Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Endpoint

8/27/2019
12:50 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

WannaCry Remains No. 1 Ransomware Weapon

Of all of the ransomware variants spotted targeting victims in the first half of 2019, the infamous WannaCry was by far the most prevalent, according to Trend Micro's detection data.

More than two years after the historic WannaCry ransomware campaign rocked the world, rapidly locking down data on more than 200,000 Windows machines in 150 countries, the known and preventable variant remains by far the most commonly detected ransomware: About 10 times as many machines were found targeted by WannaCry in the first half of this year than all other ransomware variants combined.

WannaCry exploits an old SMB vulnerability that Microsoft patched in 2017, so the machines where WannaCry attacks were detected are mostly outdated Windows 7 systems – some 95% of them, according to attack attempts detected and stopped by Trend Micro's Smart Protection Network.

"The crooks running ransomware schemes are using a reliable tool – WannaCry – for their crimes. There's no innovation or deep thought. It's just a way for them to steal," says Bill Malik, vice president of infrastructure strategies at Trend Micro, whose midyear security report, published today, includes the ransomware data.

These machines are mostly enterprise Windows machines in manufacturing, government, education, and healthcare, not consumer devices, Trend Micro's telemetry shows. "Those machines, deployed years ago, are mission-critical in those industries, so the victims are willing to pay to have their systems and data back," Malik notes.

The security firm also found WannaCry targeting machines in finance, technology, energy, food and beverage, and oil and gas organizations.

At the same time, the number of overall ransomware variants dropped dramatically in the first half of 2019, according to Trend Micro's report, A total of 118 new ransomware families emerged in the first half of 2018, but only 47 new ones debuted in the first six months of this year. That's because attackers have learned it's all about quality, not quantity. They have moved from casting a wide net to targeting victim organizations more likely to pay up, which is making them more money overall.

"Variants within a family give additional potency to those attack [new] vectors," Trend Micro's Malik says.

Ransomware attacks have become an epidemic among municipalities over the past year –  most recently the attack campaign that hit 23 localities in Texas this month. These small government entities are a prime target for obvious reasons.

"Cities have critical systems and not a lot of money for skilled information security people, so they are running thin. Attackers realize that a city cannot simply stop operations, so in many cases they have no choice but to pay," Malik says. "Note that this comes at a painful local cost. The money isn't sitting in a bank account; it is funding that would otherwise go to libraries, after-school programs, road repair, emergency services, and other basic needs."

Overall, Trend Micro spotted a 77% increase in ransomware attack attempts via malicious files, emails, and URLs. Ryuk ransomware was among the hottest and most prolific newer variants going after machines from January through June. Ryuk also tallied the largest ransomware payout of the year, when Riviera Beach, Florida, was infected with Ryuk and paid the $600,000 in ransom to the attackers, followed by Lake City, Florida, which shelled out $460,000 in ransom.

"We recognize that the number of older, unpatched, installed systems will remain a target for attackers, whether running ransomware, cryptocurrency mining, botnets, credential harvesting, or other forms of malware," Trend's Malik says. 

And those older systems don't appear to be going anywhere fast. Some 48% of small to midsize businesses still run heavily on Windows XP or Windows 7, according to new research from Kaspersky Lab, which found that 41% of consumers run these shuttered or nearing end-of-life operating systems. The security firm's anonymized telemetry data shows that 47% of SMBs run Windows 7, as do 38% of consumers and very small businesses. Windows 7 will no longer be supported by Microsoft as of January 2020.

Related Content:

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's top story: "'Culture Eats Policy for Breakfast': Rethinking Security Awareness Training."

Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Page 1 / 2   >   >>
sudeshkumar
50%
50%
sudeshkumar,
User Rank: Apprentice
9/2/2019 | 7:22:05 AM
Re: WannaCry
I heard of this virus. few months ago it was one of the most famous virus. 
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
8/29/2019 | 1:44:17 PM
Re: The most effective defense?
"An educated user pool to start with with basic rules of email iusage. "

I think you made a very good point, it starts with the users.

 

Dr.T
50%
50%
Dr.T,
User Rank: Ninja
8/29/2019 | 1:43:00 PM
Re: The most effective defense?
"The IT staff has a daunting job sometimes but it is THEIR JOB and if they do not like it, there are always trade school courses on welding."

This is really a good point it is good amount of effort needed to keep systems up-to-date

 

Dr.T
50%
50%
Dr.T,
User Rank: Ninja
8/29/2019 | 1:40:59 PM
Re: The most effective defense?
"But keeping old W7 systems running now is asking for trouble.  As it was with XP ( of which alot of that is still out there on legacy boxes)."

Agree. If there is a newer version of an operating system, there is no real reason using older version.

 

Dr.T
50%
50%
Dr.T,
User Rank: Ninja
8/29/2019 | 1:38:56 PM
Re: The most effective defense?
"True and the OS update issue is the responsibility of the IT staff and team to make clear and eviden"

It would be responsible in operational aspect of it but overall business is responsible of the security of the business

 

Dr.T
50%
50%
Dr.T,
User Rank: Ninja
8/29/2019 | 1:37:19 PM
Re: The most effective defense?
"future disruptions to business should be minimal and all the more reason to get new tools with security features built in."

Agree with this, if there's an outage business will lose more time and money.

 

Dr.T
50%
50%
Dr.T,
User Rank: Ninja
8/29/2019 | 1:36:10 PM
Re: The most effective defense?
"it's still no excuse not to plan for the future with new tools fitting business needs that would be compatible with the latest OS"

I would agree with this, there shouldn't be so much effort anyway as long as you standardized your upgrade process.

 

Dr.T
50%
50%
Dr.T,
User Rank: Ninja
8/29/2019 | 1:34:19 PM
Re: The most effective defense?
"VMware HorizonView or Citrix XenDesktop/XenApp work, if they want to go to the cloud, use WorkSpaces"

I agree, that is true but they are very expensive at the same time.

 

Dr.T
50%
50%
Dr.T,
User Rank: Ninja
8/29/2019 | 1:33:06 PM
Re: The most effective defense?
"When companies are hacked, the business owners, executive staff members should be removed from their position because they did not follow best practices and follow due-diligence."

I would say there should be some responsibilities, not everybody is directly involved into this type of activities such as upgrading Win 7.

 

Dr.T
50%
50%
Dr.T,
User Rank: Ninja
8/29/2019 | 1:31:39 PM
Re: The most effective defense?
"Companies are still holding on to Windows 7"

Yes I'm working with a few other companies where they are still using Windows 7. It is running but will not be secure anymore. 

 

Page 1 / 2   >   >>
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: Our Endpoint Protection system is a little outdated... 
Current Issue
The Year in Security: 2019
This Tech Digest provides a wrap up and overview of the year's top cybersecurity news stories. It was a year of new twists on old threats, with fears of another WannaCry-type worm and of a possible botnet army of Wi-Fi routers. But 2019 also underscored the risk of firmware and trusted security tools harboring dangerous holes that cybercriminals and nation-state hackers could readily abuse. Read more.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-2319
PUBLISHED: 2019-12-12
HLOS could corrupt CPZ page table memory for S1 managed VMs in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wired Infrastructure and Networking in MDM9205, QCS404, QCS605, SDA845, SDM670, SDM710, SDM84...
CVE-2019-2320
PUBLISHED: 2019-12-12
Possible out of bounds write in a MT SMS/SS scenario due to improper validation of array index in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in APQ8009, APQ8017, APQ805...
CVE-2019-2321
PUBLISHED: 2019-12-12
Incorrect length used while validating the qsee log buffer sent from HLOS which could then lead to remap conflict in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdra...
CVE-2019-2337
PUBLISHED: 2019-12-12
While Skipping unknown IES, EMM is reading the buffer even if the no of bytes to read are more than message length which may cause device to shutdown in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables in APQ8053, APQ809...
CVE-2019-2338
PUBLISHED: 2019-12-12
Crafted image that has a valid signature from a non-QC entity can be loaded which can read/write memory that belongs to the secure world in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wired Infrastruc...