Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Endpoint

8/27/2019
12:50 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

WannaCry Remains No. 1 Ransomware Weapon

Of all of the ransomware variants spotted targeting victims in the first half of 2019, the infamous WannaCry was by far the most prevalent, according to Trend Micro's detection data.

More than two years after the historic WannaCry ransomware campaign rocked the world, rapidly locking down data on more than 200,000 Windows machines in 150 countries, the known and preventable variant remains by far the most commonly detected ransomware: About 10 times as many machines were found targeted by WannaCry in the first half of this year than all other ransomware variants combined.

WannaCry exploits an old SMB vulnerability that Microsoft patched in 2017, so the machines where WannaCry attacks were detected are mostly outdated Windows 7 systems – some 95% of them, according to attack attempts detected and stopped by Trend Micro's Smart Protection Network.

"The crooks running ransomware schemes are using a reliable tool – WannaCry – for their crimes. There's no innovation or deep thought. It's just a way for them to steal," says Bill Malik, vice president of infrastructure strategies at Trend Micro, whose midyear security report, published today, includes the ransomware data.

These machines are mostly enterprise Windows machines in manufacturing, government, education, and healthcare, not consumer devices, Trend Micro's telemetry shows. "Those machines, deployed years ago, are mission-critical in those industries, so the victims are willing to pay to have their systems and data back," Malik notes.

The security firm also found WannaCry targeting machines in finance, technology, energy, food and beverage, and oil and gas organizations.

At the same time, the number of overall ransomware variants dropped dramatically in the first half of 2019, according to Trend Micro's report, A total of 118 new ransomware families emerged in the first half of 2018, but only 47 new ones debuted in the first six months of this year. That's because attackers have learned it's all about quality, not quantity. They have moved from casting a wide net to targeting victim organizations more likely to pay up, which is making them more money overall.

"Variants within a family give additional potency to those attack [new] vectors," Trend Micro's Malik says.

Ransomware attacks have become an epidemic among municipalities over the past year –  most recently the attack campaign that hit 23 localities in Texas this month. These small government entities are a prime target for obvious reasons.

"Cities have critical systems and not a lot of money for skilled information security people, so they are running thin. Attackers realize that a city cannot simply stop operations, so in many cases they have no choice but to pay," Malik says. "Note that this comes at a painful local cost. The money isn't sitting in a bank account; it is funding that would otherwise go to libraries, after-school programs, road repair, emergency services, and other basic needs."

Overall, Trend Micro spotted a 77% increase in ransomware attack attempts via malicious files, emails, and URLs. Ryuk ransomware was among the hottest and most prolific newer variants going after machines from January through June. Ryuk also tallied the largest ransomware payout of the year, when Riviera Beach, Florida, was infected with Ryuk and paid the $600,000 in ransom to the attackers, followed by Lake City, Florida, which shelled out $460,000 in ransom.

"We recognize that the number of older, unpatched, installed systems will remain a target for attackers, whether running ransomware, cryptocurrency mining, botnets, credential harvesting, or other forms of malware," Trend's Malik says. 

And those older systems don't appear to be going anywhere fast. Some 48% of small to midsize businesses still run heavily on Windows XP or Windows 7, according to new research from Kaspersky Lab, which found that 41% of consumers run these shuttered or nearing end-of-life operating systems. The security firm's anonymized telemetry data shows that 47% of SMBs run Windows 7, as do 38% of consumers and very small businesses. Windows 7 will no longer be supported by Microsoft as of January 2020.

Related Content:

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's top story: "'Culture Eats Policy for Breakfast': Rethinking Security Awareness Training."

Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Page 1 / 2   >   >>
sudeshkumar
50%
50%
sudeshkumar,
User Rank: Apprentice
9/2/2019 | 7:22:05 AM
Re: WannaCry
I heard of this virus. few months ago it was one of the most famous virus. 
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
8/29/2019 | 1:44:17 PM
Re: The most effective defense?
"An educated user pool to start with with basic rules of email iusage. "

I think you made a very good point, it starts with the users.

 

Dr.T
50%
50%
Dr.T,
User Rank: Ninja
8/29/2019 | 1:43:00 PM
Re: The most effective defense?
"The IT staff has a daunting job sometimes but it is THEIR JOB and if they do not like it, there are always trade school courses on welding."

This is really a good point it is good amount of effort needed to keep systems up-to-date

 

Dr.T
50%
50%
Dr.T,
User Rank: Ninja
8/29/2019 | 1:40:59 PM
Re: The most effective defense?
"But keeping old W7 systems running now is asking for trouble.  As it was with XP ( of which alot of that is still out there on legacy boxes)."

Agree. If there is a newer version of an operating system, there is no real reason using older version.

 

Dr.T
50%
50%
Dr.T,
User Rank: Ninja
8/29/2019 | 1:38:56 PM
Re: The most effective defense?
"True and the OS update issue is the responsibility of the IT staff and team to make clear and eviden"

It would be responsible in operational aspect of it but overall business is responsible of the security of the business

 

Dr.T
50%
50%
Dr.T,
User Rank: Ninja
8/29/2019 | 1:37:19 PM
Re: The most effective defense?
"future disruptions to business should be minimal and all the more reason to get new tools with security features built in."

Agree with this, if there's an outage business will lose more time and money.

 

Dr.T
50%
50%
Dr.T,
User Rank: Ninja
8/29/2019 | 1:36:10 PM
Re: The most effective defense?
"it's still no excuse not to plan for the future with new tools fitting business needs that would be compatible with the latest OS"

I would agree with this, there shouldn't be so much effort anyway as long as you standardized your upgrade process.

 

Dr.T
50%
50%
Dr.T,
User Rank: Ninja
8/29/2019 | 1:34:19 PM
Re: The most effective defense?
"VMware HorizonView or Citrix XenDesktop/XenApp work, if they want to go to the cloud, use WorkSpaces"

I agree, that is true but they are very expensive at the same time.

 

Dr.T
50%
50%
Dr.T,
User Rank: Ninja
8/29/2019 | 1:33:06 PM
Re: The most effective defense?
"When companies are hacked, the business owners, executive staff members should be removed from their position because they did not follow best practices and follow due-diligence."

I would say there should be some responsibilities, not everybody is directly involved into this type of activities such as upgrading Win 7.

 

Dr.T
50%
50%
Dr.T,
User Rank: Ninja
8/29/2019 | 1:31:39 PM
Re: The most effective defense?
"Companies are still holding on to Windows 7"

Yes I'm working with a few other companies where they are still using Windows 7. It is running but will not be secure anymore. 

 

Page 1 / 2   >   >>
Why Cyber-Risk Is a C-Suite Issue
Marc Wilczek, Digital Strategist & CIO Advisor,  11/12/2019
DevSecOps: The Answer to the Cloud Security Skills Gap
Lamont Orange, Chief Information Security Officer at Netskope,  11/15/2019
Attackers' Costs Increasing as Businesses Focus on Security
Robert Lemos, Contributing Writer,  11/15/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Navigating the Deluge of Security Data
In this Tech Digest, Dark Reading shares the experiences of some top security practitioners as they navigate volumes of security data. We examine some examples of how enterprises can cull this data to find the clues they need.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-19071
PUBLISHED: 2019-11-18
A memory leak in the rsi_send_beacon() function in drivers/net/wireless/rsi/rsi_91x_mgmt.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering rsi_prepare_beacon() failures, aka CID-d563131ef23c.
CVE-2019-19072
PUBLISHED: 2019-11-18
A memory leak in the predicate_parse() function in kernel/trace/trace_events_filter.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption), aka CID-96c5c6e6a5b6.
CVE-2019-19073
PUBLISHED: 2019-11-18
Memory leaks in drivers/net/wireless/ath/ath9k/htc_hst.c in the Linux kernel through 5.3.11 allow attackers to cause a denial of service (memory consumption) by triggering wait_for_completion_timeout() failures. This affects the htc_config_pipe_credits() function, the htc_setup_complete() function, ...
CVE-2019-19074
PUBLISHED: 2019-11-18
A memory leak in the ath9k_wmi_cmd() function in drivers/net/wireless/ath/ath9k/wmi.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption), aka CID-728c1e2a05e4.
CVE-2019-19075
PUBLISHED: 2019-11-18
A memory leak in the ca8210_probe() function in drivers/net/ieee802154/ca8210.c in the Linux kernel before 5.3.8 allows attackers to cause a denial of service (memory consumption) by triggering ca8210_get_platform_data() failures, aka CID-6402939ec86e.