Keep up with the latest cybersecurity threats, newly discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.
Cofense Malware Review Covers Trends and Predictions on Malware, Delivery Methods and Trending Attacks
Abuse of legitimate software, rapid exploitation of disclosed vulnerabilities and dynamic phishing techniques increase infection rates, according to the report
March 23, 2018
3 Min Read
PRESS RELEASE
LEESBURG, VA. – March 22, 2018 – Cofense™, formerly known as PhishMe®, today announced the release of the 2018 Cofense Malware Review, A Look Back and a Look Forward, detailing the trends that defined malware attacks in 2017 and the emerging trends for network defenders to prioritize in 2018.
While a couple of high profile breaches stole the spotlight in 2017, Cofense’s global security team uncovered a number of less visible evolutions that dramatically changed the threat landscape and continue to pose threats. Malicious actors demonstrated how quickly they could exploit recently disclosed vulnerabilities, change how they use or modify malware, and how swiftly they could profit from new attack surfaces – including the proliferation of cryptocurrencies and the enterprises moving to cloud platforms.
Based on the analysis of millions of messages received daily from a wide range of sources, the report details notable insights on phishing-specific threats seen in 2017 and what is to come, including:
The proliferation of cryptominers. 2017 saw the rise of cryptominers infiltrating computers via phishing emails and recruiting of victims’ computers for their armies of cryptomining botnets. The compromised computers perform cryptocurrency mining to generate currency for the threat actors while reducing the efficiency of infected computers.
Surge in abuse of business-critical platform features. Office Macro scripting took the lead in Office-based attacks (almost 600 campaigns analyzed), making use of Windows-based interoperability functionality for malicious purposes. Cofense analyzed nearly a hundred campaigns that abused Microsoft Office Object Linking and Embedding (OLE).
Massive amount of new ransomware campaigns. While 2016’s Locky and Cerber ransomware continued to hold encrypted files hostage in 2017, several prominent new ransomware families also emerged in major phishing campaigns. In fact, five of the top ten new malware varieties in phishing email were new ransomware varieties, demonstrating ransomware operators’ drive to evolve and survive. Many attackers require bitcoin as the preferred method of ransom payment, going as far as providing the victim step-by-step payment instructions using their cryptocurrency of choice.
The opportunism of disclosure. Threat actors quickly took advantage of disclosed or leaked vulnerabilities. After Microsoft Office’s Dynamic Data Exchange (DDE) abuse technique was disclosed by a security researcher, Cofense observed exploits across various malware utilities just a week later.
“Understanding what vulnerabilities malicious attackers took advantage of yesterday is critical when preparing for the threats of tomorrow,” said Aaron Higbee, Co-Founder and CTO at Cofense. “As delivery methods evolve daily and malware innovations accelerate, timely attack intelligence is critical and must extend across organizations. Now is the time for every inbox to be a sensor and every employee to be a security evangelist that can trigger organization-wide security orchestration to break the attack kill chain at delivery.”
Looking ahead, the report finds that ransomware attacks will continue to develop, including more ransomware operators engaging in negotiations and the diversification in types of cryptocurrencies demanded. The financial success of ransomware campaigns proves that crime does pay for malicious actors looking for fast profitability. The report also predicts cloud services will grow as an attack surface and we’ll continue to see the development of more enhanced malware delivery attacks.
To learn more, you can download the full report here: https://cofense.com/malware-review-2018/
About Cofense
Cofense, formerly known as PhishMe, is the leading provider of human-driven phishing defense solutions world-wide. Cofense delivers a collaborative approach to cybersecurity by enabling organization-wide engagement to active email threats. Our collective defense suite combines timely attack intelligence sourced from employees with best-in-class incident response technologies to stop attacks faster and stay ahead of breaches. Cofense customers include Global 1000 organizations in defense, energy, financial services, healthcare and manufacturing sectors that understand how changing user behavior will improve security, aid incident response and reduce the risk of compromise.
You May Also Like
More Insights
