{"id":11399,"date":"2020-09-07T07:46:08","date_gmt":"2020-09-07T07:46:08","guid":{"rendered":"https:\/\/nsfocusglobal.com\/?p=11399"},"modified":"2026-04-17T18:07:48","modified_gmt":"2026-04-17T18:07:48","slug":"botnet-trend-report-2019-9","status":"publish","type":"post","link":"https:\/\/nsfocusglobal.com\/pt-br\/botnet-trend-report-2019-9\/","title":{"rendered":"Botnet Trend Report 2019-9"},"content":{"rendered":"\n

Overview<\/strong><\/h2>\n\n\n\n

In 2019, banking Trojans frequently launched attacks via the multilevel free technology, posing a severe threat to enterprises and public sectors. Spam was still the main propagation method. Attackers collected a great number of email addresses against which they launched phishing attacks. In 2019,
NSFOCUS Security Labs captured and tracked such banking Trojans as Emotet, TrickBot, LokiBot, Gozi, and QakBot.<\/p>\n\n\n\n\n\n\n\n

\"Red<\/figure><\/div>\n\n\n\n

Emotet and TrickBot were the most active families, followed by Ursnif and LokiBot.<\/p>\n\n\n\n

Emotet & Trickbot<\/h2>\n\n\n\n

In 2019, Emotet had hit industries such as hospitality, education, finance, transportation, and medical sectors and local governments, posing an adverse impact.<\/p>\n\n\n\n

C&C servers of Emotet were distributed in many countries. The USA was home to the most C&C servers (23%), followed by Argentina (12%), Mexico (8%), and Columbia (6%).<\/p>\n\n\n\n

Emotet contains multiple components to steal email content and browser credentials. It also exploits weak password cracking for lateral movement by detecting shared hosts in LANs or enumerating user names. In the meanwhile, it requires port mapping be enabled on the gateway in order to allow external hosts break into the intranet to connect to zombies, using them as C&C proxies to hide attackers’ real addresses.<\/p>\n\n\n\n

TrickBot mainly targets financial enterprises. TrickBot spreads mainly via spam. It is quite threatening because it exploits shared networks and EternalBlue vulnerabilities for lateral movement.<\/p>\n\n\n\n

Highly modularization allows TrickBot to expand its functions flexibly. TrickBot conveniently installs various payloads, to increase uncertainties in attacks and improves its antagonism.<\/p>\n\n\n\n

Triple Threats<\/h2>\n\n\n\n

Banking Trojans cooperate closely with ransomware increasingly. Attacks launched by multiple families put enterprise intranets at risk.<\/p>\n\n\n\n

Emotet can spread TrickBot, which dispatches other malware, forming a long and complicated kill chain. In 2019, TrickBot began to dispatch Ryuk to launch a tertiary payload attack (Emotet → TrickBot → Ryuk), yielding greater proceeds to attackers.<\/p>\n\n\n\n

Another tertiary payload attack chain in 2019 was Emotet → Nymaim → Nozelesn. By comparing the two tertiary payload attack chains, we found that ransomware is always at the end of the kill chain, indicating that ransomware families resort to banking Trojans to obtain the required data.<\/p>\n\n\n\n

These increasing close cooperation between banking Trojans and ransomware indicates that cybercriminals are cudgeling their brains to milk victims dry.<\/p>\n\n\n\n

To be continued.<\/em><\/p>\n<\/body><\/html>\n","protected":false},"excerpt":{"rendered":"

Overview In 2019, banking Trojans frequently launched attacks via the multilevel free technology, posing a severe threat to enterprises and public sectors. Spam was still the main propagation method. Attackers collected a great number of email addresses against which they launched phishing attacks. In 2019,NSFOCUS Security Labs captured and tracked such banking Trojans as Emotet, […]<\/p>\n","protected":false},"author":1,"featured_media":10927,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"_coblocks_attr":"","_coblocks_dimensions":"","_coblocks_responsive_height":"","_coblocks_accordion_ie_support":"","footnotes":""},"categories":[3,15],"tags":[119],"class_list":["post-11399","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-blog","category-research-reports","tag-botnet-trend-report"],"acf":[],"yoast_head":"\nBotnet Trend Report 2019-9 - NSFOCUS<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/nsfocusglobal.com\/botnet-trend-report-2019-9\/\" \/>\n<meta property=\"og:locale\" content=\"pt_BR\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Botnet Trend Report 2019-9 - NSFOCUS\" \/>\n<meta property=\"og:description\" content=\"Overview In 2019, banking Trojans frequently launched attacks via the multilevel free technology, posing a severe threat to enterprises and public\" \/>\n<meta property=\"og:url\" content=\"https:\/\/nsfocusglobal.com\/botnet-trend-report-2019-9\/\" \/>\n<meta property=\"og:site_name\" content=\"NSFOCUS\" \/>\n<meta property=\"article:published_time\" content=\"2020-09-07T07:46:08+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-04-17T18:07:48+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2020\/07\/0713-1.png\" \/>\n<meta name=\"author\" content=\"NSFOCUS\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:title\" content=\"Botnet Trend Report 2019-9 - NSFOCUS\" \/>\n<meta name=\"twitter:description\" content=\"Overview In 2019, banking Trojans frequently launched attacks via the multilevel free technology, posing a severe threat to enterprises and public\" \/>\n<meta name=\"twitter:image\" content=\"https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2020\/07\/0713-1.png\" \/>\n<meta name=\"twitter:label1\" content=\"Escrito por\" \/>\n\t<meta name=\"twitter:data1\" content=\"NSFOCUS\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. tempo de leitura\" \/>\n\t<meta name=\"twitter:data2\" content=\"2 minutos\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/botnet-trend-report-2019-9\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/botnet-trend-report-2019-9\\\/\"},\"author\":{\"name\":\"NSFOCUS\",\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/#\\\/schema\\\/person\\\/fd9ab61c9c77a81bbd870f725cc0c61d\"},\"headline\":\"Botnet Trend Report 2019-9\",\"datePublished\":\"2020-09-07T07:46:08+00:00\",\"dateModified\":\"2026-04-17T18:07:48+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/botnet-trend-report-2019-9\\\/\"},\"wordCount\":377,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/botnet-trend-report-2019-9\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/nsfocusglobal.com\\\/wp-content\\\/uploads\\\/2020\\\/07\\\/0713-1.png\",\"keywords\":[\"Botnet Trend Report\"],\"articleSection\":[\"Blog\",\"Research & Reports\"],\"inLanguage\":\"pt-BR\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/nsfocusglobal.com\\\/botnet-trend-report-2019-9\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/botnet-trend-report-2019-9\\\/\",\"url\":\"https:\\\/\\\/nsfocusglobal.com\\\/botnet-trend-report-2019-9\\\/\",\"name\":\"Botnet Trend Report 2019-9 - NSFOCUS\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/botnet-trend-report-2019-9\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/botnet-trend-report-2019-9\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/nsfocusglobal.com\\\/wp-content\\\/uploads\\\/2020\\\/07\\\/0713-1.png\",\"datePublished\":\"2020-09-07T07:46:08+00:00\",\"dateModified\":\"2026-04-17T18:07:48+00:00\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/botnet-trend-report-2019-9\\\/#breadcrumb\"},\"inLanguage\":\"pt-BR\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/nsfocusglobal.com\\\/botnet-trend-report-2019-9\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"pt-BR\",\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/botnet-trend-report-2019-9\\\/#primaryimage\",\"url\":\"https:\\\/\\\/nsfocusglobal.com\\\/wp-content\\\/uploads\\\/2020\\\/07\\\/0713-1.png\",\"contentUrl\":\"https:\\\/\\\/nsfocusglobal.com\\\/wp-content\\\/uploads\\\/2020\\\/07\\\/0713-1.png\",\"width\":570,\"height\":481,\"caption\":\"botnet 1\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/botnet-trend-report-2019-9\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/nsfocusglobal.com\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Botnet Trend Report 2019-9\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/#website\",\"url\":\"https:\\\/\\\/nsfocusglobal.com\\\/\",\"name\":\"NSFOCUS\",\"description\":\"Security Made Smart and Simple\",\"publisher\":{\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/nsfocusglobal.com\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"pt-BR\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/#organization\",\"name\":\"NSFOCUS\",\"url\":\"https:\\\/\\\/nsfocusglobal.com\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"pt-BR\",\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/nsfocusglobal.com\\\/wp-content\\\/uploads\\\/2024\\\/08\\\/logo-ns.png\",\"contentUrl\":\"https:\\\/\\\/nsfocusglobal.com\\\/wp-content\\\/uploads\\\/2024\\\/08\\\/logo-ns.png\",\"width\":248,\"height\":36,\"caption\":\"NSFOCUS\"},\"image\":{\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/#\\\/schema\\\/logo\\\/image\\\/\"}},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/#\\\/schema\\\/person\\\/fd9ab61c9c77a81bbd870f725cc0c61d\",\"name\":\"NSFOCUS\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"pt-BR\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/d3dc987908fc59791d261b1006d84eb931d15287261476b9384e690ed0c568de?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/d3dc987908fc59791d261b1006d84eb931d15287261476b9384e690ed0c568de?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/d3dc987908fc59791d261b1006d84eb931d15287261476b9384e690ed0c568de?s=96&d=mm&r=g\",\"caption\":\"NSFOCUS\"},\"sameAs\":[\"https:\\\/\\\/nsfocusglobal.com\"],\"url\":\"https:\\\/\\\/nsfocusglobal.com\\\/pt-br\\\/author\\\/admin\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Botnet Trend Report 2019-9 - NSFOCUS","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/nsfocusglobal.com\/botnet-trend-report-2019-9\/","og_locale":"pt_BR","og_type":"article","og_title":"Botnet Trend Report 2019-9 - NSFOCUS","og_description":"Overview In 2019, banking Trojans frequently launched attacks via the multilevel free technology, posing a severe threat to enterprises and public","og_url":"https:\/\/nsfocusglobal.com\/botnet-trend-report-2019-9\/","og_site_name":"NSFOCUS","article_published_time":"2020-09-07T07:46:08+00:00","article_modified_time":"2026-04-17T18:07:48+00:00","og_image":[{"url":"https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2020\/07\/0713-1.png","type":"","width":"","height":""}],"author":"NSFOCUS","twitter_card":"summary_large_image","twitter_title":"Botnet Trend Report 2019-9 - NSFOCUS","twitter_description":"Overview In 2019, banking Trojans frequently launched attacks via the multilevel free technology, posing a severe threat to enterprises and public","twitter_image":"https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2020\/07\/0713-1.png","twitter_misc":{"Escrito por":"NSFOCUS","Est. tempo de leitura":"2 minutos"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/nsfocusglobal.com\/botnet-trend-report-2019-9\/#article","isPartOf":{"@id":"https:\/\/nsfocusglobal.com\/botnet-trend-report-2019-9\/"},"author":{"name":"NSFOCUS","@id":"https:\/\/nsfocusglobal.com\/#\/schema\/person\/fd9ab61c9c77a81bbd870f725cc0c61d"},"headline":"Botnet Trend Report 2019-9","datePublished":"2020-09-07T07:46:08+00:00","dateModified":"2026-04-17T18:07:48+00:00","mainEntityOfPage":{"@id":"https:\/\/nsfocusglobal.com\/botnet-trend-report-2019-9\/"},"wordCount":377,"commentCount":0,"publisher":{"@id":"https:\/\/nsfocusglobal.com\/#organization"},"image":{"@id":"https:\/\/nsfocusglobal.com\/botnet-trend-report-2019-9\/#primaryimage"},"thumbnailUrl":"https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2020\/07\/0713-1.png","keywords":["Botnet Trend Report"],"articleSection":["Blog","Research & Reports"],"inLanguage":"pt-BR","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/nsfocusglobal.com\/botnet-trend-report-2019-9\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/nsfocusglobal.com\/botnet-trend-report-2019-9\/","url":"https:\/\/nsfocusglobal.com\/botnet-trend-report-2019-9\/","name":"Botnet Trend Report 2019-9 - NSFOCUS","isPartOf":{"@id":"https:\/\/nsfocusglobal.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/nsfocusglobal.com\/botnet-trend-report-2019-9\/#primaryimage"},"image":{"@id":"https:\/\/nsfocusglobal.com\/botnet-trend-report-2019-9\/#primaryimage"},"thumbnailUrl":"https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2020\/07\/0713-1.png","datePublished":"2020-09-07T07:46:08+00:00","dateModified":"2026-04-17T18:07:48+00:00","breadcrumb":{"@id":"https:\/\/nsfocusglobal.com\/botnet-trend-report-2019-9\/#breadcrumb"},"inLanguage":"pt-BR","potentialAction":[{"@type":"ReadAction","target":["https:\/\/nsfocusglobal.com\/botnet-trend-report-2019-9\/"]}]},{"@type":"ImageObject","inLanguage":"pt-BR","@id":"https:\/\/nsfocusglobal.com\/botnet-trend-report-2019-9\/#primaryimage","url":"https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2020\/07\/0713-1.png","contentUrl":"https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2020\/07\/0713-1.png","width":570,"height":481,"caption":"botnet 1"},{"@type":"BreadcrumbList","@id":"https:\/\/nsfocusglobal.com\/botnet-trend-report-2019-9\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/nsfocusglobal.com\/"},{"@type":"ListItem","position":2,"name":"Botnet Trend Report 2019-9"}]},{"@type":"WebSite","@id":"https:\/\/nsfocusglobal.com\/#website","url":"https:\/\/nsfocusglobal.com\/","name":"NSFOCUS","description":"Security Made Smart and Simple","publisher":{"@id":"https:\/\/nsfocusglobal.com\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/nsfocusglobal.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"pt-BR"},{"@type":"Organization","@id":"https:\/\/nsfocusglobal.com\/#organization","name":"NSFOCUS","url":"https:\/\/nsfocusglobal.com\/","logo":{"@type":"ImageObject","inLanguage":"pt-BR","@id":"https:\/\/nsfocusglobal.com\/#\/schema\/logo\/image\/","url":"https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2024\/08\/logo-ns.png","contentUrl":"https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2024\/08\/logo-ns.png","width":248,"height":36,"caption":"NSFOCUS"},"image":{"@id":"https:\/\/nsfocusglobal.com\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/nsfocusglobal.com\/#\/schema\/person\/fd9ab61c9c77a81bbd870f725cc0c61d","name":"NSFOCUS","image":{"@type":"ImageObject","inLanguage":"pt-BR","@id":"https:\/\/secure.gravatar.com\/avatar\/d3dc987908fc59791d261b1006d84eb931d15287261476b9384e690ed0c568de?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/d3dc987908fc59791d261b1006d84eb931d15287261476b9384e690ed0c568de?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/d3dc987908fc59791d261b1006d84eb931d15287261476b9384e690ed0c568de?s=96&d=mm&r=g","caption":"NSFOCUS"},"sameAs":["https:\/\/nsfocusglobal.com"],"url":"https:\/\/nsfocusglobal.com\/pt-br\/author\/admin\/"}]}},"_links":{"self":[{"href":"https:\/\/nsfocusglobal.com\/pt-br\/wp-json\/wp\/v2\/posts\/11399","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/nsfocusglobal.com\/pt-br\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/nsfocusglobal.com\/pt-br\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/nsfocusglobal.com\/pt-br\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/nsfocusglobal.com\/pt-br\/wp-json\/wp\/v2\/comments?post=11399"}],"version-history":[{"count":1,"href":"https:\/\/nsfocusglobal.com\/pt-br\/wp-json\/wp\/v2\/posts\/11399\/revisions"}],"predecessor-version":[{"id":32734,"href":"https:\/\/nsfocusglobal.com\/pt-br\/wp-json\/wp\/v2\/posts\/11399\/revisions\/32734"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/nsfocusglobal.com\/pt-br\/wp-json\/wp\/v2\/media\/10927"}],"wp:attachment":[{"href":"https:\/\/nsfocusglobal.com\/pt-br\/wp-json\/wp\/v2\/media?parent=11399"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/nsfocusglobal.com\/pt-br\/wp-json\/wp\/v2\/categories?post=11399"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/nsfocusglobal.com\/pt-br\/wp-json\/wp\/v2\/tags?post=11399"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}