Summer dip in malware attacks credited to World Cup drama

July's drop in TrickBot malware likely due to criminals being distracted by the football, experts say

Football may not have come home, but it did at least reduce the number of malware attacks while the drama was unfolding.

That's one possibility floated by Cofense Intelligence, which has produced some research which demonstrates a marked drop in TrickBot malware attacks in July, after a sustained increase throughout April and June.

It wasn't just the number of attacks dropping either. Cofense noted that while TrickBot phishing lures are typically sufficiently authentic looking to fool victims into handing over banking information, the samples captured in July were "incredibly simplistic."

Analysis of all Trickbot campaigns between May and September found that around 10.5% of attacks took place in June compared to 51% of campaigns taking place in July, falling sharply to 10.5% again in August. It's believed Trickbot campaign activity fell by as much as 41% during June and August.

The lulls coincided with a noticeable decline in the sophistication of attacks, deviating from the elaborate emails that normally try to masquerade as legitimate notes from banking institutions. The belief is that Trickbot's resources may have been spread thin during this time, and that criminals may have been reliant on low-skilled freelance hackers.

Advertisement - Article continues below

It may seem odd to think of malware operators in the same way we think of employees in other sectors, but Cofense thinks that these phoned-in efforts could well be the result of the World Cup and summer holiday season distracting the usually fastidious TrickBot operatives. Certainly, activity picked up again towards the end of the month after the tournament came to an end.

Other possibilities mooted include fewer people doing the distribution work, and TrickBot operators using the summer to curate other flavours of malware.

Elsewhere, Cofense Intelligence noted an increase in the Emotet/Geodo Trojan from mid-July through to August, a resurgence in the AZORult malware, and an updated version of the Hermes ransomware. The new version's distribution method "bears a striking similarity" to Sigma and GrandCrab, leaving Cofense wondering whether the same hacking groups may be responsible for this update.

"Our findings highlight the crucial need for incident responders and network defenders to devise an appropriate response plan for high-impact phishing campaigns," said Aaron Higbee, CTO of Cofense. "By empowering and educating users to recognise and report suspicious emails, organisations and enterprises can avoid falling victim to attacks on their infrastructure."  

Featured Resources

The IT Pro guide to Windows 10 migration

Everything you need to know for a successful transition

Download now

Managing security risk and compliance in a challenging landscape

How key technology partners grow with your organisation

Download now

Software-defined storage for dummies

Control storage costs, eliminate storage bottlenecks and solve storage management challenges

Download now

6 best practices for escaping ransomware

A complete guide to tackling ransomware attacks

Download now



Google confirms Android cameras can be hijacked to spy on you

20 Nov 2019

Most Popular

identity and access management (IAM)

44 million Microsoft customers found using compromised passwords

6 Dec 2019
Microsoft Azure

Microsoft, not Amazon, is going to win the cloud wars

30 Nov 2019

Five signs that it’s time to retire IT kit

29 Nov 2019

Where modernisation and sustainability meet: A tale of two benefits

25 Nov 2019