Endpoint

1/25/2018
02:45 PM
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail
50%
50%

Ransomware Detections Up 90% for Businesses in 2017

Last year, cybercriminals shifted from consumer to enterprise targets and leveraged ransomware as their weapon of choice.

Ransomware became the fifth-most-common threat for businesses in 2017 as detections increased by 90% from the previous year. Attacks also hit consumers hard, reaching a 93% detection rate year-over-year, reports Malwarebytes.

The company today released its "2017 State of Malware Report," which highlights trends based on telemetry data collected from products between January and November 2016, and January and November 2017. Analysts also pulled data from the company's threat-facing honeypots in 2017 and combined this with their own observations and analysis.

"2016 was the year of ransomware for consumers," says Malwarebytes CEO Marcin Kleczynski in an interview with Dark Reading. "2017 was the year of ransomware for businesses."

Malwarebytes' findings support a growing body of research highlighting the 2017 ransomware spike. The Online Trust Alliance (OTA) states attacks targeting businesses nearly doubled from 82,000 in 2016 to 159,000 last year. Ransomware attacks hit 134,000 in 2017 — double the 2016 count — and were the primary driver for the overall growth in cybercrime.

In its "2017 Global Threat Intelligence Report," NTT Security found 77% of all detected ransomware was in four industries: business and professional services (28%), government (19%), healthcare (15%), and retail (15%). Ransomware-related incidents were the most common, at 22%, and made up half of all attacks targeting the healthcare industry.

Malwarebytes researchers also noticed criminals got creative with delivery methods. Leaked government exploits — such as EternalBlue, used in WannaCry — in addition to compromised update processes and increased geo-targeting were used to evade detection.

Development of exploit kits hit a standstill last year. Analysts didn't detect any new zero-day exploits used by any exploit kits in the wild. It's a "significant change" from previous years, in which exploits were the primary method of infection. Cybercriminals are instead focusing on evading detection and integrating multiple exploits into Microsoft Office documents.

Attackers started leveraging cryptocurrency mining for financial gain and using victims' system resources to mine currencies. Tactics include compromised websites serving up drive-by mining code, miners delivered via malicious spam and exploit kit drops, and adware bundlers pushing miners.

Looking Ahead
Ransomware may have been hot in 2017, but, as all trends do, it has started to fade as businesses have smartened up and learned how to protect themselves. "You're seeing less and less returns, as a criminal," says Kleczynski of the ransomware slowdown. "It's now hard to find and infect a company that really gets impacted by ransomware like the [the UK's National Health Service] did."

Cybercriminals are pivoting toward banking Trojans, spyware, and hijackers to attack enterprise targets and spy, move throughout their networks, and steal data, including login credentials, contact lists, and credit card data. Banking Trojans were up 102% in the second half of 2017.

"The strategy of cybercriminals continues to shift," notes Kleczynski, adding that hijackers were up 40% overall last year. Spyware detections increased 30%, researchers found.

Looking toward the year ahead, he anticipates the largest incident in 2018 will be on the same level as the Mirai botnet that brought down major websites in October 2016. Mirai was "scratching the surface" on the number of unprotected IoT devices, he says.

"The biggest threat this year, in my opinion, is another Mirai-like attack," Kleczynski continues. "We'll see several this year that will take down major websites."

Related Content:

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
AnupG220
50%
50%
AnupG220,
User Rank: Author
1/28/2018 | 8:40:53 PM
Stockpiling BItcoin for ransomware attacks
Funny how we all used to shake our colletive heads at the companies that would stockpile bitcoin in case they got hit with a ransomware attack. Now it looks like they made a smart investment if they were stockpiling for some time. Hopefully they didn't need to pay up!
BrianN060
50%
50%
BrianN060,
User Rank: Ninja
1/25/2018 | 4:49:44 PM
What's the score? II
"Attackers started leveraging cryptocurrency mining for financial gain and using victims' system resources to mine currencies. Tactics include..."

You can add: disguising as ransomware. 

Cryptocurrency isn't the only means of processing a ransomware payoff; but the advantages are obvious.  Also obvious is that the proliferation of ransomware strains, attacks and attackers coincides with the emergence of cryptocurrencies. 

That a successful RW attack requires the same sort of unauthorized requisition of the victim's computing device's resources, as would enable cryptocurrency mining, is obvious, as well. 

In both cases, the characteristics and availability of cryptocurrency provide an unprecedented opportunity for cybercriminals. 

When you tally the costs of cybercrimes, where cryptocurrency provides a game-changing level of means, motive and opportunity, don't stop at the costs in RW payouts, or any of the costs to businesses which might be covered by insurance, but by the cost of that insurance - and all the other costs in money, resources, talent and attention that have increased as a result. 

Draw up a society-wide balance sheet, put the costs on one side, and the benefits of cryptocurrency on the other.  Then ask: What's the score?
12 Free, Ready-to-Use Security Tools
Steve Zurier, Freelance Writer,  10/12/2018
Most IT Security Pros Want to Change Jobs
Dark Reading Staff 10/12/2018
6 Security Trends for 2018/2019
Curtis Franklin Jr., Senior Editor at Dark Reading,  10/15/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Flash Poll
The Risk Management Struggle
The Risk Management Struggle
The majority of organizations are struggling to implement a risk-based approach to security even though risk reduction has become the primary metric for measuring the effectiveness of enterprise security strategies. Read the report and get more details today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-18381
PUBLISHED: 2018-10-16
Z-BlogPHP 1.5.2.1935 (Zero) has a stored XSS Vulnerability in zb_system/function/c_system_admin.php via the Content-Type header during the uploading of image attachments.
CVE-2018-18382
PUBLISHED: 2018-10-16
Advanced HRM 1.6 allows Remote Code Execution via PHP code in a .php file to the user/update-user-avatar URI, which can be accessed through an "Update Profile" "Change Picture" (aka user/edit-profile) action.
CVE-2018-18374
PUBLISHED: 2018-10-16
XSS exists in the MetInfo 6.1.2 admin/index.php page via the anyid parameter.
CVE-2018-18375
PUBLISHED: 2018-10-16
goform/getProfileList in Orange AirBox Y858_FL_01.16_04 allows attackers to extract APN data (name, number, username, and password) via the rand parameter.
CVE-2018-18376
PUBLISHED: 2018-10-16
goform/getWlanClientInfo in Orange AirBox Y858_FL_01.16_04 allows remote attackers to discover information about currently connected devices (hostnames, IP addresses, MAC addresses, and connection time) via the rand parameter.