Endpoint

1/25/2018
02:45 PM
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail
50%
50%

Ransomware Detections Up 90% for Businesses in 2017

Last year, cybercriminals shifted from consumer to enterprise targets and leveraged ransomware as their weapon of choice.

Ransomware became the fifth-most-common threat for businesses in 2017 as detections increased by 90% from the previous year. Attacks also hit consumers hard, reaching a 93% detection rate year-over-year, reports Malwarebytes.

The company today released its "2017 State of Malware Report," which highlights trends based on telemetry data collected from products between January and November 2016, and January and November 2017. Analysts also pulled data from the company's threat-facing honeypots in 2017 and combined this with their own observations and analysis.

"2016 was the year of ransomware for consumers," says Malwarebytes CEO Marcin Kleczynski in an interview with Dark Reading. "2017 was the year of ransomware for businesses."

Malwarebytes' findings support a growing body of research highlighting the 2017 ransomware spike. The Online Trust Alliance (OTA) states attacks targeting businesses nearly doubled from 82,000 in 2016 to 159,000 last year. Ransomware attacks hit 134,000 in 2017 — double the 2016 count — and were the primary driver for the overall growth in cybercrime.

In its "2017 Global Threat Intelligence Report," NTT Security found 77% of all detected ransomware was in four industries: business and professional services (28%), government (19%), healthcare (15%), and retail (15%). Ransomware-related incidents were the most common, at 22%, and made up half of all attacks targeting the healthcare industry.

Malwarebytes researchers also noticed criminals got creative with delivery methods. Leaked government exploits — such as EternalBlue, used in WannaCry — in addition to compromised update processes and increased geo-targeting were used to evade detection.

Development of exploit kits hit a standstill last year. Analysts didn't detect any new zero-day exploits used by any exploit kits in the wild. It's a "significant change" from previous years, in which exploits were the primary method of infection. Cybercriminals are instead focusing on evading detection and integrating multiple exploits into Microsoft Office documents.

Attackers started leveraging cryptocurrency mining for financial gain and using victims' system resources to mine currencies. Tactics include compromised websites serving up drive-by mining code, miners delivered via malicious spam and exploit kit drops, and adware bundlers pushing miners.

Looking Ahead
Ransomware may have been hot in 2017, but, as all trends do, it has started to fade as businesses have smartened up and learned how to protect themselves. "You're seeing less and less returns, as a criminal," says Kleczynski of the ransomware slowdown. "It's now hard to find and infect a company that really gets impacted by ransomware like the [the UK's National Health Service] did."

Cybercriminals are pivoting toward banking Trojans, spyware, and hijackers to attack enterprise targets and spy, move throughout their networks, and steal data, including login credentials, contact lists, and credit card data. Banking Trojans were up 102% in the second half of 2017.

"The strategy of cybercriminals continues to shift," notes Kleczynski, adding that hijackers were up 40% overall last year. Spyware detections increased 30%, researchers found.

Looking toward the year ahead, he anticipates the largest incident in 2018 will be on the same level as the Mirai botnet that brought down major websites in October 2016. Mirai was "scratching the surface" on the number of unprotected IoT devices, he says.

"The biggest threat this year, in my opinion, is another Mirai-like attack," Kleczynski continues. "We'll see several this year that will take down major websites."

Related Content:

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
AnupG220
50%
50%
AnupG220,
User Rank: Author
1/28/2018 | 8:40:53 PM
Stockpiling BItcoin for ransomware attacks
Funny how we all used to shake our colletive heads at the companies that would stockpile bitcoin in case they got hit with a ransomware attack. Now it looks like they made a smart investment if they were stockpiling for some time. Hopefully they didn't need to pay up!
BrianN060
50%
50%
BrianN060,
User Rank: Ninja
1/25/2018 | 4:49:44 PM
What's the score? II
"Attackers started leveraging cryptocurrency mining for financial gain and using victims' system resources to mine currencies. Tactics include..."

You can add: disguising as ransomware. 

Cryptocurrency isn't the only means of processing a ransomware payoff; but the advantages are obvious.  Also obvious is that the proliferation of ransomware strains, attacks and attackers coincides with the emergence of cryptocurrencies. 

That a successful RW attack requires the same sort of unauthorized requisition of the victim's computing device's resources, as would enable cryptocurrency mining, is obvious, as well. 

In both cases, the characteristics and availability of cryptocurrency provide an unprecedented opportunity for cybercriminals. 

When you tally the costs of cybercrimes, where cryptocurrency provides a game-changing level of means, motive and opportunity, don't stop at the costs in RW payouts, or any of the costs to businesses which might be covered by insurance, but by the cost of that insurance - and all the other costs in money, resources, talent and attention that have increased as a result. 

Draw up a society-wide balance sheet, put the costs on one side, and the benefits of cryptocurrency on the other.  Then ask: What's the score?
WebAuthn, FIDO2 Infuse Browsers, Platforms with Strong Authentication
John Fontana, Standards & Identity Analyst, Yubico,  9/19/2018
Turn the NIST Cybersecurity Framework into Reality: 5 Steps
Mukul Kumar & Anupam Sahai, CISO & VP of Cyber Practice and VP Product Management, Cavirin Systems,  9/20/2018
NSS Labs Files Antitrust Suit Against Symantec, CrowdStrike, ESET, AMTSO
Kelly Jackson Higgins, Executive Editor at Dark Reading,  9/19/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: White Privelege Day
Current Issue
Flash Poll
The Risk Management Struggle
The Risk Management Struggle
The majority of organizations are struggling to implement a risk-based approach to security even though risk reduction has become the primary metric for measuring the effectiveness of enterprise security strategies. Read the report and get more details today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-17282
PUBLISHED: 2018-09-20
An issue was discovered in Exiv2 v0.26. The function Exiv2::DataValue::copy in value.cpp has a NULL pointer dereference.
CVE-2018-14592
PUBLISHED: 2018-09-20
The CWJoomla CW Article Attachments PRO extension before 2.0.7 and CW Article Attachments FREE extension before 1.0.6 for Joomla! allow SQL Injection within download.php.
CVE-2018-15832
PUBLISHED: 2018-09-20
upc.exe in Ubisoft Uplay Desktop Client versions 63.0.5699.0 allows remote attackers to execute arbitrary code. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of URI ha...
CVE-2018-16282
PUBLISHED: 2018-09-20
A command injection vulnerability in the web server functionality of Moxa EDR-810 V4.2 build 18041013 allows remote attackers to execute arbitrary OS commands with root privilege via the caname parameter to the /xml/net_WebCADELETEGetValue URI.
CVE-2018-16752
PUBLISHED: 2018-09-20
LINK-NET LW-N605R devices with firmware 12.20.2.1486 allow Remote Code Execution via shell metacharacters in the HOST field of the ping feature at adm/systools.asp. Authentication is needed but the default password of admin for the admin account may be used in some cases.