Vulnerabilities / Threats

3/22/2018
03:25 PM
Dark Reading
Dark Reading
Products and Releases
0%
100%

Cofense Malware Review Covers Trends and Predictions on Malware, Delivery Methods and Trending Attacks

Abuse of legitimate software, rapid exploitation of disclosed vulnerabilities and dynamic phishing techniques increase infection rates, according to the report

LEESBURG, VA. – March 22, 2018 – Cofense™, formerly known as PhishMe®, today announced the release of the 2018 Cofense Malware Review, A Look Back and a Look Forward, detailing the trends that defined malware attacks in 2017 and the emerging trends for network defenders to prioritize in 2018.

While a couple of high profile breaches stole the spotlight in 2017, Cofense’s global security team uncovered a number of less visible evolutions that dramatically changed the threat landscape and continue to pose threats. Malicious actors demonstrated how quickly they could exploit recently disclosed vulnerabilities, change how they use or modify malware, and how swiftly they could profit from new attack surfaces – including the proliferation of cryptocurrencies and the enterprises moving to cloud platforms.

Based on the analysis of millions of messages received daily from a wide range of sources, the report details notable insights on phishing-specific threats seen in 2017 and what is to come, including:

  • The proliferation of cryptominers. 2017 saw the rise of cryptominers infiltrating computers via phishing emails and recruiting of victims’ computers for their armies of cryptomining botnets. The compromised computers perform cryptocurrency mining to generate currency for the threat actors while reducing the efficiency of infected computers.
  • Surge in abuse of business-critical platform features. Office Macro scripting took the lead in Office-based attacks (almost 600 campaigns analyzed), making use of Windows-based interoperability functionality for malicious purposes. Cofense analyzed nearly a hundred campaigns that abused Microsoft Office Object Linking and Embedding (OLE).
  • Massive amount of new ransomware campaigns. While 2016’s Locky and Cerber ransomware continued to hold encrypted files hostage in 2017, several prominent new ransomware families also emerged in major phishing campaigns. In fact, five of the top ten new malware varieties in phishing email were new ransomware varieties, demonstrating ransomware operators’ drive to evolve and survive. Many attackers require bitcoin as the preferred method of ransom payment, going as far as providing the victim step-by-step payment instructions using their cryptocurrency of choice.
  • The opportunism of disclosure. Threat actors quickly took advantage of disclosed or leaked vulnerabilities. After Microsoft Office’s Dynamic Data Exchange (DDE) abuse technique was disclosed by a security researcher, Cofense observed exploits across various malware utilities just a week later.

“Understanding what vulnerabilities malicious attackers took advantage of yesterday is critical when preparing for the threats of tomorrow,” said Aaron Higbee, Co-Founder and CTO at Cofense. “As delivery methods evolve daily and malware innovations accelerate, timely attack intelligence is critical and must extend across organizations. Now is the time for every inbox to be a sensor and every employee to be a security evangelist that can trigger organization-wide security orchestration to break the attack kill chain at delivery.”

Looking ahead, the report finds that ransomware attacks will continue to develop, including more ransomware operators engaging in negotiations and the diversification in types of cryptocurrencies demanded. The financial success of ransomware campaigns proves that crime does pay for malicious actors looking for fast profitability. The report also predicts cloud services will grow as an attack surface and we’ll continue to see the development of more enhanced malware delivery attacks.

To learn more, you can download the full report here: https://cofense.com/malware-review-2018/

About Cofense

Cofense, formerly known as PhishMe, is the leading provider of human-driven phishing defense solutions world-wide. Cofense delivers a collaborative approach to cybersecurity by enabling organization-wide engagement to active email threats. Our collective defense suite combines timely attack intelligence sourced from employees with best-in-class incident response technologies to stop attacks faster and stay ahead of breaches. Cofense customers include Global 1000 organizations in defense, energy, financial services, healthcare and manufacturing sectors that understand how changing user behavior will improve security, aid incident response and reduce the risk of compromise.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
12 Free, Ready-to-Use Security Tools
Steve Zurier, Freelance Writer,  10/12/2018
Most IT Security Pros Want to Change Jobs
Dark Reading Staff 10/12/2018
6 Security Trends for 2018/2019
Curtis Franklin Jr., Senior Editor at Dark Reading,  10/15/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Flash Poll
The Risk Management Struggle
The Risk Management Struggle
The majority of organizations are struggling to implement a risk-based approach to security even though risk reduction has become the primary metric for measuring the effectiveness of enterprise security strategies. Read the report and get more details today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-10839
PUBLISHED: 2018-10-16
Qemu emulator <= 3.0.0 built with the NE2000 NIC emulation support is vulnerable to an integer overflow, which could lead to buffer overflow issue. It could occur when receiving packets over the network. A user inside guest could use this flaw to crash the Qemu process resulting in DoS.
CVE-2018-13399
PUBLISHED: 2018-10-16
The Microsoft Windows Installer for Atlassian Fisheye and Crucible before version 4.6.1 allows local attackers to escalate privileges because of weak permissions on the installation directory.
CVE-2018-18381
PUBLISHED: 2018-10-16
Z-BlogPHP 1.5.2.1935 (Zero) has a stored XSS Vulnerability in zb_system/function/c_system_admin.php via the Content-Type header during the uploading of image attachments.
CVE-2018-18382
PUBLISHED: 2018-10-16
Advanced HRM 1.6 allows Remote Code Execution via PHP code in a .php file to the user/update-user-avatar URI, which can be accessed through an "Update Profile" "Change Picture" (aka user/edit-profile) action.
CVE-2018-18374
PUBLISHED: 2018-10-16
XSS exists in the MetInfo 6.1.2 admin/index.php page via the anyid parameter.