Introduction

In 2021, cybercriminals continued to take advantage of the Covid-19 pandemic, exploiting people’s habits formed during lockdown in order to spread scams. 

The 2021 Avast Global PC Risk Report looks at Windows threats targeting home and business users throughout the year. On average, home users around the world had a 29.25% chance of encountering a threat, whereas business users had a 15.10% chance. Home users have an increased risk of encountering threats, as they do not have the same layers of protection in place as business users, whose networks and devices are often managed by professional IT-security teams, preventing them from even encountering certain threats in the first place. 

With hundreds of millions of users worldwide, Avast has one of the largest threat detection networks in the cybersecurity industry. The attacks on these devices provide valuable insights and knowledge of the most prevalent threats and those who have been most affected by them.  

Methodology

The data included in this report is collected from Avast’s threat detection network, and represents the average ratio of Avast users protected monthly from at least one threat divided by the total number of monthly active Avast users from January 1, 2021 - December 31, 2021. In order to provide statistically relevant data, this report includes data from countries and territories with a sample size of at least 10,000 computers belonging to home users that encountered threats during the months the data was collected, and at least 1,000 computers used by businesses. The regional breakdowns included in this report includes data from regions with a sample size of at least 1,000 computers belonging to home users that encountered threats during the months the data was collected and at least 100 computers used by businesses.

Global Risk Ratio: Home Users

The countries in which home users are most at risk of encountering threats are mainly in the Middle East, Asia, and Africa, and those least at risk are located mainly in Europe and North America.

The top ten countries most at risk of encountering threats are in the Middle East and Africa, in addition to Kosovo: 

1. Kosovo (53.71%)

2. China (48.11%)

3. Afghanistan (46.43%)

4. Yemen (46.21%)

5. Angola (44.65%)

6. Rwanda (44.61%)

7. Egypt (44.39%)

8. Madagascar (44.13%)

9. Algeria (44.05%)

10. Macao (44.01%)

The ten countries with the lowest risk of encountering threats are: 

1. Puerto Rico (21.64 %)

2. South Korea (22.81%)

3. United Kingdom (23.55%)

4. Martinique (23.80%)

5. Guadeloupe (23.83%)

6. Ireland (24.11%)

7. Finland (24.21%)

8. Switzerland (24.23%)

9. Netherlands (24.27%)

10. Denmark (24.39%)
    
    

Global Risk Ratio: Business Users

The countries in which business users are most at risk of encountering threats are mainly in Asia and Africa, in addition to Croatia and Bulgaria, and those least at risk are located mainly in Europe and North America.

The ten countries in which businesses are most at risk of encountering a threat are:

1. Vietnam (37.80%)

2. China (35.65%)

3. Tanzania (35.29%)

4. Pakistan (35.61%)

5. Croatia (32.55%)

6. Bulgaria (31.64)

7. Mozambique (30.54%)

8. Indonesia (30.29%)

9. Bangladesh (30.07%)

10. Taiwan (29.78%)

The ten countries with the lowest risk ratio are: 

1. Sweden (9.52%)

2. Norway (10.86%)

3. Luxembourg (11.24%)

4. Ireland (11.52%)

5. United Kingdom (11.71%)

6. Germany (11.83%)

7. Puerto Rico (11.86%)

8. Netherlands (11.86%)

9. Switzerland (12.00%)

10. United States (12.60%)
    
    

The State of Cybersecurity

People are spending more time online due to the pandemic, and research conducted for the Avast Digital Citizenship Report shows that one-third of global respondents plan to continue to do more things online as it makes life easier in general. Cybercriminals used the pandemic to their advantage, spreading scams and phishing attacks to exploit people’s digital habits.

The top ten types of malware consumers faced, globally, in 2021 were: 

• Trojans (30.73%)

• File infectors (24.21%)

• Adware (12%)

• Worms (7.79%)

• Droppers (6.97%)

• Password stealers (3.99%)

• Coinminers (2.42%)

• RATs (2.34%)

• Scams (2.33%)

• Bots (1.74%) 

Many malware samples today are like a swiss army knife, capable of performing more than one malicious action and often designed to deliver more malware. That means, if people or businesses are infected with malware such as a dropper, RAT or bot, further malware will likely follow, as droppers, RATs, bots are typically used to spread malware. 

Trojans are often spread via email, and file-sharing sites, and are risky as they can destroy files, take control over a user's device and enable data theft, impacting people’s privacy. File infectors, such as Expiro, Virut, and Sality, which have remained dominant in 2021, copy malicious code into files in order to spread themselves. 

Avast researchers saw an increase in adware activity, malware that displays ads, often in a disturbing way, without the victim realizing what is causing the ads to be displayed, in the last quarter of the year, which was likely due to an active rootkit called Cerbu. The primary function of Cerbu is to hijack browser homepages and redirect site URLs according to the rootkit configuration. This rootkit can therefore be easily deployed and configured for adware.

With the price increase of Bitcoin at the end of 2021 crypto-related crime continued to be attractive for cyber gangs, which resulted in an increase of the number of coinminers, using their victims’ devices to mine for cryptocurrencies, spreading by 40% in Q4/2021, often via infected web pages and pirated software. 

RATs, remote access Trojans, giving attackers complete control of infected systems, spread in Q3/2021 more than in the first half of the year, but slowed down in the last quarter with cybercriminals taking a break around the holidays. 

It might come as a surprise that ransomware does not appear on the list. While ransomware attacks persisted in 2021, with attacks on the Colonial Pipeline and Kaseya attack making headlines, ransomware does not belong to the top threats consumers face. Ransomware is just the tip of the iceberg of the overall threats consumers and businesses face worldwide. If ransomware hits, however, it can cause significant damage, which is why it is discussed and feared so widely, despite its relatively low overall share among threats. 

Ransomware operators have moved away from the spray and prey models, where they attempt to attack large target pools, and now are focused on targeted attacks. Successful ransomware attacks can have detrimental consequences, especially for businesses, and repercussions that span beyond businesses losing access to their devices. The attack on the Colonial Pipeline caused gas shortages, and the attack on Baltimore County Public Schools interrupted virtual learning for two days. In Q3/2021 ransomware attacks were 5% higher than in Q2/2021 and even 22% higher than in Q1/2021. The havoc ransomware caused in the first three quarters of 2021 triggered a coordinated cooperation of nations, government agencies, and security vendors to hunt down ransomware authors and operators, and Avast researchers believe all of this resulted in a significant decrease in ransomware attacks in Q4/2021. The ransomware risk ratio decreased by an impressive 28% compared to Q3/2021. 

At the end of 2021, the vulnerability in Log4j, a Java logging library, proved extremely dangerous for businesses because of the ubiquity of the library and the ease of exploitation. Avast researchers observed coinminers, RATs, bots, ransomware, and APT groups abusing the vulnerability. 

Conclusion

As reported in past Risk Reports, the countries with the highest risk ratio, both for home users and business users, for the most part are those with more conflictive socio-political situations (Middle East, Asia, Africa, and Eastern Europe). Users in these countries might resort to accessing information online otherwise blocked in their countries, via unsafe channels and therefore put themselves at risk of encountering threats. Another theory as to why computer users in these countries are most at risk is a lower level of education in terms of cybersecurity best practices. 

Nearly all of the top ten safest countries, meaning the ones with the lowest risk ratio, belong to the OECD (Organization for Economic Co-operation and Development). This organization is made up of 38 countries that work together to improve the economic and social well-being of people around the world. These countries are among the early technology adopters, which means the broad mainstream of users in these countries, for the most part, may be more aware and better informed when it comes to PC security best practices. Even so, this correlation is not completely conclusive.