Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Endpoint

8/27/2019
12:50 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

WannaCry Remains No. 1 Ransomware Weapon

Of all of the ransomware variants spotted targeting victims in the first half of 2019, the infamous WannaCry was by far the most prevalent, according to Trend Micro's detection data.

More than two years after the historic WannaCry ransomware campaign rocked the world, rapidly locking down data on more than 200,000 Windows machines in 150 countries, the known and preventable variant remains by far the most commonly detected ransomware: About 10 times as many machines were found targeted by WannaCry in the first half of this year than all other ransomware variants combined.

WannaCry exploits an old SMB vulnerability that Microsoft patched in 2017, so the machines where WannaCry attacks were detected are mostly outdated Windows 7 systems – some 95% of them, according to attack attempts detected and stopped by Trend Micro's Smart Protection Network.

"The crooks running ransomware schemes are using a reliable tool – WannaCry – for their crimes. There's no innovation or deep thought. It's just a way for them to steal," says Bill Malik, vice president of infrastructure strategies at Trend Micro, whose midyear security report, published today, includes the ransomware data.

These machines are mostly enterprise Windows machines in manufacturing, government, education, and healthcare, not consumer devices, Trend Micro's telemetry shows. "Those machines, deployed years ago, are mission-critical in those industries, so the victims are willing to pay to have their systems and data back," Malik notes.

The security firm also found WannaCry targeting machines in finance, technology, energy, food and beverage, and oil and gas organizations.

At the same time, the number of overall ransomware variants dropped dramatically in the first half of 2019, according to Trend Micro's report, A total of 118 new ransomware families emerged in the first half of 2018, but only 47 new ones debuted in the first six months of this year. That's because attackers have learned it's all about quality, not quantity. They have moved from casting a wide net to targeting victim organizations more likely to pay up, which is making them more money overall.

"Variants within a family give additional potency to those attack [new] vectors," Trend Micro's Malik says.

Ransomware attacks have become an epidemic among municipalities over the past year –  most recently the attack campaign that hit 23 localities in Texas this month. These small government entities are a prime target for obvious reasons.

"Cities have critical systems and not a lot of money for skilled information security people, so they are running thin. Attackers realize that a city cannot simply stop operations, so in many cases they have no choice but to pay," Malik says. "Note that this comes at a painful local cost. The money isn't sitting in a bank account; it is funding that would otherwise go to libraries, after-school programs, road repair, emergency services, and other basic needs."

Overall, Trend Micro spotted a 77% increase in ransomware attack attempts via malicious files, emails, and URLs. Ryuk ransomware was among the hottest and most prolific newer variants going after machines from January through June. Ryuk also tallied the largest ransomware payout of the year, when Riviera Beach, Florida, was infected with Ryuk and paid the $600,000 in ransom to the attackers, followed by Lake City, Florida, which shelled out $460,000 in ransom.

"We recognize that the number of older, unpatched, installed systems will remain a target for attackers, whether running ransomware, cryptocurrency mining, botnets, credential harvesting, or other forms of malware," Trend's Malik says. 

And those older systems don't appear to be going anywhere fast. Some 48% of small to midsize businesses still run heavily on Windows XP or Windows 7, according to new research from Kaspersky Lab, which found that 41% of consumers run these shuttered or nearing end-of-life operating systems. The security firm's anonymized telemetry data shows that 47% of SMBs run Windows 7, as do 38% of consumers and very small businesses. Windows 7 will no longer be supported by Microsoft as of January 2020.

Related Content:

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's top story: "'Culture Eats Policy for Breakfast': Rethinking Security Awareness Training."

Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Threaded  |  Newest First  |  Oldest First
REISEN1955
50%
50%
REISEN1955,
User Rank: Ninja
8/27/2019 | 2:30:45 PM
The most effective defense?
An educated user pool to start with with basic rules of email iusage.  Secondly a verified, vetted and tested  backup and restoration plan --- make sure it works.  Third are active patching and firewall monitoring.  All fall under the care of the internal IT staff and if they do not do these chores ..... well, Welcome to Hell.  
Kelly Jackson Higgins
50%
50%
Kelly Jackson Higgins,
User Rank: Strategist
8/27/2019 | 2:33:48 PM
Re: The most effective defense?
All good points. But when their apps or processes still rely on antiquated OSes like Win7 and updating disrupts the biz, then some orgs just ride it out with security tools to catch these threats, etc.
REISEN1955
50%
50%
REISEN1955,
User Rank: Ninja
8/27/2019 | 2:54:38 PM
Re: The most effective defense?
True and the OS update issue is the responsibility of the IT staff and team to make clear and evident - THAT is their job and all too often, well, disrupting the business is just TOO HARD.  Like that patch that brought down Equifax.  Right?   I work with a CSirt team using great tools and while every firm and small business may not have access, it still has to be tackled as best allowed.  But keeping old W7 systems running now is asking for trouble.  As it was with XP ( of which alot of that is still out there on legacy boxes).  The IT staff has a daunting job sometimes but it is THEIR JOB and if they do not like it, there are always trade school courses on welding. 

Disclaimer: I am something of an expert on disaster recovery techniques when 18 years ago I had to walk down out of my office building in lower Manhattan and shortly later the data center on the 103rd floor of the south tower followed me down.  I am a survivor of that day from Aon, on the 101st floor, S-tower, of the World Trade Center.
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
8/29/2019 | 1:38:56 PM
Re: The most effective defense?
"True and the OS update issue is the responsibility of the IT staff and team to make clear and eviden"

It would be responsible in operational aspect of it but overall business is responsible of the security of the business

 

Dr.T
50%
50%
Dr.T,
User Rank: Ninja
8/29/2019 | 1:40:59 PM
Re: The most effective defense?
"But keeping old W7 systems running now is asking for trouble.  As it was with XP ( of which alot of that is still out there on legacy boxes)."

Agree. If there is a newer version of an operating system, there is no real reason using older version.

 

Dr.T
50%
50%
Dr.T,
User Rank: Ninja
8/29/2019 | 1:43:00 PM
Re: The most effective defense?
"The IT staff has a daunting job sometimes but it is THEIR JOB and if they do not like it, there are always trade school courses on welding."

This is really a good point it is good amount of effort needed to keep systems up-to-date

 

AndrewfOP
50%
50%
AndrewfOP,
User Rank: Moderator
8/28/2019 | 9:20:57 AM
Re: The most effective defense?
"All good points. But when their apps or processes still rely on antiquated OSes like Win7 and updating disrupts the biz, then some orgs just ride it out with security tools to catch these threats, etc."

While I sympathize with the familiarities of existing business tools on machines with old Window systems and the disruptions caused on replacing them, it's still no excuse not to plan for the future with new tools fitting business needs that would be compatible with the latest OS. Especially now that Microsoft seems to be getting out of making-new-Windows-to-make-money business, future disruptions to business should be minimal and all the more reason to get new tools with security features built in.

 
tdsan
50%
50%
tdsan,
User Rank: Ninja
8/28/2019 | 6:48:52 PM
Re: The most effective defense?
Andrew, I must agree with you, there is no excuse.

Companies are still holding on to Windows 7 (wow), this is what it means to be loyal to a fault or not have the personnel on staff to make this migration happen (holding on to the very end).

After January 14, 2020, Microsoft will no longer provide security updates or support for PCs running Windows 7

I do think there are solutions to this problem, roll-out VDI solution and deploy desktops in a virtual session, this can be easily done without breaking the bank. VMware HorizonView or Citrix XenDesktop/XenApp work, if they want to go to the cloud, use WorkSpaces, there are a number of things they could have done.

At the end of the day, it is time to move off this platform, this says a lot about companies not taking into consideration the time and planning stages they could have planned to create a seamless migration process. When companies are hacked, the business owners, executive staff members should be removed from their position because they did not follow best practices and follow due-diligence.

Windows 7 End of Life

T
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
8/29/2019 | 1:31:39 PM
Re: The most effective defense?
"Companies are still holding on to Windows 7"

Yes I'm working with a few other companies where they are still using Windows 7. It is running but will not be secure anymore. 

 

Dr.T
50%
50%
Dr.T,
User Rank: Ninja
8/29/2019 | 1:33:06 PM
Re: The most effective defense?
"When companies are hacked, the business owners, executive staff members should be removed from their position because they did not follow best practices and follow due-diligence."

I would say there should be some responsibilities, not everybody is directly involved into this type of activities such as upgrading Win 7.

 

Dr.T
50%
50%
Dr.T,
User Rank: Ninja
8/29/2019 | 1:34:19 PM
Re: The most effective defense?
"VMware HorizonView or Citrix XenDesktop/XenApp work, if they want to go to the cloud, use WorkSpaces"

I agree, that is true but they are very expensive at the same time.

 

Dr.T
50%
50%
Dr.T,
User Rank: Ninja
8/29/2019 | 1:36:10 PM
Re: The most effective defense?
"it's still no excuse not to plan for the future with new tools fitting business needs that would be compatible with the latest OS"

I would agree with this, there shouldn't be so much effort anyway as long as you standardized your upgrade process.

 

Dr.T
50%
50%
Dr.T,
User Rank: Ninja
8/29/2019 | 1:37:19 PM
Re: The most effective defense?
"future disruptions to business should be minimal and all the more reason to get new tools with security features built in."

Agree with this, if there's an outage business will lose more time and money.

 

Dr.T
50%
50%
Dr.T,
User Rank: Ninja
8/29/2019 | 1:44:17 PM
Re: The most effective defense?
"An educated user pool to start with with basic rules of email iusage. "

I think you made a very good point, it starts with the users.

 

Dr.T
50%
50%
Dr.T,
User Rank: Ninja
8/29/2019 | 1:29:02 PM
WannaCry

The main lesson is to keep the systems up to date, obvisuly. 

 

sudeshkumar
50%
50%
sudeshkumar,
User Rank: Apprentice
9/2/2019 | 7:22:05 AM
Re: WannaCry
I heard of this virus. few months ago it was one of the most famous virus. 
Navigating Security in the Cloud
Diya Jolly, Chief Product Officer, Okta,  12/4/2019
SOC 2s & Third-Party Assessments: How to Prevent Them from Being Used in a Data Breach Lawsuit
Beth Burgin Waller, Chair, Cybersecurity & Data Privacy Practice , Woods Rogers PLC,  12/5/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: Our Endpoint Protection system is a little outdated... 
Current Issue
Navigating the Deluge of Security Data
In this Tech Digest, Dark Reading shares the experiences of some top security practitioners as they navigate volumes of security data. We examine some examples of how enterprises can cull this data to find the clues they need.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-4095
PUBLISHED: 2019-12-10
IBM Cloud Pak System 2.3 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 158015.
CVE-2019-4244
PUBLISHED: 2019-12-10
IBM SmartCloud Analytics 1.3.1 through 1.3.5 could allow a remote attacker to gain unauthorized information and unrestricted control over Zookeeper installations due to missing authentication. IBM X-Force ID: 159518.
CVE-2019-4521
PUBLISHED: 2019-12-10
Platform System Manager in IBM Cloud Pak System 2.3 is potentially vulnerable to CVS Injection. A remote attacker could execute arbitrary commands on the system, caused by improper validation of csv file contents. IBM X-Force ID: 165179.
CVE-2019-4663
PUBLISHED: 2019-12-10
IBM WebSphere Application Server - Liberty is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 171245...
CVE-2019-19251
PUBLISHED: 2019-12-10
The Last.fm desktop app (Last.fm Scrobbler) through 2.1.39 on macOS makes HTTP requests that include an API key without the use of SSL/TLS. Although there is an Enable SSL option, it is disabled by default, and cleartext requests are made as soon as the app starts.