04:00 PM
Connect Directly

Microsoft: Ransomware Decline Reversed in March 2017

Researchers discovered 71 new ransomware families in the first half of 2017, when attacks picked up after several months of decline.

Ransomware encounters consistently declined from August 2016 through March 2017, when the trend reversed and attacks became more frequent and complex, Microsoft researchers found.

Microsoft's Security Intelligence Report, which summarizes the threat landscape for the first quarter of 2017, highlighted a global increase in ransomware. In a new, second report released this week the the company, researchers take a deeper dive into the evolution of ransomware and explore how attacks became more complex in the first half of this year.

New ransomware families are being released at a faster rate and contributed to the March turnaround. In the first half of 2017, researchers discovered 71 new ransomware families, an increase from the 64 new families uncovered during the same timeframe in 2016.

"From a timeline perspective, around March and April, major ransomware families, like Locky, which were dormant early in the year came back with some major campaigns, contributing to the turnaround," says Microsoft security expert Tanmay Ganacharya.

Several new families stand out for their complexity, using techniques that had never been used in previous families, or had been improved on. Spora, for example, overtook established ransomware operation Cerber as the most common ransomware family during the first half of 2017. Researchers attribute the growth to its ability to spread via network drives and removable drives.

The report contains details on global ransomware outbreaks WannaCry and new variant of Petya, which was frequently called NotPetya in the aftermath of the attack. Both attacks wreaked havoc on Windows users in May and June 2017.

"WannaCrypt and Petya defied the trend of more targeted and localized attacks and became the first global malware attacks in quite a while," writes Microsoft in a blog post. "They generated worldwide mainstream interest. Interestingly, this attention might have added more challenges for attackers," who could not access their monitored Bitcoin wallets.

NotPetya, WannaCry, Spora, and other new ransomware variants incorporate complex techniques that enable a faster and more dangerous spread than earlier forms of malware.

New forms of ransomware use exploits to move laterally, as demonstrated in Spora's ability to spread via network drives. WannaCry exploited the EternalBlue vulnerability (CVE-2017-0144), and NotPetya expanded on this by abusing both EternalBlue and EternalRomance (CVE-2017-0145) to affect out-of-date systems. Both exploits were addressed in earlier security updates.

Other complex techniques include credential theft, which NotPetya did by stealing from Credential Score or using a credential dumping tool. Credential theft poses a security challenge to networks where users log in with local administrative privileges and have active sessions open on several machines. In case of NotPetya, stolen login data could provide the same level of access that users have on other devices.

"The Petya outbreak is testament to the importance of credential hygiene," the researchers wrote. "Enterprises need to constantly review privileged accounts, which have unhampered network access and access to corporate secrets and other critical data."

Ransomware can also spread via network scanning; NotPetya, for example, scanned infected networks to connect with other machines. When it found them, it tried to transfer copies of malware using stolen credentials, and scanned for network shares to try and grow further.

WannaCry used a different strategy and scanned IP addresses to seek computers vulnerable to the EternalBlue exploit. This technique allowed it to spread outside the network to machines that hadn't been updated with the necessary patch.

"We expect that cybercriminals will continue to use threats like ransomware because history has shown people will pay to unlock their devices," Ganacharya says. Based on the current climate, it's possible there could be twice as many ransomware attacks in 2017 than in 2016.

"Specifically, we expect to see a combination of mass-targeted, low-sophistication ransomware families and some highly sophisticated targeted ransomware attacks, especially against older platforms that don’t have the security robustness of the modern operating systems," he says.

Related Content:

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
User Rank: Moderator
9/8/2017 | 4:43:01 PM
Ransomeware Upsurge in 2017
I now neglect to worry about what type of malware is causing havoc. The problem is simple (not necessarily the solution); the internet is full of holes, like a sieve, and the need is to tackle the holes and not the individual shape of the holes (type of malware). Even the old vintage malware methods still work today which must tell the intelligent person that the 'patch, watch, pray and hope' methods aren't working. What is needed is a review  of all flaky products which fuel the internet and make them fit a new, secure architecture or be replaced. Governments and large companies can enforce this new regime as a condition of purchase; no fit new standard, no buy. It is done in other IT areas. There are too many people making good livings out of the status quo, for example, people in the know selling security services to gullible companies in the knowledge that their income is  safe in the current status of cybersecurity, sometimes relying on the old standby of FUD.
6 Security Trends for 2018/2019
Curtis Franklin Jr., Senior Editor at Dark Reading,  10/15/2018
WSJ Report: Facebook Breach the Work of Spammers, Not Nation-State Actors
Curtis Franklin Jr., Senior Editor at Dark Reading,  10/19/2018
4 Ways to Fight the Email Security Threat
Asaf Cidon, Vice President, Content Security Services, at Barracuda Networks,  10/15/2018
Register for Dark Reading Newsletters
White Papers
Latest Comment: Too funny!
Current Issue
Flash Poll
The Risk Management Struggle
The Risk Management Struggle
The majority of organizations are struggling to implement a risk-based approach to security even though risk reduction has become the primary metric for measuring the effectiveness of enterprise security strategies. Read the report and get more details today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2018-10-16
Qemu emulator <= 3.0.0 built with the NE2000 NIC emulation support is vulnerable to an integer overflow, which could lead to buffer overflow issue. It could occur when receiving packets over the network. A user inside guest could use this flaw to crash the Qemu process resulting in DoS.
PUBLISHED: 2018-10-16
The Microsoft Windows Installer for Atlassian Fisheye and Crucible before version 4.6.1 allows local attackers to escalate privileges because of weak permissions on the installation directory.
PUBLISHED: 2018-10-16
Z-BlogPHP (Zero) has a stored XSS Vulnerability in zb_system/function/c_system_admin.php via the Content-Type header during the uploading of image attachments.
PUBLISHED: 2018-10-16
Advanced HRM 1.6 allows Remote Code Execution via PHP code in a .php file to the user/update-user-avatar URI, which can be accessed through an "Update Profile" "Change Picture" (aka user/edit-profile) action.
PUBLISHED: 2018-10-16
XSS exists in the MetInfo 6.1.2 admin/index.php page via the anyid parameter.