Ransomware, Phishing And Botnets

There has been a 17% increase in cyberattacks over the past year and many organisations have begun to take cyber security far more seriously but have not yet done enough to really reduce the threats to their organisation. 

Now Webroot has released its annual Nastiest Malware list, shedding light on 2019’s worst cyber security threats. 

From ransomware strains and crypto-mining campaigns that delivered the most attack payloads to phishing attacks that wreaked the most havoc, it’s clear that cyber threats across the board are becoming more advanced and difficult to detect.

Ransomware

Ransomware is any malware that holds your data ransom. These days it usually involves encrypting a victim’s data before asking for cash (typically crypto-currency) to decrypt it. Ransomware ruled the malware world since late 2013, but finally saw a decline last year. The general drop in malware numbers, along with defensive improvements by the IT world in general (such as more widespread backup adoption), were factors, but have also led this threat to become more targeted and ruthless.

Ransomware continued to see success by evolving a more targeted model initially adopted in previous years. SMBs are the prime target as they struggle with limited security budget and skills. 

Whether its phishing attacks targeting employees or brute forcing unsecured RDP, ransomware is as effective as ever, cementing its place on our list for another year. The nastiest include:

Emotet and Trickbot and Ryuk (“Triple Threat”) – One of the most successful chains of 2019 in terms of financial damages. These strains have shifted their focus to more reconnaissance-based operations. They assign a value to the targeted network post infection and then send the ransom for that amount after moving laterally and deploying the ransomware.

Trickbot/Ryuk – The second stage payload for Emotet in the first half of 2019, Ryuk infections that are typically delivered by Trickbot result in the mass encryption of entire networks.

Dridex/Bitpaymer – Dridex is now being used as an implant in the Bitpaymer ransomware infection chain and is also being delivered as a second stage payload off of Emotet.

GandCrab – One the most successful instance of RaaS (ransomware-as-a-service) to date, the authors have boasted shared profits in excess of $2 billion.

Sodinokibi – Sodin / REvil – This combination arose after the retirement of GandCrab. It’s not uncommon for successful threat actors who receive a lot of attention to try to start new projects in an attempt remain successful.

Crysis/Dharma – Back for its second year on the Nastiest Malware list, this ransomware was actively distributed in the first half of 2019. Almost all infections observed were distributed through RDP compromise.

Phishing

Email-based malware campaigns increased dramatically in complexity and believability in 2019. Phishing campaigns became more personalised and extortion emails claimed to have captured lude behavior using compromised passwords. The nastiest phishing attacks include:

Company impersonation – The biggest security concern at the office is often an employee, not a hacker in some remote location. The year 2019 continued to prove that failure to follow best practices, including reuse and sharing of passwords and familiarity with the top impersonated brands like Microsoft, Facebook, Apple, Google and PayPal, caused significant damage.

Business Email Compromise (BEC) – In 2019 there was a rise of email address hijacking and deepfakes. Individuals who are responsible for sending payments or purchasing gift cards were targeted through spoof email accounts impersonating company executives or familiar parties. Victims were tricked into giving up wire transfers, credentials, gift cards and more.

Botnets 

Botnets remained a dominant force in the infection attack chain. No other type of malware delivered more payloads of ransomware or crypto-mining. The three nastiest include:

Emotet – The most prevalent malware of 2018 continued its dominance in 2019. Despite a brief shutdown in June, Emotet resurfaced in September as the largest botnet delivering varying malicious payloads.

Trickbot – Trickbot’s modular infrastructure makes it a serious threat for any network it infects. Its combination with Ryuk ransomware is one of the more devastating targeted attacks of 2019.

Dridex – Once considered one of the most prominent banking Trojans, Dridex is now used as an implant in the infection chain with Bitpaymer ransomware.

Crypto-mining and Crypto-jacking

The explosive growth of crypto-jacking sites in 2017-2018 is gone. Crypto-mining will not die entirely, however, because it is low-risk, guaranteed money, while also less “malicious” and profitable than ransomware. The nastiest campaigns of 2019 include:

Hidden Bee – An exploit delivering crypto-mining payloads, Hidden Bee first started last year with IE exploits and has now evolved into payloads inside JPEG and PNG images through stenography and WAV media formats flash exploits.

Retadup – A crypto-mining worm with over 850,000 infections, Retadup was removed in August by Cybercrime Fighting Center (C3N) of the French National Gendarmerie after they took control of the malware’s command and control server.

HelpNetSecuriy 1        HelpNetSecurity 2:              Webroot 1          Webroot 2 


You Might Also Read:

New Ransomware Formats Double:

Malware Has Increased By 64%:

 

 

« Artificial Intelligence & The Ethics Of War
BBC Goes To The Darkside On Tor »

ManageEngine
CyberSecurity Jobsite
Check Point

Directory of Suppliers

ZenGRC

ZenGRC

ZenGRC (formerly Reciprocity) is a leader in the GRC SaaS landscape, offering robust and intuitive products designed to make compliance straightforward and efficient.

Syxsense

Syxsense

Syxsense brings together endpoint management and security for greater efficiency and collaboration between IT management and security teams.

DigitalStakeout

DigitalStakeout

DigitalStakeout enables cyber security professionals to reduce cyber risk to their organization with proactive security solutions, providing immediate improvement in security posture and ROI.

Tines

Tines

The Tines security automation platform helps security teams automate manual tasks, making them more effective and efficient.

The PC Support Group

The PC Support Group

A partnership with The PC Support Group delivers improved productivity, reduced costs and protects your business through exceptional IT, telecoms and cybersecurity services.

CERT.hr

CERT.hr

CERT.hr is the national authority competent for prevention and protection from computer threats to public information systems in the Republic of Croatia.

ISTQB

ISTQB

ISTQB has defined the "ISTQB Certified Tester" scheme that has become the world-wide leader in the certification of competences in software testing.

Onapsis

Onapsis

Onapsis is a pioneer in cybersecurity and compliance solutions for cloud and on-premise ERP and business-critical applications.

Sysmosoft

Sysmosoft

Sysmosoft specializes in providing highly secured telecommunication solutions for mobile devices for companies requiring protected access to sensitive data remotely.

Vortiv

Vortiv

Vortiv Ltd (formerly known as Transaction Solutions International Ltd) is a technology based company focused on the cybersecurity and the cloud services sector.

Viakoo

Viakoo

Viakoo is an Enterprise IoT Applications Management company providing performance, security, and compliance. Viakoo enables you to be proactive in maintaining cyber hygiene and protecting your network

McCrary Institute - Auburn University

McCrary Institute - Auburn University

The McCrary Institute seeks practical solutions to real-world problems in the areas of cyber and critical infrastructure security.

FREE eBook: Practical Guide To Optimizing Your Cloud Deployments

FREE eBook: Practical Guide To Optimizing Your Cloud Deployments

AWS Marketplace eBook: Optimizing your cloud deployments to accelerate cloud activities, reduce costs, and improve customer experience.

Innefu Labs

Innefu Labs

Innefu is an Information Security R&D startup, providing cutting edge Information Security & Data Analytics solutions.

Liminal

Liminal

Liminal is a boutique strategy advisory firm serving digital identity, fintech, and cybersecurity clients, and the private equity / venture capital community.

Prescient Solutions

Prescient Solutions

Prescient Solutions is a managed services provider, using a cloud-based model to provide IT solutions to small, mid-sized, global organizations and government entities.

Prime Technology Services

Prime Technology Services

Prime Tech are a group of Red Hat, Microsoft & Cisco Certified IT Professionals with an impressive track record of consistently delivering value to our corporate clients.

Department of Homeland Security (DHS) - USA

Department of Homeland Security (DHS) - USA

The Department of Homeland Security has a vital mission: to secure the nation from the many threats we face. Our duties are wide-ranging, but our goal is clear - keeping America safe.

Avalor

Avalor

Avalor are on a mission to help security teams make faster, more accurate decisions by making sense of their data. With Avalor you can bring in data from anywhere, normalize it and analyze it.

Solcon Capital

Solcon Capital

Solcon Capital is a forward-looking, technology-focused investment firm that is committed to identifying and investing in the most promising areas of innovation and development in the tech industry.

Messer Studios

Messer Studios

The most popular source for free CompTIA A+, Network+, and Security+ training - Professor Messer!