Snake Keylogger among Top 10 Malwares in July

Trickbot is the most prevalent malware for the third month running, while Snake Keylogger has entered the index for the first time taking second place, according to a Check Point Research report.

The Threat Intelligence arm of Check Point Software Technologies has published its latest Global Threat Index for July 2021. Researchers report that while Trickbot is still the most prevalent malware, Snake Keylogger, which was first detected in November 2020, has surged into second place following an intense phishing campaign.

Snake Keylogger is a modular .NET keylogger and credential stealer. Its primary function is to record users’ keystrokes on computers or mobile devices, and transmit the collected data to threat actors. In recent weeks, Snake has been growing fast via phishing emails with different themes across all countries and business sectors.

Snake infections pose a major threat to users’ privacy and online safety, as the malware can steal virtually all kinds of sensitive information, and it is a particularly evasive and persistent keylogger. There are currently underground hacking forums where the Snake Keylogger is available for purchase, ranging from 25 to 500 dollars, depending on the level of service offered.

Keylogger attacks can be particularly dangerous  because individuals tend to use the same password and username for different accounts, and once one log in credential is breached, the cybercriminal gains access to all those that have the same password. To stop them, it is essential to use a unique option for each of the different profiles. To do this, a password manager can be used, which allows both managing and generating different robust access combinations for each service based on the guidelines decided upon.

“Where possible, users should reduce the reliance on passwords alone, for example by implementing Multi-Factor Authentication (MFA) or Single-Sign on (SSO) technologies,” said Maya Horowitz, VP Research, Check Point Software. “Also, when it comes to password policies, choosing a strong, unique password for each service is the best advice, then even if the bad guys do get hold of one of your passwords, it won’t immediately grant them access to multiple sites and services. Keyloggers such as Snake, are often distributed via phishing emails so it’s essential that users know to look out for small discrepancies such as misspellings in links and email addresses, and be educated to never click on suspicious links or open any unfamiliar attachments.”

CPR also revealed this month that ‘Web Server Exposed Git Repository Information Disclosure’ is the most commonly exploited vulnerability, impacting 45 percent of organizations globally, followed by ‘HTTP Headers Remote Code Execution’ which affects 44 percent of organizations worldwide. ‘MVPower DVR Remote Code Execution’ takes third place in the top exploited vulnerabilities list, with a global impact of 42 percent.