Cloud

6/1/2016
05:00 PM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

Ransomware Domains Up By 3,500% In Q1

Cybercriminals know a good thing when they see it.

In just one quarter, researchers have observed a 35-fold jump in new domains created for ransomware. The recent surge means that ransomware-related domains now account the majority of new domains related to malware (excluding exploit kits), according to the new report by Infoblox.

Infoblox partly attributes the burst of new ransomware activity -- and actors -- to the fact that it has already proven to be so successful. "What has changed ... over the past quarter or two is a shift from small-money heists targeting consumers to larger, more profitable attacks on commercial entities," the report states. The biggest culprit: Locky, the ransoware that was reportedly responsible for the costly attack on a Los Angeles hospital.

Despite the huge leap in ransomware, neither it alone nor even the entire malware category account for the most malicious domains. That prize goes to exploit kits -- which beat out malware, phishing, DDoS, and data exfiltration attack-related domains for the dubious honor. Exploit kits account for nearly 50% of Infoblox's DNS Threat Index, which measures the level of malicious domain creation, excluding domain generation algorithms and sub-domain resellers.

Angler remains the top dog of the exploit kits (for seven quarters running), but RIG jumped to second place, and Neutrino, which has always hovered near the bottom of the pile, tripled its share of the EK market (18%).

Infoblox's last noteworthy finding was that "much like cockroaches that scurry from the light, cybercriminals are quick to shift to a more advantageous location as needed." Meaning in this case that criminals have shifted the physical location of much of their malicious DNS infrastructure. Although the lion's share continues to be in the US (though it has dropped), nearly all of the infrastructure has been moved out of Germany -- dropping from about 20%  to less than 2%. In its place, Portugal, the Netherlands, the United Kingdom, Iceland, and the Russian Federation, now collectively account for half of the malicious infrastructure. 

Related Content:

 

Sara Peters is Senior Editor at Dark Reading and formerly the editor-in-chief of Enterprise Efficiency. Prior that she was senior editor for the Computer Security Institute, writing and speaking about virtualization, identity management, cybersecurity law, and a myriad ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
defenderAlex
50%
50%
defenderAlex,
User Rank: Apprentice
12/6/2016 | 5:40:00 AM
locky ransomware
Given the fact how quickly changes Locky ransomware, I think soon he will come to the fore. And that's bad news. Necessary preventive measures and backup!
theb0x
100%
0%
theb0x,
User Rank: Ninja
6/3/2016 | 10:55:32 AM
That's not that much...
Because the fact that the domain registration process can be completely scripted and automated this does not shock me at all.
Higher Education: 15 Books to Help Cybersecurity Pros Be Better
Curtis Franklin Jr., Senior Editor at Dark Reading,  12/12/2018
'PowerSnitch' Hacks Androids via Power Banks
Kelly Jackson Higgins, Executive Editor at Dark Reading,  12/8/2018
How Well Is Your Organization Investing Its Cybersecurity Dollars?
Jack Jones, Chairman, FAIR Institute,  12/11/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: When Harry Met Sally
Current Issue
10 Best Practices That Could Reshape Your IT Security Department
This Dark Reading Tech Digest, explores ten best practices that could reshape IT security departments.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-7690
PUBLISHED: 2018-12-13
A potential Remote Unauthorized Access in Micro Focus Fortify Software Security Center (SSC), versions 17.10, 17.20, 18.10 this exploitation could allow Remote Unauthorized Access
CVE-2018-7691
PUBLISHED: 2018-12-13
A potential Remote Unauthorized Access in Micro Focus Fortify Software Security Center (SSC), versions 17.10, 17.20, 18.10 this exploitation could allow Remote Unauthorized Access
CVE-2018-8033
PUBLISHED: 2018-12-13
The OFBiz HTTP engine (org.apache.ofbiz.service.engine.HttpEngine.java) handles requests for HTTP services via the /webtools/control/httpService endpoint. Both POST and GET requests to the httpService endpoint may contain three parameters: serviceName, serviceMode, and serviceContext. The exploitati...
CVE-2018-20127
PUBLISHED: 2018-12-13
An issue was discovered in zzzphp cms 1.5.8. del_file in /admin/save.php allows remote attackers to delete arbitrary files via a mixed-case extension and an extra '.' character, because (for example) "php" is blocked but path=F:/1.phP. succeeds.
CVE-2018-20128
PUBLISHED: 2018-12-13
An issue was discovered in UsualToolCMS v8.0. cmsadmin\a_sqlback.php allows remote attackers to delete arbitrary files via a backname[] directory-traversal pathname followed by a crafted substring.