Nokia Threat Intelligence Report

Introduction – Nokia Threat Intelligence Report

This report provides a view of malware activity in mobile and fixed networks around the world. The data in this report has been aggregated from service provider networks where Nokia’s NetGuard Endpoint Security solution is deployed. This network-based malware detection solution enables Nokia customers to monitor their fixed and mobile networks for evidence of malware infections in consumer and enterprise endpoint devices, including mobile phones, laptops, personal computers, notepads and the new generation of Internet of Things (IoT) devices. This solution is deployed in major fixed and mobile networks around the world, monitoring network traffic from more than 150 million devices. The system examines network traffic for malware command-and-control communication, exploit attempts, hacking activity, scanning activity and Distributed Denial of Service (DDoS) attacks. This enables the system to accurately determine which devices are infected with malware and what malware is involved. The system also monitors attack traffic to determine where the attacks are coming from and what network devices are being attacked. The report also includes details from malware analysis conducted in the sandbox environments in our malware analysis lab and additional information from our honeypot systems.

Main findings

Covid-19 caused a surge in mobile malware infections.

In 2020, the average monthly infection rate in mobile networks was 0.23%. In February and March, however, the monthly mobile infection rate increased by almost 30% over the previous months, largely due to the significant escalation of cyber security incidents related to the Covid-19 pandemic.

The impact of Covid-19 was felt later in fixed broadband.

For fixed broadband networks, the average monthly infection rate per residence was 2.16%. While this is down overall compared to 2019, there was a sharp increase in infection rates in May and June due to the Covid-19 pandemic — but this spike happened two months after the one observed in mobile networks.

Infections have increased significantly in the IoT space.

IoT devices are now responsible for 32.72% of all infections observed in mobile networks, up from 16.17% in 2019. This trend lines up with the growing number of IoT devices that are now connected to mobile networks. Nokia’s Threat Intelligence Lab anticipated this trend and has monitored the situation closely throughout the year.

Download the report to discover more.