Malware Landscape 2023: A Study of the Scope and Distribution of Malware
Interisle reviewed over 7 million reports of distinct malware events from January 2022 to December 2022 collected by the Cybercrime Information Center, examining malware that attacks both IoT and user-attended devices ("endpoints"). This year Interisle also studied reports of malicious traffic sources: malware that is used to scan web sites for exploitable vulnerabilities, to inject malicious content into web forms, or to conduct denial of service attacks.
The major findings of the study are:
Malware activity increased in 2022, continuing the trend from the previous year. Information stealing and ransomware were the dominant malware threats in 2022.
Endpoint malware activity increased 50% over 2021. The Quackbot banking trojan was the most reported endpoint malware.
IoT malware activity decreased in 2022. Mozi IoT malware reporting sharply declined in early 2022 but showed signs of renewed activity in 4Q 2022.
60% of reports identified malware that attacks or probes legitimate web sites. Nearly two-thirds of the reported probes were vulnerability scanners. PHP forum spammers accounted for one-third of attackware reported.
Malware hosting activity was most intense in China, India, and the United States.
The use of domain names in malware URLs grew sharply. Interisle found a 121% increase in the use of domain names in 4Q 2022.
Attackers continued to exploit file sharing services and code repositories to distribute malware.
The findings strongly suggest that mitigating malware requires cooperation and determined efforts by all parties that comprise the naming, addressing, and hosting ecosystem exploited by cyberattackers. The Interisle study discusses several means by which coordinated efforts among these parties, law enforcement, and private sector "first responders" could result in more effective malware mitigation.
The opinions, findings, and conclusions or recommendations expressed in this report are the product of independent work conducted by Interisle Consulting Group, without direction or other influence from any outside party, including parties that may have provided funding to support the work.
Comments can be submitted to criminaldomainabuse@interisle.net