Endpoint

9/7/2017
04:00 PM
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail
50%
50%

Microsoft: Ransomware Decline Reversed in March 2017

Researchers discovered 71 new ransomware families in the first half of 2017, when attacks picked up after several months of decline.

Ransomware encounters consistently declined from August 2016 through March 2017, when the trend reversed and attacks became more frequent and complex, Microsoft researchers found.

Microsoft's Security Intelligence Report, which summarizes the threat landscape for the first quarter of 2017, highlighted a global increase in ransomware. In a new, second report released this week the the company, researchers take a deeper dive into the evolution of ransomware and explore how attacks became more complex in the first half of this year.

New ransomware families are being released at a faster rate and contributed to the March turnaround. In the first half of 2017, researchers discovered 71 new ransomware families, an increase from the 64 new families uncovered during the same timeframe in 2016.

"From a timeline perspective, around March and April, major ransomware families, like Locky, which were dormant early in the year came back with some major campaigns, contributing to the turnaround," says Microsoft security expert Tanmay Ganacharya.

Several new families stand out for their complexity, using techniques that had never been used in previous families, or had been improved on. Spora, for example, overtook established ransomware operation Cerber as the most common ransomware family during the first half of 2017. Researchers attribute the growth to its ability to spread via network drives and removable drives.

The report contains details on global ransomware outbreaks WannaCry and new variant of Petya, which was frequently called NotPetya in the aftermath of the attack. Both attacks wreaked havoc on Windows users in May and June 2017.

"WannaCrypt and Petya defied the trend of more targeted and localized attacks and became the first global malware attacks in quite a while," writes Microsoft in a blog post. "They generated worldwide mainstream interest. Interestingly, this attention might have added more challenges for attackers," who could not access their monitored Bitcoin wallets.

NotPetya, WannaCry, Spora, and other new ransomware variants incorporate complex techniques that enable a faster and more dangerous spread than earlier forms of malware.

New forms of ransomware use exploits to move laterally, as demonstrated in Spora's ability to spread via network drives. WannaCry exploited the EternalBlue vulnerability (CVE-2017-0144), and NotPetya expanded on this by abusing both EternalBlue and EternalRomance (CVE-2017-0145) to affect out-of-date systems. Both exploits were addressed in earlier security updates.

Other complex techniques include credential theft, which NotPetya did by stealing from Credential Score or using a credential dumping tool. Credential theft poses a security challenge to networks where users log in with local administrative privileges and have active sessions open on several machines. In case of NotPetya, stolen login data could provide the same level of access that users have on other devices.

"The Petya outbreak is testament to the importance of credential hygiene," the researchers wrote. "Enterprises need to constantly review privileged accounts, which have unhampered network access and access to corporate secrets and other critical data."

Ransomware can also spread via network scanning; NotPetya, for example, scanned infected networks to connect with other machines. When it found them, it tried to transfer copies of malware using stolen credentials, and scanned for network shares to try and grow further.

WannaCry used a different strategy and scanned IP addresses to seek computers vulnerable to the EternalBlue exploit. This technique allowed it to spread outside the network to machines that hadn't been updated with the necessary patch.

"We expect that cybercriminals will continue to use threats like ransomware because history has shown people will pay to unlock their devices," Ganacharya says. Based on the current climate, it's possible there could be twice as many ransomware attacks in 2017 than in 2016.

"Specifically, we expect to see a combination of mass-targeted, low-sophistication ransomware families and some highly sophisticated targeted ransomware attacks, especially against older platforms that don’t have the security robustness of the modern operating systems," he says.

Related Content:

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
tcritchley07
50%
50%
tcritchley07,
User Rank: Strategist
9/8/2017 | 4:43:01 PM
Ransomeware Upsurge in 2017
I now neglect to worry about what type of malware is causing havoc. The problem is simple (not necessarily the solution); the internet is full of holes, like a sieve, and the need is to tackle the holes and not the individual shape of the holes (type of malware). Even the old vintage malware methods still work today which must tell the intelligent person that the 'patch, watch, pray and hope' methods aren't working. What is needed is a review  of all flaky products which fuel the internet and make them fit a new, secure architecture or be replaced. Governments and large companies can enforce this new regime as a condition of purchase; no fit new standard, no buy. It is done in other IT areas. There are too many people making good livings out of the status quo, for example, people in the know selling security services to gullible companies in the knowledge that their income is  safe in the current status of cybersecurity, sometimes relying on the old standby of FUD.
What We Talk About When We Talk About Risk
Jack Jones, Chairman, FAIR Institute,  7/11/2018
Ticketmaster Breach Part of Massive Payment Card Hacking Campaign
Jai Vijayan, Freelance writer,  7/10/2018
Lessons from My Strange Journey into InfoSec
Lysa Myers, Security Researcher, ESET,  7/12/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: Cyberspace is much less secure than my old lamp.
Current Issue
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-6681
PUBLISHED: 2018-07-17
Abuse of Functionality vulnerability in the web interface in McAfee Network Security Management (NSM) 9.1.7.11 and earlier allows authenticated users to allow arbitrary HTML code to be reflected in the response web page via appliance web interface.
CVE-2018-13864
PUBLISHED: 2018-07-17
A directory traversal vulnerability has been found in the Assets controller in Play Framework 2.6.12 through 2.6.15 (fixed in 2.6.16) when running on Windows. It allows a remote attacker to download arbitrary files from the target server via specially crafted HTTP requests.
CVE-2018-14338
PUBLISHED: 2018-07-17
samples/geotag.cpp in the example code of Exiv2 0.26 misuses the realpath function on POSIX platforms (other than Apple platforms) where glibc is not used, possibly leading to a buffer overflow.
CVE-2018-14337
PUBLISHED: 2018-07-17
The CHECK macro in mrbgems/mruby-sprintf/src/sprintf.c in mruby 1.4.1 contains a signed integer overflow, possibly leading to out-of-bounds memory access because the mrb_str_resize function in string.c does not check for a negative length.
CVE-2018-14329
PUBLISHED: 2018-07-17
In HTSlib 1.8, a race condition in cram/cram_io.c might allow local users to overwrite arbitrary files via a symlink attack.