IT threat evolution Q3 2020. Non
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2017-0199 | Remote Code Execution in Microsoft Office and WordPad via crafted document files CVE-2017-0199 is a remote code execution vulnerability in Microsoft Office and WordPad that stems from improper parsing of specially crafted files. Attackers trigger it by getting a user to open a malicious document, after which attacker-controlled code executes with the privileges of the logged-in user. Anyone running the affected Microsoft Office or WordPad software is exposed, and CISA notes the flaw has been leveraged in ransomware campaigns; no CVSS score is available in the source data. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2021-11-03, and EPSS assigns a 99.9% probability of exploitation within 30 days (100th percentile), indicating active, ongoing exploitation. Do: Apply Microsoft's security updates for Office and Windows per vendor instructions, as required by CISA's KEV catalog; the flaw was publicly reported as fixed in Microsoft's April 2017 security updates. Until patched, treat unsolicited Office documents and email attachments as high-risk, since exploitation requires a user to open a crafted file. Verify that all Office and WordPad installations across the estate—especially endpoints that handle untrusted documents—have received the update. | 7.8 | 100% | KEV ransomware PoC ×6 |
| masshundreds of millions of Office installations worldwide (exact count unknown) | |
| CVE-2017-11882 | Memory Corruption RCE in Microsoft Office via Legacy Equation Editor CVE-2017-11882 is a memory corruption vulnerability (CWE-119) in Microsoft Office, residing in the legacy Microsoft Equation Editor component (EQNEDT32.EXE), that allows remote code execution in the context of the current user. Attackers trigger it by persuading a user to open a crafted document, most commonly an RTF file or other Office document carrying a malicious embedded equation object, which overflows a buffer while the equation content is parsed. Successful exploitation lets the attacker run arbitrary code with the privileges of the signed-in user, a typical foothold for malware delivery and, per CISA, for ransomware operations. Any environment running affected Microsoft Office builds is exposed; the source data does not enumerate specific affected version ranges. The flaw is confirmed exploited in the wild: it was added to the CISA Known Exploited Vulnerabilities catalog on 2021-11-03 with known ransomware use and holds a 99.9% EPSS score (percentile 100), though the source data lists no public PoC. Do: Apply Microsoft's Office security updates (November 2017 or later) across all endpoints, prioritizing this KEV-listed flaw given its known ransomware use. On systems that cannot yet be patched, disable or unregister the legacy Equation Editor (EQNEDT32.EXE) and consider blocking or warning on RTF attachments as interim mitigations. Check for indicators of abuse such as EQNEDT32.EXE spawning unexpected child processes after document opens. | 7.8 | 100% | KEV ransomware PoC ×10 |
| masshundreds of millions of users/installations (Office is near-ubiquitous on Windows and in enterprises; the share still unpatched is unknown) | |
| CVE-2017-8570 | Remote Code Execution in Microsoft Office via Malicious PPSX Files (CVE-2017-8570) CVE-2017-8570 is a remote code execution vulnerability in Microsoft Office caused by improper handling of embedded OLE objects (composite monikers) in memory, and it is tracked separately from the related CVE-2017-0243. An attacker triggers it by embedding a crafted moniker object in a document, most commonly a PowerPoint .ppsx slide-show file, and persuading a user to open it; the CVSS vector confirms user interaction is required. Successful exploitation lets the attacker run arbitrary code with the victim's privileges, enabling malware delivery, data theft, and follow-on activity. Any user or organization running affected Office builds that open untrusted documents is in scope, and public reporting ties the bug to high-volume maldoc toolkits (e.g., EtterSilent, ThreadKit) and targeted attacks, including one against Ukrainian organizations. Exploitation is confirmed in the wild: CISA added it to the KEV catalog on 2022-02-25, EPSS puts the 30-day exploitation probability at 89.9% (100th percentile), and public PoCs exist. Do: Apply Microsoft's June 2017 (or later) security updates to all Office installations and audit the estate for outdated builds, since CISA KEV and EPSS data show this bug is still exploited years after the patch. As an interim mitigation, block or sandbox .ppsx (PowerPoint Show) email attachments, which are the primary delivery vector, and warn users about Office files triggering embedded object content. Prioritize remediation per CISA's KEV required action: apply updates per vendor instructions. | 7.8 | 90% | KEV PoC ×2 |
| masshundreds of millions of users potentially affected (Office install base exceeds 1 billion; practical exposure limited to systems not updated since mid-2017) | |
| CVE-2018-0802 | Memory Corruption RCE in Microsoft Office Equation Editor A memory-corruption flaw (out-of-bounds write, CWE-787) in the legacy Equation Editor component (EQNEDT32.EXE) shipped with Microsoft Office 2007, 2010, 2013, and 2016 allows remote code execution due to improper handling of objects in memory. An attacker triggers it by persuading a user to open a specially crafted document (for example an RTF or DOCX containing a malformed embedded equation object), causing the Equation Editor process to corrupt memory when the file is opened in Word; the user-interaction requirement is reflected in the CVSS 3.1 vector (AV:L/UI:R). Successful exploitation gives the attacker code execution in the context of the current user, with high impact on confidentiality, integrity, and availability (CVSS 3.1 score 7.8, High). Any user of the affected Office versions, the Office Compatibility Pack, or Word on an unpatched system is affected. Exploitation is confirmed in the wild: the flaw is in CISA's Known Exploited Vulnerabilities catalog (added 2021-11-03) with known ransomware use, carries a 93.3% EPSS probability of exploitation within 30 days, and multiple public analyses and proof-of-concepts exist. Do: Apply Microsoft's January 2018 security updates for Office 2007, 2010, 2013, and 2016 and the Office Compatibility Pack, and verify the legacy Equation Editor executable (EQNEDT32.EXE) on endpoints has been patched or removed (Microsoft later retired the component). Because the flaw is exploited in the wild and used in ransomware campaigns, prioritize remediation per CISA KEV required action and hunt for Word spawning EQNEDT32.EXE or unexpected child processes when documents are opened. Until patched, open untrusted documents in Protected View and treat email-delivered RTF/DOCX attachments as untrusted. | 7.8 | 93% | KEV ransomware PoC ×3 |
| masshundreds of millions of Office users at time of disclosure (vulnerable Equation Editor shipped by default with Office 2007-2016); largely patched today, with… | |
| CVE-2020-1380 | Memory Corruption RCE in Microsoft Internet Explorer Scripting Engine CVE-2020-1380 is a memory corruption vulnerability (an out-of-bounds write, CWE-787) in the Microsoft Internet Explorer scripting engine that can corrupt memory when the engine processes maliciously crafted script content. It is triggered by luring a user to visit an attacker-controlled or compromised web page in Internet Explorer or in an application that invokes the IE engine, with no authentication required. Successful exploitation allows the attacker to execute arbitrary code in the context of the current user, gaining that user's privileges on the system. All installations of the affected Microsoft Internet Explorer versions are potentially exposed, with the greatest risk to legacy and enterprise Windows systems that still browse or render content with IE. The flaw is on CISA's Known Exploited Vulnerabilities catalog (added 2021-11-03), indicating exploitation in the wild, while no public proof-of-concept is known and ransomware use is unconfirmed. Do: Apply Microsoft's June 2020 (or later) Windows cumulative security updates on every system running Internet Explorer, per the vendor instructions cited by CISA. Given the KEV listing (added 2021-11-03) and high EPSS (~24% 30-day exploitation probability, 98th percentile), treat this as a priority patch. Reduce attack surface by steering users to Microsoft Edge instead of IE for web browsing and auditing internal apps or legacy sites that still invoke the IE engine to render external content. | 7.8 | 24% | KEV |
| masshundreds of millions of Windows devices historically able to run Internet Explorer; exact currently-vulnerable count unknown |
Full article2,974 words · extracted from securelist.com · click to collapse
These statistics are based on detection verdicts of Kaspersky products received from users who consented to provide statistical data.
Quarterly figures
According to Kaspersky Security Network, in Q3:
- Kaspersky solutions blocked 1,416,295,227 attacks launched from online resources across the globe.
- 456,573,467 unique URLs were recognized as malicious by Web Anti-Virus components.
- Attempts to run malware for stealing money from online bank accounts were stopped on the computers of 146,761 unique users.
- Ransomware attacks were defeated on the computers of 121,579 unique users.
- Our File Anti-Virus detected 87,941,334 unique malicious and potentially unwanted objects.
Financial threats
Financial threat statistics
In Q3 2020, Kaspersky solutions blocked attempts to launch one or more types of malware designed to steal money from bank accounts on the computers of 146,761 users.
Number of unique users attacked by financial malware, Q3 2020 (download)
Attack geography
To evaluate and compare the risk of being infected by banking Trojans and ATM/POS malware worldwide, for each country we calculated the share of users of Kaspersky products who faced this threat during the reporting period as a percentage of all users of our products in that country.
Geography of financial malware attacks, Q3 2020 (download)
Top 10 countries by share of attacked users
| Country* | %** | |
| 1 | Costa Rica | 6.6 |
| 2 | Turkmenistan | 5.9 |
| 3 | Tajikistan | 4.7 |
| 4 | Uzbekistan | 4.6 |
| 5 | Afghanistan | 3.4 |
| 6 | Syria | 1.7 |
| 7 | Iran | 1.6 |
| 8 | Yemen | 1.6 |
| 9 | Kazakhstan | 1.5 |
| 10 | Venezuela | 1.5 |
* Excluded are countries with relatively few Kaspersky product users (under 10,000).
** Unique users whose computers were targeted by financial malware as a percentage of all unique users of Kaspersky products in the country.
First among the banker families, as in the previous quarter, is Zbot (19.7%), despite its share dropping 5.1 p.p. It is followed by Emotet (16.1%) — as we predicted, this malware renewed its activity, climbing by 9.5 p.p. as a result. Meanwhile, the share of another banker family, RTM, decreased by 11.2 p.p., falling from second position to fifth with a score of 7.4%.
Top 10 banking malware families
| Name | Verdicts | %* | ||
| 1 | Zbot | Trojan.Win32.Zbot | 19.7 | |
| 2 | Emotet | Backdoor.Win32.Emotet | 16.1 | |
| 3 | CliptoShuffler | Trojan-Banker.Win32.CliptoShuffler | 12.2 | |
| 4 | Trickster | Trojan.Win32.Trickster | 8.8 | |
| 5 | RTM | Trojan-Banker.Win32.RTM | 7.4 | |
| 6 | Neurevt | Trojan.Win32.Neurevt | 5.4 | |
| 7 | Nimnul | Virus.Win32.Nimnul | 4.4 | |
| 8 | SpyEye | Trojan-Spy.Win32.SpyEye | 3.5 | |
| 9 | Danabot | Trojan-Banker.Win32.Danabot | 3.1 | |
| 10 | Gozi | Trojan-Banker.Win32.Gozi | 1.9 |
** Unique users who encountered this malware family as a percentage of all users attacked by financial malware.
Ransomware programs
Quarterly trends and highlights
Q3 2020 saw many high-profile ransomware attacks on organizations in various fields: education, healthcare, governance, energy, finance, IT, telecommunications and many others. Such cybercriminal activity is understandable: a successful attack on a major organization can command a ransom in the millions of dollars, which is several orders of magnitude higher than the typical sum for mass ransomware.
Campaigns of this type can be viewed as advanced persistent threats (APTs), and Kaspersky researchers detected the involvement of the Lazarus group in the distribution of one of these ransomware programs.
Distributors of these Trojans also began to cooperate with the aim of carrying out more effective and destructive attacks. At the start of the quarter, word leaked out that Maze operators had joined forces with distributors of LockBit, and later RagnarLocker, to form a ransomware cartel. The cybercriminals used shared infrastructure to publish stolen confidential data. Also observed was the pooling of expertise in countering security solutions.
Of the more heartening events, Q3 will be remembered for the arrest of one of the operators of the GandCrab ransomware. Law enforcement agencies in Belarus, Romania and the UK teamed up to catch the distributor of the malware, which had reportedly infected more than 1,000 computers.
Number of new modifications
In Q3 2020, we detected four new ransomware families and 6,720 new modifications of this malware type.
Number of new ransomware modifications, Q3 2019 – Q3 2020 (download)
Number of users attacked by ransomware Trojans
In Q3 2020, Kaspersky products and technologies protected 121,579 users against ransomware attacks.
Number of unique users attacked by ransomware Trojans, Q3 2020 (download)
Attack geography
Geography of attacks by ransomware Trojans, Q3 2020 (download)
Top 10 countries attacked by ransomware Trojans
| Country* | %** | |
| 1 | Bangladesh | 2.37 |
| 2 | Mozambique | 1.10 |
| 3 | Ethiopia | 1.02 |
| 4 | Afghanistan | 0.87 |
| 5 | Uzbekistan | 0.79 |
| 6 | Egypt | 0.71 |
| 7 | China | 0.65 |
| 8 | Pakistan | 0.52 |
| 9 | Vietnam | 0.50 |
| 10 | Myanmar | 0.46 |
* Excluded are countries with relatively few Kaspersky users (under 50,000).
** Unique users attacked by ransomware Trojans as a percentage of all unique users of Kaspersky products in the country.
Top 10 most common families of ransomware Trojans
| Name | Verdicts | %* | ||
| 1 | WannaCry | Trojan-Ransom.Win32.Wanna | 18.77 | |
| 2 | (generic verdict) | Trojan-Ransom.Win32.Gen | 10.37 | |
| 3 | (generic verdict) | Trojan-Ransom.Win32.Encoder | 9.58 | |
| 4 | (generic verdict) | Trojan-Ransom.Win32.Generic | 8.55 | |
| 5 | (generic verdict) | Trojan-Ransom.Win32.Phny | 6.37 | |
| 6 | Stop | Trojan-Ransom.Win32.Stop | 5.89 | |
| 7 | (generic verdict) | Trojan-Ransom.Win32.Crypren | 4.12 | |
| 8 | PolyRansom/VirLock | Virus.Win32.PolyRansom | 3.14 | |
| 9 | Crysis/Dharma | Trojan-Ransom.Win32.Crusis | 2.44 | |
| 10 | (generic verdict) | Trojan-Ransom.Win32.Crypmod | 1.69 |
* Unique Kaspersky users attacked by this family of ransomware Trojans as a percentage of all users attacked by such malware.
Miners
Number of new modifications
In Q3 2020, Kaspersky solutions detected 3,722 new modifications of miners.
Number of new miner modifications, Q3 2020 (download)
Number of users attacked by miners
In Q3, we detected attacks using miners on the computers of 440,041 unique users of Kaspersky products worldwide. If in the previous quarter the number of attacked users decreased, in this reporting period the situation was reversed: from July we saw a gradual rise in activity.
Number of unique users attacked by miners, Q3 2020 (download)
Attack geography
Geography of miner attacks, Q3 2020 (download)
Top 10 countries attacked by miners
| Country* | %** | |
| 1 | Afghanistan | 5.53 |
| 2 | Ethiopia | 3.94 |
| 3 | Tanzania | 3.06 |
| 4 | Rwanda | 2.58 |
| 5 | Uzbekistan | 2.46 |
| 6 | Sri Lanka | 2.30 |
| 7 | Kazakhstan | 2.26 |
| 8 | Vietnam | 1.95 |
| 9 | Mozambique | 1.76 |
| 10 | Pakistan | 1.57 |
* Excluded are countries with relatively few users of Kaspersky products (under 50,000).
** Unique users attacked by miners as a percentage of all unique users of Kaspersky products in the country.
Vulnerable applications used by cybercriminals during cyberattacks
According to our statistics, vulnerabilities in the Microsoft Office suite continue to lead: in Q3, their share amounted to 71% of all identified vulnerabilities. Users worldwide are in no rush to update the package, putting their computers at risk of infection. Although our products protect against the exploitation of vulnerabilities, we strongly recommend the timely installation of patches, especially security updates.
First place in this category of vulnerabilities goes to CVE-2017-8570, which can embed a malicious script in an OLE object placed inside an Office document. Almost on a par in terms of popularity is the vulnerability CVE-2017-11882, exploits for which use a stack overflow error in the Equation Editor component. CVE-2017-0199 and CVE-2018-0802 likewise remain popular.
Distribution of exploits used by cybercriminals, by type of attacked application, Q3 2020 (download)
The share of vulnerabilities in Internet browsers increased by 3 p.p. this quarter to 15%. One of the most-talked-about browser vulnerabilities was CVE-2020-1380 — a use-after-free error in the jscript9.dll library of the current version of the Internet Explorer 9+ scripting engine. This same vulnerability was spotted in the Operation PowerFall targeted attack.
Also in Q3, researchers discovered the critical vulnerability CVE-2020-6492 in the WebGL component of Google Chrome. Theoretically, it can be used to execute arbitrary code in the context of a program. The similar vulnerability CVE-2020-6542 was later found in the same component. Use-after-free vulnerabilities were detected in other components too: Task Scheduler (CVE-2020-6543), Media (CVE-2020-6544) and Audio (CVE-2020-6545).
In another browser, Mozilla Firefox, three critical vulnerabilities, CVE-2020-15675, CVE-2020-15674 and CVE-2020-15673, related to incorrect memory handling, were detected, also potentially leading to arbitrary code execution in the system.
In the reporting quarter, the vulnerability CVE-2020-1464, used to bypass scans on malicious files delivered to user systems, was discovered in Microsoft Windows. An error in the cryptographic code made it possible for an attacker to insert a malicious JAR archive inside a correctly signed MSI file, circumvent security mechanisms, and compromise the system. Also detected were vulnerabilities that could potentially be used to compromise a system with different levels of privileges:
- CVE-2020-1554, CVE-2020-1492, CVE-2020-1379, CVE-2020-1477 and CVE-2020-1525 in the Windows Media Foundation component;
- CVE-2020-1046, detected in the .NET platform, can be used to run malicious code with administrator privileges;
- CVE-2020-1472, a vulnerability in the code for processing Netlogon Remote Protocol requests that could allow an attacker to change any user credentials.
Among network-based attacks, those involving EternalBlue exploits and other vulnerabilities from the Shadow Brokers suite remain popular. Also common are brute-force attacks on Remote Desktop Services and Microsoft SQL Server, and via the SMB protocol. In addition, the already mentioned critical vulnerability CVE-2020-1472, also known as Zerologon, is network-based. This error allows an intruder in the corporate network to impersonate any computer and change its password in Active Directory.
Attacks on macOS
Perhaps this quarter’s most interesting find was EvilQuest, also known as Virus.OSX.ThifQseut.a. It is a self-replicating piece of ransomware, that is, a full-fledged virus. The last such malware for macOS was detected 13 years ago, since which time this class of threats has been considered irrelevant for this platform.
Top 20 threats for macOS
| Verdict | %* | |
| 1 | Monitor.OSX.HistGrabber.b | 14.11 |
| 2 | AdWare.OSX.Pirrit.j | 9.21 |
| 3 | AdWare.OSX.Bnodlero.at | 9.06 |
| 4 | Trojan-Downloader.OSX.Shlayer.a | 8.98 |
| 5 | AdWare.OSX.Bnodlero.ay | 6.78 |
| 6 | AdWare.OSX.Pirrit.ac | 5.78 |
| 7 | AdWare.OSX.Ketin.h | 5.71 |
| 8 | AdWare.OSX.Pirrit.o | 5.47 |
| 9 | AdWare.OSX.Cimpli.k | 4.79 |
| 10 | AdWare.OSX.Ketin.m | 4.45 |
| 11 | Hoax.OSX.Amc.d | 4.38 |
| 12 | Trojan-Downloader.OSX.Agent.j | 3.98 |
| 13 | Trojan-Downloader.OSX.Agent.h | 3.58 |
| 14 | AdWare.OSX.Pirrit.gen | 3.52 |
| 15 | AdWare.OSX.Spc.a | 3.18 |
| 16 | AdWare.OSX.Amc.c | 2.97 |
| 17 | AdWare.OSX.Pirrit.aa | 2.94 |
| 18 | AdWare.OSX.Pirrit.x | 2.81 |
| 19 | AdWare.OSX.Cimpli.l | 2.78 |
| 20 | AdWare.OSX.Bnodlero.x | 2.64 |
* Unique users who encountered this malware as a percentage of all users of Kaspersky security solutions for macOS who were attacked.
Among the adware modules and their Trojan downloaders in the macOS threat rating for Q3 2020 was Hoax.OSX.Amc.d. Known as Advanced Mac Cleaner, this is a typical representative of the class of programs that first intimidate the user with system errors or other issues on the computer, and then ask for money to fix them.
Threat geography
Geography of threats for macOS, Q3 2020 (download)
Top 10 countries by share of attacked users
| Country* | %** | |
| 1 | Spain | 6.20% |
| 2 | France | 6.13% |
| 3 | India | 5.59% |
| 4 | Canada | 5.31% |
| 5 | Brazil | 5.23% |
| 6 | USA | 5.19% |
| 7 | Mexico | 4.98% |
| 8 | Great Britain | 4.37% |
| 9 | China | 4.25% |
| 10 | Italy | 4.19% |
* Excluded from the rating are countries with relatively few users of Kaspersky security solutions for macOS (under 5000)
** Unique users attacked as a percentage of all users of Kaspersky security solutions for macOS in the country.
Spain (6.29%) and France (6.13%) were the leaders by share of attacked users. They were followed by India (5.59%) in third place, up from fifth in the last quarter. As for detected macOS threats, the Shlayer Trojan consistently holds a leading position in countries in this Top 10 list.
IoT attacks
IoT threat statistics
In Q3 2020, the share of devices whose IP addresses were used for Telnet attacks on Kaspersky traps increased by 4.5 p.p.
| Telnet | 85.34% |
| SSH | 14.66% |
Distribution of attacked services by number of unique IP addresses of devices that carried out attacks, Q3 2020
However, the distribution of sessions from these same IPs in Q3 did not change significantly: the share of operations using the SSH protocol rose by 2.8 p.p.
| Telnet | 68.69% |
| SSH | 31.31% |
Distribution of cybercriminal working sessions with Kaspersky traps, Q3 2020
Nevertheless, Telnet still dominates both by number of attacks from unique IPs and in terms of further communication with the trap by the attacking party.
Geography of IP addresses of devices from which attempts were made to attack Kaspersky Telnet traps, Q3 2020 (download)
Top 10 countries by location of devices from which attacks were carried out on Kaspersky Telnet traps
| Country | %* |
| India | 19.99 |
| China | 15.46 |
| Egypt | 9.77 |
| Brazil | 7.66 |
| Taiwan, Province of China | 3.91 |
| Russia | 3.84 |
| USA | 3.14 |
| Iran | 3.09 |
| Vietnam | 2.83 |
| Greece | 2.52 |
* Devices from which attacks were carried out in the given country as a percentage of the total number of devices in that country.
In Q3, India (19.99%) was the location of the highest number of devices that attacked Telnet traps. China (15.46%), having ranked first in the previous quarter, moved down a notch, despite its share increasing by 2.71 p.p. Egypt (9.77%) took third place, up by 1.45 p.p.
Geography of IP addresses of devices from which attempts were made to attack Kaspersky SSH traps, Q3 2020 (download)
Top 10 countries by location of devices from which attacks were made on Kaspersky SSH traps
| Country | %* |
| China | 28.56 |
| USA | 14.75 |
| Germany | 4.67 |
| Brazil | 4.44 |
| France | 4.03 |
| India | 3.48 |
| Russia | 3.19 |
| Singapore | 3.16 |
| Vietnam | 3.14 |
| South Korea | 2.29 |
* Devices from which attacks were carried out in the given country as a percentage of the total number of devices in that country.
In Q3, as before, China (28.56%) topped the leaderboard. Likewise, the US (14.75%) retained second place. Vietnam (3.14%), however, having taken bronze in the previous quarter, fell to ninth, ceding its Top 3 position to Germany (4.67%).
Threats loaded into traps
| Verdict | %* |
| Backdoor.Linux.Mirai.b | 38.59 |
| Trojan-Downloader.Linux.NyaDrop.b | 24.78 |
| Backdoor.Linux.Mirai.ba | 11.40 |
| Backdoor.Linux.Gafgyt.a | 9.71 |
| Backdoor.Linux.Mirai.cw | 2.51 |
| Trojan-Downloader.Shell.Agent.p | 1.25 |
| Backdoor.Linux.Gafgyt.bj | 1.24 |
| Backdoor.Linux.Mirai.ad | 0.93 |
| Backdoor.Linux.Mirai.cn | 0.81 |
| Backdoor.Linux.Mirai.c | 0.61 |
* Share of malware type in the total number of malicious programs downloaded to IoT devices following a successful attack.
Attacks via web resources
The statistics in this section are based on Web Anti-Virus, which protects users when malicious objects are downloaded from malicious/infected web pages. Cybercriminals create such sites on purpose; web resources with user-created content (for example, forums), as well as hacked legitimate resources, can be infected.
Countries that are sources of web-based attacks: Top 10
The following statistics show the distribution by country of the sources of Internet attacks blocked by Kaspersky products on user computers (web pages with redirects to exploits, sites containing exploits and other malicious programs, botnet C&C centers, etc.). Any unique host could be the source of one or more web-based attacks.
To determine the geographical source of web-based attacks, domain names are matched against their actual domain IP addresses, and then the geographical location of a specific IP address (GEOIP) is established.
In Q3 2020, Kaspersky solutions blocked 1,416,295,227 attacks launched from online resources located across the globe. 456,573,467 unique URLs were recognized as malicious by Web Anti-Virus.
Distribution of web attack sources by country, Q3 2020 (download)
Countries where users faced the greatest risk of online infection
To assess the risk of online infection faced by users in different countries, for each country we calculated the share of Kaspersky users on whose computers Web Anti-Virus was triggered during the quarter. The resulting data provides an indication of the aggressiveness of the environment in which computers operate in different countries.
This rating only includes attacks by malicious programs that fall under the Malware class; it does not include Web Anti-Virus detections of potentially dangerous or unwanted programs such as RiskTool or adware.
| Country* | % of attacked users** | |
| 1 | Vietnam | 8.69 |
| 2 | Bangladesh | 7.34 |
| 3 | Latvia | 7.32 |
| 4 | Mongolia | 6.83 |
| 5 | France | 6.71 |
| 6 | Moldova | 6.64 |
| 7 | Algeria | 6.22 |
| 8 | Madagascar | 6.15 |
| 9 | Georgia | 6.06 |
| 10 | UAE | 5.98 |
| 11 | Nepal | 5.98 |
| 12 | Spain | 5.92 |
| 13 | Serbia | 5.87 |
| 14 | Montenegro | 5.86 |
| 15 | Estonia | 5.84 |
| 16 | Qatar | 5.83 |
| 17 | Tunisia | 5.81 |
| 18 | Belarus | 5.78 |
| 19 | Uzbekistan | 5.68 |
| 20 | Myanmar | 5.55 |
* Excluded are countries with relatively few Kaspersky users (under 10,000).
** Unique users targeted by Malware-class attacks as a percentage of all unique users of Kaspersky products in the country.
These statistics are based on detection verdicts by the Web Anti-Virus module that were received from users of Kaspersky products who consented to provide statistical data.
On average, 4.58% of Internet user computers worldwide experienced at least one Malware-class attack.
Geography of web-based malware attacks, Q3 2020 (download)
Local threats
In this section, we analyze statistical data obtained from the OAS and ODS modules in Kaspersky products. It takes into account malicious programs that were found directly on users’ computers or removable media connected to them (flash drives, camera memory cards, phones, external hard drives), or which initially made their way onto the computer in non-open form (for example, programs in complex installers, encrypted files, etc.).
In Q3 2020, our File Anti-Virus detected 87,941,334 malicious and potentially unwanted objects.
Countries where users faced the highest risk of local infection
For each country, we calculated the percentage of Kaspersky product users on whose computers File Anti-Virus was triggered during the reporting period. These statistics reflect the level of personal computer infection in different countries.
Note that this rating only includes attacks by malicious programs that fall under the Malware class; it does not include File Anti-Virus triggers in response to potentially dangerous or unwanted programs, such as RiskTool or adware.
| Country* | % of attacked users** | |
| 1 | Afghanistan | 49.27 |
| 2 | Turkmenistan | 45.07 |
| 3 | Myanmar | 42.76 |
| 4 | Tajikistan | 41.16 |
| 5 | Ethiopia | 41.15 |
| 6 | Bangladesh | 39.90 |
| 7 | Burkina Faso | 37.63 |
| 8 | Laos | 37.26 |
| 9 | South Sudan | 36.67 |
| 10 | Uzbekistan | 36.58 |
| 11 | Benin | 36.54 |
| 12 | China | 35.56 |
| 13 | Sudan | 34.74 |
| 14 | Rwanda | 34.40 |
| 15 | Guinea | 33.87 |
| 16 | Vietnam | 33.79 |
| 17 | Mauritania | 33.67 |
| 18 | Tanzania | 33.65 |
| 19 | Chad | 33.58 |
| 20 | Burundi | 33.49 |
* Excluded are countries with relatively few Kaspersky users (under 10,000).
** Unique users on whose computers Malware-class local threats were blocked, as a percentage of all unique users of Kaspersky products in the country.
Geography of local infection attempts, Q3 2020 (download)
Overall, 16.40% of user computers globally faced at least one Malware-class local threat during Q3.
The figure for Russia was 18.21%.
Text extracted automatically; images, tables and formatting may be missing. Original: https://securelist.com/it-threat-evolution-q3-2020-non-mobile-statistics/99404/