The most common ‘as-a-Service’ tools identified in the firm’s protection ecosystem from July to December 2023 were:

    • Malware loaders (77% of investigated threats), which can deliver and execute other forms of malware and enable attackers to repeatedly target affected networks.
    • Cryptominers (52% of investigated threats), which use an infected device to mine for cryptocurrency.
    • Botnets (39% of investigated threats) that enroll users in wider networks of infected devices, which attackers then leverage in larger-scale attacks on other targets.
    • Information-stealing malware (36% of investigated threats), which are malicious software like spyware or worms, designed to secretly access and collect sensitive data from a victim’s computer or network.
    • Proxy botnets (15% of investigated threats), more sophisticated botnets that use proxies to hide the true source of their activity.

The report by Darktrace also reveals a changing of the guard. At the beginning of 2023, after the dismantling of Hive ransomware (one of the major Ransomware-as-a-Service attacks in the firm’s user base), there had been rapid growth of a range of threats filling the void, including ScamClub, a malvertising actor notorious for spreading fake virus alerts to notable news sites, and AsyncRAT, responsible for attacking US infrastructure employees in recent memory. Also:

    • 10.4m phishing emails had been detected in the firm’s ecosystem between September and December 2023 amid novel attack techniques emerging as greater risk.
    • Cybercriminals were noted to be employing sophisticated techniques to circumvent traditional security measures during the period of analysis. One notable example is the exploitation of platforms like Microsoft Teams to distribute malware such as DarkGate.
    • Noted growth of malware designed with multiple functions to inflict maximum damage. Often deployed by sophisticated groups like cyber cartels, such as the recent Black Basta ransomware that also spreads the Qbot banking trojan for credential theft. Such multi-tasking malware lets attackers cast a wide net to monetize infections.