The latest issue of the ESET Threat Report sheds light on the most frequent external attack vectors, the reason behind the rise of email threats, and shifts in the prevalence of some threats due to fluctuating exchange rates of cryptocurrencies.
ESET Research has released its T3 2021 Threat Report summarising key statistics from ESET detection systems and highlighting notable examples of ESET cybersecurity research, including exclusive, previously unpublished updates on current threats.
One of the key insights from the research was the ProxyLogon vulnerability being found as the second most frequent external attack vector in ESET's 2021 statistics, right behind password-guessing attacks. Microsoft Exchange servers fell under siege again in August 2021, with ProxyLogon's 'younger sibling', ProxyShell, exploited worldwide by several threat groups.
Other research in the report involves the Log4Shell vulnerability, yet another critical flaw in the ubiquitous Log4j utility that surfaced in mid-December and sent IT teams scrambling, again, to locate and patch the flaw in their systems.
"This vulnerability, scoring a ten on the Common Vulnerability Scoring System, put countless servers at risk of a complete takeover – so it came as no surprise that cybercriminals instantly started exploiting it," says ESET chief research officer, Roman Kov.
"Despite only being known for the last three weeks of the year, Log4j attacks were the fifth most common external intrusion vector in 2021 in our statistics, showing just how quickly threat actors are at taking advantage of newly emerging critical vulnerabilities."
The research presented in the ESET Threat Report T3 2021 also provides previously unpublished information about APT group operations. This time, researchers offer updates on the activity of cyberespionage group OilRig, the latest information on in-the-wild ProxyShell exploitation, and new spearphishing campaigns by the infamous cyberespionage group the Dukes.
ESET says the end of the year was also turbulent for Remote Desktop Protocol (RDP) attacks, which escalated throughout all of 2020 and 2021. The numbers from the last weeks of T3 2021 broke all previous records, amounting to a massive yearly growth of 897% in total attack attempts blocked – even though 2021 was no longer marked by the chaos of newly imposed lockdowns and sudden transitions to remote work.
The report also shows that ransomware, previously described in the ESET Threat Report Q4 2020 as 'more aggressive than ever', surpassed the worst expectations in 2021, with attacks against critical infrastructure, outrageous ransom demands and over USD 5 billion worth of bitcoin transactions tied to potential ransomware payments identified in the first half of 2021 alone. As the bitcoin exchange rate reached its highest point in November, ESET experts observed an influx of cryptocurrency-targeting threats, further boosted by the recent popularity of NFTs.
In mobile, ESET noted an alarming upsurge in Android banking malware detections, which rose by 428% in 2021 compared to 2020, reaching the detection levels of adware – a common nuisance on the Android platform. While email threats saw their yearly detection numbers more than double. This trend was mainly driven by a rise in phishing emails, which more than compensated for the rapid decline in Emotet's signature malicious macros in email attachments. Emotet, an infamous trojan inactive for most of the year, as illustrated in the report, came back from the dead in T3.
The report also reviews some important research findings, with ESET Researchers uncovering FontOnLake, a new malware family targeting Linux, a previously undocumented real-world UEFI bootkit named ESPecter, FamousSparrow, a cyberespionage group targeting hotels, governments, and private companies worldwide, and others. T3 also saw ESET researchers publish a comprehensive analysis of all 17 malicious frameworks known to have been used to attack air-gapped networks and conclude their extensive series of deep dives into Latin American banking trojans.