Attacks/Breaches

12/16/2014
04:50 PM
Connect Directly
Twitter
Twitter
RSS
E-Mail
50%
50%

2014's Top Malware: Less Money, Mo' Problems

Here are the five most active malware packages to give attackers a huge ROI on a small investment.

Why reinvent the wheel when the first version rolls just fine? Black hat criminals certainly ascribe to this philosophy when it comes to the malware they use to carry out attacks. As illegal as it may be, the cybercrime game is fundamentally a business, and the bad guys are looking to improve their margin. According to new analysis from the Israeli security startup CyActive, the black market reflects this on a daily basis. Researchers identified the five malware families that offered hackers the biggest bang for their buck.

Among those malicious programs, a common theme emerged with all of them achieving their aims through recycling of code and refining previously perfected attack methods. Across the entire group, these five malicious attacks reused 37 components. As attackers reduce their operating costs, they create an unfair advantage over the good guys, who increasingly must spend more to deal with the ever-growing list of attacks to hit the corporate environment each day.

"Fighting malware is time-consuming and expensive, while 'recycling' malware for reuse is quick and cost-effective: for every dollar spent by black hat hackers, hundreds of dollars are spent by the IT security industry," the report explained. "This price tag imbalance is a key facilitator of the springboard from which cybercrime and cyber-terrorism are launched."

Tops on the list in this category is Snake, also known as Turla and Urubos, which CyActive ranked as the most effective and efficient malware of the year. A variant on malware that breached the US Department of Defense in 2008, Snake is still infiltrating government and military targets six years later and includes 12 reused components throughout its attack cycle. Next up is Black PoS, which is best known as the malware to hit Target and Home Depot in their megabreaches. With eight recycled components and costing just $1,800 on the black market, this malware offers the bad guys a ton of ROI.

In the No. 3 slot, Gyges is actually government-created malware that criminals have repurposed for other commercial attacks. It sports eight reused components, with stealth and encryption tools that were once used only in state-sponsored malware. Coming in fourth, Dragonfly reuses six common components to help attackers target industrial control systems used within the aviation, defense, and energy industries. Finally, No. 5 is ZBerp, a hybrid banking malware program that mashed up components from the wildly popular Zeus and Carberp packages that cropped up last year and targeted 450 financial institutions this year.

According to CyActive, these pieces of malware should offer a warning to security programs that they need to find more ways to bring the economics of security in line with the attacker's financial efficiency. "2015 marks the time to start thinking like hackers, rather than defenders, and move the unfair advantage to the good guys' side," the report advises.

Ericka Chickowski specializes in coverage of information technology and business innovation. She has focused on information security for the better part of a decade and regularly writes about the security industry as a contributor to Dark Reading.  View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Higher Education: 15 Books to Help Cybersecurity Pros Be Better
Curtis Franklin Jr., Senior Editor at Dark Reading,  12/12/2018
'PowerSnitch' Hacks Androids via Power Banks
Kelly Jackson Higgins, Executive Editor at Dark Reading,  12/8/2018
Worst Password Blunders of 2018 Hit Organizations East and West
Curtis Franklin Jr., Senior Editor at Dark Reading,  12/12/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
10 Best Practices That Could Reshape Your IT Security Department
This Dark Reading Tech Digest, explores ten best practices that could reshape IT security departments.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-14623
PUBLISHED: 2018-12-14
A SQL injection flaw was found in katello's errata-related API. An authenticated remote attacker can craft input data to force a malformed SQL query to the backend database, which will leak internal IDs. This is issue is related to an incomplete fix for CVE-2016-3072. Version 3.10 and older is vulne...
CVE-2018-18093
PUBLISHED: 2018-12-14
Improper file permissions in the installer for Intel VTune Amplifier 2018 Update 3 and before may allow unprivileged user to potentially gain privileged access via local access.
CVE-2018-18096
PUBLISHED: 2018-12-14
Improper memory handling in Intel QuickAssist Technology for Linux (all versions) may allow an authenticated user to potentially enable a denial of service via local access.
CVE-2018-18097
PUBLISHED: 2018-12-14
Improper directory permissions in Intel Solid State Drive Toolbox before 3.5.7 may allow an authenticated user to potentially enable escalation of privilege via local access.
CVE-2018-3704
PUBLISHED: 2018-12-14
Improper directory permissions in the installer for the Intel Parallel Studio before 2019 Gold may allow authenticated users to potentially enable an escalation of privilege via local access.