Summer dip in malware attacks credited to World Cup drama

July's drop in TrickBot malware likely due to criminals being distracted by the football, experts say

Football may not have come home, but it did at least reduce the number of malware attacks while the drama was unfolding.

That's one possibility floated by Cofense Intelligence, which has produced some research which demonstrates a marked drop in TrickBot malware attacks in July, after a sustained increase throughout April and June.

It wasn't just the number of attacks dropping either. Cofense noted that while TrickBot phishing lures are typically sufficiently authentic looking to fool victims into handing over banking information, the samples captured in July were "incredibly simplistic."

Analysis of all Trickbot campaigns between May and September found that around 10.5% of attacks took place in June compared to 51% of campaigns taking place in July, falling sharply to 10.5% again in August. It's believed Trickbot campaign activity fell by as much as 41% during June and August.

The lulls coincided with a noticeable decline in the sophistication of attacks, deviating from the elaborate emails that normally try to masquerade as legitimate notes from banking institutions. The belief is that Trickbot's resources may have been spread thin during this time, and that criminals may have been reliant on low-skilled freelance hackers.

Advertisement - Article continues below
Advertisement - Article continues below

It may seem odd to think of malware operators in the same way we think of employees in other sectors, but Cofense thinks that these phoned-in efforts could well be the result of the World Cup and summer holiday season distracting the usually fastidious TrickBot operatives. Certainly, activity picked up again towards the end of the month after the tournament came to an end.

Other possibilities mooted include fewer people doing the distribution work, and TrickBot operators using the summer to curate other flavours of malware.

Elsewhere, Cofense Intelligence noted an increase in the Emotet/Geodo Trojan from mid-July through to August, a resurgence in the AZORult malware, and an updated version of the Hermes ransomware. The new version's distribution method "bears a striking similarity" to Sigma and GrandCrab, leaving Cofense wondering whether the same hacking groups may be responsible for this update.

"Our findings highlight the crucial need for incident responders and network defenders to devise an appropriate response plan for high-impact phishing campaigns," said Aaron Higbee, CTO of Cofense. "By empowering and educating users to recognise and report suspicious emails, organisations and enterprises can avoid falling victim to attacks on their infrastructure."  

Featured Resources

Digitally perfecting the supply chain

How new technologies are being leveraged to transform the manufacturing supply chain

Download now

Three keys to maximise application migration and modernisation success

Harness the benefits that modernised applications can offer

Download now

Your enterprise cloud solutions guide

Infrastructure designed to meet your company's IT needs for next-generation cloud applications

Download now

The 3 approaches of Breach and Attack Simulation technologies

A guide to the nuances of BAS, helping you stay one step ahead of cyber criminals

Download now


internet security

Avast and AVG extensions pulled from Chrome

19 Dec 2019

Google confirms Android cameras can be hijacked to spy on you

20 Nov 2019

Most Popular

operating systems

17 Windows 10 problems - and how to fix them

13 Jan 2020
Microsoft Windows

What to do if you're still running Windows 7

14 Jan 2020
General Data Protection Regulation (GDPR)

Data protection fines hit £100m during first 18 months of GDPR

20 Jan 2020
web browser

What is HTTP error 503 and how do you fix it?

7 Jan 2020