International demand for multifunctional malware that are flexible enough to perform almost any task are on the rise, according to the latest research by Kaspersky Lab.
Botnets – nets of compromised devices used in criminal activity – are harnessed by criminals to spread malware and facilitate DDoS and spam attacks. Using Kaspersky Lab’s Botnet Tracking technology, the company’s researchers continuously monitor botnet activity to prevent forthcoming attacks, or to nip a new type of banker Trojan in the bud. The technology works by emulating a compromised device, trapping the commands received from threat actors that are using the botnets to distribute malware. This provides the researchers with valuable malware samples and statistics.
Based on the results of recent research, in the first half of 2018 the share of single-purpose malware distributed through botnets dropped significantly in comparison to the second half of 2017. For example, in H2 2017, 22.46 percent of all unique malicious files distributed through the botnets monitored by Kaspersky Lab were banking Trojans, while in the first half of 2018, the share of bankers dropped by 9.21 percentage points – to 13.25 percent of all malicious files witnessed by the Botnet Tracking service.
The share of spamming bots – another type of single-purpose malicious software distributed through botnets – also decreased significantly: from 18.93 percent in H2 2017 to 12.23 percent in H1 2018. DDoS bots, yet another typical single-purpose malware, also dropped, from 2.66 percent in H2 2017 to 1.99 percent in H1 2018.
At the same time, the most distinctive growth was demonstrated by malware of a versatile nature, in particular Remote Access Tools (RAT) malware that provides almost unlimited opportunities for exploiting the infected PC. Since H1 2017, the share of RAT files found among the malware distributed by botnets almost doubled, rising from 6.55 percent to 12.22 percent.
Njrat, DarkComet and Nanocore topped the list of the most widespread RATs. Due to their relatively simple structure, the three backdoors can be modified even by an amateur threat actor. This allows the malware to be adapted for distribution in a specific region.
Trojans, also used for a variety of purposes, did not demonstrate as much progress as RATs, but, unlike a lot of single-purpose malware, their share of detected files increased, rising from 32.89 percent in H2 2017 to 34.25 percent H1 2018.
Just like the backdoors, one Trojan family can be modified and controlled by multiple command and control (C&C) servers, each with different purposes, for example, cyberespionage or the stealing of credentials.
The only type of single-purpose malicious programs to demonstrate impressive growth within botnet networks were miners. Even though their per cent of registered files is not comparable to highly popular multifunctional malware, their share increased two-fold and this fits in the general trend of a malicious mining boom as seen earlier by Kaspersky experts.
To reduce the risk of turning your devices into part of a botnet, users are advised to:
- Patch the software on your PC as soon as security updates for the latest bugs uncovered are available. Unpatched devices can be exploited by cybercriminals and connected into a botnet.
- Do not download pirated software and other illegal content, as these are often used to distribute malicious bots.
- Use Kaspersky Internet Security to prevent your computer being infected with any type of malware, including that used for the creation of botnets.
