IBM X Force Dissect The Destructive Power Of Malware

Destructive malware that disables access to data or destroys system functions has been expanding across geographies and industries over the past few years. Organisations previously thought safe from this form of cyber aggression increasingly finds themselves affected, either directly or indirectly. 

IBM has produced a Report called Combating Destructive Malware, which explains the significant effects and the lessons learnt.

The cost of a destructive malware infection can be significant for an organisation. In fact, IBM X-Force Incident Response and Intelligence Services (IRIS) estimates that victimised organisations on average experience a total cost of over $200 million and have more than 12,000 devices destroyed in an attack. Recovery from destructive malware can also require hundreds of hours to remediate and rebuild environments that have been destroyed. 

The NotPetya malware that hit organisations across the globe is a stark example of the costly damage that destructive malware can leave in its wake. According to a White House assessment, NotPetya caused serious business disruption across geographies and resulted in more than $10 billion in total damages. 

IBM X-Force IRIS’ team of veteran intelligence and response specialists have amassed data and real-world experience from responding to and analyzing a variety of destructive malware incidents. 

What is Destructive Malware? 
Destructive malware is malicious software with the capability to render affected systems inoperable and challenge reconstitution. Most destructive malware variants cause destruction through the deletion or wiping of les that are critical to the operating system’s ability to run. 

In a few cases, such as the Stuxnet worm, destructive malware used by nation-state actors and was designed to destroy industrial equipment by sending tailored messages to turbines that caused them to malfunction and become inoperable. 
Historically, destructive malware such as Stuxnet, Shamoon, and Dark Seoul, was primarily used by nation-state actors. However, especially since late 2018, cybercriminals have been incorporating wiper elements into their attacks, such as with new strains of ransomware like LockerGoga and MegaCortex. 

Who uses Destructive Malware, and why? 
Between the years 2010 and 2018, destructive malware was primarily used by nation-state actors to further state interests. A classic intent of destructive malware is to cause harm to a geopolitical opponent. Some examples include the destruction of nuclear centrifuges in Iran, or debilitating operations of key industry organisations worldwide. 

Cybercriminals may be adopting these destructive elements to add pressure to their demands that victims pay the ransom, adding irreparable data destruction to encryption as a potential repercussion. Alternatively, criminals may be using wiper malware to lash out at victims if they feel wronged, using destructive attacks more impulsively rather than strategically. 

The impact and cost of Destructive Malware 
The amount of damage companies experience in a destructive malware attack can be difficult to quantify, but X-Force IRIS has assembled some informed estimations based on IBM’s analysis of several publicly disclosed attacks. 

On average, large multinational companies appear to incur costs around $239 million, per incident, according to our analysis of several publicly disclosed attacks. 

This number is 61 times greater than the cost of a typical data breach, which the Ponemon Institute places at $3.92 million on average for companies worldwide, underscoring the significant cost destructive malware attacks can incur. Yet it is apparent that the actors behind the activity are still human, and not robots.

IBM have tracked changes in behavior by destructive malware attackers when they find incident responders are conducting detection and containment work on networks they have compromised. They lose composure, unwittingly reveal their actions, and react in ways that can prevent them from accomplishing their objectives. 

Where is destructive malware going next? 
Based on data from our incident response teams, managed security services, and open source information, IBM X-Force IRIS assesses that destructive malware attacks are continuing to grow in popularity and effectiveness. As we move into the second half of 2019, additional cyber-criminal groups, particularly those intent on conducting ransomware attacks, are recognising the utility of having a wiping mechanism built into their tools. 

This type of mechanism can provide adversaries with additional options to pressure victims, while simultaneously increasing the risk of an attack that will require disaster recovery. 

This trend leads us to believe that more financially-motivated cybercriminal groups are likely to explore destructive malware as an option to incorporate into current attacks, a task made easier when dark web markets provide these tools at relatively humble costs. 

These tactics suggest that, at least at present, destructive malware tends to lay in the hands of the most advanced cybercriminal groups or nation-state actors. However, if the popularity of these tools continues to grow, destructive malware capabilities may become a reality for groups we tend to associate with lower levels of sophistication, such as some hacktivist groups or even terrorists. 

In terms of geographical focus, IBM anticipate that the effects of destructive malware attacks are likely to grow. 
For example, targets located in the United States and Europe are increasingly falling victim to destructive malware attacks using destructive ransomware such as LockerGoga and MegaCortex. 

Destructive malware attacks in the Middle East and Asia are likely to continue, and have the potential to spread to other geographies as well. It is wise to prepare for the scenario of a destructive attack in all parts of the globe. 

IBM-X-Force

You Might Also Read:

Malware Attacks Drop As Encrypted Attacks Increase

Alarming Trends In Data Theft:

 

« Five New Security Trends Relevant To Your Business
FBI Turns To Social Media To Track Shooters »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

DigitalStakeout

DigitalStakeout

DigitalStakeout enables cyber security professionals to reduce cyber risk to their organization with proactive security solutions, providing immediate improvement in security posture and ROI.

ZenGRC

ZenGRC

ZenGRC - the first, easy-to-use, enterprise-grade information security solution for compliance and risk management - offers businesses efficient control tracking, testing, and enforcement.

UK Cyber Week Expo & Conference

UK Cyber Week Expo & Conference

Award-winning event organiser ROAR B2B announces the launch of UK Cyber Week and its inaugural event on 4 and 5 April 2023 at the Business Design Centre, London.

NordLayer

NordLayer

NordLayer is an adaptive network access security solution for modern businesses — from the world’s most trusted cybersecurity brand, Nord Security. 

Perimeter 81 / How to Select the Right ZTNA Solution

Perimeter 81 / How to Select the Right ZTNA Solution

Gartner insights into How to Select the Right ZTNA offering. Download this FREE report for a limited time only.

DeviceLock

DeviceLock

DeviceLock is a leading provider of endpoint device/port control and data leak prevention software.

Rubicon Workflow Solutions

Rubicon Workflow Solutions

Rubicon is a leading provider of managed IT support and strategic services, specialising in creative and mixed platform environments.

Axiomatics

Axiomatics

Axiomatics provides dynamic authorization and access control solutions to protect critical data assets.

CompliancePoint

CompliancePoint

We design and implement strategies, processes & procedures to mitigate risk, reach compliance goals, protect data assets, and meet industry standards.

DEFCON Cyber

DEFCON Cyber

DEFCON CYBER is a solution that seamlessly molds a new, or existing, cybersecurity program into a highly effective risk management operation.

Sabasai

Sabasai

Sabasai specialises in all aspects of insider threat management from training and education to building security frameworks and insider threat programs to on-site risk & vulnerability assessments.

FileWave

FileWave

FileWave offers a single solution for managing apps, devices, and more for Mac, Windows, and mobile devices.

Edureka

Edureka

Edureka is an online technology training provider with the most effective learning system in the world. We help professionals learn trending technologies for career growth.

Hex-Rays

Hex-Rays

Founded in 2005, privately held, Belgium based, Hex-Rays SA focuses on the development of fast, stable, and robust binary analysis tools for the IT security market.

Venari Security

Venari Security

Venari is an award-winning cybersecurity SaaS provider that has developed an ETA (Encrypted Traffic Analysis) platform which fundamentally changes the way encrypted traffic is analysed.

RankedRight

RankedRight

RankedRight empowers security teams to take immediate action on their most critical risks.

Birch Cline Cybersecurity

Birch Cline Cybersecurity

Birch Cline specializes in helping Local Government and Education agencies, as well as mid-market organizations, build and maintain successful cybersecurity programs.

Arcserve

Arcserve

Defend your data with Arcserve all-in-one data protection and management solutions designed to be the right fit for your business, regardless of size or complexity.

International Association of Financial Crimes Investigators (IAFCI)

International Association of Financial Crimes Investigators (IAFCI)

International Association of Financial Crimes Investigators provides services and information about financial fraud, fraud investigation and fraud prevention.

Hook Security

Hook Security

Setting a new standard in security awareness. Hook Security is a people-first company that uses psychological security training to help companies create security-aware culture.

Strategic Technology Solutions (STS)

Strategic Technology Solutions (STS)

Strategic Technology Solutions specialize in providing Cybersecurity and Managed IT Services to the legal industry.