--- title: Malware Digests --- [![Spamhaus Tech](https://info.spamhaus.com/hubfs/raw_assets/public/Spamhaus_May2020/images/logo.svg "Spamhaus Tech")](https://www.spamhaus.com/) # MALWARE DIGEST REPORTS Find malware trends from Spamhaus Project, giving you insight into observed malware campaigns. ![Malware Report Jan 24](https://info.spamhaus.com/hubfs/Malware%20Report%20Jan%2024.png "Malware Report Jan 24") # THE MALWARE DIGEST [![Read January report here](https://no-cache.hubspot.com/cta/default/5652833/96704316-96da-4a75-b429-d0a9ce471402.png)](https://cta-redirect.hubspot.com/cta/redirect/5652833/96704316-96da-4a75-b429-d0a9ce471402) January saw a 173% increase in new malware sites hosted in India, with a welcome 41% decrease in the US. Mirai is back as the most common malware with 851 samples shared, and there are now 19,292 YARA rules available for hunting on YARAify! Read the full report. ## ALL MALWARE DIGESTS ![January](https://info.spamhaus.com/hs-fs/hubfs/January.png?width=690&name=January.png "January") ### Published 7 Feb 2024 January saw a 173% increase in new malware sites hosted in India, with a welcome 41% decrease in the US. Mirai is the most common malware with 851 samples shared, and there are now 19,292 YARA rules available for hunting on YARAify!  [![Download](https://no-cache.hubspot.com/cta/default/5652833/241de136-0983-4803-a132-7a403192bae9.png)](https://cta-redirect.hubspot.com/cta/redirect/5652833/241de136-0983-4803-a132-7a403192bae9) ![December 2023](https://info.spamhaus.com/hs-fs/hubfs/December%202023.png?width=690&name=December%202023.png "December 2023") ### Published 9 Jan 2024 URLHaus experienced a surge in new malware sites hosted across the APAC region, including China (360%), Singapore (265%) and Taiwan (103%). Whilst new entrant Sock5Systemz is #1 for samples shared - find out more in December's malware report.  [![Download](https://no-cache.hubspot.com/cta/default/5652833/c9304774-fc58-4ef0-a9a4-093946f35311.png)](https://cta-redirect.hubspot.com/cta/redirect/5652833/c9304774-fc58-4ef0-a9a4-093946f35311) ![November 2023](https://info.spamhaus.com/hs-fs/hubfs/Frame%2057.png?width=690&name=Frame%2057.png "November 2023") ### Published 5 Dec 2023 This month saw an increase in active malware distribution sites across Central Europe. New October entrant ShadowPad dominated the ThreatFox Top 15s with a +459.82% increase. Meanwhile, YARAify scanned over 8 million distinct files!  [![Download](https://no-cache.hubspot.com/cta/default/5652833/1966fc0f-fb4f-4524-89c2-72b9e9789c60.png)](https://cta-redirect.hubspot.com/cta/redirect/5652833/1966fc0f-fb4f-4524-89c2-72b9e9789c60) ![October 2023](https://info.spamhaus.com/hs-fs/hubfs/Frame%2054.png?width=345&name=Frame%2054.png "October 2023") ### Published 3 Nov 2023 October saw increases across 12 geolocations hosting new malware sites, most significantly India (181.82%) but the US is back at number one. Meanwhile, Cobalt Strike was associated with the largest number of IOCs. Read the full report here. [![Download](https://no-cache.hubspot.com/cta/default/5652833/0a905e17-54d7-490c-b17b-518666c4a4cb.png)](https://cta-redirect.hubspot.com/cta/redirect/5652833/0a905e17-54d7-490c-b17b-518666c4a4cb) ![September](https://info.spamhaus.com/hs-fs/hubfs/September.png?width=690&name=September.png "September") ### Published 6 Oct 2023 We saw the rise of the RATS this month, with NJRAT (+2129.56%) and RemcosRAT (+1392.49%) experiencing staggering increases, as well as new entrants AsyncRAT, QuasarRAT and BitRAT - find out more in September's malware report. [![Download](https://no-cache.hubspot.com/cta/default/5652833/121cfd45-02e3-4ebb-9445-1914e7f5bdfd.png)](https://cta-redirect.hubspot.com/cta/redirect/5652833/121cfd45-02e3-4ebb-9445-1914e7f5bdfd) ![August 2023](https://info.spamhaus.com/hs-fs/hubfs/Malware%20Reports/August%202023.png?width=690&name=August%202023.png "August 2023") ### Published 6 Sept 2023 August saw an increase in new malware sites hosted in The Netherlands (284%) and Singapore (220%). Whilst, Mirai appear is making a come back - with an increase in distribution sites and malware samples shared. [![Download](https://no-cache.hubspot.com/cta/default/5652833/7ad43660-8605-4463-b952-09e28762d1fb.png)](https://cta-redirect.hubspot.com/cta/redirect/5652833/7ad43660-8605-4463-b952-09e28762d1fb) ![July](https://info.spamhaus.com/hs-fs/hubfs/July.png?width=690&name=July.png "July") ### Published 4 Aug 2023 This month saw a spike in new malware sites hosted in Bulgaria (almost 400%) and a welcomed 55% decrease (finally!) in the US. With new entrant DBatLoader contributing 22% of all IOCs shared via ThreatFox. Read the full report. [![Download](https://no-cache.hubspot.com/cta/default/5652833/a46b57a6-a8d3-40d3-95a0-691d7281ff9c.png)](https://cta-redirect.hubspot.com/cta/redirect/5652833/a46b57a6-a8d3-40d3-95a0-691d7281ff9c) ![June](https://info.spamhaus.com/hs-fs/hubfs/June.png?width=690&name=June.png "June") ### Published 6 Jul 2023 Another busy month for Qakbot - 61.4% of ALL malware sites shared on URLhaus and 4,150 IOCs shared on ThreatFox. Malware sites hosted in India is on the rise, with Indian network BSNL climbing to #1 host of malware distribution sites.  [![Download](https://no-cache.hubspot.com/cta/default/5652833/994d5763-0f31-425d-858f-60e516f88be9.png)](https://cta-redirect.hubspot.com/cta/redirect/5652833/994d5763-0f31-425d-858f-60e516f88be9) ![Frame 51](https://info.spamhaus.com/hs-fs/hubfs/Frame%2051.png?width=690&name=Frame%2051.png "Frame 51") ### Published 6 Apr 2023 Together, Emotet and Qakbot were responsible for 38% of ALL malware sites shared on URLhaus, Mirai had the biggest growth across the board, and there are officially over 1 million IOCs shared on ThreatFox. Find the report here: [![Download](https://no-cache.hubspot.com/cta/default/5652833/222b9642-1dff-4ee6-89ce-431523e0a867.png)](https://cta-redirect.hubspot.com/cta/redirect/5652833/222b9642-1dff-4ee6-89ce-431523e0a867) ![Frame 37-1](https://info.spamhaus.com/hs-fs/hubfs/Frame%2037-1.png?width=690&name=Frame%2037-1.png "Frame 37-1") ### Published 3 Mar 2023 The U.S. experienced a 447% increase in the number of malware distribution sites it was hosting. Meanwhile, a familiar name returned with vengeance; Qakbot, which was associated with the largest number of IOCs.  [![Download](https://no-cache.hubspot.com/cta/default/5652833/bd78ff4c-97a6-4053-b588-592900397062.png)](https://cta-redirect.hubspot.com/cta/redirect/5652833/bd78ff4c-97a6-4053-b588-592900397062) ![Frame 34](https://info.spamhaus.com/hubfs/Frame%2034.png "Frame 34") ### Published 3 Feb 2023 January saw an increase in new malware sites hosted in Russia (almost 200%!) and decrease in the US by 95%. We also saw a big increase in compromised hosts spreading Mirai. [![Download](https://no-cache.hubspot.com/cta/default/5652833/7a364cdc-ba80-47c9-8a71-f1c3d7cd20c7.png)](https://cta-redirect.hubspot.com/cta/redirect/5652833/7a364cdc-ba80-47c9-8a71-f1c3d7cd20c7) ![Dec 2022](https://info.spamhaus.com/hubfs/Dec%202022.png "Dec 2022") ### Published 5 Jan 2023 It was a busy month for Qakbot - ThreatFox saw 30,611 IOCs related to this malware threat. On the flip side,  we are happy to celebrate 1k active hunting rules on MalwareBazaar! [![Download](https://no-cache.hubspot.com/cta/default/5652833/7e16acdb-717a-439f-ae6f-e455db4b9efa.png)](https://cta-redirect.hubspot.com/cta/redirect/5652833/7e16acdb-717a-439f-ae6f-e455db4b9efa) ![Frame 26](https://info.spamhaus.com/hubfs/Frame%2026.png "Frame 26") ### Published 8 Dec 2022 Emotet is well and truly back! abuse.ch saw a 68% increase in Indicators of Compromise relating to this malware family - find more in November’s malware report. [![Download](https://no-cache.hubspot.com/cta/default/5652833/1da2744d-8939-42ed-bd5b-93d68dc2a024.png)](https://cta-redirect.hubspot.com/cta/redirect/5652833/1da2744d-8939-42ed-bd5b-93d68dc2a024) ![Frame 23-1](https://info.spamhaus.com/hubfs/Frame%2023-1.png "Frame 23-1") ### Published 4 November 2022 Using data from abuse.ch's platforms, the report gives an overview of malware campaigns, with insights into malware distribution sites, samples, IOCs & YARA rules. [![Download](https://no-cache.hubspot.com/cta/default/5652833/d3927010-f777-4d25-83eb-d2ce9444b57b.png)](https://cta-redirect.hubspot.com/cta/redirect/5652833/d3927010-f777-4d25-83eb-d2ce9444b57b) ![Frame 24](https://info.spamhaus.com/hubfs/Frame%2024.png "Frame 24") ### Published 6 October 2022 Using data from abuse.ch's platforms, the report gives an overview of malware campaigns, with insights into malware distribution sites, samples, IOCs & YARA rules. [![Download](https://no-cache.hubspot.com/cta/default/5652833/315747c2-5294-4d04-9440-cb08a69343c3.png)](https://cta-redirect.hubspot.com/cta/redirect/5652833/315747c2-5294-4d04-9440-cb08a69343c3) ![Frame 25](https://info.spamhaus.com/hubfs/Frame%2025.png "Frame 25") ### Published 7 September 2022 Using data from abuse.ch's platforms, the report gives an overview of malware campaigns, with insights into malware distribution sites, samples, IOCs & YARA rules. [![Download](https://no-cache.hubspot.com/cta/default/5652833/ce1f04c9-91d7-4126-9cc0-3b9f3c796bfc.png)](https://cta-redirect.hubspot.com/cta/redirect/5652833/ce1f04c9-91d7-4126-9cc0-3b9f3c796bfc) [Back to reports menu](https://info.spamhaus.com/reports) - [Privacy policy](https://www.spamhaus.com/privacy-policy/) - [Cookie Policy](https://www.spamhaus.com/cookie-policy/) - [Terms and Conditions](https://www.spamhaus.com/terms-and-conditions/)