Each month, approximately 1% of users in Australia attempt to access malicious content on the web or in the cloud and are blocked from doing so by Netskope Advanced Threat Protection engines. The malicious content takes multiple forms, including malicious JavaScript content that the browser executes and malware downloads that infect the host OS. The following is a list of the top five malware families detected in Australia over the past year.
- Backdoor.Zusy (a.k.a. TinyBanker) is a banking Trojan based on the source code of Zeus, aiming to steal personal information via code injection into websites.
- Downloader.SLoad (a.k.a Starslord) is a downloader often used to deliver Ramnit.
- Trojan.FakeUpdater (a.k.a. SocGholish) is a JavaScript downloader that delivers various payloads, including Dridex and Azorult.
- Trojan.Parrottds is a JavaScript-based traffic direction system that has been used to redirect traffic to various malicious locations since 2019.
- Trojan.VexTrio is a JavaScript-based traffic direction system active since 2017 and is used by multiple criminal organizations to redirect victims to various malicious locations.
Delivering malware using popular cloud apps is a technique adversaries use to fly under the radar. Each month, 86% of organizations have users attempting to download malware from cloud apps. While the full list of apps numbers in the hundreds, three apps appear commonly across organizations in Australia. The following chart presents those three apps in terms of the percentage of organizations that see malware downloaded from the app monthly. GitHub is at the top because it is used to host a variety of hacktools. OneDrive and Amazon S3 are at the top because they are ubiquitous. Adversaries attempt to share malicious payloads in those apps with the understanding the apps will be widely used in target organizations.
Netskope Threat Labs tracks adversaries actively targeting Netskope customers to understand their motivations, tactics, and techniques, so that we can build better defenses against them. We generally categorize adversary motivations as either criminal or geopolitical. The two top adversary groups targeting organizations in Australia over the past year were criminal groups based in Russia.
Back 
