3 'Old' Attack Trends That Dominated Q1

Trend Micro TrendLabs released a new report today that summed up the first three months worth of malicious activity as a function of utility rather than ingenuity. As Trend's researchers explained, the high volume of attacks lobbied today against Internet targets relied very heavily on old techniques recycled in slightly new ways.

"Don’t let their age fool you: these threats have come back stronger and more malicious than ever," explained Christopher Budd, global threat communications manager for Trend. "The prevalence and success of these threats shows again that innovation isn’t restricted to developing new threats in new arenas: it’s also in taking old threats and improving them to succeed against the security protections that once thwarted them."

According to Trend analysis, the following three attack techniques were some of the most prevalent in first quarter of 2015.

Malvertising

Abusing third party ad infrastructure to serve up malware in addition to ads on websites is a longstanding technique at this point. But Q1 "saw attackers take up malvertisements once again with a vengeance," says Budd. Malvertising was paired with zero-day vulnerabilities using exploit tools like Angler to give malvertising "a new lease on life," he says.

Attackers are slowly evolving the malvertising methodology by establishing ways to better perpetrate mobile attacks, as was the case with the MDash adware attacks on the Google Play ecosystem.

Cryptoransomware

Similarly, cryptoransomware was huge in 2013 but somewhat dropped off the map toward the end of that year. That changed in the last quarter of 2014 when ransomware attacks in general started picking up and continued to surge in 2015.

According  to Trend researchers, cryptoransomware rose to make up half of all ransomware infections and infected four times as many victims in Q1 2015 as they did during the same time period in 2014. In this latest rise, researchers are seeing cryptoransomware move from consumer targets to focus more squarely on enterprises, encrypting files in network shares, websites and web servers to ensnare more profitable businesses in their malicious scheme.

'Old-School' Macro Malware

It's been more than two decades since macro malware came onto the scene with the spread of the Word Concept virus. The security community has worked to mitigate macro risks, which may have led the community to forget it as an attack vector. Last quarter showed attackers taking advantage of that complacency and a resurgence in attacks using the technique—with a macro malware infection rate nearly double that of the previous quarter. Not only are attackers taking advantage of social engineering to enable and run macros, but they're also finding other end-arounds.

"In the past, cybercriminals would use social engineering to get users to run malicious macros in documents," says Numaan Huq, senior threat researcher for Trend. "Today, they also exploit vulnerabilities in Office to run the macro."