Protect Your Business And Your Clients from Malware

Emotet was one of the first botnets to spread banking Trojans laterally within the infected network, making it difficult to remove.

Trickbot followed Emotet's lead, but contains additional modules (and counting) and has even been seen dropping ransomware. Imagine all the machines in your network being encrypted all at once...

Zeus Panda has similar functionality to Trickbot, but most interesting are its distribution methods, from macro-enabled Word documents to exploit kits and even compromised RMMs.

GhostMiner’s distribution method is the scariest part for its victims, who are unaware of its entry point. Like a scary movie where you know someone’s in the house, but you don’t know where.

WannaMine’s Windows Management Instrumentation (WMI) persistence technique was extremely nasty, allowing it to remain stealthy and difficult to locate and remove.

Coinhive, initially innocuous, was quickly added to the standard toolkit for attackers looking to compromise websites. If visiting a website causes your CPU to spike to 100 percent, it might be Coinhive.

Crysis/Dharma goes hand in hand with the term “compromised RDP.” It remains a top dog in the RaaS (Ransomware-as-a-Service) world, specifically targeting the RDP vector. System administrators often go to work to find machines encrypted, usually without knowing the source.

GandCrab is another especially nasty RaaS distributed via malspam campaigns, exploit kits, and RDP. Interestingly, it uses the .bit TLD (Top Level Domain), not sanctioned by ICANN, providing additional secrecy.

SamSam, initially distributed via a JBoss exploit, soon turned to RDP as well. It’s now bringing down entire cities (portions of them, at least). You’ve likely seen these attacks in the news after taking down the city of Atlanta or Colorado’s Transportation Department.