Attacks/Breaches

12/16/2014
04:50 PM
Connect Directly
Twitter
Twitter
RSS
E-Mail
50%
50%

2014's Top Malware: Less Money, Mo' Problems

Here are the five most active malware packages to give attackers a huge ROI on a small investment.

Why reinvent the wheel when the first version rolls just fine? Black hat criminals certainly ascribe to this philosophy when it comes to the malware they use to carry out attacks. As illegal as it may be, the cybercrime game is fundamentally a business, and the bad guys are looking to improve their margin. According to new analysis from the Israeli security startup CyActive, the black market reflects this on a daily basis. Researchers identified the five malware families that offered hackers the biggest bang for their buck.

Among those malicious programs, a common theme emerged with all of them achieving their aims through recycling of code and refining previously perfected attack methods. Across the entire group, these five malicious attacks reused 37 components. As attackers reduce their operating costs, they create an unfair advantage over the good guys, who increasingly must spend more to deal with the ever-growing list of attacks to hit the corporate environment each day.

"Fighting malware is time-consuming and expensive, while 'recycling' malware for reuse is quick and cost-effective: for every dollar spent by black hat hackers, hundreds of dollars are spent by the IT security industry," the report explained. "This price tag imbalance is a key facilitator of the springboard from which cybercrime and cyber-terrorism are launched."

Tops on the list in this category is Snake, also known as Turla and Urubos, which CyActive ranked as the most effective and efficient malware of the year. A variant on malware that breached the US Department of Defense in 2008, Snake is still infiltrating government and military targets six years later and includes 12 reused components throughout its attack cycle. Next up is Black PoS, which is best known as the malware to hit Target and Home Depot in their megabreaches. With eight recycled components and costing just $1,800 on the black market, this malware offers the bad guys a ton of ROI.

In the No. 3 slot, Gyges is actually government-created malware that criminals have repurposed for other commercial attacks. It sports eight reused components, with stealth and encryption tools that were once used only in state-sponsored malware. Coming in fourth, Dragonfly reuses six common components to help attackers target industrial control systems used within the aviation, defense, and energy industries. Finally, No. 5 is ZBerp, a hybrid banking malware program that mashed up components from the wildly popular Zeus and Carberp packages that cropped up last year and targeted 450 financial institutions this year.

According to CyActive, these pieces of malware should offer a warning to security programs that they need to find more ways to bring the economics of security in line with the attacker's financial efficiency. "2015 marks the time to start thinking like hackers, rather than defenders, and move the unfair advantage to the good guys' side," the report advises.

Ericka Chickowski specializes in coverage of information technology and business innovation. She has focused on information security for the better part of a decade and regularly writes about the security industry as a contributor to Dark Reading.  View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
WebAuthn, FIDO2 Infuse Browsers, Platforms with Strong Authentication
John Fontana, Standards & Identity Analyst, Yubico,  9/19/2018
NSS Labs Files Antitrust Suit Against Symantec, CrowdStrike, ESET, AMTSO
Kelly Jackson Higgins, Executive Editor at Dark Reading,  9/19/2018
Turn the NIST Cybersecurity Framework into Reality: 5 Steps
Mukul Kumar & Anupam Sahai, CISO & VP of Cyber Practice and VP Product Management, Cavirin Systems,  9/20/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: Are you sure this is how we get our data into the cloud?
Current Issue
Flash Poll
The Risk Management Struggle
The Risk Management Struggle
The majority of organizations are struggling to implement a risk-based approach to security even though risk reduction has become the primary metric for measuring the effectiveness of enterprise security strategies. Read the report and get more details today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2015-8298
PUBLISHED: 2018-09-24
Multiple SQL injection vulnerabilities in the login page in RXTEC RXAdmin UPDATE 06 / 2012 allow remote attackers to execute arbitrary SQL commands via the (1) loginpassword, (2) loginusername, (3) zusatzlicher, or (4) groupid parameter to index.htm, or the (5) rxtec cookie to index.htm.
CVE-2018-14825
PUBLISHED: 2018-09-24
A skilled attacker with advanced knowledge of the target system could exploit this vulnerability by creating an application that would successfully bind to the service and gain elevated system privileges. This could enable the attacker to obtain access to keystrokes, passwords, personal identifiable...
CVE-2018-17437
PUBLISHED: 2018-09-24
Memory leak in the H5O_dtype_decode_helper() function in H5Odtype.c in the HDF HDF5 through 1.10.3 library allows attackers to cause a denial of service (memory consumption) via a crafted HDF5 file.
CVE-2018-17438
PUBLISHED: 2018-09-24
A SIGFPE signal is raised in the function H5D__select_io() of H5Dselect.c in the HDF HDF5 through 1.10.3 library during an attempted parse of a crafted HDF file, because of incorrect protection against division by zero. It could allow a remote denial of service attack.
CVE-2018-17439
PUBLISHED: 2018-09-24
An issue was discovered in the HDF HDF5 1.10.3 library. There is a stack-based buffer overflow in the function H5S_extent_get_dims() in H5S.c. Specifically, this issue occurs while converting an HDF5 file to a GIF file.