It’s that time of year again. The leaves have changed, ghouls and goblins are about to take to the streets demanding tricks or treats, and Webroot is shining the light on the nastiest malware threats lurking online in 2019. It’s not names like Jason or Freddy that should curdle your blood this October, but TrickBot, Crysis, and the dreaded “Man in the Mirror.”

From zombie botnets to insidious email infiltrators, here are 2019’s top malware threats to watch out for.

Be sure to catch our LIVE Q&A on November 13th at 1:00PM MT

VOTE on the Nastiest Malware

Read my interview with a psychologist and professor about why we click

Botnets

Botnets have continued dominate the infection attack chain in 2019. No other type of malware was responsible for delivering more ransomware and cryptomining payloads. Here are the top offenders:

Emotet , the most prevalent malware of 2018, held onto that notorious distinction into 2019. While it was briefly shut down in June, Emotet returned from the dead in September of this year. It remains the largest botnet to date, delivering various malicious payloads.

, the most prevalent malware of 2018, held onto that notorious distinction into 2019. While it was briefly shut down in June, Emotet returned from the dead in September of this year. It remains the largest botnet to date, delivering various malicious payloads. Trickbot has been partnering with banking Trojan groups like IcedID and Ursif in 2019. Its modular infrastructure makes it a serious threat for any network it infects and, when combined with Ryuk ransomware, it's one of the more devasting targeted attacks of 2019.

has been partnering with banking Trojan groups like IcedID and Ursif in 2019. Its modular infrastructure makes it a serious threat for any network it infects and, when combined with Ryuk ransomware, it's one of the more devasting targeted attacks of 2019. Dridex was once one of the most prominent banking trojans. Now it acts as an implant in the infection chain with the Bitpaymer ransomware and is achieving alarming success.

Ransomware

Ransomware remains a threat, adopting a more targeted model last year. Small and medium-sized businesses (SMBs) are easy prey and make up most of its victims. Whether gaining access through targeted phishing attacks or by brute forcing unsecured remote desk protocol (RDP), Ransomware is as effective as ever and isn't going anywhere.

Emotet, Trickbot, and Ryuk , with one leading to the next, make up the most frightening ransomware triple threat. In terms of financial damage, this is probably the most successful chain of 2019. With more targeted, reconnaissance-based operations, they now assign a value to targeted networks post-infection will extort them accordingly after deploying ransomware. Through the first half of 2019, Trickbot was often delivered as secondary payload after Emotet . Ryuk infections, typically delivered by Trickbot , then resulted in mass encryption of entire networks. Dridex is now being used as an implant in the Bitpaymer ransomware infection chain. We have observed it also delivered as a second=stage payload following Emotet .

, with one leading to the next, make up the most frightening ransomware triple threat. In terms of financial damage, this is probably the most successful chain of 2019. With more targeted, reconnaissance-based operations, they now assign a value to targeted networks post-infection will extort them accordingly after deploying ransomware. GandCrab is one of the most successful examples of ransomware-as-a-service (RaaS) to date, with profits in excess of $2 billion. We believe they are closely tied to the Sondinokibi/REvil ransomware variant.

is one of the most successful examples of ransomware-as-a-service (RaaS) to date, with profits in excess of $2 billion. We believe they are closely tied to the Sondinokibi/REvil ransomware variant. Sodinokibi/ REvil arose after the retirement of GandCrab. Many of their affiliates seem to be having decent success targeting MSPs.

arose after the retirement of GandCrab. Many of their affiliates seem to be having decent success targeting MSPs. Crysis (aka Dharma) makes its second consecutive appearance on our Nastiest Malware list. This ransomware was actively distributed in the first half of 2019, with almost all infections we observed distributed through RDP compromise.

Cryptomining & Cryptojacking

The explosive growth cryptojacking sites experienced from 2017-2018 is gone. The campaigns running today are shells of their former selves. With around 5% month-over-month decline since Bitcoin peaked in early 2018, the threat has since atrophied. But we don't anticipate cryptomining will die entirely. It's still low-risk, guaranteed money that’s less "malicious” than ransomware. For instance, though Coinhive shutdown in March, Cryptoloot and CoinImp still saw growth from April through June. Cryptomining payloads also declined this year, thought they fared better than cryptojacking campaigns. Almost all cryptomining campaigns use XMRrig, which is an opensource miner that mines Monero with great flexibility.

Hidden Bee is an interesting exploit delivering cryptomining payloads. First seen last year with Internet Explorer exploits, it has now evolved into payloads inside JPEG and PNG images through steganography and WAV media formats flash exploits.

is an interesting exploit delivering cryptomining payloads. First seen last year with Internet Explorer exploits, it has now evolved into payloads inside JPEG and PNG images through steganography and WAV media formats flash exploits. Retadup was a cryptomining worm with over 850,000 infections. It was removed in August by Cybercrime Fighting Center (C3N) of the French National Gendarmerie when they took control over the malware’s command and control server.

Your Inbox

We saw email-based malware campaigns grow in their complexity and believability dramatically this year. Phishing became increasingly more personalized and extortion emails have begun claiming to have captured lude behavior using compromised passwords.