The results of Fortinet Threat Intelligence Insider Latin America for the fourth quarter of 2019 reveal the continuous increasing of malware, exploits and botnet activity in Latin America and the Caribbean. In the last quarter of the year, the region suffered more than 9 billion attempts to attack, totaling 85 billion in 2019.
The report also reveals the most common infections in Latin America and the Caribbean:
As we have seen throughout the year, DoublePulsar, the backdoor used by the WannaCry ransomware, is still a mechanism for distributing malware in the region. Considering it takes advantage of already resolved vulnerabilities, its continuous use evidences the vast software footprint without updates in Latin America, affecting companies and individuals alike. DoublePulsar is mainly targeted to banks and financial service companies.
The Emotet botnet (aimed at attacking mostly banks) reappears prominently in FortiGuard detections for the fourth quarter, and Latin America provides a 45% presence of this botnet globally.
Emotet is a Trojan malware that targets Windows platform. It contacts Command and Control servers via HTTP or HTTPS requests. A remote attacker can issue commands to the malware to perform different operations. Emotet can download and install additional malware such as ransomware.
FortiGuard detected relevant threats aimed at Cryptocurrency in Latin America and the Caribbean this fourth quarter of 2019. Here are some examples of this trend:
Different variations of malware, trojans and exploits for ransomware are still very active in Latin America.
How to defend from such multi-pronged attacks?
W32/FlyAgent.K!tr.bdr is classified as a trojan. A trojan is a type of malware that performs activities without the user’s knowledge. These activities commonly include establishing remote access connections, capturing keyboard input, collecting system information, downloading/uploading files, dropping other malware into the infected system, performing denial-of-service (DoS) attacks, and running/terminating processes.
JS/ProxyChanger.ES!tr is classified as a trojan. A trojan is a type of malware that performs activities without the user’s knowledge. These activities commonly include establishing remote access connections, capturing keyboard input, collecting system information, downloading/uploading files, dropping other malware into the infected system, performing denial-of-service (DoS) attacks, and running/terminating processes.
Riskware/TotalVirusProtection is classified as a type of Riskware. Riskware is any potentially unwanted application that is not classified as malware, but may utilize system resources in an undesirable or annoying manner, and/or may pose a security risk.
SMB.Login.Brute.Force This indicates a detection of at least 500 failed SAMBA logins in one minute which indicate a possible SAMBA logins brute force attack. Affected Microsoft Windows Operating Systems.
Web.Server.Password.Files.Access This indicates an attempt to access a sensitive file through HTTP requests.
Cross.Site.Scripting This indicates a potential cross-site scripting attack. Cross-site scripting (XSS) is a popular web security issue. If a web application doesn't properly validate input from one user and uses it in the output for other users, attackers can exploit it to send malicious code to other users.
Emotet.Cridex.Botnet This indicates that a system might be infected by Emotet Botnet. Emotet is a Trojan that targets Windows platform. It contacts C&C servers via HTTP or HTTPS requests. Emotet can download and install additional malware such as ransomware or infostealer. Emotet is a variant of Cridex malware.
Sora.Botnet This indicates that a system might be infected by a Sora Botnet. Sora is an IoT malware which targets embedded systems.
Virut.botnet This botnet is a type of malware bot that may perform many malicious tasks, such as downloading and executing additional malware, receiving commands from a control server and relaying specific information and telemetry back to the control server, updating or deleting itself, stealing login and password information, logging keystrokes, participating in a Distributed Denial of Service (DDoS) attack, or locking and encrypting the contents of your computer and demanding payment for its safe return.