Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Regional Malware Trends in Latin America: July - December 2016

Summary: Unit 42 observed nearly 530,000 unique sessions of unknown malware across more than 37,000 unique samples in Latin America from July 1 through December 31, 2016, with 89% delivered via email phishing and the large majority being the Locky ransomware variant. Mexico accounted for 54% of the region's malicious activity, Brazil 31%, and in Argentina Locky and the Bayrob Trojan together made up 98% of observed activity.

Why it matters: The Lazarus Group modified the websites of Mexico's Comisión Nacional Bancaria y de Valores and Uruguay's Banco de la República Oriental del Uruguay into watering holes running a custom exploit kit, and the exploit code carried an allowlist of targeted subnets in Mexico, Chile, Brazil, Peru, and Colombia - meaning the attack was built to fire only on victims inside those countries.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related