Upon the conclusion of 2024, cybersecurity professionals are pondering over a dynamic fourth quarter that experienced evolving dangers and increased activity in the malicious software environment.
ANY.RUN, a prominent interactive malware scrutiny platform, has published its quarterly report, exposing emerging patterns and spotlighting the most active malware categories, tools, and methods utilized by cyber offenders.
Surge in Malware Analysis Activity
During Q4 2024, ANY.RUN users engaged in 1,151,901 public interactive analysis sessions, marking a 5.6% uptick from Q3. Out of these, 22.6% were labeled as malicious and 6.2% as suspicious, indicating an increase in both malicious and suspicious behaviors compared to the previous quarter.
A remarkable 712 million Indicators of Compromise (IOCs) were amassed during Q4, showcasing the escalating intricacy of studied threats.
Primary Observed Malware Categories
Stealers emerged as the most detected malware category in Q4, surpassing Loaders and demonstrating a 53.5% surge in activity compared to Q3. The following are the top malware categories and their respective detections:
- Stealer – 25,341 detections (53.5% increase from Q3)
- Loader – 10,418 detections (27% increase)
- RAT (Remote Access Trojan) – 6,415 detections (10.8% decrease)
- Ransomware – 5,853 detections (1.9% decrease)
- Keylogger – 1,915 detections (39.5% decrease)
Interestingly, Adware made its way into the top ten list with 1,666 detections in Q4, indicating its growing presence in cyber offenders’ arsenals.
Leading Malware Families: Lumma Dominates Afresh
The most active malware families in Q4 encompassed familiar titles alongside escalating threats:
- Lumma – 6,982 detections (+68.7% from Q3)
- Stealc – 4,790 detections (+136.3%)
- Redline – 4,321 detections (+26.7%)
- Amadey – 3,870 detections
- Xworm – 3,141 detections (+43.7%)
Lumma sustained its prevailing position for a second consecutive quarter, whereas Stealc exhibited explosive expansion, doubling its detections from Q3.
Surging Phishing Threats
Phishing instances soared in Q4 2024, with 82,684 phishing-linked threats identified. Noteworthy highlights include:
- Tycoon2FA emerged as the prevalent phishing kit, with 8,785 instances detected.
- Cyber offender group Storm1747 uploaded 11,015 phishing-related samples, leading the group activity metrics.
This escalation accentuates the evolving sophistication and broader reach of phishing strategies, targeting unsuspecting individuals globally.
Cyberattacks’ Obfuscation Utilities
In developing malware, creators increasingly depended on safeguards and packers to elude detection. The key utilities included:
- UPX (12,262 detections)
- Netreactor (8,333 detections)
- Themida (4,627 detections)
These utilities are pivotal in concealing malware code, heightening the challenge of identification for defenders.
MITRE ATT&CK Techniques: Focused Tactics
In Q4, adversaries leveraged multiple advanced techniques, with the Windows Command Shell (T1059.003) seizing the top position with 44,850 detections. Other prominent techniques encompassed:
- Masquerading through system utility renaming (T1036.003)
- Spearphishing Links (T1566.002), which witnessed an upsurge in activity compared to Q3
These techniques underscore the sustained ingenuity of cyber criminals in circumventing defenses.
Operable Insights for Cyber Defenders
ANY.RUN’s Threat Intelligence Lookup renders imperative instruments for tracking and evaluating emerging threats.
Security squads can delve into malware execution processes, investigate Indicators of Compromise (IOCs), and recognize patterns in attack data. For instance, employing threat queries like threatName:"stealer" in conjunction with location filters can unveil regional trends in malware activity.
Advocacy for Vigilance in 2025
The Q4 2024 report illuminates how cyber offenders are broadening their methodologies and expanding their endeavors. The dominion of stealers, the proliferation of phishing kits, and the deployment of advanced obfuscation practices emphasize the necessity for heightened watchfulness.
As we embark on 2025, organizations are urged to adopt a proactive stance, utilizing platforms like ANY.RUN to gain actionable understandings into the evolving threat spectrum.
Uninterrupted monitoring, robust defenses, and prompt response strategies persist as pivotal elements in combating the ever-evolving visage of cybersecurity threats.
About ANY.RUN
ANY.RUN assists over 500,000 cybersecurity professionals globally. Its interactive sandbox simplifies malware analysis of threats targeting both Windows and Linux systems.
ANY.RUN’s threat intelligence products, TI Lookup, YARA Search, and Feeds, aid in locating IOC or files for enhanced insights into threats and quicker incident response.
The post Top Sophisticated Cyber Security Threats of 2024 appeared first on Cyber Security News.