Cybercriminals know a good thing when they see it.
In just one quarter, researchers have observed a 35-fold jump in new domains created for ransomware. The recent surge means that ransomware-related domains now account the majority of new domains related to malware (excluding exploit kits), according to the new report by Infoblox.
Infoblox partly attributes the burst of new ransomware activity -- and actors -- to the fact that it has already proven to be so successful. "What has changed ... over the past quarter or two is a shift from small-money heists targeting consumers to larger, more profitable attacks on commercial entities," the report states. The biggest culprit: Locky, the ransoware that was reportedly responsible for the costly attack on a Los Angeles hospital.
Despite the huge leap in ransomware, neither it alone nor even the entire malware category account for the most malicious domains. That prize goes to exploit kits -- which beat out malware, phishing, DDoS, and data exfiltration attack-related domains for the dubious honor. Exploit kits account for nearly 50% of Infoblox's DNS Threat Index, which measures the level of malicious domain creation, excluding domain generation algorithms and sub-domain resellers.
Angler remains the top dog of the exploit kits (for seven quarters running), but RIG jumped to second place, and Neutrino, which has always hovered near the bottom of the pile, tripled its share of the EK market (18%).
Infoblox's last noteworthy finding was that "much like cockroaches that scurry from the light, cybercriminals are quick to shift to a more advantageous location as needed." Meaning in this case that criminals have shifted the physical location of much of their malicious DNS infrastructure. Although the lion's share continues to be in the US (though it has dropped), nearly all of the infrastructure has been moved out of Germany -- dropping from about 20% to less than 2%. In its place, Portugal, the Netherlands, the United Kingdom, Iceland, and the Russian Federation, now collectively account for half of the malicious infrastructure.
Related Content:
About the Author(s)
You May Also Like
The fuel in the new AI race: Data
April 23, 2024Securing Code in the Age of AI
April 24, 2024Beyond Spam Filters and Firewalls: Preventing Business Email Compromises in the Modern Enterprise
April 30, 2024Key Findings from the State of AppSec Report 2024
May 7, 2024Is AI Identifying Threats to Your Network?
May 14, 2024
Black Hat USA - August 3-8 - Learn More
August 3, 2024Cybersecurity's Hottest New Technologies: What You Need To Know
March 21, 2024