Ankura CTIX FLASH Update - December 31, 2024

Malware Activity

Androxgh0st Botnet Becomes the Most Prevalent Malware

The Register reports that Androxgh0st, a new hybrid botnet, has taken the lead as the most prevalent malware globally, impacting around 5% of organizations worldwide in the month of November. Researchers suspect with low confidence that the botnet is operated by Chinese threat actors based on its targeting of a hospital in Hong Kong last year and its focus on compromising technology primarily used in China. Androxgh0st is a hybrid botnet in that it targets both web servers and IoT devices, commonly exploiting known vulnerabilities to compromise devices recruited into the botnet for follow-on attacks including denial of service, surveillance, and data theft. The botnet's prevalence had increased following the exit of a well-known botnet named "Mozi" last year. Researchers believe that Androxgh0st will likely ramp up its infections by two-fold in 2025. Androxgh0st targets vulnerabilities in