{"id":53426,"date":"2023-08-28T16:30:09","date_gmt":"2023-08-28T16:30:09","guid":{"rendered":"https:\/\/www.threatshub.org\/blog\/malware-loader-lowdown-the-big-3-responsible-for-80-of-attacks-so-far-this-year\/"},"modified":"2023-08-28T16:30:09","modified_gmt":"2023-08-28T16:30:09","slug":"malware-loader-lowdown-the-big-3-responsible-for-80-of-attacks-so-far-this-year","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/malware-loader-lowdown-the-big-3-responsible-for-80-of-attacks-so-far-this-year\/","title":{"rendered":"Malware loader lowdown: The big 3 responsible for 80% of attacks so far this year"},"content":{"rendered":"

Three malware loaders \u2014 QBot, SocGholish, and Raspberry Robin \u2014 are responsible for 80 percent of observed attacks on computers and networks so far this year.<\/p>\n

Security shop ReliaQuest reported on Friday the top nasties that should be detected and blocked by IT defenses are QBot (also known as QakBot, QuackBot, and Pinkslipbot), the most observed loader between January 1 and July 31, responsible for 30 percent of the intrusion attempts recorded. SocGholish came in second at 27 percent, and Raspberry Robin claimed 23 percent. The other seven loaders in the lineup lag far behind the three leaders: Gootloader with 3 percent, and Guloader, Chromeloader, and Ursnif with 2 percent.<\/p>\n

As the name suggests, loaders are an intermediary stage of a malware infection. The loader is run on a victim’s computer by, for example, a miscreant exploiting some vulnerability or simply sending a mark an email with a malicious attachment to open. When the loader is running, it usually secures its foothold in the system, taking steps to maintain persistence, and fetches the main malware payload to execute, which could be ransomware or a backdoor or some such.<\/p>\n