PC malware statistics, Q3 2023
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2023-20269 | Unauthenticated Brute-Force VPN Access in Cisco ASA and Firepower Threat Defense Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) contain an authentication weakness (CWE-288) that allows an unauthenticated, remote attacker to conduct brute-force attacks against the SSL VPN login interface to guess valid username and password combinations, and to establish a clientless SSL VPN session as an unauthorized user under certain configurations. The attack is triggered simply by sending repeated or crafted authentication attempts to an internet-facing remote-access VPN endpoint, and vendor guidance centers on the group-lock and vpn-simultaneous-logins settings. A successful attempt gives the attacker VPN access, typically allowing them to reach the internal network as a legitimate user, which makes the flaw a common foothold for follow-on attacks including ransomware. Any organization operating a Cisco ASA or FTD with remote-access/clientless SSL VPN exposed to the internet is affected. The vulnerability was added to CISA's Known Exploited Vulnerabilities catalog on 2023-09-13 with known ransomware use, and EPSS assigns it a 25.6% probability of exploitation within 30 days (98th percentile). Do: Apply the mitigations in the Cisco advisory: configure group-lock and per-user vpn-simultaneous-logins restrictions as directed, and update ASA/FTD to the fixed releases listed there; if the device is end-of-support/unsupported, discontinue or isolate it. Prioritize internet-facing VPN concentrators given the KEV listing and known ransomware use, and review VPN logs for unusual failed-login bursts and unexpected clientless SSL VPN sessions. | 9.1 | 25% | KEV ransomware |
| masshundreds of thousands of internet-exposed ASA/FTD VPN devices | |
| CVE-2023-27532 | Missing Authentication in Veeam Backup & Replication Exposes Stored Credentials Veeam Backup & Replication (VBR) contains a missing-authentication flaw (CWE-306) in its Cloud Connect component that lets an unauthenticated network attacker obtain encrypted credentials stored in VBR's configuration database. It is triggered simply by connecting to the exposed service, because the function that serves credential material performs no authentication check; no privileges or user interaction are required (CVSS 3.1: 7.5, network vector). With the recovered credentials, an attacker can gain access to backup infrastructure hosts, which has been used as an entry point and pivot for ransomware operations. Any organization running Veeam Backup & Replication is potentially affected, with the greatest risk where the VBR/Cloud Connect service is reachable from the internet. Exploitation is confirmed: CISA added the bug to its KEV catalog on 2023-08-22 with known ransomware use, the Cuba ransomware group has been observed stealing credentials through this exploit, and EPSS assigns a 77.6% near-term exploitation probability (100th percentile). Do: Apply the fixes Veeam provides in its security advisory immediately — per CISA's KEV listing, patch per vendor instructions or discontinue use — prioritizing internet-facing Cloud Connect servers. After patching, rotate all credentials stored in the configuration database, since they should be considered exposed, and review those accounts for signs of misuse. Restrict network access to the VBR service from untrusted networks and check servers for exploitation indicators such as unexpected connections to the service or anomalous logins with stored credentials. | 7.5 | 78% | KEV ransomware |
| largetens of thousands of deployments, of which thousands are internet-exposed (estimate) | |
| CVE-2023-32315 | Unauthenticated Path Traversal in Ignite Realtime Openfire Admin Console CVE-2023-32315 is an unauthenticated path traversal flaw (CWE-22) in the Ignite Realtime Openfire XMPP server that allows a remote attacker to reach pages of the Openfire Admin Console that are reserved for administrative users. It is triggered by sending a crafted HTTP request to the admin console web interface containing path traversal sequences, which bypasses the authentication check protecting those restricted pages. Successful exploitation exposes administrative console functionality to an unauthenticated attacker, potentially enabling further compromise of the server and the chat environment it hosts. Any organization running Openfire is affected, particularly instances whose admin console interface is reachable from the internet. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2023-08-24 and carries an EPSS probability of 100% (top percentile), indicating active exploitation in the wild; ransomware use is not yet documented. Do: Upgrade Openfire to the patched release recommended in the Ignite Realtime advisory for CVE-2023-32315, per the CISA KEV required action; if patching must be delayed, restrict the admin console (default ports 9090/9091) to trusted networks or place it behind a VPN. Review access logs for requests to admin console pages containing traversal sequences, and check for unauthorized admin accounts or configuration changes, since KEV listing confirms exploitation in the wild. | 7.5 | 100% | KEV PoC ×2 |
| large≈ tens of thousands of internet-exposed Openfire servers (~30,000–40,000 per public scans) | |
| CVE-2023-3519 | Unauthenticated RCE in Citrix NetScaler ADC and NetScaler Gateway CVE-2023-3519 is a critical (CVSS 9.8) unauthenticated remote code execution flaw caused by improper code-injection handling (CWE-94) in Citrix NetScaler ADC and NetScaler Gateway. A remote attacker with no credentials can trigger it by sending crafted requests to an appliance configured as a Gateway (VPN/ICA proxy/RDP proxy) or AAA authentication virtual server, gaining arbitrary code execution on the appliance. Exploitation typically yields a foothold behind the VPN edge — access to internal networks, credential theft, and follow-on activity such as espionage or ransomware deployment. Any organization running unpatched NetScaler ADC/Gateway appliances, especially internet-facing remote-access endpoints, is affected; NetScaler is one of the most widely deployed enterprise VPN/ADC platforms. Exploitation is confirmed in the wild: the flaw was added to CISA's KEV on 2023-07-19 with known ransomware use, EPSS estimates a 99.7% exploitation probability, and researchers have linked activity to China-nexus espionage (Silk Typhoon) and ransomware operations. Do: Immediately upgrade internet-facing NetScaler ADC/Gateway appliances to the fixed builds in Citrix's advisory (14.1-8.50+, 13.1-49.13+, 13.0-82.45+, 12.1-55.300+, including FIPS/NDcPP equivalents) — per CISA KEV, apply these mitigations or discontinue use if patching is unavailable. Confirm whether each appliance is configured as a Gateway or AAA virtual server (only those are affected), and hunt for compromise — unexpected configuration changes, unfamiliar accounts, webshells, or anomalous VPN sessions — rotating credentials on any suspected compromise. | 9.8 | 100% | KEV ransomware PoC |
| largetens of thousands of internet-exposed NetScaler Gateway/ADC appliances (order 10k-100k at disclosure), serving hundreds of thousands to millions of downstream… | |
| CVE-2023-36884 | Race Condition RCE in Microsoft Windows Search CVE-2023-36884 is a race condition (TOCTOU) vulnerability in Microsoft Windows Search that permits remote code execution, rated 7.5 (high) on CVSS 3.1. It is triggered over the network with user interaction — for example, when a user opens or interacts with a specially crafted document that causes the vulnerable search code path to race, allowing arbitrary code execution in the context of the current user. An attacker gains code execution on the victim's Windows system, which the RomCom threat actor chained with Firefox flaws to deploy backdoors against political targets, and CISA notes known ransomware use. Virtually every supported Windows client and server release at the time is affected, spanning Windows 10 1507 through 22H2, Windows 11 21H2/22H2, and Windows Server 2008 through 2022. The flaw was actively exploited as a zero-day before being fixed in the July 2023 Patch Tuesday; it was added to the CISA KEV catalog on 2023-07-17 and carries a 98.9% EPSS score (100th percentile). Do: Apply the July 2023 Patch Tuesday Windows security updates to all Windows 10, Windows 11, and Windows Server systems, prioritizing high-value and frequently attacked endpoints since the bug was exploited as a zero-day by RomCom and carries a KEV deadline (US civilian agencies were directed to remediate by August 1, 2023). Because exploitation requires user interaction, caution users against opening untrusted documents, and verify patch status via your patch management or vulnerability scanner against the KEV requirement. If patching is not possible, follow vendor mitigations per CISA's required action or discontinue use. | 7.5 | 99% | KEV ransomware |
| mass≈1 billion+ Windows devices (Windows 10/11 installed base) plus the enterprise Windows Server estate | |
| CVE-2023-38831 | Code Execution in RARLAB WinRAR via Crafted ZIP File/Folder Name Confusion RARLAB WinRAR before 6.23 mishandles ZIP archives that contain a benign file (such as a JPG) alongside a folder with the same name, causing the folder's contents - which can include malicious executable files - to be processed when the user merely attempts to view the benign file. By sending a crafted ZIP archive, an attacker gains arbitrary code execution on the victim's machine with the user's privileges. Because the flaw is local (AV:L) and requires user interaction, risk is limited to Windows systems running an unpatched copy of WinRAR, while machines without the tool are unaffected. The bug was actively exploited in the wild from April through October 2023, including by government-backed actors (APT28), SideCopy attacks on Indian government entities, ransomware operations, and trading-account theft campaigns, and it was added to CISA's Known Exploited Vulnerabilities catalog on 2023-08-24. Do: Upgrade all Windows systems running WinRAR to version 6.23 or later, which fixes this flaw; if patching is not immediately possible, treat ZIP files from untrusted sources with caution and check archives for duplicate file/folder names before opening. Given KEV listing with known ransomware use and public proof-of-concept exploits, hunt for compromise by reviewing whether unexpected executables or scripts ran when ZIP archives were opened, and apply vendor mitigations per CISA's required action or discontinue use if mitigations are unavailable. | 7.8 | 98% | KEV ransomware PoC ×4 |
| masshundreds of millions of users/installations worldwide (WinRAR is one of the most widely installed Windows archive utilities) |
Full article2,769 words · extracted from securelist.com · click to collapse
- IT threat evolution in Q3 2023
- IT threat evolution in Q3 2023. Non-mobile statistics
- IT threat evolution in Q3 2023. Mobile statistics
These statistics are based on detection verdicts of Kaspersky products and services received from users who consented to providing statistical data.
Quarterly figures
According to Kaspersky Security Network, in Q3 2023:
- Kaspersky solutions blocked 694,400,301 attacks from online resources across the globe.
- A total of 169,194,807 unique links were recognized as malicious by Web Anti-Virus components.
- Attempts to run malware for stealing money from online bank accounts were stopped on the computers of 76,551 unique users.
- Ransomware attacks were defeated on the computers of 46,872 unique users.
- Our File Anti-Virus detected 33,847,517 unique malicious and potentially unwanted objects.
Financial threats
Financial threat statistics
In Q3 2023, Kaspersky solutions blocked the launch of at least one piece of banking malware on the computers of 76,551 unique users.
Number of unique users attacked by financial malware, Q3 2023 (download)
Geography of financial malware attacks
To assess the extent to which PC users in different countries and territories are at risk of infection by banking Trojans and ATM/PoS malware, for each country and territory we calculated the share of Kaspersky users who encountered this threat during the reporting period out of all users of our products in the given country or territory.
TOP 10 countries and territories by share of attacked users
| Country or territory* | %** | |
| 1 | Afghanistan | 3.9 |
| 2 | Turkmenistan | 3.5 |
| 3 | China | 2.4 |
| 4 | Tajikistan | 2.1 |
| 5 | Yemen | 1.7 |
| 6 | Egypt | 1.5 |
| 7 | Thailand | 1.5 |
| 8 | Venezuela | 1.4 |
| 9 | Syria | 1.4 |
| 10 | Paraguay | 1.2 |
* Excluded are countries and territories with relatively few Kaspersky users (under 10,000).
** Unique users whose computers were targeted by financial malware as a percentage of all unique users of Kaspersky products in the country/territory.
TOP 10 banking malware families
| Name | Verdicts | %* | |
| 1 | Ramnit/Nimnul | Trojan-Banker.Win32.Ramnit | 34.0 |
| 2 | Zbot/Zeus | Trojan-Banker.Win32.Zbot | 16.0 |
| 3 | Emotet | Trojan-Banker.Win32.Emotet | 12.6 |
| 4 | CliptoShuffler | Trojan-Banker.Win32.CliptoShuffler | 7.1 |
| 5 | SpyEyes | Trojan-Spy.Win32.SpyEye | 3.0 |
| 6 | Danabot | Trojan-Banker.Win32.Danabot | 2.4 |
| 7 | Qbot/Qakbot | Trojan-Banker.Win32.Qbot | 2.1 |
| 8 | Gozi | Trojan-Banker.Win32.Gozi | 0.9 |
| 9 | Tinba | Trojan-Banker.Win32.Tinba | 0.8 |
| 10 | IcedID | Trojan-Banker.Win32.IcedID | 0.6 |
* Unique users who encountered this malware family as a percentage of all users attacked by financial malware.
Ransomware programs
Quarterly trends and highlights
Vulnerability exploitation
In Q3, ransomware groups were detected exploiting vulnerabilities in various server software. For example, CVE-2023-3519, a remote code execution vulnerability in Citrix NetScaler, was used by attackers believed to be affiliated with the BlackCat/ALPHV group. The groups using Akira and Lockbit malware exploited the CVE-2023-20269 vulnerability in Cisco Adaptive Security Appliance (ASA) and Cisco Firepower Threat Defense (FTD) as a way to compromise victims’ networks. The Cuba group utilized an exploit for the CVE-2023-27532 vulnerability in Veeam Backup & Replication (VBR) to extract credentials from the configuration files of this software. Also detected were attacks by unknown ransomware on unpatched Openfire servers with CVE-2023-32315. This vulnerability allows an unauthenticated attacker to create an administrative account on the server and install arbitrary malware in the form of a JAR plugin.
More attacks on healthcare
Our Q2 report already noted a significant amount of news coverage of ransomware attacks on hospitals, universities, and municipal organizations. This trend continued in Q3. Among the victims of high-profile incidents in the healthcare industry were: McLaren HealthCare (the BlackCat/ALPHV group claimed responsibility for the attack and posted information about it on its data leak site); Prospect Medical Holdings (the Rhysida group posted a statement on its website announcing the theft of 1 TB of documents and a 1.3 TB database of personal data); PhilHealth (the Medusa group demanded the equivalent of $300,000 and began releasing sensitive data stolen in the attack shortly afterwards).
Most prolific groups
This section looks at ransomware groups that engage in so-called “double extortion”, that is, stealing and encrypting confidential data. Most of these groups target large companies, and often maintain a DLS (data leak site), where they publish a list of organizations they have attacked. Here’s the chart of the busiest ransomware gangs of Q3 2023:
The most prolific ransomware gangs, Q3 2023 (download)
The diagram shows each group’s share of the total number of victims published on all the DLS sites analyzed.
Number of new modifications
In Q3 2023, we uncovered nine new ransomware families and 11,387 new modifications of this malware type.
Number of new ransomware modifications, Q3 2022 — Q3 2023 (download)
Number of users attacked by ransomware Trojans
In Q3 2023, Kaspersky products and technologies protected 46,872 users from ransomware attacks.
Number of unique users attacked by ransomware Trojans, Q3 2023 (download)
Geography of attacked users
TOP 10 countries and territories attacked by ransomware Trojans
| Country or territory* | %** | |
| 1 | Yemen | 1.63 |
| 2 | Bangladesh | 1.39 |
| 3 | South Korea | 0.65 |
| 4 | Pakistan | 0.51 |
| 5 | Mozambique | 0.51 |
| 6 | Iraq | 0.27 |
| 7 | Taiwan | 0.27 |
| 8 | Mainland China | 0.26 |
| 9 | Nigeria | 0.26 |
| 10 | Libya | 0.23 |
* Excluded are countries and territories with relatively few Kaspersky users (under 50,000).
** Unique users whose computers were attacked by ransomware Trojans as a percentage of all unique users of Kaspersky products in the country/territory.
TOP 10 most common families of ransomware Trojans
| Name | Verdicts* | Share of attacked users** | |
| 1 | (generic verdict) | Trojan-Ransom.Win32.Gen | 16.80 |
| 2 | WannaCry | Trojan-Ransom.Win32.Wanna | 14.45 |
| 3 | (generic verdict) | Trojan-Ransom.Win32.Encoder | 11.98 |
| 4 | (generic verdict) | Trojan-Ransom.Win32.Phny | 7.26 |
| 5 | Stop/Djvu | Trojan-Ransom.Win32.Stop | 5.69 |
| 6 | (generic verdict) | Trojan-Ransom.Win32.Crypren | 5.69 |
| 7 | Magniber | Trojan-Ransom.Win64.Magni / Trojan-Ransom.Win32.Magni | 4.06 |
| 8 | PolyRansom/VirLock | Trojan-Ransom.Win32.PolyRansom / Virus.Win32.PolyRansom | 3.43 |
| 9 | (generic verdict) | Trojan-Ransom.Win32.Agent | 2.72 |
| 10 | Lockbit | Trojan-Ransom.Win32.Lockbit | 2.39 |
* Statistics are based on detection verdicts of Kaspersky products. The information was provided by Kaspersky product users who consented to providing statistical data.
** Unique Kaspersky users attacked by specific ransomware Trojan families as a percentage of all unique users attacked by ransomware Trojans.
Miners
Number of new miner modifications
In Q3 2023, Kaspersky solutions detected 2199 new miner modifications.
Number of new miner modifications, Q3 2023 (download)
Number of users attacked by miners
In Q3, we detected attacks that used miners on the computers of 363,120 unique users of Kaspersky products worldwide.
Number of unique users attacked by miners, Q3 2023 (download)
Geography of miner attacks
TOP 10 countries and territories attacked by miners
| Country or territory* | %** | |
| 1 | Tajikistan | 2.38 |
| 2 | Kazakhstan | 1.96 |
| 3 | Uzbekistan | 1.69 |
| 4 | Venezuela | 1.57 |
| 5 | Kyrgyzstan | 1.56 |
| 6 | Mozambique | 1.44 |
| 7 | Pakistan | 1.44 |
| 8 | Belarus | 1.43 |
| 9 | Sri Lanka | 1.30 |
| 10 | Ukraine | 1.19 |
* Excluded are countries and territories with relatively few users of Kaspersky products (under 50,000).
** Unique users attacked by miners as a percentage of all unique users of Kaspersky products in the country/territory.
Vulnerable applications used in cyberattacks
Quarterly highlights
Q3 2023 was quite eventful in terms of in-the-wild (ITW) vulnerability discoveries. Worth noting are:
- CVE-2023-36884, a vulnerability in MS Office allowing execution of commands with user privileges to bypass Protected View mode.
- CVE-2023-38831, a vulnerability in WinRAR. To exploit this vulnerability, attackers use a specially crafted archive which, when opened through the WinRAR GUI, launches a malicious file.
- CVE-2023-4762, a type confusion vulnerability in Google Chrome’s V8 engine. Its exploitation allows escaping the browser sandbox.
- CVE-2023-4863, a vulnerability in the WebP image library in Google Chrome. It can also be used for sandbox escape.
- CVE-2023-5217, a vulnerability in the VP8 encoding function in Google Chrome, exploitation of which allows sandbox escape.
Since each of these vulnerabilities was found ITW, we recommend installing the latest updates of the relevant software.
Vulnerability statistics
As is customary, Microsoft Office (80.14%) ranks first by number of attempts to exploit vulnerabilities in Q3, gaining 4.5 p.p. Cybercriminals continue to use old vulnerabilities to attack unpatched corporate systems. Among the most commonly exploited vulnerabilities in the suite are:
- CVE-2017-11882 and CVE-2018-0802 in the Equation Editor component, allowing an Equation object in a document to cause application memory corruption upon being processed and make it possible to execute arbitrary code in the system;
- CVE-2017-0199, allowing exploitation of MS Office features to download malicious scripts;
- CVE-2017-8570, allowing download and execution of a malicious HTA script.
Distribution of exploits used by cybercriminals, by type of attacked application, Q3 2023 (download)
In second place are browsers (5.85%), whose share decreased by 2 p.p. against the previous quarter. The Android platform (4.70%) rounds out the TOP 3: exploits for it were up by 0.37 p.p. against the previous period.
Network threats in Q3 2023 are mainly brute-force password attacks on MSSQL and RDP services. Note that among exploits for operating system vulnerabilities, EternalBlue and EternalRomance remain popular. Additionally, we observed scanning for Log4j-type vulnerabilities (CVE-2021-44228), attacks on them, and probing of systems for insecure deserialization in Java.
Attacks on macOS
This quarter saw the appearance of a new version of XLoader masquerading as a popular document viewing and editing application. As with previous versions, the Trojan grabs clipboard contents and authorization data from Chrome and Firefox browsers.
TOP 20 threats for macOS
| Verdict | %* | |
| 1 | AdWare.OSX.Agent.ai | 9.08 |
| 2 | AdWare.OSX.Pirrit.ac | 6.84 |
| 3 | Hoax.OSX.MacBooster.a | 6.32 |
| 4 | AdWare.OSX.Agent.ap | 6.05 |
| 5 | Monitor.OSX.HistGrabber.b | 5.82 |
| 6 | AdWare.OSX.Amc.e | 5.72 |
| 7 | AdWare.OSX.Bnodlero.ax | 4.75 |
| 8 | AdWare.OSX.Pirrit.j | 4.33 |
| 9 | Trojan.OSX.Agent.gen | 4.25 |
| 10 | AdWare.OSX.Agent.gen | 3.84 |
| 11 | AdWare.OSX.Pirrit.ae | 3.39 |
| 12 | AdWare.OSX.Mhp.a | 2.97 |
| 13 | Trojan-Downloader.OSX.Agent.h | 2.74 |
| 14 | AdWare.OSX.Amc.c | 2.35 |
| 15 | Downloader.OSX.InstallCore.ak | 2.32 |
| 16 | AdWare.OSX.Pirrit.aa | 2.17 |
| 17 | AdWare.OSX.Bnodlero.bg | 2.09 |
| 18 | AdWare.OSX.Pirrit.gen | 2.06 |
| 19 | Backdoor.OSX.Twenbc.g | 2.01 |
| 20 | AdWare.OSX.Pirrit.o | 1.88 |
* Unique users who encountered this malware as a percentage of all users of Kaspersky security solutions for macOS who were attacked.
Adware programs and fake system accelerators remained the main threat to macOS users in Q3.
Geography of threats for macOS
TOP 10 countries and territories by share of attacked users
| Country or territory* | %** | |
| 1 | Hong Kong | 1.40 |
| 2 | Mainland China | 1.19 |
| 3 | Italy | 1.16 |
| 4 | France | 1.06 |
| 5 | United States | 1.04 |
| 6 | Mexico | 0.98 |
| 7 | Spain | 0.96 |
| 8 | Australia | 0.86 |
| 9 | United Kingdom | 0.81 |
| 10 | Russian Federation | 0.81 |
* Excluded from the rankings are countries and territories with relatively few users of Kaspersky security solutions for macOS (under 10,000).
** Unique attacked users as a percentage of all users of Kaspersky macOS security products in the country/territory.
IoT attacks
IoT threat statistics
In Q3 2023, the distribution of devices attacking Kaspersky traps using the Telnet and SSH protocols did not change significantly.
| Telnet | 78.94% |
| SSH | 21.06% |
Distribution of attacked services by number of unique IP addresses of attacking devices, Q3 2023
In terms of session numbers, Telnet accounted for the absolute majority.
| Telnet | 97.19% |
| SSH | 2.81% |
Distribution of cybercriminal working sessions with Kaspersky traps, Q3 2023
Attacks on IoT honeypots
In Q3, the main sources of SSH attacks were again the United States and the APAC region. The share of attacks emanating from the mainland China (20.14%) rose, while those from South Korea (3.63%) and Vietnam (2.76%) fell slightly. The shares of other countries and territories changed insignificantly.
TOP 10 countries and territories as sources of SSH attacks
| Country or territory | %* | |
| Q2 2023 | Q3 2023 | |
| Mainland China | 12.63 | 20.14 |
| United States | 11.50 | 11.58 |
| India | 5.01 | 5.54 |
| Singapore | 5.32 | 5.54 |
| Germany | 4.21 | 4.68 |
| Brazil | 4.57 | 4.30 |
| Russian Federation | 3.73 | 3.92 |
| South Korea | 6.21 | 3.63 |
| Vietnam | 3.39 | 2.76 |
| Hong Kong | 2.33 | 2.64 |
| Other | 41.96 | 35.27 |
* Unique IP addresses located in a country/territory as a percentage of all unique IP addresses where SSH attacks on Kaspersky honeypots originated.
Cybercriminals controlling devices in India increased their share of the total number of Telnet-based attacks (to 20.07%), while the share of threat actors owning devices in the mainland China dropped slightly (to 31.58%).
TOP 10 countries and territories as sources of Telnet attacks
| Country or territory | %* | |
| Q2 2023 | Q3 2023 | |
| Mainland China | 35.38 | 31.58 |
| India | 14.03 | 20.07 |
| United States | 4.41 | 4.38 |
| Brazil | 6.36 | 4.20 |
| Russian Federation | 4.33 | 3.81 |
| Taiwan | 2.79 | 2.67 |
| South Korea | 2.51 | 2.50 |
| Egypt | 0.93 | 2.35 |
| Namibia | 0.41 | 2.13 |
| Argentina | 2.24 | 2.11 |
| Other | 20.40 | 24.19 |
* Unique IP addresses located in a country/territory as a percentage of all unique IP addresses where Telnet attacks on Kaspersky honeypots originated.
TOP 10 threats delivered to IoT devices via Telnet
| Verdict | %* | |
| 1 | Trojan-Downloader.Linux.NyaDrop.b | 39.16 |
| 2 | Backdoor.Linux.Mirai.b | 16.95 |
| 3 | Backdoor.Linux.Mirai.ba | 9.03 |
| 4 | Backdoor.Linux.Mirai.es | 6.39 |
| 5 | Backdoor.Linux.Mirai.cw | 5.97 |
| 6 | Backdoor.Linux.Mirai.fg | 3.58 |
| 7 | Trojan.Linux.Agent.nx | 2.22 |
| 8 | Trojan-Downloader.Linux.Mirai.d | 1.87 |
| 9 | Trojan-Downloader.Shell.Agent.p | 1.77 |
| 10 | Backdoor.Linux.Gafgyt.a | 1.62 |
* Share of each threat delivered to infected devices as a result of a successful Telnet attack out of the total number of delivered threats.
Attacks via web resources
The statistics in this section come from Web Anti-Virus, which protects users when malicious objects are downloaded from malicious or infected web pages. Cybercriminals create such sites on purpose; they can infect hacked legitimate resources as well as web resources with user-created content, such as forums.
Countries and territories that serve as sources of web-based attacks: TOP 10
The following statistics show the distribution by country and territory of the sources of internet attacks blocked by Kaspersky products on user computers (web pages with redirects to exploits, sites hosting malicious programs, botnet C&C centers, etc.). Any unique host could be the source of one or more web-based attacks.
To determine the geographic source of web attacks, the GeoIP technique was used to match the domain name to the real IP address at which the domain is hosted.
In Q3 2023, Kaspersky solutions blocked 694,400,301 attacks from online resources located across the globe. A total of 169,194,807 unique URLs were recognized as malicious by Web Anti-Virus components.
Distribution of web-attack sources by country and territory, Q3 2023 (download)
Countries and territories where users faced the greatest risk of online infection
To assess the risk of online infection faced by users in different countries and territories, for each country and territory we calculated the share of Kaspersky users on whose devices Web Anti-Virus was triggered at least once during the reporting period. The resulting data provides an indication of the aggressiveness of the environment in which computers operate in different countries and territories.
Note that these rankings only include attacks by malicious objects that fall under the Malware class; they do not include Web Anti-Virus detections of potentially dangerous or unwanted programs, such as RiskTool or adware.
| Country or territory* | %** | |
| 1 | Belarus | 15.42 |
| 2 | Moldova | 15.35 |
| 3 | Albania | 14.05 |
| 4 | Taiwan | 13.46 |
| 5 | North Macedonia | 13.08 |
| 6 | Bulgaria | 12.84 |
| 7 | Serbia | 12.75 |
| 8 | Kyrgyzstan | 12.73 |
| 9 | Latvia | 12.64 |
| 10 | Greece | 12.53 |
| 11 | Estonia | 12.06 |
| 12 | Bangladesh | 11.94 |
| 13 | Nepal | 11.91 |
| 14 | Sri Lanka | 11.91 |
| 15 | Slovenia | 11.70 |
| 16 | Algeria | 11.61 |
| 17 | Turkey | 11.58 |
| 18 | Bosnia and Herzegovina | 11.22 |
| 19 | Belgium | 11.15 |
| 20 | Canada | 11.04 |
* Excluded are countries and territories with relatively few Kaspersky users (under 10,000).
** Unique users targeted by Malware-class attacks as a percentage of all unique users of Kaspersky products in the country/territory.
On average during the quarter, 8.81% of computers of internet users worldwide were subjected to at least one Malware-class web attack.
Local threats
In this section, we analyze statistical data obtained from the OAS (On-Access Scan) and ODS (On-Demand Scan) modules in Kaspersky products. It takes into account malicious programs that were found directly on users’ computers or removable media connected to them (flash drives, camera memory cards, phones, external hard drives), or which initially made their way onto the computer in non-open form (for example, programs in complex installers, encrypted files, etc.).
In Q3 2023, our File Anti-Virus detected 33,847,517 malicious and potentially unwanted objects.
Countries and territories where users faced the highest risk of local infection
For each country and territory, we calculated the percentage of Kaspersky product users on whose computers File Anti-Virus was triggered during the reporting period. These statistics reflect the level of personal computer infection in different countries and territories worldwide.
The ranking includes only Malware-class attacks; it doesn’t consider File Anti-Virus triggerings by potentially dangerous or unwanted programs such as RiskTool or adware.
| Country or territory* | %** | |
| 1 | Turkmenistan | 49.40 |
| 2 | Yemen | 44.54 |
| 3 | Afghanistan | 40.48 |
| 4 | Tajikistan | 39.09 |
| 5 | Burundi | 34.92 |
| 6 | Bangladesh | 34.45 |
| 7 | Myanmar | 33.78 |
| 8 | South Sudan | 33.63 |
| 9 | Syria | 33.60 |
| 10 | Benin | 33.12 |
| 11 | Guinea | 32.81 |
| 12 | Chad | 32.61 |
| 13 | Cameroon | 31.92 |
| 14 | Tanzania | 31.90 |
| 15 | Uzbekistan | 31.86 |
| 16 | Republic of the Congo | 31.51 |
| 17 | Democratic Republic of the Congo | 31.18 |
| 18 | Malawi | 30.82 |
| 19 | Burkina Faso | 30.77 |
| 20 | Rwanda | 30.55 |
* Excluded are countries and territories with relatively few Kaspersky users (under 10,000).
** Unique users on whose computers Malware-class local threats were blocked, as a percentage of all unique users of Kaspersky products in the country or territory.
Overall globally, 15.4% of user computers faced at least one Malware-class local threat during Q3.
Text extracted automatically; images, tables and formatting may be missing. Original: https://securelist.com/it-threat-evolution-q3-2023-non-mobile-statistics/111228/