Crypto-Mining For Cyber Criminals

WatchGuard threat intelligence from Q1 2018 revealed that 98.8 percent of seemingly common Linux/Downloader malware variants were actually designed to deliver a popular Linux-based crypto-currency miner. 

This is just one of several signs that malicious crypto-mining malware is becoming a top tactic among cyber criminals.

“Our Threat Lab team has uncovered multiple indicators that suggest malicious crypto miners are becoming a mainstay in cyber criminals’ arsenals, and will continue to grow more dominant in Q2,” said Corey Nachreiner, CTO at WatchGuard Technologies. 

“While ransomware and other advanced threats are still a major concern, these new crypto-miner attacks illustrate that bad actors are constantly adjusting their tactics to find new ways to take advantage of their victims. 
“In fact, once again in Q1, we saw nearly half of all malware slip past basic signature-based antivirus solutions due to various obfuscation methods. 

“One way every organisation can become more secure against these sophisticated, evasive threats is to deploy defenses enabled with advanced malware prevention.”

Crypto-currency miners are on the rise
Several crypto-currency miners appeared for the first time in WatchGuard’s list of the top 25 malware variants. Firebox appliances have a rule called Linux/Downloader, which catches a variety of Linux “dropper” or “downloader” programs that download and run malware payloads. 

Usually these droppers download a wide range of malware, but in Q1 2018, 98.8 percent of Linux/Downloader instances were trying to download the same popular Linux-based crypto miner. Evidence from Q2 so far indicates that crypto-mining malware will stay on WatchGuard’s top 25 list and may even crack the top 10 by the end of the quarter.

The Ramnit Trojan makes a comeback in Italy
The only malware sample on WatchGuard’s top 10 list that hadn’t appeared in a past report was Ramnit, a Trojan that first emerged in 2010 and had a brief resurgence in 2016. Nearly all (98.9 percent) of WatchGuard’s Ramnit detections came from Italy, indicating a targeted attack campaign. 

Since past versions of Ramnit have targeted banking credentials, WatchGuard advises Italians to take extra precautions with their banking information and enable multi-factor authentication for any financial accounts.

For the first time, APAC reports the highest Malware volume
In past reports, APAC has trailed EMEA and AMER in the number of reported malware hits by a wide margin. In Q1 2018, APAC received the most malware overall. The vast majority of these attacks were Windows-based malware and 98 percent were aimed at India and Singapore.

Nearly half of all malware eludes basic AV solutions
Zero-day malware (a term for malware that is able to evade traditional signature-based AV) accounted for 46 percent of all malware in Q1. This level of zero-day malware suggests that criminals are continuing to use obfuscation techniques to beat traditional AV services, emphasising the importance of behavior-based defenses.

Mimikatz targets the US, skips Asia Pacific
The Mimikatz Windows credential-stealing malware reappeared on WatchGuard’s top 10 malware list after several quarters of absence. Two thirds of the detection of this malware was in the United States and under 0.1 percent of detections were in APAC, possibly due to the complexity of double-byte characters in countries like Japan that use a symbol-based language for passwords.

HelpNetSecurity

You Might Also Read:

Crypto Mining Malware Hits Business:

13 Ways Cyber Criminals Spread Malware:

 

« Cybercrime & Terrorism Threaten South Africa
Blockchain For US Border Security »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Resecurity, Inc.

Resecurity, Inc.

Resecurity is a cybersecurity company that delivers a unified platform for endpoint protection, risk management, and cyber threat intelligence.

CYRIN

CYRIN

CYRIN® Cyber Range. Real Tools, Real Attacks, Real Scenarios. See why leading educational institutions and companies in the U.S. have begun to adopt the CYRIN® system.

IT Governance

IT Governance

IT Governance is a leading global provider of information security solutions. Download our free guide and find out how ISO 27001 can help protect your organisation's information.

XYPRO Technology

XYPRO Technology

XYPRO is the market leader in HPE Non-Stop Security, Risk Management and Compliance.

DigitalStakeout

DigitalStakeout

DigitalStakeout enables cyber security professionals to reduce cyber risk to their organization with proactive security solutions, providing immediate improvement in security posture and ROI.

HireVergence

HireVergence

HireVergence is a full service IT staffing and recruiting firm with a focus on cyber and information security.

mnemonic

mnemonic

mnemonic helps businesses manage their security risks, protect their data and defend against cyber threats.

ATSEC Information Security

ATSEC Information Security

ATSEC is an independent, privately-owned company that focuses on providing laboratory and consulting services for information security.

Lynx Technology Partners

Lynx Technology Partners

Lynx Technology Partners is a full service, full life-cycle risk-based security consulting firm.

Zettaset

Zettaset

Zettaset’s XCrypt Data Encryption Platform delivers proven protection for Object, Relational/SQL, NoSQL, and Hadoop data stores…in the cloud and on-premises.

Spherical Defense

Spherical Defense

Spherical Defense offers an alternative approach to WAFs and first generation API security tools.

Secude

Secude

SECUDE is an established global security solutions provider offering innovative data protection for SAP users.

Maven Technologies

Maven Technologies

Maven Technologies specialize in secure data destruction, electronics recycling, asset management, and highly detailed reporting.

X-Ways Software Technology

X-Ways Software Technology

X-Ways provide software for computer forensics, electronic discovery, data recovery, low-level data processing, and IT security.

Secberus

Secberus

SECBERUS creates cloud security technology to help organizations stay secure & compliant in the public cloud.

Stamus Networks

Stamus Networks

Stamus Networks offers Scirius Security Platform solutions that marry real-time network traffic data with enhanced Suricata intrusion detection (IDS) and an advanced analytics engine.

Expel

Expel

Expel provide transparent managed security services, 24x7 detection, response and resilience.

Onclave Networks

Onclave Networks

Onclave Networks is a global cybersecurity leader, transforming the future of securing all IT/OT devices and systems.

Kontex

Kontex

Kontex is a Cyber Security consultancy creating resilient solutions. From Strategy, Advisory and Implementation to Management and everything in between.

Netstar

Netstar

Netstar is an IT Support company based in Central London providing fully managed IT Support, Cyber Security and Technology Consulting services.

Sikich

Sikich

Sikich LLP is a leading professional services firm specializing in accounting, advisory, technology and managed services.