❌

Reading view

Sophos Annual Threat Report appendix: Most frequently encountered malware and abused software

Security Operations – Sophos News

By:gallagherseanm

16 April 2025 at 05:00

These are the tools of the trade Sophos detected in use by cybercriminals over 2024

Other12.79% Miner 0.89% Ransomware 1.18% Web/Browser Hijack 3.60% Attack tool/Exploit/EDR Killer 7.95% RAT/Backdoor 15.52% Stealer/Spyware 18.63% Loader/Downloader/Dropper 39.74% 9.13% of all malware was malware-as-a-service

Qilin (ransomware)1.05% Blacksuit (ransomware) 1.23% Faust (ransomware) 1.23% Crytox (ransomware) 1.41% Playcrypt (ransomware) 1.58% Black Basta (ransomware) 1.93% RansomHub (ransomware) 2.28% Gootloader (malware loader/dropper) 2.64% ChromeLoader (malware loader/dropper) 3.51% Fog (ransomware) 3.51% LockBit (ransomware) 4.39% Lumma Stealer (information stealer) 4.57% Akira (ransomware) 4.92% Cobalt Strike (C2 tool) 8.08% Web shell (C2) 9.84%

ExMatter (data exfiltration)0.56% Backstab (EDR killer) 0.56% Parcel RAT 0.56% DataGrabber (data exfiltration) 0.56% AsyncRAT 0.56% Sliver attack tool 0.56% Pikabot backdoor 0.56% Brute Ratel C4 0.56% Metasploit exploit framework 1.11% Grixba network scanning tool 1.11% SystemBC proxy/RAT 1.67% XMRIG miner malware 2.22% Web shell 7.22% Cobalt Strike attack tool 10.56%

Advanced Port Scanner (network discovery)4.92% FileZilla (file exfiltration) 5.10% Rclone (file exfiltration) 7.38% 7-Zip (file archiving/encryption) 7.38% PuTTy (remote command execution) 7.73% ScreenConnect (remote desktop access) 9.14% WinRAR (file archiving/encryption) 9.31% Sophos Uninstall (security tool removal) 9.49% Advanced IP Scanner (network discovery) 10.72% Mimikatz (credential dumping) 11.60% RDPclip (remote/local shared clipboard) 16.70% Impacket (network protocol exploitation) 17.05% AnyDesk (remote desktop access) 17.40% PsExec (remote command execution) 18.28% SoftPerfect Network Scanner (network discovery) 19.51%

TypeFrequency LevelRMM (remote machine management) 0.70% RemCom (remote command execution) 0.70% MobaXterm (remote shell) 0.88% VNC (remote desktop) 1.58% NetSupport (remote machine management) 1.76% Cloudflared (Cloudflare network tunneling client) 1.76% Ngrok (web application tunneling) 2.11% WinRM (remote machine management) 2.28% Splashtop (remote desktop) 2.99% TeamViewer (remote desktop) 3.16% Atera (remote machine management) 3.51% OpenSSH (remote shell) 4.04% PuTTy (remote shell) 7.73% ScreenConnect (remote desktop) 9.14% AnyDesk (remote desktop) 17.40% PSExec (remote command execution) 18.28%

A chart showing a histogram of Lumma Stealer detections, with a majority of detections occurring in October and November of 2024.

A histogram showing a peak of Lumma Stealer events in November

A histogram showing spikes of Strela Stealer detections in February, March and July of 2024.

Stealc (information stealer)0.35% AsyncRAT (RAT with infostealer features) 0.53% More_eggs (RAT that can carry infostealer payload) 0.53% Brute Ratel C4 (red team C2 tool) 0.53% Metasploit (red team command and control tool) 0.70% Remcos (RAT) 0.70% FakeBat /EugenLoader (malware loader) 0.70% Sliver (red team C2 tool) 0.88% XMRIG (cryptocurrency miner) 1.05% SystemBC (proxy and RAT) 1.05% Gootloader (malware loader) 2.64% ChromeLoader (browser malware loader) 3.51% Lumma Stealer (information stealer) 4.57% Cobalt Strike (red team C2 tool with information stealing modules) 8.08% Web shell (malware deployment, command and control) 9.84%

Cicada33011.64% Mimic 1.64% Hunters International 2.19% INC Ransomware 2.19% 8Base 2.73% Qilin 3.28% Blacksuit 3.83% Faust 3.83% Crytox 4.37% Playcrypt 4.92% Black Basta 6.01% RansomHub 7.10% Fog 10.93% LockBit 13.66% Akira 15.30%

A histogram of Lockbit variant ransomware detections with a spike in late February 2024.