The 10th November Threat Intelligence Report provides an analysis of the global cyber threat landscape, identifying the most active malware and prominent attack vectors. Data from the report indicates a continued prevalence of information stealers and banking trojans, with email serving as a primary distribution method for malicious payloads.

Top Malware Families in November

This month’s report highlights several key malware families that demonstrated significant activity. The most impactful threats observed include:

Qbot: Also known as Qakbot, this banking trojan persists as a major threat. Its primary functions include stealing banking credentials, logging keystrokes, and acting as a dropper to deliver other malware, including ransomware, onto compromised systems.

Formbook: A widely available infostealer for the Windows operating system, Formbook was frequently distributed via phishing campaigns. Its capabilities include harvesting credentials from web browsers, capturing screenshots, and executing commands received from a remote command-and-control server.

AgentTesla: This .NET-based remote access trojan (RAT) and keylogger continued to be a common threat. AgentTesla is designed to exfiltrate sensitive data, such as passwords stored in web browsers, email clients, and FTP applications.

Dominant Attack Vectors Observed

The report details the primary methods used by threat actors to compromise networks and systems during this period. The most common vectors include:

Widespread Phishing Campaigns: Email phishing remains the number one attack vector. Malicious email campaigns frequently impersonated trusted brands and financial institutions to lure victims into opening malicious attachments or clicking on harmful links. These campaigns were instrumental in distributing malware like Formbook and AgentTesla.

Exploitation of Public-Facing Applications: Threat actors were observed actively scanning for and exploiting known vulnerabilities in internet-facing software and services. The failure to apply security patches in a timely manner was a key factor in successful initial access events reported during the month.