{"id":107963,"date":"2022-11-18T08:10:34","date_gmt":"2022-11-18T08:10:34","guid":{"rendered":"https:\/\/kasperskycontenthub.com\/securelist\/?p=107963"},"modified":"2022-11-30T11:34:30","modified_gmt":"2022-11-30T11:34:30","slug":"it-threat-evolution-in-q3-2022-non-mobile-statistics","status":"publish","type":"post","link":"https:\/\/securelist.com\/it-threat-evolution-in-q3-2022-non-mobile-statistics\/107963\/","title":{"rendered":"IT threat evolution in Q3 2022. Non-mobile statistics"},"content":{"rendered":"<ul>\n<li><a href=\"https:\/\/securelist.com\/it-threat-evolution-q3-2022\/107957\/\" rel=\"noopener\" target=\"_blank\">IT threat evolution in Q3\u00a02022<\/a><\/li>\n<li><strong>IT threat evolution in Q3\u00a02022. Non-mobile statistics<\/strong><\/li>\n<li><a href=\"https:\/\/securelist.com\/it-threat-evolution-in-q3-2022-mobile-statistics\/107978\/\" rel=\"noopener\" target=\"_blank\">IT threat evolution in Q3\u00a02022. Mobile statistics<\/a><\/li>\n<\/ul>\n<p><em>These statistics are based on detection verdicts of Kaspersky products and services received from users who consented to providing statistical data.<\/em><\/p>\n<h2 id=\"quarterly-figures\">Quarterly figures<\/h2>\n<p>According to Kaspersky Security Network, in Q3\u00a02022:<\/p>\n<ul>\n<li>Kaspersky solutions blocked 956,074,958 attacks from online resources across the globe.<\/li>\n<li>Web Anti-Virus recognized 251,288,987 unique URLs as malicious.<\/li>\n<li>Attempts to run malware for stealing money from online bank accounts were stopped on the computers of 99,989 unique users.<\/li>\n<li>Ransomware attacks were defeated on the computers of 72,941 unique users.<\/li>\n<li>Our File Anti-Virus detected 49,275,253 unique malicious and potentially unwanted objects.<\/li>\n<\/ul>\n<h2 id=\"financial-threats\">Financial threats<\/h2>\n<h3 id=\"number-of-users-attacked-by-banking-malware\">Number of users attacked by banking malware<\/h3>\n<p>In Q3\u00a02022, Kaspersky solutions blocked the launch of at least one piece of banking malware on the computers of 99,989 unique users.<\/p>\n<div class=\"js-infogram-embed\" data-id=\"_\/9cD5tzLY2xoIYDVtXtvu\" data-type=\"interactive\" data-title=\"01 EN Malware report Q3 2022 PC stat\" style=\"min-height:;\"><\/div>\n<p style=\"text-align: center;font-style: italic;font-weight: bold;margin-top: -10px\"><em>Number of unique users attacked by financial malware, Q3 2022 (<a href=\"https:\/\/media.kasperskycontenthub.com\/wp-content\/uploads\/sites\/43\/2022\/11\/15154318\/01-en-malware-report-q3-2022-pc-stat.png\">download<\/a>)<\/em><\/p>\n<h3 id=\"top-10-banking-malware-families\">TOP 10 banking malware families<\/h3>\n<table width=\"100%\">\n<tbody>\n<tr>\n<td width=\"10%\"><\/td>\n<td width=\"30%\"><strong>Name<\/strong><\/td>\n<td width=\"40%\"><strong>Verdicts<\/strong><\/td>\n<td width=\"20%\"><strong>%*<\/strong><\/td>\n<\/tr>\n<tr>\n<td>1<\/td>\n<td>Ramnit\/Nimnul<\/td>\n<td>Trojan-Banker.Win32.Ramnit<\/td>\n<td>33.2<\/td>\n<\/tr>\n<tr>\n<td>2<\/td>\n<td>Zbot\/Zeus<\/td>\n<td>Trojan-Banker.Win32.Zbot<\/td>\n<td>15.2<\/td>\n<\/tr>\n<tr>\n<td>3<\/td>\n<td>IcedID<\/td>\n<td>Trojan-Banker.Win32.IcedID<\/td>\n<td>10.0<\/td>\n<\/tr>\n<tr>\n<td>4<\/td>\n<td>CliptoShuffler<\/td>\n<td>Trojan-Banker.Win32.CliptoShuffler<\/td>\n<td>5.8<\/td>\n<\/tr>\n<tr>\n<td>5<\/td>\n<td>Trickster\/Trickbot<\/td>\n<td>Trojan-Banker.Win32.Trickster<\/td>\n<td>5.8<\/td>\n<\/tr>\n<tr>\n<td>6<\/td>\n<td>SpyEye<\/td>\n<td>Trojan-Spy.Win32.SpyEye<\/td>\n<td>2.1<\/td>\n<\/tr>\n<tr>\n<td>7<\/td>\n<td>RTM<\/td>\n<td>Trojan-Banker.Win32.RTM<\/td>\n<td>1.9<\/td>\n<\/tr>\n<tr>\n<td>8<\/td>\n<td>Danabot<\/td>\n<td>Trojan-Banker.Win32.Danabot<\/td>\n<td>1.4<\/td>\n<\/tr>\n<tr>\n<td>9<\/td>\n<td>Tinba\/TinyBanker<\/td>\n<td>Trojan-Banker.Win32.Tinba<\/td>\n<td>1.4<\/td>\n<\/tr>\n<tr>\n<td>10<\/td>\n<td>Gozi<\/td>\n<td>Trojan-Banker.Win32.Gozi<\/td>\n<td>1.1<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p><em>* Unique users who encountered this malware family as a percentage of all users attacked by financial malware.<\/em><\/p>\n<h3 id=\"geography-of-financial-malware-attacks\">Geography of financial malware attacks<\/h3>\n<p><strong>TOP 10 countries and territories by share of attacked users<\/strong><\/p>\n<table width=\"100%\">\n<tbody>\n<tr>\n<td width=\"10%\"><\/td>\n<td width=\"50%\"><strong>Country or territory*<\/strong><\/td>\n<td width=\"40%\"><strong>%**<\/strong><\/td>\n<\/tr>\n<tr>\n<td>1<\/td>\n<td>Turkmenistan<\/td>\n<td>4.7<\/td>\n<\/tr>\n<tr>\n<td>2<\/td>\n<td>Afghanistan<\/td>\n<td>4.6<\/td>\n<\/tr>\n<tr>\n<td>3<\/td>\n<td>Paraguay<\/td>\n<td>2.8<\/td>\n<\/tr>\n<tr>\n<td>4<\/td>\n<td>Tajikistan<\/td>\n<td>2.8<\/td>\n<\/tr>\n<tr>\n<td>5<\/td>\n<td>Yemen<\/td>\n<td>2.3<\/td>\n<\/tr>\n<tr>\n<td>6<\/td>\n<td>Sudan<\/td>\n<td>2.3<\/td>\n<\/tr>\n<tr>\n<td>7<\/td>\n<td>China<\/td>\n<td>2.0<\/td>\n<\/tr>\n<tr>\n<td>8<\/td>\n<td>Switzerland<\/td>\n<td>2.0<\/td>\n<\/tr>\n<tr>\n<td>9<\/td>\n<td>Egypt<\/td>\n<td>1.9<\/td>\n<\/tr>\n<tr>\n<td>10<\/td>\n<td>Venezuela<\/td>\n<td>1.8<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p><em>* Excluded are countries and territories with relatively few Kaspersky users (under 10,000).<br \/>\n** Unique users whose computers were targeted by financial malware as a percentage of all unique users of Kaspersky products in the country.<\/em><\/p>\n<h2 id=\"ransomware-programs\">Ransomware programs<\/h2>\n<h3 id=\"quarterly-trends-and-highlights\">Quarterly trends and highlights<\/h3>\n<p>The third quarter of 2022 saw the builder for LockBit, a well-known ransomware, <a href=\"https:\/\/www.bleepingcomputer.com\/news\/security\/lockbit-ransomware-builder-leaked-online-by-angry-developer-\/\" target=\"_blank\" rel=\"noopener\">leaked online<\/a>. LockBit themselves attributed the leakage to one of their developers&#8217; personal initiative, not the group&#8217;s getting hacked. One way or another, the LockBit 3.0 build kit is now accessible to the broader cybercriminal community. Similarly to other ransomware families in the past, such as Babuk and Conti, Trojan builds generated with the leaked builder began to serve other groups unrelated to LockBit. One example was Bloody\/Bl00dy <a href=\"https:\/\/www.bleepingcomputer.com\/news\/security\/leaked-lockbit-30-builder-used-by-bl00dy-ransomware-gang-in-attacks\/\" target=\"_blank\" rel=\"noopener\">spotted back in May<\/a>. A borrower rather than a creator, this group added the freshly available LockBit to its arsenal in September 2022.<\/p>\n<p>Mass attacks on NAS (network attached storage) devices continue. QNAP issued warnings about Checkmate and Deadbolt infections in Q3 2022. The <a href=\"https:\/\/www.qnap.com\/en\/security-advisory\/QSA-22-21\" target=\"_blank\" rel=\"noopener\">former<\/a> threatened files accessible from the internet over SMB protocol and protected by a weak account password. The latter <a href=\"https:\/\/www.qnap.com\/en\/security-news\/2022\/take-immediate-action-to-update-photo-station-to-the-latest-available-version\" target=\"_blank\" rel=\"noopener\">attacked<\/a> devices that had a vulnerable version of the Photo Station software installed. Threats that target NAS remain prominent, so we recommend keeping these devices inaccessible from the internet to ensure maximum safety of your data.<\/p>\n<p>The United States Department of Justice <a href=\"https:\/\/www.justice.gov\/opa\/pr\/justice-department-seizes-and-forfeits-approximately-500000-north-korean-ransomware-actors\" target=\"_blank\" rel=\"noopener\">announced<\/a> that it had teamed up with the FBI to seize about $500,000 paid as ransom after a Maui ransomware attack. The Trojan was likely <a href=\"https:\/\/securelist.com\/andariel-deploys-dtrack-and-maui-ransomware\/107063\/\">used<\/a> by the North Korean operators Andariel. The DOJ said victims had started getting their money back.<\/p>\n<p>The creators of the little-known AstraLocker and Yashma ransomware <a href=\"https:\/\/www.bleepingcomputer.com\/news\/security\/astralocker-ransomware-shuts-down-and-releases-decryptors\/\" target=\"_blank\" rel=\"noopener\">published<\/a> decryptors and stopped spreading both of them. The hackers provided no explanation for the move, but it appeared to be related to an increase in media coverage.<\/p>\n<h3 id=\"number-of-new-modifications\">Number of new modifications<\/h3>\n<p>In Q3\u00a02022, we detected 17 new ransomware families and 14,626 new modifications of this malware type. More than 11,000 of those were assigned the verdict of Trojan-Ransom.Win32.Crypmod, which hit the sixth place in our rankings of the most widespread ransomware Trojans.<\/p>\n<div class=\"js-infogram-embed\" data-id=\"_\/PnjlC83ohJBU9bvO64xO\" data-type=\"interactive\" data-title=\"03 EN-RU-ES Malware report Q3 2022 PC stat\" style=\"min-height:;\"><\/div>\n<p style=\"text-align: center;font-style: italic;font-weight: bold;margin-top: -10px\"><em>Number of new ransomware modifications, Q3\u00a02021\u00a0\u2014 Q3\u00a02022 (<a href=\"https:\/\/media.kasperskycontenthub.com\/wp-content\/uploads\/sites\/43\/2022\/11\/15154421\/03-en-ru-es-malware-report-q3-2022-pc-stat.png\">download<\/a>)<\/em><\/p>\n<h3 id=\"number-of-users-attacked-by-ransomware-trojans\">Number of users attacked by ransomware Trojans<\/h3>\n<p>In Q3\u00a02022, Kaspersky products and technologies protected 72,941 users from ransomware attacks.<\/p>\n<div class=\"js-infogram-embed\" data-id=\"_\/YvHMV9QybfSeVeNQTuqD\" data-type=\"interactive\" data-title=\"04 EN Malware report Q3 2022 PC stat\" style=\"min-height:;\"><\/div>\n<p style=\"text-align: center;font-style: italic;font-weight: bold;margin-top: -10px\"><em>Number of unique users attacked by ransomware Trojans, Q3 2022 (<a href=\"https:\/\/media.kasperskycontenthub.com\/wp-content\/uploads\/sites\/43\/2022\/11\/15154500\/04-en-malware-report-q3-2022-pc-stat.png\">download<\/a>)<\/em><\/p>\n<p><strong>TOP 10 most common families of ransomware Trojans<\/strong><\/p>\n<table width=\"100%\">\n<tbody>\n<tr>\n<td width=\"10%\"><\/td>\n<td width=\"30%\"><strong>Name<\/strong><\/td>\n<td width=\"40%\"><strong>Verdicts<\/strong><\/td>\n<td width=\"20%\"><strong>%*<\/strong><\/td>\n<\/tr>\n<tr>\n<td>1<\/td>\n<td>(generic verdict)<\/td>\n<td>Trojan-Ransom.Win32.Encoder<\/td>\n<td>14.76<\/td>\n<\/tr>\n<tr>\n<td>2<\/td>\n<td>WannaCry<\/td>\n<td>Trojan-Ransom.Win32.Wanna<\/td>\n<td>12.12<\/td>\n<\/tr>\n<tr>\n<td>3<\/td>\n<td>(generic verdict)<\/td>\n<td>Trojan-Ransom.Win32.Gen<\/td>\n<td>11.68<\/td>\n<\/tr>\n<tr>\n<td>4<\/td>\n<td>Stop\/Djvu<\/td>\n<td>Trojan-Ransom.Win32.Stop<\/td>\n<td>6.59<\/td>\n<\/tr>\n<tr>\n<td>5<\/td>\n<td>(generic verdict)<\/td>\n<td>Trojan-Ransom.Win32.Phny<\/td>\n<td>6.53<\/td>\n<\/tr>\n<tr>\n<td>6<\/td>\n<td>(generic verdict)<\/td>\n<td>Trojan-Ransom.Win32.Crypmod<\/td>\n<td5.46<\/td>\n<\/tr>\n<tr>\n<td>7<\/td>\n<td>Magniber<\/td>\n<td>Trojan-Ransom.Win64.Magni<\/td>\n<td>4.93<\/td>\n<\/tr>\n<tr>\n<td>8<\/td>\n<td>PolyRansom\/VirLock<\/td>\n<td>Trojan-Ransom.Win32.PolyRansom \/ Virus.Win32.PolyRansom<\/td>\n<td>4.84<\/td>\n<\/tr>\n<tr>\n<td>9<\/td>\n<td>(generic verdict)<\/td>\n<td>Trojan-Ransom.Win32.Instructions<\/td>\n<td>4.35<\/td>\n<\/tr>\n<tr>\n<td>10<\/td>\n<td>Hive<\/td>\n<td>Trojan-Ransom.Win32.Hive<\/td>\n<td>3.87<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p><em>* Unique users who encountered this malware family as a percentage of all users attacked by financial malware.<\/em><\/p>\n<h3 id=\"geography-of-attacked-users\">Geography of attacked users<\/h3>\n<p><strong>TOP 10 countries and territories attacked by ransomware Trojans<\/strong><\/p>\n<table width=\"100%\">\n<tbody>\n<tr>\n<td width=\"10%\"><\/td>\n<td width=\"50%\"><strong>Country or territory*<\/strong><\/td>\n<td width=\"40%\"><strong>%**<\/strong><\/td>\n<\/tr>\n<tr>\n<td>1<\/td>\n<td>Bangladesh<\/td>\n<td>1.66<\/td>\n<\/tr>\n<tr>\n<td>2<\/td>\n<td>Yemen<\/td>\n<td>1.30<\/td>\n<\/tr>\n<tr>\n<td>3<\/td>\n<td>South Korea<\/td>\n<td>0.98<\/td>\n<\/tr>\n<tr>\n<td>4<\/td>\n<td>Taiwan<\/td>\n<td>0.77<\/td>\n<\/tr>\n<tr>\n<td>5<\/td>\n<td>Mozambique<\/td>\n<td>0.64<\/td>\n<\/tr>\n<tr>\n<td>6<\/td>\n<td>China<\/td>\n<td>0.52<\/td>\n<\/tr>\n<tr>\n<td>7<\/td>\n<td>Colombia<\/td>\n<td>0.43<\/td>\n<\/tr>\n<tr>\n<td>8<\/td>\n<td>Nigeria<\/td>\n<td>0.40<\/td>\n<\/tr>\n<tr>\n<td>9<\/td>\n<td>Pakistan<\/td>\n<td>0.39<\/td>\n<\/tr>\n<tr>\n<td>10<\/td>\n<td>Venezuela<\/td>\n<td>0.32<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p><em>* Excluded are countries with relatively few Kaspersky users (under 50,000).<br \/>\n** Unique users whose computers were attacked by ransomware Trojans as a percentage of all unique users of Kaspersky products in the country.<\/em><\/p>\n<h3 id=\"top-10-most-common-families-of-ransomware-trojans\">TOP 10 most common families of ransomware Trojans<\/h3>\n<table width=\"100%\">\n<tbody>\n<tr>\n<td width=\"10%\"><\/td>\n<td width=\"30%\"><strong>Name<\/strong><\/td>\n<td width=\"40%\"><strong>Verdicts*<\/strong><\/td>\n<td width=\"20%\"><strong>Percentage of attacked users**<\/strong><\/td>\n<\/tr>\n<tr>\n<td>1<\/td>\n<td>(generic verdict)<\/td>\n<td>Trojan-Ransom.Win32.Encoder<\/td>\n<td>14.76<\/td>\n<\/tr>\n<tr>\n<td>2<\/td>\n<td>WannaCry<\/td>\n<td>Trojan-Ransom.Win32.Wanna<\/td>\n<td>12.12<\/td>\n<\/tr>\n<tr>\n<td>3<\/td>\n<td>(generic verdict)<\/td>\n<td>Trojan-Ransom.Win32.Gen<\/td>\n<td>11.68<\/td>\n<\/tr>\n<tr>\n<td>4<\/td>\n<td>Stop\/Djvu<\/td>\n<td>Trojan-Ransom.Win32.Stop<\/td>\n<td>6.59<\/td>\n<\/tr>\n<tr>\n<td>5<\/td>\n<td>(generic verdict)<\/td>\n<td>Trojan-Ransom.Win32.Phny<\/td>\n<td>6.53<\/td>\n<\/tr>\n<tr>\n<td>6<\/td>\n<td>(generic verdict)<\/td>\n<td>Trojan-Ransom.Win32.Crypmod<\/td>\n<td>5.46<\/td>\n<\/tr>\n<tr>\n<td>7<\/td>\n<td>Magniber<\/td>\n<td>Trojan-Ransom.Win64.Magni<\/td>\n<td>4.93<\/td>\n<\/tr>\n<tr>\n<td>8<\/td>\n<td>PolyRansom\/VirLock<\/td>\n<td>Trojan-Ransom.Win32.PolyRansom \/ Virus.Win32.PolyRansom<\/td>\n<td>4.84<\/td>\n<\/tr>\n<tr>\n<td>9<\/td>\n<td>(generic verdict)<\/td>\n<td>Trojan-Ransom.Win32.Instructions<\/td>\n<td>4.35<\/td>\n<\/tr>\n<tr>\n<td>10<\/td>\n<td>Hive<\/td>\n<td>Trojan-Ransom.Win32.Hive<\/td>\n<td>3.87<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p><em>* Statistics are based on detection verdicts of Kaspersky products. The information was provided by Kaspersky product users who consented to providing statistical data.<br \/>\n** Unique Kaspersky users attacked by specific ransomware Trojan families as a percentage of all unique users attacked by ransomware Trojans.<\/em><\/p>\n<h2 id=\"miners\">Miners<\/h2>\n<h3 id=\"number-of-new-miner-modifications\">Number of new miner modifications<\/h3>\n<p>In Q3 2022, Kaspersky systems detected 153,773 new miner mods. More than 140,000 of these were found in July and August; combined with June&#8217;s figure of more than 35,000, this suggests that miner creators kept themselves abnormally busy this past summer.<\/p>\n<div class=\"js-infogram-embed\" data-id=\"_\/l0f8itQat9XhpVerfkFS\" data-type=\"interactive\" data-title=\"06 EN Malware report Q3 2022 PC stat\" style=\"min-height:;\"><\/div>\n<p style=\"text-align: center;font-style: italic;font-weight: bold;margin-top: -10px\"><em>Number of new miner modifications, Q3 2022 (<a href=\"https:\/\/media.kasperskycontenthub.com\/wp-content\/uploads\/sites\/43\/2022\/11\/15154533\/06-en-malware-report-q3-2022-pc-stat.png\">download<\/a>)<\/em><\/p>\n<h3 id=\"number-of-users-attacked-by-miners\">Number of users attacked by miners<\/h3>\n<p>In Q3, we detected attacks that used miners on the computers of 432,363 unique users of Kaspersky products worldwide. A quieter period from late spring through the early fall was followed by another increase in activity.<\/p>\n<div class=\"js-infogram-embed\" data-id=\"_\/LYRtteBQ6eecGbWymvHb\" data-type=\"interactive\" data-title=\"07 EN Malware report Q3 2022 PC stat\" style=\"min-height:;\"><\/div>\n<p style=\"text-align: center;font-style: italic;font-weight: bold;margin-top: -10px\"><em>Number of unique users attacked by miners, Q3 2022 (<a href=\"https:\/\/media.kasperskycontenthub.com\/wp-content\/uploads\/sites\/43\/2022\/11\/15154601\/07-en-malware-report-q3-2022-pc-stat.png\">download<\/a>)<\/em><\/p>\n<h3 id=\"geography-of-miner-attacks\">Geography of miner attacks<\/h3>\n<p><strong>TOP 10 countries and territories attacked by miners<\/strong><\/p>\n<table width=\"100%\">\n<tbody>\n<tr>\n<td width=\"10%\"><\/td>\n<td width=\"50%\"><strong>Country or territory*<\/strong><\/td>\n<td width=\"40%\"><strong>%**<\/strong><\/td>\n<\/tr>\n<tr>\n<td>1<\/td>\n<td>Ethiopia<\/td>\n<td>2.38<\/td>\n<\/tr>\n<tr>\n<td>2<\/td>\n<td>Kazakhstan<\/td>\n<td>2.13<\/td>\n<\/tr>\n<tr>\n<td>3<\/td>\n<td>Uzbekistan<\/td>\n<td>2.01<\/td>\n<\/tr>\n<tr>\n<td>4<\/td>\n<td>Rwanda<\/td>\n<td>1.93<\/td>\n<\/tr>\n<tr>\n<td>5<\/td>\n<td>Tajikistan<\/td>\n<td>1.83<\/td>\n<\/tr>\n<tr>\n<td>6<\/td>\n<td>Venezuela<\/td>\n<td>1.78<\/td>\n<\/tr>\n<tr>\n<td>7<\/td>\n<td>Kyrgyzstan<\/td>\n<td>1.73<\/td>\n<\/tr>\n<tr>\n<td>8<\/td>\n<td>Mozambique<\/td>\n<td>1.57<\/td>\n<\/tr>\n<tr>\n<td>9<\/td>\n<td>Tanzania<\/td>\n<td>1.56<\/td>\n<\/tr>\n<tr>\n<td>10<\/td>\n<td>Ukraine<\/td>\n<td>1.54<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p><em>* Excluded are countries and territories with relatively few users of Kaspersky products (under 50,000).<br \/>\n** Unique users attacked by miners as a percentage of all unique users of Kaspersky products in the country.<\/em><\/p>\n<h2 id=\"vulnerable-applications-used-by-criminals-during-cyberattacks\">Vulnerable applications used by criminals during cyberattacks<\/h2>\n<h3 id=\"quarterly-highlights\">Quarterly highlights<\/h3>\n<p>Q3 2022 was remembered for a series of vulnerabilities discovered in various software products. Let&#8217;s begin with Microsoft Windows and some of its components. Researchers found new vulnerabilities that affected the CLFS driver: <a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2022-30220\" target=\"_blank\" rel=\"noopener\">CVE-2022-30220<\/a>, along with <a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2022-35803\" target=\"_blank\" rel=\"noopener\">CVE-2022-35803<\/a> and <a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2022-37969\" target=\"_blank\" rel=\"noopener\">CVE-2022-37969<\/a>, both encountered in the wild. By manipulating Common Log File System data in a specific way, an attacker can make the kernel write their own data to arbitrary memory addresses, allowing cybercriminals to hijack kernel control and elevate their privileges in the system. Several vulnerabilities were discovered in the Print Spooler service: <a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2022-22022\" target=\"_blank\" rel=\"noopener\">CVE-2022-22022<\/a>, <a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2022-30206\" target=\"_blank\" rel=\"noopener\">CVE-2022-30206<\/a>, and <a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2022-30226\" target=\"_blank\" rel=\"noopener\">CVE-2022-30226<\/a>. These allow elevating the system privileges through a series of manipulations while installing a printer. Serious vulnerabilities were also discovered in the Client\/Server Runtime Subsystem (CSRSS), an essential Windows component. Some of these can be exploited for privilege escalation (<a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2022-22047\" target=\"_blank\" rel=\"noopener\">CVE-2022-22047<\/a>, <a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2022-22049\" target=\"_blank\" rel=\"noopener\">CVE-2022-22049<\/a>, and <a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2022-22026\" target=\"_blank\" rel=\"noopener\">CVE-2022-22026<\/a>), while <a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2022-22038\" target=\"_blank\" rel=\"noopener\">CVE-2022-22038<\/a> affects remote procedure call (RPC) protocol, allowing an attacker to execute arbitrary code remotely. A series of critical vulnerabilities were discovered in the graphics subsystem, including <a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2022-22034\" target=\"_blank\" rel=\"noopener\">CVE-2022-22034<\/a> and <a href=\"https:\/\/cve.mitre.org\/cgi-bin\/cvename.cgi?name=CVE-2022-35750\" target=\"_blank\" rel=\"noopener\">CVE-2022-35750<\/a>, which can also be exploited for privilege escalation. Note that most of the above vulnerabilities require that exploits entrench in the system before an attacker can run their malware. The Microsoft Support Diagnostic Tool (MSDT) was found to contain a further two vulnerabilities, <a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2022-34713\" target=\"_blank\" rel=\"noopener\">CVE-2022-34713<\/a> and <a href=\"https:\/\/cve.mitre.org\/cgi-bin\/cvename.cgi?name=CVE-2022-35743\" target=\"_blank\" rel=\"noopener\">CVE-2022-35743<\/a>, which can be exploited to take advantage of security flaws in the link handler to remotely run commands in the system.<\/p>\n<p>Most of the network threats detected in Q3 2022 were again attacks associated with <a href=\"https:\/\/encyclopedia.kaspersky.com\/glossary\/brute-force\/?utm_source=securelist&amp;utm_medium=blog&amp;utm_campaign=termin-explanation\" target=\"_blank\" rel=\"noopener\">brute-forcing<\/a> passwords for Microsoft SQL Server, RDP, and other services. Network attacks on vulnerable versions of Windows via EternalBlue, EternalRomance, and other exploits were still common. The attempts at exploiting network services and other software via vulnerabilities in the Log4j library (<a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2021-44228\" target=\"_blank\" rel=\"noopener\">CVE-2021-44228<\/a>, <a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2021-44832\" target=\"_blank\" rel=\"noopener\">CVE-2021-44832<\/a>, <a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2021-45046\" target=\"_blank\" rel=\"noopener\">CVE-2021-45046<\/a>, and <a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/cve-2021-45105\" target=\"_blank\" rel=\"noopener\">CVE-2021-45105<\/a>) also continued. Several vulnerabilities were found in the Microsoft Windows Network File System (NFS) driver. These are <a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2022-22028\" target=\"_blank\" rel=\"noopener\">CVE-2022-22028<\/a>, which can lead to leakage of confidential information, as well as <a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2022-22029\" target=\"_blank\" rel=\"noopener\">CVE-2022-22029<\/a>, <a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2022-22039\" target=\"_blank\" rel=\"noopener\">CVE-2022-22039<\/a> and <a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2022-34715\" target=\"_blank\" rel=\"noopener\">CVE-2022-34715<\/a>, which a cybercriminal can use to remotely execute arbitrary code in the system \u2014 in kernel context \u2014 by using a specially crafted network packet. The TCP\/IP stack was found to contain the critical vulnerability <a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2022-34718\" target=\"_blank\" rel=\"noopener\">CVE-2022-34718<\/a>, which allows in theory to remotely exploit a target system by taking advantage of errors in the IPv6 protocol handler. Finally, it is worth mentioning the <a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2022-34724\" target=\"_blank\" rel=\"noopener\">CVE-2022-34724<\/a> vulnerability, which affects Windows DNS Server and can lead to denial of service if exploited.<\/p>\n<p>Two vulnerabilities in Microsoft Exchange Server, <a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2022-41040\" target=\"_blank\" rel=\"noopener\">CVE-2022-41040<\/a> and <a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2022-41082\" target=\"_blank\" rel=\"noopener\">CVE-2022-41082<\/a>, received considerable media coverage. They were collectively dubbed &#8220;ProxyNotShell&#8221; in reference to the ProxyShell vulnerabilities with similar exploitation technique (they were closed earlier). Researchers discovered the ProxyNotShell exploits while investigating an APT attack: an authenticated user can use the loopholes to elevate their privileges and run arbitrary code on an MS Exchange server. As a result, the attacker can steal confidential data, encrypt critical files on the server to to extort money from the victim, etc.<\/p>\n<h3 id=\"vulnerability-statistics\">Vulnerability statistics<\/h3>\n<p>In Q3 2022, malicious Microsoft Office documents again accounted for the greatest number of detections \u2014 80% of the exploits we discovered, although the number decreased slightly compared to Q2. Most of these detections were triggered by exploits that targeted the following vulnerabilities:<\/p>\n<ul>\n<li><a href=\"https:\/\/portal.msrc.microsoft.com\/en-US\/security-guidance\/advisory\/CVE-2018-0802\" target=\"_blank\" rel=\"noopener\">CVE-2018-0802<\/a> and <a href=\"https:\/\/portal.msrc.microsoft.com\/en-US\/security-guidance\/advisory\/CVE-2017-11882\" target=\"_blank\" rel=\"noopener\">CVE-2017-11882<\/a>, in the Equation Editor component, which allow corrupting the application memory when processing formulas, and subsequently running arbitrary code in the system;<\/li>\n<li><a href=\"https:\/\/portal.msrc.microsoft.com\/en-US\/security-guidance\/advisory\/CVE-2017-0199\" target=\"_blank\" rel=\"noopener\">CVE-2017-0199<\/a>, which allows downloading and running malicious script files;<\/li>\n<li><a href=\"https:\/\/portal.msrc.microsoft.com\/en-US\/security-guidance\/advisory\/CVE-2022-30190\" target=\"_blank\" rel=\"noopener\">CVE-2022-30190<\/a>, also known as &#8220;Follina&#8221;, which exploits a flaw in the Microsoft Windows Support Diagnostic Tool (MSDT) for running arbitrary programs in a vulnerable system even in Protected Mode or when macros are disabled;<\/li>\n<li><a href=\"https:\/\/portal.msrc.microsoft.com\/en-US\/security-guidance\/advisory\/CVE-2021-40444\" target=\"_blank\" rel=\"noopener\">CVE-2021-40444<\/a>, which allows an attacker to deploy malicious code using a special ActiveX template due to inadequate input validation.<\/li>\n<\/ul>\n<div class=\"js-infogram-embed\" data-id=\"_\/i0xY2feL8TwM5xu1XPeP\" data-type=\"interactive\" data-title=\"09 EN Malware report Q3 2022 PC stat\" style=\"min-height:;\"><\/div>\n<p style=\"text-align: center;font-style: italic;font-weight: bold;margin-top: -10px\"><em>Distribution of exploits used by cybercriminals, by type of attacked application, Q3 2022 (<a href=\"https:\/\/media.kasperskycontenthub.com\/wp-content\/uploads\/sites\/43\/2022\/11\/15154631\/09-en-malware-report-q3-2022-pc-stat.png\">download<\/a>)<\/em><\/p>\n<p>These were followed by exploits that target browsers. Their share amounted to 6%, or 1% higher than in Q2. We will list the most serious vulnerabilities, all of them targeting Google Chrome:<\/p>\n<ul>\n<li><a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2022-2294\" target=\"_blank\" rel=\"noopener\">CVE-2022-2294<\/a>, in the WebRTC component, which leads to buffer overflow;<\/li>\n<li><a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2022-2624\" target=\"_blank\" rel=\"noopener\">CVE-2022-2624<\/a>, which exploits a memory overflow error in the PDF viewing component;<\/li>\n<li><a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2022-2295\" target=\"_blank\" rel=\"noopener\">CVE-2022-2295<\/a>, a Type Confusion error that allows an attacker to corrupt the browser process memory remotely and run arbitrary code in a sandbox;<\/li>\n<li><a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2022-3075\" target=\"_blank\" rel=\"noopener\">CVE-2022-3075<\/a>, an error linked to inadequate input validation in the Mojo interprocess communication component in Google Chromium-based browsers that allows escaping the sandbox and running arbitrary commands in the system.<\/li>\n<\/ul>\n<p>Since many modern browsers are based on Google Chromium, attackers can often take advantage of the shared vulnerabilities to attack the other browsers as long as they run on one engine.<\/p>\n<p>A series of vulnerabilities were identified in Microsoft Edge. Worth noting is <a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2022-33649\" target=\"_blank\" rel=\"noopener\">CVE-2022-33649<\/a>, which allows running an application in the system by circumventing the browser protections; <a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2022-33636\" target=\"_blank\" rel=\"noopener\">CVE-2022-33636<\/a> and <a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2022-35796\" target=\"_blank\" rel=\"noopener\">CVE-2022-35796<\/a>, Race Condition vulnerabilities that ultimately allow a sandbox escape; and <a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2022-38012\" target=\"_blank\" rel=\"noopener\">CVE-2022-38012<\/a>, which exploits an application memory corruption error, with similar results.<\/p>\n<p>The Mozilla Firefox browser was found to contain vulnerabilities associated with memory corruption, which allow running arbitrary code in the system: <a href=\"https:\/\/cve.mitre.org\/cgi-bin\/cvename.cgi?name=CVE-2022-38476\" target=\"_blank\" rel=\"noopener\">CVE-2022-38476<\/a>, a Race Condition vulnerability that leads to a subsequent Use-After-Free scenario, and the similar vulnerabilities <a href=\"https:\/\/cve.mitre.org\/cgi-bin\/cvename.cgi?name=CVE-2022-38477\" target=\"_blank\" rel=\"noopener\">CVE-2022-38477<\/a> and <a href=\"https:\/\/cve.mitre.org\/cgi-bin\/cvename.cgi?name=CVE-2022-38478\" target=\"_blank\" rel=\"noopener\">CVE-2022-38478<\/a>, which exploit memory corruption. As you can see from our reports, browsers are an attractive target for cybercriminals, as these are widely used and allow attackers to infiltrate the system remotely and virtually unbeknownst to the user. That said, browser vulnerabilities are not simple to exploit, as attackers often have to use a chain of vulnerabilities to work around the protections of modern browsers.<\/p>\n<p>The remaining positions in our rankings were distributed among Android (5%) and Java (4%) exploits. The fifth-highest number of exploits (3%) targeted Adobe Flash, a technology that is obsolete but remains in use. Rounding out the rankings with 2% were exploits spread through PDF documents.<\/p>\n<h2 id=\"attacks-on-macos\">Attacks on macOS<\/h2>\n<p>The third quarter of 2022 brought with it a significant number of interesting macOS malware discoveries.\u00a0 In particular, researchers found <a href=\"https:\/\/www.sentinelone.com\/blog\/lazarus-operation-interception-targets-macos-users-dreaming-of-jobs-in-crypto\/\" target=\"_blank\" rel=\"noopener\">Operation In(ter)ception<\/a>, a campaign operated by North Korean Lazarus group, which targets macOS users looking for cryptocurrency jobs. The malware was disguised as documents containing summaries of positions at Coinbase and Crypto.com.<\/p>\n<p><a href=\"https:\/\/www.welivesecurity.com\/2022\/07\/19\/i-see-what-you-did-there-look-cloudmensis-macos-spyware\/\" target=\"_blank\" rel=\"noopener\">CloudMensis<\/a>, a spy program written in Objective-C, used cloud storage services as C&amp;C servers and <a href=\"https:\/\/twitter.com\/ESETresearch\/status\/1575103839115804672\" target=\"_blank\" rel=\"noopener\">shared several characteristics<\/a> with the RokRAT Windows malware operated by ScarCruft.<\/p>\n<p>The creators of XCSSET <a href=\"https:\/\/www.sentinelone.com\/blog\/xcsset-malware-update-macos-threat-actors-prepare-for-life-without-python\/\" target=\"_blank\" rel=\"noopener\">adapted<\/a> their toolset to macOS Monterey and migrated from Python 2 to Python 3.<\/p>\n<p>In Q3, cybercrooks also began to make use of open-source tools in their attacks. July saw the discovery of two campaigns that used a fake <a href=\"https:\/\/www.sentinelone.com\/blog\/from-the-front-lines-new-macos-covid-malware-masquerades-as-apple-wears-face-of-apt\/\" target=\"_blank\" rel=\"noopener\">VPN application<\/a> and fake <a href=\"https:\/\/twitter.com\/ESETresearch\/status\/1547943014860894210\" target=\"_blank\" rel=\"noopener\">Salesforce updates<\/a>, both built on the Sliver framework.<\/p>\n<p>In addition to this, researchers announced a new multi-platform <a href=\"https:\/\/blog.sekoia.io\/luckymouse-uses-a-backdoored-electron-app-to-target-macos\/\" target=\"_blank\" rel=\"noopener\">find<\/a>: the LuckyMouse group (APT27 \/ Iron Tiger \/ Emissary Panda) attacked Windows, Linux, and macOS users with a malicious mod of the Chinese MiMi instant messaging application.<\/p>\n<h3 id=\"top-20-threats-for-macos\">TOP 20 threats for macOS<\/h3>\n<table width=\"100%\">\n<tbody>\n<tr>\n<td width=\"10%\"><\/td>\n<td width=\"50%\"><strong>Verdict<\/strong><\/td>\n<td width=\"40%\"><strong>%*<\/strong><\/td>\n<\/tr>\n<tr>\n<td>1<\/td>\n<td>AdWare.OSX.Amc.e<\/td>\n<td>14.77<\/td>\n<\/tr>\n<tr>\n<td>2<\/td>\n<td>AdWare.OSX.Pirrit.ac<\/td>\n<td>10.45<\/td>\n<\/tr>\n<tr>\n<td>3<\/td>\n<td>AdWare.OSX.Agent.ai<\/td>\n<td>9.40<\/td>\n<\/tr>\n<tr>\n<td>4<\/td>\n<td>Monitor.OSX.HistGrabber.b<\/td>\n<td>7.15<\/td>\n<\/tr>\n<tr>\n<td>5<\/td>\n<td>AdWare.OSX.Pirrit.j<\/td>\n<td>7.10<\/td>\n<\/tr>\n<tr>\n<td>6<\/td>\n<td>AdWare.OSX.Bnodlero.at<\/td>\n<td>6.09<\/td>\n<\/tr>\n<tr>\n<td>7<\/td>\n<td>AdWare.OSX.Bnodlero.ax<\/td>\n<td>5.95<\/td>\n<\/tr>\n<tr>\n<td>8<\/td>\n<td>Trojan-Downloader.OSX.Shlayer.a<\/td>\n<td>5.71<\/td>\n<\/tr>\n<tr>\n<td>9<\/td>\n<td>AdWare.OSX.Pirrit.ae<\/td>\n<td>5.27<\/td>\n<\/tr>\n<tr>\n<td>10<\/td>\n<td>Trojan-Downloader.OSX.Agent.h<\/td>\n<td>3.87<\/td>\n<\/tr>\n<tr>\n<td>11<\/td>\n<td>AdWare.OSX.Bnodlero.bg<\/td>\n<td>3.46<\/td>\n<\/tr>\n<tr>\n<td>12<\/td>\n<td>AdWare.OSX.Pirrit.o<\/td>\n<td>3.32<\/td>\n<\/tr>\n<tr>\n<td>13<\/td>\n<td>AdWare.OSX.Agent.u<\/td>\n<td>3.13<\/td>\n<\/tr>\n<tr>\n<td>14<\/td>\n<td>AdWare.OSX.Agent.gen<\/td>\n<td>2.90<\/td>\n<\/tr>\n<tr>\n<td>15<\/td>\n<td>AdWare.OSX.Pirrit.aa<\/td>\n<td>2.85<\/td>\n<\/tr>\n<tr>\n<td>16<\/td>\n<td>Backdoor.OSX.Twenbc.e<\/td>\n<td>2.85<\/td>\n<\/tr>\n<tr>\n<td>17<\/td>\n<td>AdWare.OSX.Ketin.h<\/td>\n<td>2.82<\/td>\n<\/tr>\n<tr>\n<td>18<\/td>\n<td>AdWare.OSX.Pirrit.gen<\/td>\n<td>2.69<\/td>\n<\/tr>\n<tr>\n<td>19<\/td>\n<td>Trojan-Downloader.OSX.Lador.a<\/td>\n<td>2.52<\/td>\n<\/tr>\n<tr>\n<td>20<\/td>\n<td>Downloader.OSX.InstallCore.ak<\/td>\n<td>2.28<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p><em>* Unique users who encountered this malware as a percentage of all users of Kaspersky security solutions for macOS who were attacked.<\/em><\/p>\n<p>As usual, our TOP 20 ranking for biggest threats encountered by users of Kaspersky security solutions for macOS were dominated by adware. AdWare.OSX.Amc.e, touted as &#8220;Advanced Mac Cleaner,&#8221; had taken the top place for a second quarter in a row. This application displays fake system issue messages, offering to buy the full version to fix those. Second and third places went to members of the AdWare.OSX.Pirrit and AdWare.OSX.Agent families.<\/p>\n<h3 id=\"geography-of-threats-for-macos\">Geography of threats for macOS<\/h3>\n<p><strong>TOP 10 countries and territories by share of attacked users<\/strong><\/p>\n<table width=\"100%\">\n<tbody>\n<tr>\n<td width=\"10%\"><\/td>\n<td width=\"50%\"><strong>Country or territory*<\/strong><\/td>\n<td width=\"40%\"><strong>%**<\/strong><\/td>\n<\/tr>\n<tr>\n<td>1<\/td>\n<td>France<\/td>\n<td>1.71<\/td>\n<\/tr>\n<tr>\n<td>2<\/td>\n<td>Canada<\/td>\n<td>1.70<\/td>\n<\/tr>\n<tr>\n<td>3<\/td>\n<td>Russia<\/td>\n<td>1.57<\/td>\n<\/tr>\n<tr>\n<td>4<\/td>\n<td>India<\/td>\n<td>1.53<\/td>\n<\/tr>\n<tr>\n<td>5<\/td>\n<td>United States<\/td>\n<td>1.52<\/td>\n<\/tr>\n<tr>\n<td>6<\/td>\n<td>Spain<\/td>\n<td>1.48<\/td>\n<\/tr>\n<tr>\n<td>7<\/td>\n<td>Australia<\/td>\n<td>1.36<\/td>\n<\/tr>\n<tr>\n<td>8<\/td>\n<td>Italy<\/td>\n<td>1.35<\/td>\n<\/tr>\n<tr>\n<td>9<\/td>\n<td>Mexico<\/td>\n<td>1.27<\/td>\n<\/tr>\n<tr>\n<td>10<\/td>\n<td>United Kingdom<\/td>\n<td>1.24<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p><em>* Excluded from the rankings are countries with relatively few users of Kaspersky security solutions for macOS (under 10,000).<br \/>\n** Unique users attacked as a percentage of all users of Kaspersky security solutions for macOS in the country.<\/em><\/p>\n<p>France, with 1.71%, was again the most attacked country by number of users. Canada, with 1.70%, and Russia, with 1.57%, followed close behind. The most frequently encountered family in France and Canada was AdWare.OSX.Amc.e, and in Russia, it was AdWare.OSX.Pirrit.ac.<\/p>\n<h2 id=\"iot-attacks\">IoT attacks<\/h2>\n<h3 id=\"iot-threat-statistics\">IoT threat statistics<\/h3>\n<p>In Q3\u00a02022, three-fourths of the devices that attacked Kaspersky honeypots used the Telnet protocol.<\/p>\n<table width=\"100%\">\n<tbody>\n<tr>\n<td width=\"50%\">Telnet<\/td>\n<td width=\"50%\">75.92%<\/td>\n<\/tr>\n<tr>\n<td>SSH<\/td>\n<td>24.08%<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p style=\"text-align: center\"><em>Distribution of attacked services by number of unique IP addresses of attacking devices, Q3 2022<\/em><\/p>\n<p>A majority of the attacks on Kaspersky honeypots in terms of sessions were controlled via Telnet as well.<\/p>\n<table width=\"100%\">\n<tbody>\n<tr>\n<td width=\"50%\">Telnet<\/td>\n<td width=\"50%\">97.53%<\/td>\n<\/tr>\n<tr>\n<td>SSH<\/td>\n<td>2.47%<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p style=\"text-align: center\"><em>Distribution of cybercriminal working sessions with Kaspersky traps, Q3 2022<\/em><\/p>\n<p><strong>TOP 10 threats delivered to IoT devices via Telnet<\/strong><\/p>\n<table width=\"100%\">\n<tbody>\n<tr>\n<td width=\"10%\"><\/td>\n<td width=\"50%\"><strong>Verdict<\/strong><\/td>\n<td width=\"40%\"><strong>%*<\/strong><\/td>\n<\/tr>\n<tr>\n<td>1<\/td>\n<td>Backdoor.Linux.Mirai.b<\/td>\n<td>28.67<\/td>\n<\/tr>\n<tr>\n<td>2<\/td>\n<td>Trojan-Downloader.Linux.NyaDrop.b<\/td>\n<td>18.63<\/td>\n<\/tr>\n<tr>\n<td>3<\/td>\n<td>Backdoor.Linux.Mirai.ba<\/td>\n<td>11.63<\/td>\n<\/tr>\n<tr>\n<td>4<\/td>\n<td>Backdoor.Linux.Mirai.cw<\/td>\n<td>10.94<\/td>\n<\/tr>\n<tr>\n<td>5<\/td>\n<td>Backdoor.Linux.Gafgyt.a<\/td>\n<td>3.69<\/td>\n<\/tr>\n<tr>\n<td>6<\/td>\n<td>Backdoor.Linux.Mirai.ew<\/td>\n<td>3.49<\/td>\n<\/tr>\n<tr>\n<td>7<\/td>\n<td>Trojan-Downloader.Shell.Agent.p<\/td>\n<td>2.56<\/td>\n<\/tr>\n<tr>\n<td>8<\/td>\n<td>Backdoor.Linux.Gafgyt.bj<\/td>\n<td>1.63<\/td>\n<\/tr>\n<tr>\n<td>9<\/td>\n<td>Backdoor.Linux.Mirai.et<\/td>\n<td>1.17<\/td>\n<\/tr>\n<tr>\n<td>10<\/td>\n<td>Backdoor.Linux.Mirai.ek<\/td>\n<td>1.08<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p><em>* Share of each threat delivered to infected devices as a result of a successful Telnet attack out of the total number of delivered threats.<\/em><\/p>\n<p>Detailed IoT-threat statistics are published in the DDoS report for Q3 2022.<\/p>\n<h2 id=\"attacks-via-web-resources\">Attacks via web resources<\/h2>\n<p><em>The statistics in this section are based on Web Anti-Virus, which protects users when malicious objects are downloaded from malicious\/infected web pages. Cybercriminals create these sites on purpose; they can infect hacked legitimate resources as well as web resources with user-created content, such as forums.<\/em><\/p>\n<h3 id=\"countries-and-territories-that-serve-as-sources-of-web-based-attacks-top-10\">Countries and territories that serve as sources of web-based attacks: TOP 10<\/h3>\n<p><em>The following statistics show the distribution by country or territory of the sources of internet attacks blocked by Kaspersky products on user computers (web pages with redirects to exploits, sites hosting malicious programs, botnet C&amp;C centers, etc.). Any unique host could be the source of one or more web-based attacks.<\/em><\/p>\n<p><em>To determine the geographic source of web attacks, the GeoIP technique was used to match the domain name to the real IP address at which the domain is hosted.<\/em><\/p>\n<p>In Q3 2022, Kaspersky solutions blocked 956,074,958 attacks launched from online resources across the globe. A total of 251,288,987 unique URLs were recognized as malicious by Web Anti-Virus components.<\/p>\n<div class=\"js-infogram-embed\" data-id=\"_\/rwz7SkNQk3MNH2COl9zU\" data-type=\"interactive\" data-title=\"11 EN Malware report Q3 2022 PC stat\" style=\"min-height:;\"><\/div>\n<p style=\"text-align: center;font-style: italic;font-weight: bold;margin-top: -10px\"><em>Distribution of web-attack sources country and territory, Q3 2022 (<a href=\"https:\/\/media.kasperskycontenthub.com\/wp-content\/uploads\/sites\/43\/2022\/11\/15154703\/11-en-malware-report-q3-2022-pc-stat.png\">download<\/a>)<\/em><\/p>\n<h3 id=\"countries-and-territories-where-users-faced-the-greatest-risk-of-online-infection\">Countries and territories where users faced the greatest risk of online infection<\/h3>\n<p>To assess the risk of online infection faced by users in different countries and territories, for each country or territory we calculated the percentage of Kaspersky users on whose computers Web Anti-Virus was triggered during the quarter. The resulting data provides an indication of the aggressiveness of the environment in which computers operate in different countries and territories.<\/p>\n<p>Note that these rankings only include attacks by malicious objects that fall under the <strong><em>Malware<\/em><\/strong><em> class<\/em>; they do not include Web Anti-Virus detections of potentially dangerous or unwanted programs, such as RiskTool or adware.<\/p>\n<table width=\"100%\">\n<tbody>\n<tr>\n<td width=\"10%\"><\/td>\n<td width=\"50%\"><strong>Country or territory*<\/strong><\/td>\n<td width=\"40%\"><strong>%**<\/strong><\/td>\n<\/tr>\n<tr>\n<td>1<\/td>\n<td>Taiwan<\/td>\n<td>19.65<\/td>\n<\/tr>\n<tr>\n<td>2<\/td>\n<td>Belarus<\/td>\n<td>17.01<\/td>\n<\/tr>\n<tr>\n<td>3<\/td>\n<td>Serbia<\/td>\n<td>15.05<\/td>\n<\/tr>\n<tr>\n<td>4<\/td>\n<td>Russia<\/td>\n<td>14.12<\/td>\n<\/tr>\n<tr>\n<td>5<\/td>\n<td>Algeria<\/td>\n<td>14.01<\/td>\n<\/tr>\n<tr>\n<td>6<\/td>\n<td>Turkey<\/td>\n<td>13.82<\/td>\n<\/tr>\n<tr>\n<td>7<\/td>\n<td>Tunisia<\/td>\n<td>13.31<\/td>\n<\/tr>\n<tr>\n<td>8<\/td>\n<td>Bangladesh<\/td>\n<td>13.30<\/td>\n<\/tr>\n<tr>\n<td>9<\/td>\n<td>Moldova<\/td>\n<td>13.22<\/td>\n<\/tr>\n<tr>\n<td>10<\/td>\n<td>Palestine<\/td>\n<td>12.61<\/td>\n<\/tr>\n<tr>\n<td>11<\/td>\n<td>Yemen<\/td>\n<td>12.58<\/td>\n<\/tr>\n<tr>\n<td>12<\/td>\n<td>Ukraine<\/td>\n<td>12.25<\/td>\n<\/tr>\n<tr>\n<td>13<\/td>\n<td>Libya<\/td>\n<td>12.23<\/td>\n<\/tr>\n<tr>\n<td>14<\/td>\n<td>Sri Lanka<\/td>\n<td>11.97<\/td>\n<\/tr>\n<tr>\n<td>15<\/td>\n<td>Kyrgyzstan<\/td>\n<td>11.69<\/td>\n<\/tr>\n<tr>\n<td>16<\/td>\n<td>Estonia<\/td>\n<td>11.65<\/td>\n<\/tr>\n<tr>\n<td>17<\/td>\n<td>Hong Kong<\/td>\n<td>11.52<\/td>\n<\/tr>\n<tr>\n<td>18<\/td>\n<td>Nepal<\/td>\n<td>11.52<\/td>\n<\/tr>\n<tr>\n<td>19<\/td>\n<td>Syria<\/td>\n<td>11.39<\/td>\n<\/tr>\n<tr>\n<td>20<\/td>\n<td>Lithuania<\/td>\n<td>11.33<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p><em>* Excluded are countries and territories with relatively few Kaspersky users (under 10,000).<\/em><br \/>\n<em>** Unique users targeted by <strong>Malware<\/strong>-class attacks as a percentage of all unique users of Kaspersky products in the country.<\/em><\/p>\n<p>On average during the quarter, 9.08% of internet users&#8217; computers worldwide were subjected to at least one <strong>Malware<\/strong>-class web attack.<\/p>\n<h2 id=\"local-threats\">Local threats<\/h2>\n<p><em>In this section, we analyze statistical data obtained from the OAS and ODS modules of Kaspersky products. It takes into account malicious programs that were found directly on users&#8217; computers or removable media connected to them (flash drives, camera memory cards, phones, external hard drives), or which initially made their way onto the computer in non-open form (for example, programs in complex installers, encrypted files, etc.).<\/em><\/p>\n<p>In Q3\u00a02022, our File Anti-Virus detected <strong>49,275,253<\/strong> malicious and potentially unwanted objects.<\/p>\n<h3 id=\"countries-and-territories-where-users-faced-the-highest-risk-of-local-infection\">Countries and territories where users faced the highest risk of local infection<\/h3>\n<p>For each country, we calculated the percentage of Kaspersky product users on whose computers File Anti-Virus was triggered during the reporting period. These statistics reflect the level of personal computer infection in different countries.<\/p>\n<p>These rankings only include attacks by malicious programs that fall under the <strong>Malware<\/strong> class; they do not include File Anti-Virus triggerings in response to potentially dangerous or unwanted programs, such as RiskTool or adware.<\/p>\n<table width=\"100%\">\n<tbody>\n<tr>\n<td width=\"10%\"><\/td>\n<td width=\"50%\"><strong>Country or territory*<\/strong><\/td>\n<td width=\"40%\"><strong>%**<\/strong><\/td>\n<\/tr>\n<tr>\n<td>1<\/td>\n<td>Turkmenistan<\/td>\n<td>46.48<\/td>\n<\/tr>\n<tr>\n<td>2<\/td>\n<td>Yemen<\/td>\n<td>45.12<\/td>\n<\/tr>\n<tr>\n<td>3<\/td>\n<td>Afghanistan<\/td>\n<td>44.18<\/td>\n<\/tr>\n<tr>\n<td>4<\/td>\n<td>Cuba<\/td>\n<td>40.48<\/td>\n<\/tr>\n<tr>\n<td>5<\/td>\n<td>Tajikistan<\/td>\n<td>39.17<\/td>\n<\/tr>\n<tr>\n<td>6<\/td>\n<td>Bangladesh<\/td>\n<td>37.06<\/td>\n<\/tr>\n<tr>\n<td>7<\/td>\n<td>Uzbekistan<\/td>\n<td>37.00<\/td>\n<\/tr>\n<tr>\n<td>8<\/td>\n<td>Ethiopia<\/td>\n<td>36.96<\/td>\n<\/tr>\n<tr>\n<td>9<\/td>\n<td>South Sudan<\/td>\n<td>36.89<\/td>\n<\/tr>\n<tr>\n<td>10<\/td>\n<td>Myanmar<\/td>\n<td>36.64<\/td>\n<\/tr>\n<tr>\n<td>11<\/td>\n<td>Syria<\/td>\n<td>34.82<\/td>\n<\/tr>\n<tr>\n<td>12<\/td>\n<td>Benin<\/td>\n<td>34.56<\/td>\n<\/tr>\n<tr>\n<td>13<\/td>\n<td>Burundi<\/td>\n<td>33.91<\/td>\n<\/tr>\n<tr>\n<td>14<\/td>\n<td>Tanzania<\/td>\n<td>33.05<\/td>\n<\/tr>\n<tr>\n<td>15<\/td>\n<td>Rwanda<\/td>\n<td>33.03<\/td>\n<\/tr>\n<tr>\n<td>16<\/td>\n<td>Chad<\/td>\n<td>33.01<\/td>\n<\/tr>\n<tr>\n<td>17<\/td>\n<td>Venezuela<\/td>\n<td>32.79<\/td>\n<\/tr>\n<tr>\n<td>18<\/td>\n<td>Cameroon<\/td>\n<td>32.30<\/td>\n<\/tr>\n<tr>\n<td>19<\/td>\n<td>Sudan<\/td>\n<td>31.93<\/td>\n<\/tr>\n<tr>\n<td>20<\/td>\n<td>Malawi<\/td>\n<td>31.88<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p><em>* Excluded are countries with relatively few Kaspersky users (under 10,000).<\/em><br \/>\n<em>** Unique users on whose computers <strong>Malware<\/strong>-class local threats were blocked, as a percentage of all unique users of Kaspersky products in the country.<\/em><\/p>\n<p>On average worldwide, Malware-class local threats were registered on 14.74% of users&#8217; computers at least once during Q3. Russia scored 16.60% in this ranking.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>PC malware statistics for Q3 2022 includes data on miners, ransomware, banking Trojans, and other threats to Windows, macOS and IoT devices.<\/p>\n","protected":false},"author":2487,"featured_media":107994,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[919],"tags":[113,561,556,458,123,86,933,121,544,41,117,54],"banners":"","hreflang":[{"hreflang":"x-default","url":"https:\/\/securelist.com\/it-threat-evolution-in-q3-2022-non-mobile-statistics\/107963\/"},{"hreflang":"ru","url":"https:\/\/securelist.ru\/it-threat-evolution-in-q3-2022-non-mobile-statistics\/106077\/"},{"hreflang":"es","url":"https:\/\/securelist.lat\/it-threat-evolution-in-q3-2022-non-mobile-statistics\/97184\/"}],"_links":{"self":[{"href":"https:\/\/securelist.com\/wp-json\/wp\/v2\/posts\/107963"}],"collection":[{"href":"https:\/\/securelist.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/securelist.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/securelist.com\/wp-json\/wp\/v2\/users\/2487"}],"replies":[{"embeddable":true,"href":"https:\/\/securelist.com\/wp-json\/wp\/v2\/comments?post=107963"}],"version-history":[{"count":12,"href":"https:\/\/securelist.com\/wp-json\/wp\/v2\/posts\/107963\/revisions"}],"predecessor-version":[{"id":108173,"href":"https:\/\/securelist.com\/wp-json\/wp\/v2\/posts\/107963\/revisions\/108173"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/securelist.com\/wp-json\/wp\/v2\/media\/107994"}],"wp:attachment":[{"href":"https:\/\/securelist.com\/wp-json\/wp\/v2\/media?parent=107963"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/securelist.com\/wp-json\/wp\/v2\/categories?post=107963"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/securelist.com\/wp-json\/wp\/v2\/tags?post=107963"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}