Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

1/23/2019
09:05 AM
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail
50%
50%

Enterprise Malware Detections Up 79% as Attackers Refocus

A new report on the state of malware shows a spike in B2B malware, with former banking Trojans Emotet and TrickBot topping the list.

Enterprise threats ramped up toward the end of 2018 as cybercriminals shifted their strategies to hit business victims with unpatched, insecure networks – and found plenty of targets.

That's one of the key findings from Malwarebytes Labs' "State of Malware Report 2019," which analyzes threats from January through November 2018 and compares them with the same period from 2017. After cryptomining exploded near the end of 2017, the next year began with attackers broadening their strategies to hit Mac and Android devices and use browser-based threats.

But cryptomining began to slow down by the second quarter of 2018, researchers report, and a new set of attacks took its place. Former banking Trojans Emotet and TrickBot evolved into droppers with several modules for spam production, network propagation, and data skimming. New malware variants targeted the enterprise, hunting sensitive data they could sell for profit.

Criminals have historically gone after consumers, says Malwarebytes CEO Marcin Kleczynski, but the past year has shown they've found value in targeting the enterprise. One corporate login can grant them access to troves of far more valuable information, and it's not hard to get.

A Pivot Toward the Enterprise
Most attackers don't plan to hit specific companies, Kleczynski points out. They start by casting a wide net, conducting online research to see who's most vulnerable, then pursuing them. Business malware detections rose 79% over the last year, report Malwarebytes researchers, who link the rise to an increase in backdoors, miners, spyware, and information stealers.

While 2017 can be considered the year of global outbreaks – WannaCry and NotPetya made sure of it – 2018 was the "year of the mega breach." Attackers hit major corporations, including Facebook, Marriott, Exactis, MyHeritage, and Quora, affecting hundreds of millions of customers and driving the numbers of compromised records up 133% compared with 2017.

Companies may worry about becoming the next Marriott, Kleczynski says, but most of the attacks Malwarebytes sees aren't the big ones. Many businesses are affected with popular strains of malware like Emotet, which he explains is "going around like the flu." Trojan detections were up 132%, a rise led by the prevalence of the Emotet, which, like other info-stealing malware, uses exploits to move across corporate networks and brute-forces credentials.

Backdoors increased 173% among enterprise victims, spyware was up 142%, and RiskwareTool rose by 126%, researchers report. They attribute the rise in spyware to similar variants and families of Emotet and TrickBot being identified as spyware in the wild – a sign attackers have focused on information stealing and creating footholds in corporate networks, they explain.

Common attack vectors like spam "work so well" on business victims, Kleczynski says. "At the end of the day, it's still very common to spread an attack like Emotet," he adds, just by getting more people to click on a malicious email. It doesn't help that company websites and platforms like LinkedIn expose useful information (full names, job titles) that help make attacks targeted.

Emotet and Trickbot topped the threats of 2018 and found success in malspam, a technique that disguises the threats as a legitimate email. What made their attacks successful was how they spread.For Emotet, this meant infected attachments and embedded URLs, with social engineering tactics designed to make targets believe messages come from trusted sources.

While businesses saw more malware detections, consumers saw fewer. In 2017, there were 775,327,346 consumer detections, Malwarebytes reports. The most recent year brought about 25 million fewer instances and a 3% decline – "a healthy decrease," percentages aside.

"Always, at the end of the day, [it's] around money and the value of some of these assets," Kleczynski says of cyberattackers eyeing enterprise data. "I would claim that credit card and Social Security and passport numbers aren't as valuable as they were 10 years ago."

Ransomware: It's Complicated
Toward the end of 2017, security experts predicted the cryptomining crazy would continue. Indeed, 2018 brought the decline of ransomware and rise of cryptominers, following a spike in Bitcoin value at the end of 2017. Criminals seeking financial gain jumped on the trend, hitting Mac, Windows, and Android devices with software- and browser-based cryptomining attacks.

However, cryptomining only increased 7% last year as the second half of 2018 brought its decline. It's still one of the major malware trends of 2018, but the drop in cryptocurrency value has slowed it down. "Bitcoin losing more than 80% of its value over the last year has led cybercriminals to pivot," Kleczynski explains.

As the trend lagged, cybercriminals shifted their ransomware techniques from malvertising exploits and ransomware payloads to manual, targeted ransomware attacks. While it's not the wide-ranging threat it was in 2017, it's still a threat to keep in mind. Trends show an increase in focused, sophisticated attacks geared toward the enterprise and lack of interest in consumers.

Businesses, unlike individuals, have the potential funds to pay a ransom and several pressing reasons to get back up and running after a ransomware attack. Delays caused by ransomware can be incredibly expensive, researchers say, especially when the victim has a wealth of infected endpoints and no backup plan in place. Incident response is costlier than paying up.

SamSam, which hit the city of Atlanta and medical organizations across the US in 2018, was revamped to charge victims a more moderate price compared with recovery methods that businesses would otherwise have to pay. The change led to operators making more overall. GandCrab, the top ransomware variants of Q2 2018, adopted the Magnitude exploit kit, which plagued network admins and home users with its unusual malware-loading method.

High Risk Meets Few Resources
Kleczynski says many companies have stepped up their security game despite struggling with a lack of resources. Despite attacks over the past decade, he says, the pressure on security teams to request sufficient resources from their organizations is still relevant. In the education and state/local government sectors, for example, budgets are a significant concern.

"It's interesting to see companies doing what they can with as little as they have," he says.

Security-focused conversations are also making their way to the board, where execs are concerned about being hit with the next major breach. "I think the weight of the topic is significant," he adds. It's especially difficult for companies with small security teams, which struggle to cover every aspect of security with few people. Open source software, free tools, and outsourcing have helped drive security efforts, Kleczynski adds.

Read the report here.

Related Content:

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
For Cybersecurity to Be Proactive, Terrains Must Be Mapped
Craig Harber, Chief Technology Officer at Fidelis Cybersecurity,  10/8/2019
A Realistic Threat Model for the Masses
Lysa Myers, Security Researcher, ESET,  10/9/2019
USB Drive Security Still Lags
Dark Reading Staff 10/9/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
2019 Online Malware and Threats
2019 Online Malware and Threats
As cyberattacks become more frequent and more sophisticated, enterprise security teams are under unprecedented pressure to respond. Is your organization ready?
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-17593
PUBLISHED: 2019-10-14
JIZHICMS 1.5.1 allows admin.php/Admin/adminadd.html CSRF to add an administrator.
CVE-2019-17594
PUBLISHED: 2019-10-14
There is a heap-based buffer over-read in the _nc_find_entry function in tinfo/comp_hash.c in the terminfo library in ncurses before 6.1-20191012.
CVE-2019-17595
PUBLISHED: 2019-10-14
There is a heap-based buffer over-read in the fmt_entry function in tinfo/comp_hash.c in the terminfo library in ncurses before 6.1-20191012.
CVE-2019-14823
PUBLISHED: 2019-10-14
A flaw was found in the "Leaf and Chain" OCSP policy implementation in JSS' CryptoManager versions after 4.4.6, 4.5.3, 4.6.0, where it implicitly trusted the root certificate of a certificate chain. Applications using this policy may not properly verify the chain and could be vulnerable to...
CVE-2019-17592
PUBLISHED: 2019-10-14
The csv-parse module before 4.4.6 for Node.js is vulnerable to Regular Expression Denial of Service. The __isInt() function contains a malformed regular expression that processes large crafted input very slowly. This is triggered when using the cast option.