Source: The Red Canary Blog: Information Security Insights Author: The Red Canary Team URL: https://redcanary.com/blog/threat-intelligence/intelligence-insights-december-2024/

ONE SENTENCE SUMMARY:

ChromeLoader remains the most prevalent threat for six months, with evolving techniques and notable entries in the top 10 threats.

MAIN POINTS:

1. ChromeLoader holds the top position on the prevalent threat list for six consecutive months.
2. The volume of ChromeLoader has been decreasing since July 2024.
3. Popular technique “paste and run” could have claimed the top spot if included in rankings.
4. Most threats utilizing “paste and run” disguise as fake CAPTCHAs to trick users.
5. LummaC2 is the primary paste and run payload, ranking second in November.
6. Raspberry Robin returned to the top 5, ranking 4th after an increase in USB infections.
7. Newcomer HijackLoader entered the list at 3rd, related to LummaC2 delivery configurations.
8. Top threats are tracked by unique customer environments observed over time.
9. The threats list is updated monthly, reflecting changes in cyber threat landscape.
10. November saw significant activity in USB-based infections, impacting threat prominence.

TAKEAWAYS:

1. Cyber threats are continuously evolving, impacting their prevalence and methods.
2. Tracking threat landscapes over time reveals shifts in attacker strategies.
3. Fake CAPTCHAs increasingly serve as successful lure mechanisms for cyber threats.
4. Understanding payload connections aids in recognizing emerging threats.
5. Frequent updates to threat assessments are crucial for effective cybersecurity measures.