Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Endpoint

8/27/2019
12:50 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

WannaCry Remains No. 1 Ransomware Weapon

Of all of the ransomware variants spotted targeting victims in the first half of 2019, the infamous WannaCry was by far the most prevalent, according to Trend Micro's detection data.

More than two years after the historic WannaCry ransomware campaign rocked the world, rapidly locking down data on more than 200,000 Windows machines in 150 countries, the known and preventable variant remains by far the most commonly detected ransomware: About 10 times as many machines were found targeted by WannaCry in the first half of this year than all other ransomware variants combined.

WannaCry exploits an old SMB vulnerability that Microsoft patched in 2017, so the machines where WannaCry attacks were detected are mostly outdated Windows 7 systems – some 95% of them, according to attack attempts detected and stopped by Trend Micro's Smart Protection Network.

"The crooks running ransomware schemes are using a reliable tool – WannaCry – for their crimes. There's no innovation or deep thought. It's just a way for them to steal," says Bill Malik, vice president of infrastructure strategies at Trend Micro, whose midyear security report, published today, includes the ransomware data.

These machines are mostly enterprise Windows machines in manufacturing, government, education, and healthcare, not consumer devices, Trend Micro's telemetry shows. "Those machines, deployed years ago, are mission-critical in those industries, so the victims are willing to pay to have their systems and data back," Malik notes.

The security firm also found WannaCry targeting machines in finance, technology, energy, food and beverage, and oil and gas organizations.

At the same time, the number of overall ransomware variants dropped dramatically in the first half of 2019, according to Trend Micro's report, A total of 118 new ransomware families emerged in the first half of 2018, but only 47 new ones debuted in the first six months of this year. That's because attackers have learned it's all about quality, not quantity. They have moved from casting a wide net to targeting victim organizations more likely to pay up, which is making them more money overall.

"Variants within a family give additional potency to those attack [new] vectors," Trend Micro's Malik says.

Ransomware attacks have become an epidemic among municipalities over the past year –  most recently the attack campaign that hit 23 localities in Texas this month. These small government entities are a prime target for obvious reasons.

"Cities have critical systems and not a lot of money for skilled information security people, so they are running thin. Attackers realize that a city cannot simply stop operations, so in many cases they have no choice but to pay," Malik says. "Note that this comes at a painful local cost. The money isn't sitting in a bank account; it is funding that would otherwise go to libraries, after-school programs, road repair, emergency services, and other basic needs."

Overall, Trend Micro spotted a 77% increase in ransomware attack attempts via malicious files, emails, and URLs. Ryuk ransomware was among the hottest and most prolific newer variants going after machines from January through June. Ryuk also tallied the largest ransomware payout of the year, when Riviera Beach, Florida, was infected with Ryuk and paid the $600,000 in ransom to the attackers, followed by Lake City, Florida, which shelled out $460,000 in ransom.

"We recognize that the number of older, unpatched, installed systems will remain a target for attackers, whether running ransomware, cryptocurrency mining, botnets, credential harvesting, or other forms of malware," Trend's Malik says. 

And those older systems don't appear to be going anywhere fast. Some 48% of small to midsize businesses still run heavily on Windows XP or Windows 7, according to new research from Kaspersky Lab, which found that 41% of consumers run these shuttered or nearing end-of-life operating systems. The security firm's anonymized telemetry data shows that 47% of SMBs run Windows 7, as do 38% of consumers and very small businesses. Windows 7 will no longer be supported by Microsoft as of January 2020.

Related Content:

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's top story: "'Culture Eats Policy for Breakfast': Rethinking Security Awareness Training."

Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Page 1 / 2   >   >>
sudeshkumar
50%
50%
sudeshkumar,
User Rank: Apprentice
9/2/2019 | 7:22:05 AM
Re: WannaCry
I heard of this virus. few months ago it was one of the most famous virus. 
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
8/29/2019 | 1:44:17 PM
Re: The most effective defense?
"An educated user pool to start with with basic rules of email iusage. "

I think you made a very good point, it starts with the users.

 

Dr.T
50%
50%
Dr.T,
User Rank: Ninja
8/29/2019 | 1:43:00 PM
Re: The most effective defense?
"The IT staff has a daunting job sometimes but it is THEIR JOB and if they do not like it, there are always trade school courses on welding."

This is really a good point it is good amount of effort needed to keep systems up-to-date

 

Dr.T
50%
50%
Dr.T,
User Rank: Ninja
8/29/2019 | 1:40:59 PM
Re: The most effective defense?
"But keeping old W7 systems running now is asking for trouble.  As it was with XP ( of which alot of that is still out there on legacy boxes)."

Agree. If there is a newer version of an operating system, there is no real reason using older version.

 

Dr.T
50%
50%
Dr.T,
User Rank: Ninja
8/29/2019 | 1:38:56 PM
Re: The most effective defense?
"True and the OS update issue is the responsibility of the IT staff and team to make clear and eviden"

It would be responsible in operational aspect of it but overall business is responsible of the security of the business

 

Dr.T
50%
50%
Dr.T,
User Rank: Ninja
8/29/2019 | 1:37:19 PM
Re: The most effective defense?
"future disruptions to business should be minimal and all the more reason to get new tools with security features built in."

Agree with this, if there's an outage business will lose more time and money.

 

Dr.T
50%
50%
Dr.T,
User Rank: Ninja
8/29/2019 | 1:36:10 PM
Re: The most effective defense?
"it's still no excuse not to plan for the future with new tools fitting business needs that would be compatible with the latest OS"

I would agree with this, there shouldn't be so much effort anyway as long as you standardized your upgrade process.

 

Dr.T
50%
50%
Dr.T,
User Rank: Ninja
8/29/2019 | 1:34:19 PM
Re: The most effective defense?
"VMware HorizonView or Citrix XenDesktop/XenApp work, if they want to go to the cloud, use WorkSpaces"

I agree, that is true but they are very expensive at the same time.

 

Dr.T
50%
50%
Dr.T,
User Rank: Ninja
8/29/2019 | 1:33:06 PM
Re: The most effective defense?
"When companies are hacked, the business owners, executive staff members should be removed from their position because they did not follow best practices and follow due-diligence."

I would say there should be some responsibilities, not everybody is directly involved into this type of activities such as upgrading Win 7.

 

Dr.T
50%
50%
Dr.T,
User Rank: Ninja
8/29/2019 | 1:31:39 PM
Re: The most effective defense?
"Companies are still holding on to Windows 7"

Yes I'm working with a few other companies where they are still using Windows 7. It is running but will not be secure anymore. 

 

Page 1 / 2   >   >>
Malicious USB Drive Hides Behind Gift Card Lure
Dark Reading Staff 3/27/2020
How Attackers Could Use Azure Apps to Sneak into Microsoft 365
Kelly Sheridan, Staff Editor, Dark Reading,  3/24/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
6 Emerging Cyber Threats That Enterprises Face in 2020
This Tech Digest gives an in-depth look at six emerging cyber threats that enterprises could face in 2020. Download your copy today!
Flash Poll
State of Cybersecurity Incident Response
State of Cybersecurity Incident Response
Data breaches and regulations have forced organizations to pay closer attention to the security incident response function. However, security leaders may be overestimating their ability to detect and respond to security incidents. Read this report to find out more.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-10940
PUBLISHED: 2020-03-27
Local Privilege Escalation can occur in PHOENIX CONTACT PORTICO SERVER through 3.0.7 when installed to run as a service.
CVE-2020-10939
PUBLISHED: 2020-03-27
Insecure, default path permissions in PHOENIX CONTACT PC WORX SRT through 1.14 allow for local privilege escalation.
CVE-2020-6095
PUBLISHED: 2020-03-27
An exploitable denial of service vulnerability exists in the GstRTSPAuth functionality of GStreamer/gst-rtsp-server 1.14.5. A specially crafted RTSP setup request can cause a null pointer deference resulting in denial-of-service. An attacker can send a malicious packet to trigger this vulnerability.
CVE-2020-10817
PUBLISHED: 2020-03-27
The custom-searchable-data-entry-system (aka Custom Searchable Data Entry System) plugin through 1.7.1 for WordPress allows SQL Injection. NOTE: this product is discontinued.
CVE-2020-10952
PUBLISHED: 2020-03-27
GitLab EE/CE 8.11 through 12.9.1 allows blocked users to pull/push docker images.