Endpoint

1/25/2018
02:45 PM
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail
50%
50%

Ransomware Detections Up 90% for Businesses in 2017

Last year, cybercriminals shifted from consumer to enterprise targets and leveraged ransomware as their weapon of choice.

Ransomware became the fifth-most-common threat for businesses in 2017 as detections increased by 90% from the previous year. Attacks also hit consumers hard, reaching a 93% detection rate year-over-year, reports Malwarebytes.

The company today released its "2017 State of Malware Report," which highlights trends based on telemetry data collected from products between January and November 2016, and January and November 2017. Analysts also pulled data from the company's threat-facing honeypots in 2017 and combined this with their own observations and analysis.

"2016 was the year of ransomware for consumers," says Malwarebytes CEO Marcin Kleczynski in an interview with Dark Reading. "2017 was the year of ransomware for businesses."

Malwarebytes' findings support a growing body of research highlighting the 2017 ransomware spike. The Online Trust Alliance (OTA) states attacks targeting businesses nearly doubled from 82,000 in 2016 to 159,000 last year. Ransomware attacks hit 134,000 in 2017 — double the 2016 count — and were the primary driver for the overall growth in cybercrime.

In its "2017 Global Threat Intelligence Report," NTT Security found 77% of all detected ransomware was in four industries: business and professional services (28%), government (19%), healthcare (15%), and retail (15%). Ransomware-related incidents were the most common, at 22%, and made up half of all attacks targeting the healthcare industry.

Malwarebytes researchers also noticed criminals got creative with delivery methods. Leaked government exploits — such as EternalBlue, used in WannaCry — in addition to compromised update processes and increased geo-targeting were used to evade detection.

Development of exploit kits hit a standstill last year. Analysts didn't detect any new zero-day exploits used by any exploit kits in the wild. It's a "significant change" from previous years, in which exploits were the primary method of infection. Cybercriminals are instead focusing on evading detection and integrating multiple exploits into Microsoft Office documents.

Attackers started leveraging cryptocurrency mining for financial gain and using victims' system resources to mine currencies. Tactics include compromised websites serving up drive-by mining code, miners delivered via malicious spam and exploit kit drops, and adware bundlers pushing miners.

Looking Ahead
Ransomware may have been hot in 2017, but, as all trends do, it has started to fade as businesses have smartened up and learned how to protect themselves. "You're seeing less and less returns, as a criminal," says Kleczynski of the ransomware slowdown. "It's now hard to find and infect a company that really gets impacted by ransomware like the [the UK's National Health Service] did."

Cybercriminals are pivoting toward banking Trojans, spyware, and hijackers to attack enterprise targets and spy, move throughout their networks, and steal data, including login credentials, contact lists, and credit card data. Banking Trojans were up 102% in the second half of 2017.

"The strategy of cybercriminals continues to shift," notes Kleczynski, adding that hijackers were up 40% overall last year. Spyware detections increased 30%, researchers found.

Looking toward the year ahead, he anticipates the largest incident in 2018 will be on the same level as the Mirai botnet that brought down major websites in October 2016. Mirai was "scratching the surface" on the number of unprotected IoT devices, he says.

"The biggest threat this year, in my opinion, is another Mirai-like attack," Kleczynski continues. "We'll see several this year that will take down major websites."

Related Content:

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
AnupG220
50%
50%
AnupG220,
User Rank: Author
1/28/2018 | 8:40:53 PM
Stockpiling BItcoin for ransomware attacks
Funny how we all used to shake our colletive heads at the companies that would stockpile bitcoin in case they got hit with a ransomware attack. Now it looks like they made a smart investment if they were stockpiling for some time. Hopefully they didn't need to pay up!
BrianN060
50%
50%
BrianN060,
User Rank: Ninja
1/25/2018 | 4:49:44 PM
What's the score? II
"Attackers started leveraging cryptocurrency mining for financial gain and using victims' system resources to mine currencies. Tactics include..."

You can add: disguising as ransomware. 

Cryptocurrency isn't the only means of processing a ransomware payoff; but the advantages are obvious.  Also obvious is that the proliferation of ransomware strains, attacks and attackers coincides with the emergence of cryptocurrencies. 

That a successful RW attack requires the same sort of unauthorized requisition of the victim's computing device's resources, as would enable cryptocurrency mining, is obvious, as well. 

In both cases, the characteristics and availability of cryptocurrency provide an unprecedented opportunity for cybercriminals. 

When you tally the costs of cybercrimes, where cryptocurrency provides a game-changing level of means, motive and opportunity, don't stop at the costs in RW payouts, or any of the costs to businesses which might be covered by insurance, but by the cost of that insurance - and all the other costs in money, resources, talent and attention that have increased as a result. 

Draw up a society-wide balance sheet, put the costs on one side, and the benefits of cryptocurrency on the other.  Then ask: What's the score?
Election Websites, Back-End Systems Most at Risk of Cyberattack in Midterms
Kelly Jackson Higgins, Executive Editor at Dark Reading,  8/14/2018
Intel Reveals New Spectre-Like Vulnerability
Curtis Franklin Jr., Senior Editor at Dark Reading,  8/15/2018
The Data Security Landscape Is Shifting: Is Your Company Prepared?
Francis Dinha, CEO & Co-Founder of OpenVPN,  8/13/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-1712
PUBLISHED: 2018-08-16
IBM API Connect's Developer Portal 5.0.0.0 through 5.0.8.3 is vulnerable to Server Side Request Forgery. An attacker, using specially crafted input parameters can trick the server into making potentially malicious calls within the trusted network. IBM X-Force ID: 146370.
CVE-2018-10139
PUBLISHED: 2018-08-16
The PAN-OS response page for GlobalProtect in Palo Alto Networks PAN-OS 6.1.21 and earlier, PAN-OS 7.1.18 and earlier, PAN-OS 8.0.11 and earlier may allow an unauthenticated attacker to inject arbitrary JavaScript or HTML. PAN-OS 8.1 is NOT affected.
CVE-2018-10140
PUBLISHED: 2018-08-16
The PAN-OS Management Web Interface in Palo Alto Networks PAN-OS 8.1.2 and earlier may allow an authenticated user to shut down all management sessions, resulting in all logged in users to be redirected to the login page. PAN-OS 6.1, PAN-OS 7.1 and PAN-OS 8.0 are NOT affected.
CVE-2018-11771
PUBLISHED: 2018-08-16
When reading a specially crafted ZIP archive, the read method of Apache Commons Compress 1.7 to 1.17's ZipArchiveInputStream can fail to return the correct EOF indication after the end of the stream has been reached. When combined with a java.io.InputStreamReader this can lead to an infinite stream,...
CVE-2018-1715
PUBLISHED: 2018-08-16
IBM Maximo Asset Management 7.6 through 7.6.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 14700...