Attacks/Breaches

12/21/2017
09:00 AM
50%
50%

Small,Targeted Ransomware Attacks Emerge

Cybercriminals narrow their focus on specific industries, geographies, or size for a better return on investment, security experts say.

Ransomware attackers in the past year have begun to launch small, targeted campaigns, seeking a better return on their investment of time and money.

Cybercriminals are expanding beyond ransomware "spray and pray" attacks delivered by spam, and focusing instead on specific industries, geographies, or companies of a particular size with ransomware phishing campaigns, according to security experts.

"For most of 2016, ransomware campaigns were sent by spam. On some days, tens of millions of emails were sent out," says Patrick Wheeler, director of threat intelligence for Proofpoint. He says spray and pray campaigns were designed to infect as many machines as possible with the expectation that a certain percentage of the victims would pay the ransom.

Ransomware will mostly involve targeted campaigns in the future because attackers know they can get more money with this method, says Anton Ivanov, lead malware analyst with Kaspersky Lab. Attackers behind ransomware campaigns have gone as far as creating special teams with specific developer skills to penetrate networks and language skills to write phishing emails that appear more convincing, too, he says.

Financial organizations, higher-education institutions, and healthcare, manufacturing, and technology companies, are some of the industries that have been hit this year with targeted ransomware campaigns.

"We find when ransomware targets specific verticals, it is usually healthcare and higher education. We don't know why these verticals, but maybe because there is a large user base," says Wheeler.

A previously undocumented strain of the Defray ransomware was used in one attack against healthcare companies and educational institutions, while another Defray attack targeted manufacturing and technology companies, according to a Proofpoint report.

PetrWrap, a Petya-based ransomware variant, targeted financial organizations across the globe, according to Kaspersky.

Wheeler says the Philadelphia ransomware authors initially targeted healthcare companies, while Petya's authors concentrated on regions within Germany during the spring. Other ransomware campaigns also targeted specific geographies: Serpent's authors focused their campaign on the Netherlands then Belgium, while Crysis targeted German organizations, he says.

Company size also factors into targeted ransomware attacks. Mamba ransomware authors target large organizations with more than 1,000 endpoints, Ivanov says, citing the high-profile attack against the San Francisco Municipal Transportation Agency as one example.

"They are focusing on big organizations because with ransomware, [the payout] is based on how many endpoints you can compromise," Ivanov says, adding that Mamba is still active and targeting organizations in the Middle East.

Evolution

Meantime, while the Philadelphia and Petya authors started out with targeted campaigns, their strategy eventually shifted. "Once ransomware goes global, it is not used as a targeted campaign. That's what happened with Philadelphia and Petya," Wheeler says.

Philadelphia targeted healthcare companies before it later become a commodity and was sold as a ransomware-as-a-service (RaaS), a situation similar to Petya, which initially targeted companies in Germany, explains Wheeler.

Defending against targeted or spray-and-pray ransomware attacks is similar: each require backing up data frequently, dedicating a team to analyze the organization's endpoint security and activity, and ensuring all control processes are in place on the network, Ivanov says.

"Targeted ransomware attacks will continue to evolve," Ivanov warns, so companies need to take steps to reduce the impact.

Related Content:

 

 

Dawn Kawamoto is an Associate Editor for Dark Reading, where she covers cybersecurity news and trends. She is an award-winning journalist who has written and edited technology, management, leadership, career, finance, and innovation stories for such publications as CNET's ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
12 Free, Ready-to-Use Security Tools
Steve Zurier, Freelance Writer,  10/12/2018
Pair of Reports Paint Picture of Enterprise Security Struggling to Keep Up
Curtis Franklin Jr., Senior Editor at Dark Reading,  10/11/2018
New Domains: A Wide-Open Playing Field for Cybercrime
Ben April, CTO, Farsight Security,  10/9/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Flash Poll
The Risk Management Struggle
The Risk Management Struggle
The majority of organizations are struggling to implement a risk-based approach to security even though risk reduction has become the primary metric for measuring the effectiveness of enterprise security strategies. Read the report and get more details today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-18324
PUBLISHED: 2018-10-15
CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.480 has XSS via the admin/fileManager2.php fm_current_dir parameter, or the admin/index.php module, service_start, service_fullstatus, service_restart, service_stop, or file (within the file_editor) parameter.
CVE-2018-18322
PUBLISHED: 2018-10-15
CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.480 has Command Injection via shell metacharacters in the admin/index.php service_start, service_restart, service_fullstatus, or service_stop parameter.
CVE-2018-18323
PUBLISHED: 2018-10-15
CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.480 has Local File Inclusion via directory traversal with an admin/index.php?module=file_editor&file=/../ URI.
CVE-2018-18319
PUBLISHED: 2018-10-15
** DISPUTED ** An issue was discovered in the Merlin.PHP component 0.6.6 for Asuswrt-Merlin devices. An attacker can execute arbitrary commands because api.php has an eval call, as demonstrated by the /6/api.php?function=command&class=remote&Cc='ls' URI. NOTE: the vendor indicates that Merli...
CVE-2018-18320
PUBLISHED: 2018-10-15
** DISPUTED ** An issue was discovered in the Merlin.PHP component 0.6.6 for Asuswrt-Merlin devices. An attacker can execute arbitrary commands because exec.php has a popen call. NOTE: the vendor indicates that Merlin.PHP is designed only for use on a trusted intranet network, and intentionally allo...