Cyber threats continued to evolve rapidly throughout 2022, with businesses across industries facing a range of aggressive malware strains. From trojans that quietly harvest data to ransomware that can paralyze entire networks, the year delivered some of the most dangerous and damaging malware seen to date.
So, what were the worst offenders? Here’s a closer look—starting with one of the most pervasive threats of the year: Emotet.
No. 1: Emotet Malware
Emotet first emerged in 2014 and then topped the list as one of the nastiest malware strains of 2022. But what is Emotet malware, exactly?
Emotet is a sophisticated banking trojan that spreads primarily through malicious spam emails (malspam). These emails often appear to be legitimate, using familiar branding or subject lines like “Your Invoice” or “Payment Details.” This malware goes through your contact list and sends itself to family, friends, colleagues, or clients. In some cases, they mimic parcel delivery notifications to entice users into clicking a malicious link or downloading an infected attachment.
Once installed, Emotet hijacks the victim’s email account to spread itself to their contact list—making subsequent messages look more trustworthy and difficult to identify as threats.
How Emotet Works:
- Initial Access: Macro-enabled Microsoft Office documents
- Distribution Method: Spam emails using social engineering tactics
- Payload: Self-propagating trojan that steals information and facilitates other malware downloads
Since 2022, Emotet has been taken down repeatedly by law enforcement, but it has consistently bounced back, still distributing malware families like TrickBot, Ryuk, Qakbot, etc. Thus, it remains a persistent threat rather than a permanently eradicated one.
No. 2: LockBit
In the second position is LockBit—one of the most dominant ransomware strains seen in 2022. Once inside a system, LockBit encrypts files and demands a ransom in exchange for a decryption key. Even if the ransom is paid, there’s no guarantee the attackers will provide the key—or that your data won’t be exposed.
What makes LockBit so dangerous is its ability to remain undetected in a network for weeks, allowing it to spread across multiple devices before launching the attack.
Initial Access Technique:
- Typically via compromised Remote Desktop Protocol (RDP) accounts or vulnerable servers purchased from affiliates.
No. 3: Conti
Next up is Conti, another ransomware threat that stood out in 2022 for its speed and aggression. It can quickly encrypt files across systems and networks, minimizing your ability to respond in time.
But what really set Conti apart is its double-extortion tactic: not only does it encrypt files and demand a ransom, but it also steals copies of sensitive data. If victims refuse to pay, the attackers may publish or sell the stolen data.
Initial Access Technique:
- Social engineering to steal credentials
- Exploiting vulnerable firewalls or RDP servers
No. 4: Qbot – A Banking Trojan on the Rise
Qbot (also known as QakBot or Pinkslipbot) is a versatile trojan that’s been around for years but surged in use during 2022. Its primary goal is to steal banking credentials and passwords, often through infected email attachments or password-protected archives.
Qbot is particularly dangerous because it is often dropped by other malware, including Emotet, creating a cascading malware infection.
Initial Access Technique:
- Phishing emails with malicious attachments
- Often deployed by trojans like Emotet
Cybersecurity Best Practices to Stay Protected
While these threats are serious, the good news is that your organization can significantly reduce risk with the right precautions. Here are key cybersecurity best practices:
- Keep your entire network and all devices updated with consistent monitoring year round
- Avoid clicking suspicious links or attachments unless you’re certain they’re genuine
- Practice strong password hygiene, including multi-factor authentication, password managers, biometrics and passkeys where available.
- Follow the principle of least privilege: only give users access to what they need
- Remove access for former employees immediately
- Create and regularly check back-ups
- Educate staff frequently on cyber hygiene and phishing awareness
Cybersecurity is a moving target, but you don’t have to face it alone. If you’re ready to protect your systems from threats like Emotet, LockBit, and beyond—AISN is here to help. Get in touch with our team today.