Attacks/Breaches

12/16/2014
04:50 PM
Connect Directly
Twitter
Twitter
RSS
E-Mail
50%
50%

2014's Top Malware: Less Money, Mo' Problems

Here are the five most active malware packages to give attackers a huge ROI on a small investment.

Why reinvent the wheel when the first version rolls just fine? Black hat criminals certainly ascribe to this philosophy when it comes to the malware they use to carry out attacks. As illegal as it may be, the cybercrime game is fundamentally a business, and the bad guys are looking to improve their margin. According to new analysis from the Israeli security startup CyActive, the black market reflects this on a daily basis. Researchers identified the five malware families that offered hackers the biggest bang for their buck.

Among those malicious programs, a common theme emerged with all of them achieving their aims through recycling of code and refining previously perfected attack methods. Across the entire group, these five malicious attacks reused 37 components. As attackers reduce their operating costs, they create an unfair advantage over the good guys, who increasingly must spend more to deal with the ever-growing list of attacks to hit the corporate environment each day.

"Fighting malware is time-consuming and expensive, while 'recycling' malware for reuse is quick and cost-effective: for every dollar spent by black hat hackers, hundreds of dollars are spent by the IT security industry," the report explained. "This price tag imbalance is a key facilitator of the springboard from which cybercrime and cyber-terrorism are launched."

Tops on the list in this category is Snake, also known as Turla and Urubos, which CyActive ranked as the most effective and efficient malware of the year. A variant on malware that breached the US Department of Defense in 2008, Snake is still infiltrating government and military targets six years later and includes 12 reused components throughout its attack cycle. Next up is Black PoS, which is best known as the malware to hit Target and Home Depot in their megabreaches. With eight recycled components and costing just $1,800 on the black market, this malware offers the bad guys a ton of ROI.

In the No. 3 slot, Gyges is actually government-created malware that criminals have repurposed for other commercial attacks. It sports eight reused components, with stealth and encryption tools that were once used only in state-sponsored malware. Coming in fourth, Dragonfly reuses six common components to help attackers target industrial control systems used within the aviation, defense, and energy industries. Finally, No. 5 is ZBerp, a hybrid banking malware program that mashed up components from the wildly popular Zeus and Carberp packages that cropped up last year and targeted 450 financial institutions this year.

According to CyActive, these pieces of malware should offer a warning to security programs that they need to find more ways to bring the economics of security in line with the attacker's financial efficiency. "2015 marks the time to start thinking like hackers, rather than defenders, and move the unfair advantage to the good guys' side," the report advises.

Ericka Chickowski specializes in coverage of information technology and business innovation. She has focused on information security for the better part of a decade and regularly writes about the security industry as a contributor to Dark Reading.  View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Intel Says to Stop Applying Problematic Spectre, Meltdown Patch
Kelly Jackson Higgins, Executive Editor at Dark Reading,  1/22/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
The Year in Security: 2017
A look at the biggest news stories (so far) of 2017 that shaped the cybersecurity landscape -- from Russian hacking, ransomware's coming-out party, and voting machine vulnerabilities to the massive data breach of credit-monitoring firm Equifax.
Flash Poll
[Strategic Security Report] Navigating the Threat Intelligence Maze
[Strategic Security Report] Navigating the Threat Intelligence Maze
Most enterprises are using threat intel services, but many are still figuring out how to use the data they're collecting. In this Dark Reading survey we give you a look at what they're doing today - and where they hope to go.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-0290
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

CVE-2016-10369
Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

CVE-2016-8202
Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

CVE-2016-8209
Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

CVE-2017-0890
Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.