Endpoint

1/25/2018
02:45 PM
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail
50%
50%

Ransomware Detections Up 90% for Businesses in 2017

Last year, cybercriminals shifted from consumer to enterprise targets and leveraged ransomware as their weapon of choice.

Ransomware became the fifth-most-common threat for businesses in 2017 as detections increased by 90% from the previous year. Attacks also hit consumers hard, reaching a 93% detection rate year-over-year, reports Malwarebytes.

The company today released its "2017 State of Malware Report," which highlights trends based on telemetry data collected from products between January and November 2016, and January and November 2017. Analysts also pulled data from the company's threat-facing honeypots in 2017 and combined this with their own observations and analysis.

"2016 was the year of ransomware for consumers," says Malwarebytes CEO Marcin Kleczynski in an interview with Dark Reading. "2017 was the year of ransomware for businesses."

Malwarebytes' findings support a growing body of research highlighting the 2017 ransomware spike. The Online Trust Alliance (OTA) states attacks targeting businesses nearly doubled from 82,000 in 2016 to 159,000 last year. Ransomware attacks hit 134,000 in 2017 — double the 2016 count — and were the primary driver for the overall growth in cybercrime.

In its "2017 Global Threat Intelligence Report," NTT Security found 77% of all detected ransomware was in four industries: business and professional services (28%), government (19%), healthcare (15%), and retail (15%). Ransomware-related incidents were the most common, at 22%, and made up half of all attacks targeting the healthcare industry.

Malwarebytes researchers also noticed criminals got creative with delivery methods. Leaked government exploits — such as EternalBlue, used in WannaCry — in addition to compromised update processes and increased geo-targeting were used to evade detection.

Development of exploit kits hit a standstill last year. Analysts didn't detect any new zero-day exploits used by any exploit kits in the wild. It's a "significant change" from previous years, in which exploits were the primary method of infection. Cybercriminals are instead focusing on evading detection and integrating multiple exploits into Microsoft Office documents.

Attackers started leveraging cryptocurrency mining for financial gain and using victims' system resources to mine currencies. Tactics include compromised websites serving up drive-by mining code, miners delivered via malicious spam and exploit kit drops, and adware bundlers pushing miners.

Looking Ahead
Ransomware may have been hot in 2017, but, as all trends do, it has started to fade as businesses have smartened up and learned how to protect themselves. "You're seeing less and less returns, as a criminal," says Kleczynski of the ransomware slowdown. "It's now hard to find and infect a company that really gets impacted by ransomware like the [the UK's National Health Service] did."

Cybercriminals are pivoting toward banking Trojans, spyware, and hijackers to attack enterprise targets and spy, move throughout their networks, and steal data, including login credentials, contact lists, and credit card data. Banking Trojans were up 102% in the second half of 2017.

"The strategy of cybercriminals continues to shift," notes Kleczynski, adding that hijackers were up 40% overall last year. Spyware detections increased 30%, researchers found.

Looking toward the year ahead, he anticipates the largest incident in 2018 will be on the same level as the Mirai botnet that brought down major websites in October 2016. Mirai was "scratching the surface" on the number of unprotected IoT devices, he says.

"The biggest threat this year, in my opinion, is another Mirai-like attack," Kleczynski continues. "We'll see several this year that will take down major websites."

Related Content:

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
AnupG220
50%
50%
AnupG220,
User Rank: Author
1/28/2018 | 8:40:53 PM
Stockpiling BItcoin for ransomware attacks
Funny how we all used to shake our colletive heads at the companies that would stockpile bitcoin in case they got hit with a ransomware attack. Now it looks like they made a smart investment if they were stockpiling for some time. Hopefully they didn't need to pay up!
BrianN060
50%
50%
BrianN060,
User Rank: Ninja
1/25/2018 | 4:49:44 PM
What's the score? II
"Attackers started leveraging cryptocurrency mining for financial gain and using victims' system resources to mine currencies. Tactics include..."

You can add: disguising as ransomware. 

Cryptocurrency isn't the only means of processing a ransomware payoff; but the advantages are obvious.  Also obvious is that the proliferation of ransomware strains, attacks and attackers coincides with the emergence of cryptocurrencies. 

That a successful RW attack requires the same sort of unauthorized requisition of the victim's computing device's resources, as would enable cryptocurrency mining, is obvious, as well. 

In both cases, the characteristics and availability of cryptocurrency provide an unprecedented opportunity for cybercriminals. 

When you tally the costs of cybercrimes, where cryptocurrency provides a game-changing level of means, motive and opportunity, don't stop at the costs in RW payouts, or any of the costs to businesses which might be covered by insurance, but by the cost of that insurance - and all the other costs in money, resources, talent and attention that have increased as a result. 

Draw up a society-wide balance sheet, put the costs on one side, and the benefits of cryptocurrency on the other.  Then ask: What's the score?
Want Your Daughter to Succeed in Cyber? Call Her John
John De Santis, CEO, HyTrust,  5/16/2018
Don't Roll the Dice When Prioritizing Vulnerability Fixes
Ericka Chickowski, Contributing Writer, Dark Reading,  5/15/2018
New Mexico Man Sentenced on DDoS, Gun Charges
Dark Reading Staff 5/18/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: "Security through obscurity"
Current Issue
Flash Poll
[Strategic Security Report] How Enterprises Are Attacking the IT Security Problem
[Strategic Security Report] How Enterprises Are Attacking the IT Security Problem
Enterprises are spending more of their IT budgets on cybersecurity technology. How do your organization's security plans and strategies compare to what others are doing? Here's an in-depth look.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-2607
PUBLISHED: 2018-05-21
jenkins before versions 2.44, 2.32.2 is vulnerable to a persisted cross-site scripting vulnerability in console notes (SECURITY-382). Jenkins allows plugins to annotate build logs, adding new content or changing the presentation of existing content while the build is running. Malicious Jenkins users...
CVE-2018-1108
PUBLISHED: 2018-05-21
kernel drivers before version 4.17-rc1 are vulnerable to a weakness in the Linux kernel's implementation of random seed data. Programs, early in the boot sequence, could use the data allocated for the seed before it was sufficiently generated.
CVE-2018-11330
PUBLISHED: 2018-05-21
An issue was discovered in Pluck before 4.7.6. There is authenticated stored XSS because the character set for filenames is not properly restricted.
CVE-2018-11331
PUBLISHED: 2018-05-21
An issue was discovered in Pluck before 4.7.6. Remote PHP code execution is possible because the set of disallowed filetypes for uploads in missing some applicable ones such as .phtml and .htaccess.
CVE-2018-7687
PUBLISHED: 2018-05-21
The Micro Focus Client for OES before version 2 SP4 IR8a has a vulnerability that could allow a local attacker to elevate privileges via a buffer overflow in ncfsd.sys.