Most Wanted Malware: Androxgh0st, targets IoT devices, critical infrastructure - ITREALMS

ITREALMS ... making leadership SENSE with digital news!

The Check Point Software's latest threat index for November 2024 has highlighted the rise of Androxgh0st, a Mozi-integrated botnet, and ongoing threats from Joker and Anubis, showcasing evolving cybercriminal tactics, reports ITREALMS.

This is coming as Seven African countries are among the top 20 most attacked.

Check Point Software Technologies Ltd. a pioneer and global leader of cyber security solutions, in its latest index available to 
ITREALMS emphasized the growing sophistication of cyber criminals.

The report highlights the swift ascent of Androxgh0st, now integrated with the Mozi botnet, as it continues to target critical infrastructure worldwide.

Critical infrastructure—spanning energy grids, transportation systems, healthcare networks, and more—remains a prime target for cybercriminals due to its indispensable role in daily life and its vulnerabilities. Disrupting these systems can lead to widespread chaos, financial losses, and even threats to public safety.

African countries continue to be among those most targeted by malware attacks. Of the top 20 countries attacked in November, seven are on the continent. Ethiopia is the most attacked country of the 107 surveyed, while Zimbabwe ranked 4th with a 82,8% Normalised Risk Index, Uganda 9th and Angola 10th, with a Normalised Risk Index of 67,8- and 67,5% respectively, Ghana 13th with a Normalised Risk Index of 62%, Mozambique 17th with a Normalised Risk Index of 58,3%, Nigeria 19th and Kenya 20th, with a Normalised Risk Index of 56,9- and 55,8% respectively. South Africa moved down the rankings to be positioned at 67th with a Normalised Risk Index of 39,1%.

"Researchers have discovered that Androxgh0st, now at the top of the malware rankings, is exploiting vulnerabilities across multiple platforms, including IoT devices and web servers, key components of critical infrastructure. By adopting tactics from Mozi, it targets systems using remote code execution and credential-stealing methods to maintain persistent access enabling malicious activities like DDoS attacks and data theft. The botnet infiltrates critical infrastructures through unpatched vulnerabilities, and the integration of Mozi’s capabilities has significantly expanded Androxgh0st’s reach, allowing it to infect more IoT devices and control a broader range of targets. These attacks create cascading effects across industries, highlighting the high stakes for governments, businesses, and individuals reliant on these infrastructures."

Among the top mobile malware threats, Joker remains the most prevalent, followed by Anubis and Necro. Joker continues to steal SMS messages, contacts, and device information while silently subscribing victims to premium services. Meanwhile, Anubis, a banking Trojan, has gained new features, including remote access, keylogging, and ransomware functionality.

Maya Horowitz, VP of Research at Check Point Software, commented on the evolving threat landscape, stating, “The rise of Androxgh0st and the integration of Mozi illustrates how cyber criminals are constantly evolving their tactics. Organisations must adapt quickly and implement robust security measures that can identify and neutralize these advanced threats before they can cause significant damage.”



Chuks Egbune/DoP