Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

12/16/2014
04:50 PM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

2014's Top Malware: Less Money, Mo' Problems

Here are the five most active malware packages to give attackers a huge ROI on a small investment.

Why reinvent the wheel when the first version rolls just fine? Black hat criminals certainly ascribe to this philosophy when it comes to the malware they use to carry out attacks. As illegal as it may be, the cybercrime game is fundamentally a business, and the bad guys are looking to improve their margin. According to new analysis from the Israeli security startup CyActive, the black market reflects this on a daily basis. Researchers identified the five malware families that offered hackers the biggest bang for their buck.

Among those malicious programs, a common theme emerged with all of them achieving their aims through recycling of code and refining previously perfected attack methods. Across the entire group, these five malicious attacks reused 37 components. As attackers reduce their operating costs, they create an unfair advantage over the good guys, who increasingly must spend more to deal with the ever-growing list of attacks to hit the corporate environment each day.

"Fighting malware is time-consuming and expensive, while 'recycling' malware for reuse is quick and cost-effective: for every dollar spent by black hat hackers, hundreds of dollars are spent by the IT security industry," the report explained. "This price tag imbalance is a key facilitator of the springboard from which cybercrime and cyber-terrorism are launched."

Tops on the list in this category is Snake, also known as Turla and Urubos, which CyActive ranked as the most effective and efficient malware of the year. A variant on malware that breached the US Department of Defense in 2008, Snake is still infiltrating government and military targets six years later and includes 12 reused components throughout its attack cycle. Next up is Black PoS, which is best known as the malware to hit Target and Home Depot in their megabreaches. With eight recycled components and costing just $1,800 on the black market, this malware offers the bad guys a ton of ROI.

In the No. 3 slot, Gyges is actually government-created malware that criminals have repurposed for other commercial attacks. It sports eight reused components, with stealth and encryption tools that were once used only in state-sponsored malware. Coming in fourth, Dragonfly reuses six common components to help attackers target industrial control systems used within the aviation, defense, and energy industries. Finally, No. 5 is ZBerp, a hybrid banking malware program that mashed up components from the wildly popular Zeus and Carberp packages that cropped up last year and targeted 450 financial institutions this year.

According to CyActive, these pieces of malware should offer a warning to security programs that they need to find more ways to bring the economics of security in line with the attacker's financial efficiency. "2015 marks the time to start thinking like hackers, rather than defenders, and move the unfair advantage to the good guys' side," the report advises.

Ericka Chickowski specializes in coverage of information technology and business innovation. She has focused on information security for the better part of a decade and regularly writes about the security industry as a contributor to Dark Reading.  View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 8/14/2020
Lock-Pickers Face an Uncertain Future Online
Seth Rosenblatt, Contributing Writer,  8/10/2020
Hacking It as a CISO: Advice for Security Leadership
Kelly Sheridan, Staff Editor, Dark Reading,  8/10/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
7 New Cybersecurity Vulnerabilities That Could Put Your Enterprise at Risk
In this Dark Reading Tech Digest, we look at the ways security researchers and ethical hackers find critical vulnerabilities and offer insights into how you can fix them before attackers can exploit them.
Flash Poll
The Changing Face of Threat Intelligence
The Changing Face of Threat Intelligence
This special report takes a look at how enterprises are using threat intelligence, as well as emerging best practices for integrating threat intel into security operations and incident response. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-17475
PUBLISHED: 2020-08-14
Lack of authentication in the network relays used in MEGVII Koala 2.9.1-c3s allows attackers to grant physical access to anyone by sending packet data to UDP port 5000.
CVE-2020-0255
PUBLISHED: 2020-08-14
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2020-10751. Reason: This candidate is a duplicate of CVE-2020-10751. Notes: All CVE users should reference CVE-2020-10751 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidenta...
CVE-2020-14353
PUBLISHED: 2020-08-14
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2017-18270. Reason: This candidate is a duplicate of CVE-2017-18270. Notes: All CVE users should reference CVE-2017-18270 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidenta...
CVE-2020-17464
PUBLISHED: 2020-08-14
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE-2020-17473
PUBLISHED: 2020-08-14
Lack of mutual authentication in ZKTeco FaceDepot 7B 1.0.213 and ZKBiosecurity Server 1.0.0_20190723 allows an attacker to obtain a long-lasting token by impersonating the server.