A list of the top 10 most exploited vulnerabilities in 2018 has revealed that Microsoft Office was the favorite victim of cybercriminals. Microsoft Office vulnerabilities appear 8 times in the list with one Adobe Flash Player vulnerability and an AndroidRAT cyber vulnerability being the only mobile device flaw in the list.
The list has been compiled by Recorded Future after analyzing a large of sources including deep web forum postings, code repositories, and dark web sites. Cyber attacks conducted through exploit kits, phishing and remote access trojan (RAT) have been included in the list, and the company behind the compilation has not included nation state-related exploits in the analysis.
The study indicated that cybercriminals are gradually shifting from using web exploit kits for targetting software to phishing campaigns in 2018. The reason behind that shift is because browser developers are enforcing regular updates and deploying mechanisms for ensuring the safety of users. There are only three browser related flaws in the list, and all three vulnerabilities exist in the older versions of Internet Explorer.
Most Exploited Vulnerabilities
Recorded Future also highlighted top exploited vulnerabilities and surprisingly for the first time, a vulnerability going by CVE-2016-0189 has appeared in the list of top 10 vulnerability for three years in a row. This flaw affects Internet Explorer 9 through 11, and it’s the versatility of this flaw that allows hackers to incorporate it into different exploit kits.
The top exploited vulnerability is CVE-2018-8174 is dubbed “Double Kill” and targets Microsoft Internet Explorer. It was deployed in four exploit kits — RIG, Fallout, KaiXin, and Magnitude. Double Kill spreads Trickbot named malware through phishing attacks.
CVE-2018-4878 grabbed the second spot in the list of top most exploited vulnerabilities. It was also incorporated in multiple exploit kits. Fallout became the exploit kit in which this vulnerability was deployed to spread the infamous GrandCrab ransomware. Interestingly, Fallout was available in the black market for $300 a week and $1,100 a month.
Why do you think Microsoft Office is the favorite target of cyber attackers? Tell us in the comments.
Also Read: 12 Most Common Subjects In Phishing Emails Used For Fooling Users
