IT threat evolution in Q3 2023. Mobile statistics

• IT threat evolution in Q3 2023
• IT threat evolution in Q3 2023. Non-mobile statistics
• IT threat evolution in Q3 2023. Mobile statistics

These statistics are based on detection verdicts of Kaspersky products received from users who consented to providing statistical data.

Quarterly figures

According to Kaspersky Security Network, in Q3 2023:

• A total of 8,346,169 mobile malware, adware, and riskware attacks were blocked.
• The most common threat to mobile devices was adware, accounting for 52% of all detected threats.
• 438,962 malicious installation packages were detected, of which:
  • 21,674 packages were related to mobile banking Trojans;
  • 1,855 packages were mobile ransomware Trojans.

Quarterly highlights

The number of malware, adware and unwanted software attacks on mobile devices continued to climb in Q3. In total, Kaspersky products blocked more than 8.3 million attacks.

Number of attacks targeting users of Kaspersky mobile solutions, Q1 2022 — Q3 2023 (download)

This quarter, we discovered on Google Play a malicious app that we assigned the verdict Trojan-Downloader.AndroidOS.Banker.aj.

Disguised as a PDF viewer, the app in fact downloaded the Trojan-Banker.AndroidOS.Coper.a banking Trojan to the victim’s device.

Our other find on Google Play was a spyware Telegram mod capable of stealing user messages.

Also in Q3, cybercriminals made active use of a modified remote access client disguised as a bank technical support app to siphon off money. During the reporting period, more than 3,000 attacks using such apps were blocked.

One other discovery this quarter was the spyware Trojan-Spy.AndroidOS.Agent.afd. The malware caught our eye for its non-standard development approach: almost all Android malware is written in Java, sometimes in C/C++, but the coders of this malware opted for .NET Framework. This cross-platform framework is used widely to create Windows software, but rarely to write malware for Android.

Mobile threat statistics

The number of new malware samples continues to grow, attaining the level of Q3 of last year.

Number of detected malicious installation packages, Q3 2022 — Q3 2023 (download)

Distribution of detected mobile malware by type*

Distribution of newly detected mobile malware by type, Q2 2023 and Q3 2023 (download)

* Data for the previous quarter may differ slightly from previously published data due to some verdicts being retrospectively revised.

Adware and potentially unwanted software (riskware) traditionally top the rankings. Among adware families, first place again went to MobiDash, which increased its relative share to 55%; next come the generalized verdicts Dnotua (10.8%) and HiddenAd (4.3%).

Share of users who encountered a certain type of threat out of all attacked mobile users in Q2 2023 and Q3 2023 (download)

RiskTool threats (6.83%) dropped one place in the ranking by share of attacked users, ceding ground to Trojans (24.66%), while top spot was retained by adware (63.66%). Among Trojans, the previously described GriftHorse and Fakemoney remained highly active, but in first position this quarter was the adware Trojan Triada (23.5%) in WhatsApp mods.

TOP 20 most frequently detected mobile malware programs

Note that the malware rankings below exclude riskware and potentially unwanted software, such as RiskTool or adware.

* Unique users who encountered this malware as a percentage of all attacked users of Kaspersky mobile solutions.

The generalized cloud verdict DangerousObject.Multi.Generic (14.98%) held on to first position in Q3. In second place was a malicious WhatsApp mod with the verdict Trojan.AndroidOS.Triada.et (12.16%), followed by GriftHorse and Fakemoney, which have been regular fixtures in the TOP 20 for several quarters in a row. Ranking behind the collective verdict for machine-learning technologies Trojan.AndroidOS.Boogr.gsh (7.05%) was Trojan-Dropper.AndroidOS.Badpack.g (4.67%), a packer commonly used to deliver banking malware.

Region-specific malware

This section describes mobile malware that mostly targets the residents of certain countries.

* Country where the malware was most active.
* Unique users who encountered the malware in the indicated country as a percentage of all Kaspersky mobile security solution users attacked by the same malware.

When it comes to attacks concentrated in a specific country, the leader in Q3 was Turkey. Among the threats faced by residents there, banking Trojans predominated. These included Trojan-Banker.AndroidOS.GodFather, which gives intruders remote access to devices, and Trojan-Banker.AndroidOS.Agent.la, which steals text messages. The Trojan-Dropper.AndroidOS.Agent.sm and Trojan-Dropper.AndroidOS.Hqwar.hc packers are also used to deliver banking malware to the victim.

The Brats banking Trojan continues to target users in Brazil, while various SMS-based spyware mods have been seeking new victims in Indonesia. Also of interest was the relative concentration of Trojan.AndroidOS.Thamera.u malware attacks in India. This Trojan is used to turn the target device into a proxy for creating accounts on social networks.

Mobile banking Trojans

In Q3 2023, the number of new banking Trojan installation packages dropped sharply to 21,000.

Number of installation packages for mobile banking Trojans detected by Kaspersky, Q3 2022 — Q3 2023 (download)

Ten most common mobile bankers

* Unique users who encountered this malware as a percentage of all Kaspersky mobile security solution users who encountered banking threats.

Despite the fall in the number of unique installation packages, the total number of Trojan-Banker malware attacks even rose slightly. In other words, one and the same files are increasingly being reused to carry out attacks on different users.

Mobile ransomware Trojans

Q3 saw a slight change in the number of new ransomware installation packages compared to the previous quarter.

Number of installation packages for mobile ransomware Trojans detected by Kaspersky, Q3 2022 — Q3 2023 (download)

TOP 10 most common mobile ransomware

* Unique users who encountered this malware as a percentage of all Kaspersky mobile security solution users attacked by ransomware Trojans.

The Rasket.a Trojan (32.44%) leaped into first place by number of attacks among other malware of the same type. As usual, the remaining positions in the ranking are occupied by various modifications of Pigetrl, Rkor, Congur and Small.