltrating credentials to a variety of software installed on a victim’s machine (including Google Chrome, Mozilla Firefox and the Microsoft Outlook email client). 6. ↓ Formbook – Formbook is an Infostealer targeting the Windows OS and was first detected in 2016. It is marketed as Malware as a Service (MaaS) in underground hacking forums for its strong evasion techniques and relatively low price. FormBook harvests credentials from various web browsers, collects screenshots, monitors and logs keystrokes, and can download and execute files according to orders from its C&C. 7. ↑ CloudEyE – CloudEye is a downloader that targets the Windows platform and is used to download and install malicious programs on victims’ computers. 8. ↔ Vidar- Vidar is an infostealer malware operating as malware-as-a-service that was first discovered in the wild in late 2018. The malware runs on Windows and can collect a wide range of sensitive data from browsers and digital wallets. Additionally, the malware is used as a downloader for ransomware. 9. ↓ Remcos – Remcos is a RAT that first appeared in the wild in 2016. Remcos distributes itself through malicious Microsoft Office documents, which are attached to SPAM emails, and is designed to bypass Microsoft Windowss UAC security and execute malware with high-level privileges. 10. ↔ NJRat – NJRat is a remote accesses Trojan, targeting mainly government agencies and organizations in the Middle East. The Trojan has first emerged on 2012 and has multiple capabilities: capturing keystrokes, accessing the victim’s camera, stealing credentials stored in browsers, uploading and downloading files, performing process and file manipulations, and viewing the victim’s desktop. NJRat infects victims via phishing attacks and drive-by downloads, and propagates through infected USB keys or networked drives, with the support of Command & Control server software. Top exploited vulnerabilities 1. ↔ Command Injection Over HTTP (CVE-2021-43936,CVE-2022-24086) – A command Injection over HTTP vulnerability has been reported. A remote attacker can exploit this issue by sending a specially crafted request to the victim. Successful exploitation would allow an attacker to execute arbitrary code on the target machine. 2. ↔ Zyxel ZyWALL Command Injection (CVE-2023-28771( – A command injection vulnerability exists in Zyxel ZyWALL. Successful exploitation of this vulnerability would allow remote attackers to execute arbitrary OS commands in the effected system. 3. ↔ HTTP Headers Remote Code Execution (CVE-2020-10826,CVE-2020-10827,CVE-2020-10828,CVE-2020-1375) – HTTP headers let the client and the server pass additional information with an HTTP request. A remote attacker may use a vulnerable HTTP Header to run arbitrary code on the victim machine. Top Mobile Malwares This month Joker in the 1st place in the most prevalent Mobile malware, followed by Anubis and Hydra. 1. ↔ Joker – An android Spyware in Google Play, designed to steal SMS messages, contact lists and device information. Furthermore, the malware signs the victim silently for premium services in advertisement websites. 2. ↔ Anubis – Anubis is a banking Trojan malware designed for Android mobile phones. Since it was initially detected, it has gained additional functions including Remote Access Trojan (RAT) functionality, keylogger, audio recording capabilities and various ransomware features. It has been detected on hundreds of different applications available in the Google Store. 3. ↑ Hydra– Hydra is a banking Trojan designed to steal banking credentials by requesting victims to enable dangerous permissions and access each time the enter any banking app. Top-Attacked Industries Globally This month Education/Research remained in the 1st place in the attacked industries globally, followed by Government/Military and Healthcare. 1. Education/Research 2. Government/Military 3. Healthcare Top Ransomware Groups The data is based on insights from ransomware “shame sites” run by double-extortion ransomware groups which posted victim information. RansomHub is the most prevalent ransomware group this month, responsible for 15% of the published attacks, followed by Meow with 9% and Lockbit3 with 8%. 1. RansomHub – RansomHub is a Ransomware-as-a-Service (RaaS) operation that emerged as a rebranded version of the previously known Knight ransomware. Surfacing prominently in early 2024 in underground cybercrime forums, RansomHub has quickly gained notoriety for its aggressive campaigns targeting various systems including Windows, macOS, Linux, and particularly VMware ESXi environments. This malware is known for employing sophisticated encryption methods. 2. Meow – Meow Ransomware is a variant based on the Conti ransomware, known for encrypting a wide range of files on compromised systems and appending the “.MEOW” extension to them. It leaves a ransom note named “readme.txt,” instructing victims to contact the attackers via email or Telegram to negotiate ransom payments. Meow Ransomware spreads through various vectors, including unprotected RDP configurations, email spam, and malicious downloads, and uses the ChaCha20 encryption algorithm to lock files, excluding “.exe” and text files. 3. Lockbit3– LockBit is a ransomware, operating in a RaaS model, first reported in September 2019. LockBit targets large enterprises and government entities from various countries and does not target individuals in Russia or the Commonwealth of Independent States. 0 2806 YOU MAY ALSO LIKE Artificial Intelligence November 1, 2024 AI’S IMPACT IN 2024 ELECTIONS AND WHAT VOTERS CAN DO TO PROTECT THEMSELVES FROM DISINFORMATION 2024 is perhaps the biggest election year the world has ... Research November 1, 2024 RANSOMWARE’S EVOLVING THREAT: THE RISE OF RANSOMHUB, DECLINE OF LOCKBIT, AND THE NEW ERA OF DATA EXTORTION 1.Introduction The ransomware landscape is witnessing significant changes, with new ... Research October 18, 2024 A CLOSER LOOK AT Q3 2024: 75% SURGE IN CYBER ATTACKS WORLDWIDE A Record Spike in Attacks: In Q3 2024, an average ... Research October 17, 2024 CHECK POINT RESEARCH UNVEILS Q3 2024 BRAND PHISHING TRENDS: MICROSOFT REMAINS MOST IMITATED BRAND AS ALIBABA AND ADOBE ENTER TOP 10 Microsoft is identified as the primary target in phishing attacks, ... * COMPANY * About Us * Careers * Leadership * Newsroom * Trust Center * Investor Relations * Merchandise Store * Contact Us * TECHNICAL RESOURCES * User Center Sign In * Advisories * Threat Map * Threat Wiki * URL Categorization * App Wiki * EXPAND & LEARN * Resource Center * Cyber Hub * Check Point Research * Check Point Blog * Customer Stories * Product Knowledge Center * SUPPORT & SERVICES * Support Center * Infinity Global Service * IGS Portal * * Contact Sales * North America: * +1-866-488-6691 * International: * +44-125-333-5558 * Contact Support * North America: * +1-888-361-5030 * International: * +44-114-478-2845 -------------------------------------------------------------------------------- Follow Us YOU DESERVE THE BEST SECURITY™ ©1994- 2024 Check Point Software Technologies Ltd. All rights reserved. Copyright | Privacy Policy | Cookie Settings | Get the Latest News This website uses cookies in order to optimize your user experience as well as for advertising and analytics. For further information, please read our Privacy Policy and ourCookie Notice. Cookies Settings Reject All Accept When you visit any website, it may store or retrieve information on your browser, mostly in the form of cookies. This information might be about you, your preferences or your device and is mostly used to make the site work as you expect it to. The information does not usually directly identify you, but it can give you a more personalized web experience. Because we respect your right to privacy, you can choose not to allow some types of cookies. Click on the different category headings to find out more and change our default settings. However, blocking some types of cookies may impact your experience of the site and the services we are able to offer. More information Allow All MANAGE CONSENT PREFERENCES FUNCTIONAL COOKIES Functional Cookies These cookies enable the website to provide enhanced functionality and personalisation. They may be set by us or by third party providers whose services we have added to our pages. If you do not allow these cookies then some or all of these services may not function properly. STRICTLY NECESSARY COOKIES Always Active These cookies are necessary for the website to function and cannot be switched off in our systems. They are usually only set in response to actions made by you which amount to a request for services, such as setting your privacy preferences, logging in or filling in forms. You can set your browser to block or alert you about these cookies, but some parts of the site will not then work. These cookies do not store any personally identifiable information. PERFORMANCE COOKIES Performance Cookies These cookies allow us to count visits and traffic sources so we can measure and improve the performance of our site. They help us to know which pages are the most and least popular and see how visitors move around the site. All information these cookies collect is aggregated and therefore anonymous. If you do not allow these cookies we will not know when you have visited our site, and will not be able to monitor its performance. TARGETING COOKIES Targeting Cookies These cookies may be set through our site by our advertising partners. They may be used by those companies to build a profile of your interests and show you relevant adverts on other sites. They do not store directly personal information, but are based on uniquely identifying your browser and internet device. If you do not allow these cookies, you will experience less targeted advertising. Back Button PERFORMANCE COOKIES Search Icon Filter Icon Clear checkbox label label Apply Cancel Consent Leg.Interest checkbox label label checkbox label label checkbox label label Reject All Confirm My Choices