Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

11/30/2016
10:30 AM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

Windows Malware Infections Spiked 106% From Black Friday To Cyber Monday

The number of infected PCs jumped some 106% during the holiday season's first shopping weekend and 118% above normal on Cyber Monday.

'Tis the season for gift-giving, snowfall - and cybercrime. The 2016 holiday shopping season has already proven risky, with malware infections in the US jumping 106% between Black Friday and Cyber Monday.

The data comes from Enigma Software Group (ESG), which compiled data on infections recorded in its SpyHunter program. ESG analyzed malware data in the month leading up to Thanksgiving and compared it with infections recorded between Nov. 25 and Nov. 28, 2016.

It's worth noting this data only applies to malware infections recorded on PCs, and does not include activity from smartphones or Apple products. 

The number of recorded infections has doubled year-over-year. This year's 106% jump marks a significant increase from the same weekend in 2015, when malware was 84% above normal. Malware activity peaked on Cyber Monday, when instances were 118% higher than normal.

ESG believes there are multiple drivers behind the malware surge, says spokesperson Ryan Gerding.

"The biggest thing is that there are more people who are shopping online every year," he explains. "What's more, the bad guys are getting smarter in tricking people into accidentally clicking on links that install malware on their computers."

Consumers are most likely to fall for emails that appear to come from legitimate companies. These messages may promise a free gift card or claim there is a problem with an order, but instead include a malicious link that will download malware onto the victim's computers. 

During the holidays, more people are shopping and anticipating these types of emails. They're more likely to click on a money-saving coupon or wonder if there really is a problem with their order. As a result, malware infections continue to climb.

Emails aside, hackers also abuse social media accounts and post status updates containing malicious links. Others bundle malware with software downloaded from the Internet; for example, programs that promise to bypass location-specific restrictions on services like Netflix.

The vast majority of these infections are "nuisanceware," says Gerding. They may slow down victims' PCs or cause a spike in pop-up ads; things that are annoying but not necessarily dangerous.

However, the occasional dangerous attacks do take place. Ransomware makes up a tiny percentage of infections, but it can be devastating when it hits. ESG discovered about 0.5% of all infections include ransomware.

It's a miniscule percentage, but Gerding notes the amount of infections made of ransomware has doubled since 2015. One year ago, ransomware made up about 0.25% of malware attacks. The trend promises ransomware will continue to grow as a consumer-facing threat in 2017.

"As long as the crooks are successful in getting people to pay a ransom, they'll keep trying to get infections out there on as many computers as possible," he says.

The ESG research was focused on consumers, but Gerding acknowledges the malware spike could also affect businesses.

"Wherever people are online is where the risk is," he says. "If they're at home the risk is at home; if they're at work, the risk is at work. We all know people don't spend 100% of their time at work doing work-specific things." 

The most important step users can take is backing up their data so if there is a problem, they can return to the settings they had prior to the attack. Both physical and cloud-based backups are recommended.

Users should also ensure they have automatic updates scheduled for their operating systems and any anti-malware program they have installed, he says.

Also, think twice before clicking, he says. Who is it coming from? Where is directing you to? Is it too good to be true? If an email from USPS, Amazon, eBay, Best Buy, or another company says there is a problem with an order, visit the website instead of following the link.

"It's the best way to protect yourself and ensure there is a legitimate issue," he says.

Related Content:

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Joe Stanganelli
50%
50%
Joe Stanganelli,
User Rank: Ninja
11/30/2016 | 6:19:44 PM
Comparisons
While I am glad to see comparisons to the same time period last year, to properly and entirely place this information into the right context, we also ought to know precisely how much online activity/traffic spiked over this period of time in each respective year.

To wit, if web traffic overall spiked 106% this year from Black Friday to Cyber Monday, then this would be exactly normal -- and merely an indicator of what happens when web traffic spikes.  If web traffic overall spiked a statistically significantly lower percentage, then theree is much more at play.
When It Comes To Security Tools, More Isn't More
Lamont Orange, Chief Information Security Officer at Netskope,  1/11/2021
US Capitol Attack a Wake-up Call for the Integration of Physical & IT Security
Seth Rosenblatt, Contributing Writer,  1/11/2021
IoT Vendor Ubiquiti Suffers Data Breach
Dark Reading Staff 1/11/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
2020: The Year in Security
Download this Tech Digest for a look at the biggest security stories that - so far - have shaped a very strange and stressful year.
Flash Poll
Assessing Cybersecurity Risk in Today's Enterprises
Assessing Cybersecurity Risk in Today's Enterprises
COVID-19 has created a new IT paradigm in the enterprise -- and a new level of cybersecurity risk. This report offers a look at how enterprises are assessing and managing cyber-risk under the new normal.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-25533
PUBLISHED: 2021-01-15
An issue was discovered in Malwarebytes before 4.0 on macOS. A malicious application was able to perform a privileged action within the Malwarebytes launch daemon. The privileged service improperly validated XPC connections by relying on the PID instead of the audit token. An attacker can construct ...
CVE-2021-3162
PUBLISHED: 2021-01-15
Docker Desktop Community before 2.5.0.0 on macOS mishandles certificate checking, leading to local privilege escalation.
CVE-2021-21242
PUBLISHED: 2021-01-15
OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, there is a critical vulnerability which can lead to pre-auth remote code execution. AttachmentUploadServlet deserializes untrusted data from the `Attachment-Support` header. This Servlet does not enforce any authentication or a...
CVE-2021-21245
PUBLISHED: 2021-01-15
OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, AttachmentUploadServlet also saves user controlled data (`request.getInputStream()`) to a user specified location (`request.getHeader("File-Name")`). This issue may lead to arbitrary file upload which can be used to u...
CVE-2021-21246
PUBLISHED: 2021-01-15
OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, the REST UserResource endpoint performs a security check to make sure that only administrators can list user details. However for the `/users/` endpoint there are no security checks enforced so it is possible to retrieve ar...