logo
DATABASE RESOURCES PRICING ABOUT US

IT threat evolution in Q2 2021. PC statistics

2021-08-12T10:00:12

Description

![](https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2021/08/12091857/abstract_malware_report-990x400.jpg) _These statistics are based on detection verdicts of Kaspersky products received from users who consented to providing statistical data._ ## Quarterly figures According to Kaspersky Security Network, in Q2 2021: * Kaspersky solutions blocked 1,686,025,551 attacks from online resources across the globe. * Web antivirus recognized 675,832,360 unique URLs as malicious. * Attempts to run malware for stealing money from online bank accounts were stopped on the computers of 119,252 unique users. * Ransomware attacks were defeated on the computers of 97,451 unique users. * Our file antivirus detected 68,294,298 unique malicious and potentially unwanted objects. ## Financial threats ### Financial threat statistics In Q2 2021, Kaspersky solutions blocked the launch of at least one piece of banking malware on the computers of 119,252 unique users. _Number of unique users attacked by financial malware, Q2 2021 ([download](<https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2021/08/11140610/01-en-malware-report-q2-2021-graphs-pc.png>))_ **Geography of financial malware attacks** _To evaluate and compare the risk of being infected by banking Trojans and ATM/POS malware worldwide, for each country we calculated the share of users of Kaspersky products who faced this threat during the reporting period as a percentage of all users of our products in that country._ _Geography of financial malware attacks, Q2 2021 ([download](<https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2021/08/11140636/02-en-malware-report-q2-2021-graphs-pc.png>))_ **Top 10 countries by share of attacked users** | **Country*** | **%**** ---|---|--- 1 | Turkmenistan | 5.8 2 | Tajikistan | 5.0 3 | Afghanistan | 4.2 4 | Uzbekistan | 3.3 5 | Lithuania | 2.9 6 | Sudan | 2.8 7 | Paraguay | 2.5 8 | Zimbabwe | 1.6 9 | Costa Rica | 1.5 10 | Yemen | 1.5 _* Excluded are countries with relatively few Kaspersky product users (under 10,000)._ _** Unique users whose computers were targeted by financial malware as a percentage of all unique users of Kaspersky products in the country._ Last quarter, as per tradition, the most widespread family of bankers was ZeuS/Zbot (17.8%), but its share in Q2 almost halved, by 13 p.p. Second place again went to the CliptoShuffler family (9.9%), whose share also fell, by 6 p.p. The Top 3 is rounded out by SpyEye (8.8%), which added 5 p.p., climbing from the eighth place. Note the disappearance of Emotet from the Top 10, which was predictable given the liquidation of its infrastructure in the previous quarter. **Top 10 banking malware families** | Name | Verdicts | %* ---|---|---|--- 1 | Zbot | Trojan.Win32.Zbot | 17.8 2 | CliptoShuffler | Trojan-Banker.Win32.CliptoShuffler | 9.9 3 | SpyEye | Trojan-Spy.Win32.SpyEye | 8.8 4 | Trickster | Trojan.Win32.Trickster | 5.5 5 | RTM | Trojan-Banker.Win32.RTM | 3.8 6 | Danabot | Trojan-Banker.Win32.Danabot | 3.6 7 | Nimnul | Virus.Win32.Nimnul | 3.3 8 | Cridex | Backdoor.Win32.Cridex | 2.3 9 | Nymaim | Trojan.Win32.Nymaim | 1.9 10 | Neurevt | Trojan.Win32.Neurevt | 1.6 _* Unique users who encountered this malware family as a percentage of all users attacked by financial malware._ ## Ransomware programs ### Quarterly trends and highlights #### Attack on Colonial Pipeline and closure of DarkSide Ransomware attacks on large organizations continued in Q2. Perhaps the most notable event of the quarter was the [attack by the DarkSide group on Colonial Pipeline](<https://ics-cert.kaspersky.com/reports/2021/05/21/darkchronicles-the-consequences-of-the-colonial-pipeline-attack/>), one of the largest fuel pipeline operators in the US. The incident led to fuel outages and a state of emergency in four states. The results of the investigation, which involved the FBI and several other US government agencies, was reported to US President Joe Biden. For the cybercriminals, this sudden notoriety proved unwelcome. In their blog, DarkSide's creators heaped the blame on third-party operators. Another post was published stating that DarkSide's developers had lost access to part of their infrastructure and were shutting down the service and the affiliate program. Another consequence of this high-profile incident was a new rule on the Russian-language forum XSS, where many developers of ransomware, including REvil (also known as Sodinokibi or Sodin), LockBit and Netwalker, advertise their affiliate programs. The new rule forbade the advertising and selling of any ransomware programs on the site. The administrators of other forums popular with cybercriminals took similar decisions. #### Closure of Avaddon Another family of targeted ransomware whose owners shut up shop in Q2 is Avaddon. At the same time as announcing the shutdown, the attackers [provided](<https://www.bleepingcomputer.com/news/security/avaddon-ransomware-shuts-down-and-releases-decryption-keys/>) Bleeping Computer with the decryption keys. #### Clash with Clop Ukrainian police [searched](<https://cyberpolice.gov.ua/news/kiberpolicziya-vykryla-xakerske-ugrupovannya-u-rozpovsyudzhenni-virusu-shyfruvalnyka-ta-nanesenni-inozemnym-kompaniyam-piv-milyarda-dolariv-zbytkiv-2402/>) and arrested members of the Clop group. Law enforcement agencies also deactivated part of the cybercriminals' infrastructure, which [did not](<https://www.bleepingcomputer.com/news/security/clop-ransomware-is-back-in-business-after-recent-arrests/>), however, stop the group's activities. #### Attacks on NAS devices In Q2, cybercriminals stepped up their attacks on network-attached storage (NAS) devices. There appeared the new [Qlocker](<https://support.qnap.ru/hc/ru/articles/360021328659-Уязвимость-Qnap-Ransomware-Qlocker>) family, which packs user files into a password-protected 7zip archive, plus our old friends [ech0raix](<https://www.qnap.com/en/security-advisory/QSA-21-18>) and [AgeLocker](<https://www.qnap.com/en-us/security-advisory/QSA-21-15>) began to gather steam. ### Number of new ransomware modifications In Q2 2021, we detected 14 new ransomware families and 3,905 new modifications of this malware type. _Number of new ransomware modifications, Q2 2020 — Q2 2021 ([download](<https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2021/08/11141411/03-en-ru-es-malware-report-q2-2021-graphs-pc.png>))_ ### Number of users attacked by ransomware Trojans In Q2 2021, Kaspersky products and technologies protected 97,451 users from ransomware attacks. _Number of unique users attacked by ransomware Trojans, Q2 2021 ([download](<https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2021/08/11141438/04-en-malware-report-q2-2021-graphs-pc.png>))_ ### Geography of ransomware attacks _Geography of attacks by ransomware Trojans, Q2 2021 ([download](<https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2021/08/11141505/05-en-malware-report-q2-2021-graphs-pc.png>))_ **Top 10 countries attacked by ransomware Trojans** | **Country*** | **%**** ---|---|--- 1 | Bangladesh | 1.85 2 | Ethiopia | 0.51 3 | China | 0.49 4 | Pakistan | 0.40 5 | Egypt | 0.38 6 | Indonesia | 0.36 7 | Afghanistan | 0.36 8 | Vietnam | 0.35 9 | Myanmar | 0.35 10 | Nepal | 0.33 _* Excluded are countries with relatively few Kaspersky users (under 50,000)._ _** Unique users attacked by ransomware Trojans as a percentage of all unique users of Kaspersky products in the country._ ### Top 10 most common families of ransomware Trojans | **Name** | **Verdicts** | **%*** ---|---|---|--- 1 | WannaCry | Trojan-Ransom.Win32.Wanna | 20.66 2 | Stop | Trojan-Ransom.Win32.Stop | 19.70 3 | (generic verdict) | Trojan-Ransom.Win32.Gen | 9.10 4 | (generic verdict) | Trojan-Ransom.Win32.Crypren | 6.37 5 | (generic verdict) | Trojan-Ransom.Win32.Phny | 6.08 6 | (generic verdict) | Trojan-Ransom.Win32.Encoder | 5.87 7 | (generic verdict) | Trojan-Ransom.Win32.Agent | 5.19 8 | PolyRansom/VirLock | Virus.Win32.Polyransom / Trojan-Ransom.Win32.PolyRansom | 2.39 9 | (generic verdict) | Trojan-Ransom.Win32.Crypmod | 1.48 10 | (generic verdict) | Trojan-Ransom.MSIL.Encoder | 1.26 _* Unique Kaspersky users attacked by this family of ransomware Trojans as a percentage of all users attacked by such malware._ ## Miners ### Number of new miner modifications In Q2 2021, Kaspersky solutions detected 31,443 new modifications of miners. _Number of new miner modifications, Q2 2021 ([download](<https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2021/08/11141534/06-en-malware-report-q2-2021-graphs-pc.png>))_ ### Number of users attacked by miners In Q2, we detected attacks using miners on the computers of 363,516 unique users of Kaspersky products worldwide. At the same time, the number of attacked users gradually decreased during the quarter; in other words, the downward trend in miner activity returned. _Number of unique users attacked by miners, Q2 2021 ([download](<https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2021/08/11141602/07-en-malware-report-q2-2021-graphs-pc.png>))_ ### Geography of miner attacks _Geography of miner attacks, Q2 2021 ([download](<https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2021/08/11141627/08-en-malware-report-q2-2021-graphs-pc.png>))_ **Top 10 countries attacked by miners** | **Country*** | **%**** ---|---|--- 1 | Afghanistan | 3.99 2 | Ethiopia | 2.66 3 | Rwanda | 2.19 4 | Uzbekistan | 1.61 5 | Mozambique | 1.40 6 | Sri Lanka | 1.35 7 | Vietnam | 1.33 8 | Kazakhstan | 1.31 9 | Azerbaijan | 1.21 10 | Tanzania | 1.19 _* Excluded are countries with relatively few users of Kaspersky products (under 50,000)._ _** Unique users attacked by miners as a percentage of all unique users of Kaspersky products in the country._ ## Vulnerable applications used by cybercriminals during cyberattacks Q2 2021 injected some minor changes into our statistics on exploits used by cybercriminals. In particular, the share of exploits for Microsoft Office dropped to 55.81% of the total number of threats of this type. Conversely, the share of exploits attacking popular browsers rose by roughly 3 p.p. to 29.13%. _Distribution of exploits used by cybercriminals, by type of attacked application, Q2 2021 ([download](<https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2021/08/11141656/09-en-malware-report-q2-2021-graphs-pc.png>))_ Microsoft Office exploits most often tried to utilize the memory corruption vulnerability [CVE-2018-0802](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0802>). This error can occur in the Equation Editor component when processing objects in a specially constructed document, and its exploitation causes a buffer overflow and allows an attacker to execute arbitrary code. Also seen in Q2 was the similar vulnerability [CVE-2017-11882](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11882>), which causes a buffer overflow on the stack in the same component. Lastly, we spotted an attempt to exploit the [CVE-2017-8570](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8570>) vulnerability, which, like other bugs in Microsoft Office, permits the execution of arbitrary code in vulnerable versions of the software. Q2 2021 was marked by the emergence of several dangerous vulnerabilities in various versions of the Microsoft Windows family, many of them observed in the wild. Kaspersky alone found three vulnerabilities used in targeted attacks: * [CVE-2021-28310](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-28310>) — an out-of-bounds (OOB) write vulnerability in the Microsoft DWM Core library used in Desktop Window Manager. Due to insufficient checks in the data array code, an unprivileged user using the DirectComposition API can write their own data to the memory areas they control. As a result, the data of real objects is corrupted, which, in turn, can lead to the execution of arbitrary code; * [CVE-2021-31955](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-31955>) — an information disclosure vulnerability that exposes information about kernel objects. Together with other exploits, it allows an intruder to attack a vulnerable system; * [CVE-2021-31956](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-31956>) — a vulnerability in the ntfs.sys file system driver. It causes incorrect checking of transferred sizes, allowing an attacker to inflict a buffer overflow by manipulating parameters. You can read more about these vulnerabilities and their exploitation in our articles [PuzzleMaker attacks with Chrome zero-day exploit chain](<https://securelist.com/puzzlemaker-chrome-zero-day-exploit-chain/102771/>) and [Zero-day vulnerability in Desktop Window Manager (CVE-2021-28310) used in the wild](<https://securelist.com/zero-day-vulnerability-in-desktop-window-manager-cve-2021-28310-used-in-the-wild/101898/>). Other security researchers found a number of browser vulnerabilities, including: * [CVE-2021-33742](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-33742>) — a bug in the Microsoft Trident browser engine (MSHTML) that allows writing data outside the memory of operable objects; * Three Google Chrome vulnerabilities found in the wild that exploit bugs in various browser components: [CVE-2021-30551](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-30551>) — a data type confusion vulnerability in the V8 scripting engine; [CVE-2021-30554](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-30554>) — a use-after-free vulnerability in the WebGL component; and [CVE-2021-21220](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-21220>) — a heap corruption vulnerability; * Three vulnerabilities in the WebKit browser engine, now used mainly in Apple products (for example, the Safari browser), were also found in the wild: [CVE-2021-30661](<https://support.apple.com/en-us/HT212317>) — a use-after-free vulnerability; [CVE-2021-30665](<https://support.apple.com/en-us/HT212336>) — a memory corruption vulnerability; and [CVE-2021-30663](<https://support.apple.com/en-us/HT212336>) — an integer overflow vulnerability. All of these vulnerabilities allow a cybercriminal to attack a system unnoticed if the user opens a malicious site in an unpatched browser. In Q2, two similar vulnerabilities were found ([CVE-2021-31201](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-31201>) and [CVE-2021-31199](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-31199>)), exploiting integer overflow bugs in the Microsoft Windows Cryptographic Provider component. Using these vulnerabilities, an attacker could prepare a special signed document that would ultimately allow the execution of arbitrary code in the context of an application that uses the vulnerable library. But the biggest talking point of the quarter was the [critical vulnerabilities CVE-2021-1675 and CVE-2021-34527](<https://securelist.com/quick-look-at-cve-2021-1675-cve-2021-34527-aka-printnightmare/103123/>) in the Microsoft Windows Print Spooler, in both server and client editions. Their discovery, together with a [proof of concept](<https://encyclopedia.kaspersky.com/glossary/poc-proof-of-concept/?utm_source=securelist&utm_medium=blog&utm_campaign=termin-explanation>), caused a stir in both the expert community and the media, which dubbed one of the vulnerabilities PrintNightmare. Exploitation of these vulnerabilities is quite trivial, since Print Spooler is enabled by default in Windows, and the methods of compromise are available even to unprivileged users, including remote ones. In the latter case, the RPC mechanism can be leveraged for compromise. As a result, an attacker with low-level access can take over not only a local machine, but also the domain controller, if these systems have not been updated, or available [risk mitigation methods](<https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-34527>) against these vulnerabilities have not been applied. Among the network threats in Q2 2021, attempts to brute-force passwords in popular protocols and services (RDP, SSH, MSSQL, etc.) are still current. Attacks using EternalBlue, EternalRomance and other such exploits remain prevalent, although their share is gradually shrinking. New attacks include [CVE-2021-31166](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-31166>), a vulnerability in the Microsoft Windows HTTP protocol stack that causes a denial of service during processing of web-server requests. To gain control over target systems, attackers are also using the previously found NetLogon vulnerability ([CVE-2020-1472](<https://msrc.microsoft.com/update-guide/vulnerability/CVE-2020-1472>)) and, for servers running Microsoft Exchange Server, vulnerabilities recently discovered while researching targeted attacks by the [HAFNIUM](<https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/>) group. ## Attacks on macOS As for threats to the macOS platform, Q2 will be remembered primarily for the appearance of new samples of the XCSSET Trojan. Designed to steal data from browsers and other applications, the malware is notable for spreading itself through infecting projects in the Xcode development environment. The Trojan takes the form of a bash script packed with the SHC utility, allowing it to evade macOS protection, which does not block script execution. During execution of the script, the SHC utility uses the RC4 algorithm to decrypt the payload, which, in turn, downloads additional modules. **Top 20 threats for macOS** | **Verdict** | **%*** ---|---|--- 1 | AdWare.OSX.Pirrit.j | 14.47 2 | AdWare.OSX.Pirrit.ac | 13.89 3 | AdWare.OSX.Pirrit.o | 10.21 4 | AdWare.OSX.Pirrit.ae | 7.96 5 | AdWare.OSX.Bnodlero.at | 7.94 6 | Monitor.OSX.HistGrabber.b | 7.82 7 | Trojan-Downloader.OSX.Shlayer.a | 7.69 8 | AdWare.OSX.Bnodlero.bg | 7.28 9 | AdWare.OSX.Pirrit.aa | 6.84 10 | AdWare.OSX.Pirrit.gen | 6.44 11 | AdWare.OSX.Cimpli.m | 5.53 12 | Trojan-Downloader.OSX.Agent.h | 5.50 13 | Backdoor.OSX.Agent.z | 4.64 14 | Trojan-Downloader.OSX.Lador.a | 3.92 15 | AdWare.OSX.Bnodlero.t | 3.64 16 | AdWare.OSX.Bnodlero.bc | 3.36 17 | AdWare.OSX.Ketin.h | 3.25 18 | AdWare.OSX.Bnodlero.ay | 3.08 19 | AdWare.OSX.Pirrit.q | 2.84 20 | AdWare.OSX.Pirrit.x | 2.56 _* Unique users who encountered this malware as a percentage of all users of Kaspersky security solutions for macOS who were attacked._ As in the previous quarter, a total of 15 of the Top 20 threats for macOS are adware programs. The Pirrit and Bnodlero families have traditionally stood out from the crowd, with the former accounting for two-thirds of the total number of threats. ### Geography of threats for macOS _Geography of threats for macOS, Q2 2021 ([download](<https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2021/08/11141728/10-en-malware-report-q2-2021-graphs-pc.png>))_ **Top 10 countries by share of attacked users** | **Country*** | **%**** ---|---|--- 1 | India | 3.77 2 | France | 3.67 3 | Spain | 3.45 4 | Canada | 3.08 5 | Italy | 3.00 6 | Mexico | 2.88 7 | Brazil | 2.82 8 | USA | 2.69 9 | Australia | 2.53 10 | Great Britain | 2.33 _* Excluded from the rating are countries with relatively few users of Kaspersky security solutions for macOS (under 10,000)._ _** Unique users attacked as a percentage of all users of Kaspersky security solutions for macOS in the country._ In Q2 2021, first place by share of attacked users went to India (3.77%), where adware applications from the Pirrit family were most frequently encountered. A comparable situation was observed in France (3.67%) and Spain (3.45%), which ranked second and third, respectively. ## IoT attacks ### IoT threat statistics In Q2 2021, as before, most of the attacks on Kaspersky traps came via the Telnet protocol. Telnet | 70.55% ---|--- SSH | 29.45% _Distribution of attacked services by number of unique IP addresses of devices that carried out attacks, Q2 2021_ The statistics for cybercriminal working sessions with Kaspersky honeypots show similar Telnet dominance. Telnet | 63.06% ---|--- SSH | 36.94% _Distribution of cybercriminal working sessions with Kaspersky traps, Q2 2021_ **Top 10 threats delivered to IoT devices via Telnet** | **Verdict** | **%*** ---|---|--- 1 | Backdoor.Linux.Mirai.b | 30.25% 2 | Trojan-Downloader.Linux.NyaDrop.b | 27.93% 3 | Backdoor.Linux.Mirai.ba | 5.82% 4 | Backdoor.Linux.Agent.bc | 5.10% 5 | Backdoor.Linux.Gafgyt.a | 4.44% 6 | Trojan-Downloader.Shell.Agent.p | 3.22% 7 | RiskTool.Linux.BitCoinMiner.b | 2.90% 8 | Backdoor.Linux.Gafgyt.bj | 2.47% 9 | Backdoor.Linux.Mirai.cw | 2.52% 10 | Backdoor.Linux.Mirai.ad | 2.28% _* Share of each threat delivered to infected devices as a result of a successful Telnet attack out of the total number of delivered threats._ Detailed IoT threat statistics are published in our Q2 2021 DDoS report: <https://securelist.com/ddos-attacks-in-q2-2021/103424/#attacks-on-iot-honeypots> ## Attacks via web resources _The statistics in this section are based on Web Anti-Virus, which protects users when malicious objects are downloaded from malicious/infected web pages. Cybercriminals create such sites on purpose and web resources with user-created content (for example, forums), as well as hacked legitimate resources, can be infected._ ### Countries that serve as sources of web-based attacks: Top 10 _The following statistics show the distribution by country of the sources of Internet attacks blocked by Kaspersky products on user computers (web pages with redirects to exploits, sites hosting malicious programs, botnet C&C centers, etc.). Any unique host could be the source of one or more web-based attacks._ _To determine the geographic source of web attacks, the GeoIP technique was used to match the domain name to the real IP address at which the domain is hosted._ In Q2 2021, Kaspersky solutions blocked 1,686,025,551 attacks from online resources located across the globe. 675,832,360 unique URLs were recognized as malicious by Web Anti-Virus components. _Distribution of web-attack sources by country, Q2 2021 ([download](<https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2021/08/11141800/13-en-malware-report-q2-2021-graphs-pc.png>))_ ### Countries where users faced the greatest risk of online infection To assess the risk of online infection faced by users in different countries, for each country we calculated the percentage of Kaspersky users on whose computers Web Anti-Virus was triggered during the quarter. The resulting data provides an indication of the aggressiveness of the environment in which computers operate in different countries. This rating only includes attacks by malicious programs that fall under the **Malware class**; it does not include Web Anti-Virus detections of potentially dangerous or unwanted programs such as RiskTool or adware. | Country* | % of attacked users** ---|---|--- 1 | Belarus | 23.65 2 | Mauritania | 19.04 3 | Moldova | 18.88 4 | Ukraine | 18.37 5 | Kyrgyzstan | 17.53 6 | Algeria | 17.51 7 | Syria | 15.17 8 | Uzbekistan | 15.16 9 | Kazakhstan | 14.80 10 | Tajikistan | 14.70 11 | Russia | 14.54 12 | Yemen | 14.38 13 | Tunisia | 13.40 14 | Estonia | 13.36 15 | Latvia | 13.23 16 | Libya | 13.04 17 | Armenia | 12.95 18 | Morocco | 12.39 19 | Saudi Arabia | 12.16 20 | Macao | 11.67 _* Excluded are countries with relatively few Kaspersky users (under 10,000)._ _** Unique users targeted by **Malware-class** attacks as a percentage of all unique users of Kaspersky products in the country._ _These statistics are based on detection verdicts by the Web Anti-Virus module that were received from users of Kaspersky products who consented to provide statistical data._ On average during the quarter, 9.43% of computers of Internet users worldwide were subjected to at least one **Malware-class** web attack. _Geography of web-based malware attacks, Q2 2021 ([download](<https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2021/08/11141830/14-en-malware-report-q2-2021-graphs-pc.png>))_ ## Local threats _In this section, we analyze statistical data obtained from the OAS and ODS modules in Kaspersky products. It takes into account malicious programs that were found directly on users' computers or removable media connected to them (flash drives, camera memory cards, phones, external hard drives), or which initially made their way onto the computer in non-open form (for example, programs in complex installers, encrypted files, etc.)._ In Q2 2021, our File Anti-Virus detected **68,294,298** malicious and potentially unwanted objects. ### Countries where users faced the highest risk of local infection For each country, we calculated the percentage of Kaspersky product users on whose computers File Anti-Virus was triggered during the reporting period. These statistics reflect the level of personal computer infection in different countries. Note that this rating only includes attacks by malicious programs that fall under the **Malware class**; it does not include File Anti-Virus triggers in response to potentially dangerous or unwanted programs, such as RiskTool or adware. | Country* | % of attacked users** ---|---|--- 1 | Turkmenistan | 49.38 2 | Tajikistan | 48.11 3 | Afghanistan | 46.52 4 | Uzbekistan | 44.21 5 | Ethiopia | 43.69 6 | Yemen | 43.64 7 | Cuba | 38.71 8 | Myanmar | 36.12 9 | Syria | 35.87 10 | South Sudan | 35.22 11 | China | 35.14 12 | Kyrgyzstan | 34.91 13 | Bangladesh | 34.63 14 | Venezuela | 34.15 15 | Benin | 32.94 16 | Algeria | 32.83 17 | Iraq | 32.55 18 | Madagascar | 31.68 19 | Mauritania | 31.60 20 | Belarus | 31.38 _* Excluded are countries with relatively few Kaspersky users (under 10,000)._ _** Unique users on whose computers **Malware-class** local threats were blocked, as a percentage of all unique users of Kaspersky products in the country._ _Geography of local infection attempts, Q2 2021 ([download](<https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2021/08/11141906/15-en-malware-report-q2-2021-graphs-pc.png>))_ On average worldwide, **Malware-class** local threats were recorded on 15.56% of users' computers at least once during the quarter. Russia scored 17.52% in this rating.


Related


thn
info

Update Your Windows Computers to Patch 6 New In-the-Wild Zero-Day Bugs

2021-06-09T06:07:00
thn
info

Apple Releases Urgent Security Patches For Zero‑Day Bugs Under Active Attacks

2021-05-04T05:42:00
thn
info

Update‌ ‌Your Chrome Browser to Patch Yet Another 0-Day Exploit‌ed ‌in‌-the‌-Wild

2021-06-18T03:16:00
thn
info

Cybercrime Group TA558 Targeting Hospitality, Hotel, and Travel Organizations

2022-08-19T13:35:00
thn
info

Bitter APT Hackers Add Bangladesh to Their List of Targets in South Asia

2022-05-11T12:37:00
thn
info

Microsoft Issues Emergency Patch for Critical Windows PrintNightmare Vulnerability

2021-07-07T03:11:00
thn
info

Microsoft Warns of Critical "PrintNightmare" Flaw Being Exploited in the Wild

2021-07-02T05:36:00
thn
info

Microsoft's Emergency Patch Fails to Fully Fix PrintNightmare RCE Vulnerability

2021-07-08T04:35:00
thn
info

Apple‌ Issues Patches to Combat Ongoing 0-Day Attacks on macOS, tvOS

2021-05-25T04:52:00
thn
info

New USBCulprit Espionage Tool Steals Data From Air-Gapped Computers

2020-06-04T08:31:00
thn
info

New Chinese Malware Targeted Russia's Largest Nuclear Submarine Designer

2021-05-03T07:34:00
thn
info

Google Details iOS, Chrome, IE Zero-Day Flaws Exploited Recently in the Wild

2021-07-15T08:25:00
thn
info

New Chrome 0-Day Bug Under Active Attacks – Update Your Browser ASAP!

2021-06-10T04:14:00
thn
info

Update Your Chrome Browser to Patch New Zero‑Day Bug Exploited in the Wild

2021-07-16T05:08:00
thn
info

Microsoft Uncovers Austrian Company Exploiting Windows and Adobe Zero-Day Exploits

2022-07-28T11:18:00
threatpost
info

Despite Ringleader’s Arrest, Cobalt Group Still Active

2018-05-28T12:21:42
threatpost
info

Cobalt Group Pushes Revamped ThreadKit Malware

2018-12-11T18:40:00
threatpost
info

Microsoft Patch Tuesday Fixes 6 In-The-Wild Exploits

2021-06-08T21:45:12
threatpost
info

Word Attachment Delivers FormBook Malware, No Macros Required

2018-04-09T18:35:39
threatpost
info

Microsoft Releases Emergency Patch for PrintNightmare Bugs

2021-07-07T10:55:02
threatpost
info

CISA Offers New Mitigation for PrintNightmare Bug

2021-07-02T12:21:02
threatpost
info

Microsoft: Unpatched Bug in Windows Print Spooler

2021-07-16T11:57:53
threatpost
info

Apple Fixes Zero‑Day Security Bugs Under Active Attack

2021-05-04T16:16:37
threatpost
info

PortDoor Espionage Malware Takes Aim at Russian Defense Sector

2021-04-30T19:32:34
threatpost
info

Novel 'Victory' Backdoor Spotted in Chinese APT Campaign

2021-06-07T18:49:44
threatpost
info

Chrome Browser Bug Under Active Attack

2021-06-10T20:07:53
threatpost
info

Microsoft Warns: Another Unpatched PrintNightmare Zero-Day

2021-08-12T13:19:50
threatpost
info

Scammers Pose as Meal-Kit Services to Steal Customer Data

2021-05-18T20:48:13
threatpost
info

DarkSide Hits Toshiba; XSS Forum Bans Ransomware

2021-05-17T16:23:35
threatpost
info

What a Year It's Been: RSA 2021 Embraces 'Resilience'

2021-05-17T19:40:27
threatpost
info

Magecart Goes Server-Side in Latest Tactics Changeup

2021-05-17T21:46:14
threatpost
info

Safari Zero-Day Used in Malicious LinkedIn Campaign

2021-07-15T11:04:49
securelist
blog

PuzzleMaker attacks with Chrome zero-day exploit chain

2021-06-08T17:32:30
securelist
blog

IT threat evolution Q2 2021

2021-08-12T10:00:37
securelist
blog

APT annual review 2021

2021-11-30T10:00:31
securelist
blog

Quick look at CVE-2021-1675 & CVE-2021-34527 (aka PrintNightmare)

2021-07-08T05:00:06
securelist
blog

Kaspersky Managed Detection and Response: interesting cases

2021-12-15T10:00:42
securelist
blog

TOP 10 unattributed APT mysteries

2022-10-07T10:00:47
securelist
blog

Spam and phishing in 2022

2023-02-16T08:00:07
securelist
blog

Recent Cloud Atlas activity

2019-08-12T10:00:58
securelist
blog

Spam and phishing in Q1 2019

2019-05-15T10:00:23
securelist
blog

Spam and phishing in Q3 2021

2021-11-01T12:00:26
securelist
blog

Spam and phishing in 2021

2022-02-09T10:00:28
securelist
blog

IT threat evolution Q1 2018. Statistics

2018-05-14T10:00:30
securelist
blog

APT trends report Q2 2021

2021-07-29T10:00:46
securelist
blog

IT threat evolution Q3 2021

2021-11-26T12:00:36
securelist
blog

Cycldek: Bridging the (air) gap

2020-06-03T10:00:32
securelist
blog

IT threat evolution Q3 2019

2019-11-29T10:00:12
avleonov
blog

Vulristics: Microsoft Patch Tuesdays Q2 2021

2021-07-10T00:14:59
nessus
scanner

Apple iOS < 12.5.3 Multiple Vulnerabilities (HT212341)

2021-05-07T00:00:00
nessus
scanner

Apple iOS < 14.5.1 Multiple Vulnerabilities (HT212336)

2021-05-07T00:00:00
nessus
scanner

KB5003695: Windows Server 2008 Security Update (June 2021)

2021-06-08T00:00:00
nessus
scanner

KB5003694: Windows 7 and Windows Server 2008 R2 Security Update (June 2021)

2021-06-08T00:00:00
nessus
scanner

Google Chrome < 91.0.4472.114 Multiple Vulnerabilities

2021-06-17T00:00:00
nessus
scanner

KB5003697: Windows Server 2012 Security Update (June 2021)

2021-06-08T00:00:00
nessus
scanner

Safari < 14.1 Multiple Vulnerabilities

2021-05-05T00:00:00
apple
software

About the security content of iOS 12.5.3

2021-05-03T00:00:00
apple
software

About the security content of iOS 14.5.1 and iPadOS 14.5.1

2021-05-03T00:00:00
apple
software

About the security content of macOS Big Sur 11.3.1

2021-05-03T00:00:00
apple
software

About the security content of Safari 14.1

2021-05-04T00:00:00
apple
software

About the security content of watchOS 7.4.1

2021-05-03T00:00:00
krebs
blog

Microsoft Patches Six Zero-Day Security Holes

2021-06-08T20:53:28
cisa_kev
info

Microsoft Enhanced Cryptographic Provider Privilege Escalation Vulnerabilities

2021-11-03T00:00:00
cisa_kev
info

Microsoft Enhanced Cryptographic Provider Privilege Escalation Vulnerabilities

2021-11-03T00:00:00
cisa_kev
info

Microsoft Windows Kernel Information Disclosure Vulnerability

2021-11-03T00:00:00
cisa_kev
info

Google Chrome WebGL Use-After-Free Vulnerability

2021-11-03T00:00:00
cisa_kev
info

Apple iOS Webkit Storage Use-After-Free Remote Code Execution Vulnerability

2021-11-03T00:00:00
cisa_kev
info

Microsoft Windows NTFS Privilege Escalation Vulnerability

2021-11-03T00:00:00
cisa_kev
info

Microsoft HTTP Protocol Stack Remote Code Execution Vulnerability

2022-04-06T00:00:00
cisa_kev
info

Chromium V8 Input Validation Vulnerability

2021-11-03T00:00:00
cisa_kev
info

Apple Safari Webkit Browser Engine Buffer Overflow Vulnerability

2021-11-03T00:00:00
cisa_kev
info

Apple Safari Webkit Browser Engine Integer Overflow Vulnerability

2021-11-03T00:00:00
cve
NVD

CVE-2021-31199

2021-06-08T23:15:00
cve
NVD

CVE-2021-31201

2021-06-08T23:15:00
cve
NVD

CVE-2021-31955

2021-06-08T23:15:00
cve
NVD

CVE-2021-30554

2021-07-02T19:15:00
cve
NVD

CVE-2021-31166

2021-05-11T19:15:00
cve
NVD

CVE-2021-31956

2021-06-08T23:15:00
cve
NVD

CVE-2021-30661

2021-09-08T15:15:00
cve
NVD

CVE-2021-21220

2021-04-26T17:15:00
cve
NVD

CVE-2021-30665

2021-09-08T15:15:00
cve
NVD

CVE-2021-30663

2021-09-08T15:15:00
hivepro
info

Are you a victim of the Conti Ransomware?

2021-09-23T13:47:51
hivepro
info

Emergency patches have been released by Microsoft for PrintNightmare

2021-07-08T13:50:55
mskb
microsoft

July 6, 2021—KB5004945 (OS Builds 19041.1083, 19042.1083, and 19043.1083) Out-of-band

2021-07-01T07:00:00
githubexploit
exploit

Exploit for Improper Privilege Management in Microsoft

2021-07-03T12:25:21
githubexploit
exploit

Exploit for Improper Privilege Management in Microsoft

2021-07-02T12:10:49
githubexploit
exploit

Exploit for Improper Privilege Management in Microsoft

2021-07-01T09:00:31
githubexploit
exploit

Exploit for Improper Privilege Management in Microsoft

2021-07-01T12:12:16
githubexploit
exploit

Exploit for Improper Privilege Management in Microsoft

2021-06-29T17:24:14
githubexploit
exploit

Exploit for Improper Privilege Management in Microsoft

2021-07-02T07:30:52
githubexploit
exploit

Exploit for Improper Privilege Management in Microsoft

2021-07-02T16:44:24
githubexploit
exploit

Exploit for Improper Privilege Management in Microsoft

2021-07-05T12:10:43
githubexploit
exploit

Exploit for Improper Privilege Management in Microsoft

2021-07-28T07:55:42
githubexploit
exploit

Exploit for Improper Privilege Management in Microsoft

2021-07-05T20:13:49
githubexploit
exploit

Exploit for Improper Privilege Management in Microsoft

2021-07-22T10:49:30
githubexploit
exploit

Exploit for Improper Privilege Management in Microsoft

2021-07-03T15:15:12
githubexploit
exploit

Exploit for Improper Privilege Management in Microsoft

2021-09-26T13:53:10
githubexploit
exploit

Exploit for Improper Privilege Management in Microsoft

2022-02-22T03:32:14
githubexploit
exploit

Exploit for Improper Privilege Management in Microsoft

2021-07-01T09:47:13
githubexploit
exploit

Exploit for Improper Privilege Management in Microsoft

2021-07-12T08:18:40
githubexploit
exploit

Exploit for Improper Privilege Management in Microsoft

2022-02-19T23:20:58
githubexploit
exploit

Exploit for Use of Insufficiently Random Values in Microsoft

2021-06-23T12:23:48
githubexploit
exploit

Exploit for Exposure of Sensitive Information to an Unauthorized Actor in Microsoft

2021-06-26T03:59:38
githubexploit
exploit

Exploit for Use After Free in Microsoft

2021-05-17T11:12:45
githubexploit
exploit

Exploit for Use After Free in Microsoft

2021-07-03T14:54:59
githubexploit
exploit

Exploit for Use After Free in Microsoft

2021-05-16T16:15:56
githubexploit
exploit

Exploit for Use After Free in Microsoft

2021-05-17T23:54:12
githubexploit
exploit

Exploit for Use After Free in Microsoft

2021-05-24T07:42:18
githubexploit
exploit

Exploit for Use After Free in Microsoft

2021-05-23T18:41:48
githubexploit
exploit

Exploit for Use After Free in Microsoft

2021-05-19T07:50:40
githubexploit
exploit

Exploit for Use After Free in Microsoft

2021-05-17T19:55:41
githubexploit
exploit

Exploit for Use After Free in Microsoft

2021-09-27T05:56:45
githubexploit
exploit

Exploit for Use After Free in Microsoft

2021-10-20T07:37:46
githubexploit
exploit

Exploit for Use After Free in Microsoft

2021-05-17T19:55:41
githubexploit
exploit

Exploit for Vulnerability in Microsoft

2022-09-02T10:35:11
githubexploit
exploit

Exploit for Use After Free in Microsoft

2022-03-07T18:56:52
githubexploit
exploit

Exploit for Vulnerability in Microsoft

2022-01-11T16:03:38
githubexploit
exploit

Exploit for Out-of-bounds Write in Google Chrome

2021-09-15T03:11:41
mscve
microsoft

Windows Print Spooler Remote Code Execution Vulnerability

2021-06-08T07:00:00
mscve
microsoft

Windows Print Spooler Remote Code Execution Vulnerability

2021-07-01T07:00:00
mscve
microsoft

Microsoft Enhanced Cryptographic Provider Elevation of Privilege Vulnerability

2021-06-08T07:00:00
mscve
microsoft

Microsoft Enhanced Cryptographic Provider Elevation of Privilege Vulnerability

2021-06-08T07:00:00
mscve
microsoft

Windows Kernel Information Disclosure Vulnerability

2021-06-08T07:00:00
mscve
microsoft

Chromium: CVE-2021-30554 Use after free in WebGL

2021-06-18T16:21:57
mscve
microsoft

HTTP Protocol Stack Remote Code Execution Vulnerability

2021-05-11T07:00:00
mscve
microsoft

Windows NTFS Elevation of Privilege Vulnerability

2021-06-08T07:00:00
mscve
microsoft

Chromium: CVE-2021-21220 Insufficient validation of untrusted input in V8 for x86_64

2021-04-14T07:00:00
mscve
microsoft

Chromium: CVE-2021-30551 Type Confusion in V8

2021-06-11T07:00:00
talosblog
blog

PrintNightmare: Here’s what you need to know and Talos’ coverage

2021-07-08T13:25:03
talosblog
blog

Vice Society Leverages PrintNightmare In Ransomware Attacks

2021-08-12T16:16:46
talosblog
blog

Multiple Cobalt Personality Disorder

2018-07-31T09:38:00
cisa
info

PrintNightmare, Critical Windows Print Spooler Vulnerability

2021-06-30T00:00:00
cisa
info

Microsoft Releases Out-of-Band Security Updates for PrintNightmare

2021-07-06T00:00:00
cisa
info

Google Releases Security Updates for Chrome

2021-06-18T00:00:00
cisa
info

Google Releases Security Updates for Chrome

2021-06-10T00:00:00
malwarebytes
blog

PrintNightmare 0-day can be used to take over Windows domain controllers

2021-07-01T14:08:26
malwarebytes
blog

UPDATED: Patch now! Emergency fix for PrintNightmare released by Microsoft

2021-07-07T14:17:31
malwarebytes
blog

Microsoft fixes seven zero-days, including two PuzzleMaker targets, Google fixes serious Android flaw

2021-06-09T14:50:52
malwarebytes
blog

Microsoft’s PrintNightmare continues, shrugs off Patch Tuesday fixes

2021-08-12T11:30:26
ics
info

#StopRansomware: Vice Society

2022-09-08T12:00:00
ics
info

#StopRansomware: Vice Society

2022-09-08T12:00:00
packetstorm
exploit

Print Spooler Remote DLL Injection

2022-05-25T00:00:00
packetstorm
exploit

Google Chrome XOR Typer Out-Of-Bounds Access / Remote Code Execution

2021-05-03T00:00:00
rapid7blog
info

Russia-Ukraine Cybersecurity Updates

2022-03-04T14:30:00
rapid7blog
info

Metasploit Wrap-up

2021-07-09T17:53:41
rapid7blog
info

CVE-2021-34527 (PrintNightmare): What You Need to Know

2021-06-30T18:15:59
attackerkb
info

CVE-2021-34527 "PrintNightmare"

2021-07-02T00:00:00
attackerkb
info

CVE-2021-1675

2021-06-08T00:00:00
attackerkb
info

CVE-2021-21224

2021-04-26T00:00:00
attackerkb
info

CVE-2021-31955

2021-06-08T00:00:00
attackerkb
info

CVE-2021-31201

2021-06-08T00:00:00
attackerkb
info

CVE-2021-31199

2021-06-08T00:00:00
attackerkb
info

CVE-2018-0802

2018-01-10T00:00:00
attackerkb
info

CVE-2021-30554

2021-07-02T00:00:00
attackerkb
info

CVE-2021-31956

2021-06-08T00:00:00
attackerkb
info

CVE-2021-30661

2021-09-08T00:00:00
attackerkb
info

CVE-2021-21220

2021-04-26T00:00:00
attackerkb
info

CVE-2021-30665

2021-09-08T00:00:00
attackerkb
info

CVE-2021-30663

2021-09-08T00:00:00
kitploit
tools

SpoolSploit - A Collection Of Windows Print Spooler Exploits Containerized With Other Utilities For Practical Exploitation

2021-10-07T11:30:00
cert
info

Microsoft Windows Print Spooler allows for RCE via AddPrinterDriverEx()

2021-06-30T00:00:00
metasploit
exploit

Print Spooler Remote DLL Injection

2022-05-16T18:56:46
metasploit
exploit

Windows IIS HTTP Protocol Stack DOS

2022-03-16T21:55:03
fireeye
info

Government Sector in Central Asia Targeted With New HAWKBALL Backdoor Delivered via Microsoft Office Vulnerabilities

2019-06-05T15:00:00
myhack58
info

A use cve-2017-11882 and cve-2018-0802 combination of vulnerability a malicious document analysis-vulnerability warning-the black bar safety net

2018-12-25T00:00:00
myhack58
info

A CVE-2017-11882 vulnerability is a new variation of a sample of the debugging and analysis-vulnerability warning-the black bar safety net

2018-12-02T00:00:00
kaspersky
info

KLA12198 Multiple vulnerabilities in Microsoft Products (ESU)

2021-06-08T00:00:00
qualysblog
blog

Conti Ransomware

2021-11-18T17:17:56
qualysblog
blog

Microsoft Windows Print Spooler RCE Vulnerability (PrintNightmare-CVE-2021-34527) – Automatically Discover, Prioritize and Remediate Using Qualys VMDR®

2021-07-07T23:30:23
qualysblog
blog

Ransomware Insights from the FBI’s 2021 Internet Crime Report

2022-05-04T09:40:56
checkpoint_advisories
info

Microsoft Windows Kernel Information Disclosure (CVE-2021-31955)

2021-06-08T00:00:00
checkpoint_advisories
info

Microsoft Win32k Elevation of Privilege (CVE-2021-28310)

2021-04-13T00:00:00
checkpoint_advisories
info

Microsoft Windows dssenh.dll Elevation of Privilege (CVE-2021-31201)

2021-06-08T00:00:00
checkpoint_advisories
info

Microsoft Windows rsaenh.dll Elevation of Privilege (CVE-2021-31199)

2021-06-08T00:00:00
checkpoint_advisories
info

Microsoft Windows NTFS Elevation of Privilege (CVE-2021-31956)

2021-06-08T00:00:00
checkpoint_advisories
info

Microsoft HTTP Protocol Stack Remote Code Execution (CVE-2021-31166)

2021-05-12T00:00:00
checkpoint_advisories
info

Google Chrome Remote Code Execution (CVE-2021-21220)

2021-05-10T00:00:00
checkpoint_advisories
info

Google Chrome Heap Corruption (CVE-2021-30551)

2021-07-26T00:00:00
ubuntucve
info

CVE-2021-30554

2021-07-02T00:00:00
ubuntucve
info

CVE-2021-30661

2021-09-08T00:00:00
ubuntucve
info

CVE-2021-21220

2021-04-26T00:00:00
ubuntucve
info

CVE-2021-30663

2021-07-27T00:00:00
ubuntucve
info

CVE-2021-30665

2021-07-27T00:00:00
ubuntucve
info

CVE-2021-30551

2021-06-15T00:00:00
debiancve
info

CVE-2021-30554

2021-07-02T19:15:00
debiancve
info

CVE-2021-30661

2021-09-08T15:15:00
debiancve
info

CVE-2021-21220

2021-04-26T17:15:00
debiancve
info

CVE-2021-30665

2021-09-08T15:15:00
debiancve
info

CVE-2021-30663

2021-09-08T15:15:00
redhatcve
info

CVE-2021-30661

2021-07-28T13:53:46
redhatcve
info

CVE-2021-30663

2021-07-28T13:53:25
redhatcve
info

CVE-2021-30665

2021-07-28T13:53:58
seebug
exploit

HTTP协议栈远程代码执行漏洞（CVE-2021-31166）

2021-05-13T00:00:00
seebug
exploit

Chrome 远程代码执行漏洞（CVE-2021-21220）

2021-04-13T00:00:00
zdt
exploit

Google Chrome XOR Typer Out-Of-Bounds Access / Remote Code Execution Exploit

2021-05-04T00:00:00
veracode
software

Remote Code Execution (RCE)

2021-04-21T17:42:46
veracode
software

Denial Of Service (DoS)

2021-07-29T05:06:26
zdi
info

(Pwn2Own) Chromium V8 XOR Typer Mismatch Out-Of-Bounds Access Remote Code Execution Vulnerability

2021-04-15T00:00:00