A review of what’s changed in malware in 2022, and what hasn’t, based on Adam Kujawa’s talk at RSAC 2022.
Earlier this year Malwarebytes released its 2022 Threat Review, a review of the most important threats and cybersecurity trends of 2021, and what they could mean for 2022. Among other things it covers the year’s alarming rebound in malware detections, and a significant shift in the balance of email threats.
We are now halfway through 2022 and Malwarebytes’ Security Evangelist Adam Kujawa has been updating attendees at this year’s RSA Conference on what the report contains, and what’s happened since it was published.
This is what he had to say about how the trends in detections and email threats have changed in the months since the Threat Review data was compiled.
The “Covid bounce”
The 2022 Threat Review detailed the remarkable rebound in detection numbers for malware, adware and Potentially Unwanted Programs (PUPs) in 2021.
Detections of all three went down during 2020, as pandemic restrictions created a huge increase in the number of people working from home. As cybercriminals adapted and restrictions eased, detection numbers surged again in 2021, on Windows business machines and home computers, and on Macs.
Kujawa has now updated the chart to include the first five months of 2022, and it shows that the trend of the last year has broadly continued into this one. Business detections are currently on course to be slightly ahead of 2021’s numbers, and consumer detections slightly behind, perhaps reflecting a reduction in working from home and an increase in office work.
Looking in detail at what’s been detected this year further strengthens the idea that 2021’s patterns are extending into 2022. After a radical shake up in 2020, the types of malware being detected have settled down somewhat, with only small changes in the ten most commonly detected threats in the first half of 2022.
Dramatic change in email detections
Last year saw a significant evolution in email threat detections, and that change has accelerated dramatically in the first half of 2022.
At the end of the last decade, the email threat landscape was dominated by vast numbers of Emotet, TrickBot, and Dridex detections—complex and sophisticated threats with multiple tools designed to attack corporate networks. All three were banking trojans that were later used to deploy ransomware.
In each year from 2018-2020, these malware families accounted for between 75 percent and 90 percent of all email detections.
That picture changed in 2021. The pandemic restrictions introduced in 2020 had seen an enormous rise in working from home, necessitating a switch in tactics by threat actors. The dominant trio of Emotet, TrickBot, and Dridex were less widely used, perhaps because they were a poor fit for home networks.
Between them, they made up just 42 percent of detections in 2021, and the space they vacated was filled by six other malware families operating at a similar scale.
One of the newcomers was AsyncRat, a Remote Access Trojan (RAT) that hadn’t featured at all in previous years but made up 13 percent of detections in 2021.
In the first half of 2022 AsyncRat accounted for a massive 62 percent of malicious email detections, with Dridex the next most prevalent at 12 percent, Trickbot at six, and Emotet at just two.
It appears that the “changing of the guard” first identified in the 2022 Threat Review is now complete.
