New Ransomware Formats Double

The number of new ransomware samples more than doubled in the first quarter of this year, a new study shows. Cyber criminals are still using spear-phishing tactics, but an increasing number of attacks are gaining access to a company that has open and exposed remote access points and these are being used as methods for ransomware. 

The report from McAfee shows cyber attacks leveraging the file-locking malware have more than doubled this year with hackers modifying attack methods for more lucrative payouts.

Now they have reported that new ransomware increased by 118%, while the most prevalent strains were Dharma (aka Crysis), which has been in operation since 2016 with new versions, GandCrab, which uses AES encryption and puts a file labeled GrandCrab.exe on to the hacked system and Ryuk, which is probably a cyber-crime operation.

GandCrab and Ryuk are using mostly spear-phishing as a distribution mechanism, whereas Dharma is used in Remote Desktop Protocal (RDP) attacks. 

They have also now recorded an average of 504 new threats per minute in Q1 2019, and a resurgence of ransomware along with changes in campaign execution and code. 

More than 2.2 billion stolen account credentials were made available on the cyber-criminal underground over the course of the quarter. Sixty-eight percent of targeted attacks utilised spear-phishing for initial access, 77% relied upon user actions for campaign execution.

“The impact of these threats is very real,” said Raj Samani, McAfee fellow and chief scientist. “It’s important to recognise that the numbers, highlighting increases or decreases of certain types of attacks, only tell a fraction of the story.....Every infection is another business dealing with outages, or a consumer facing major fraud. We must not forget for every cyber-attack, there is a human cost.”

Ransomware Resurgence 
McAfee Advanced Threat Research (ATR) observed innovations in ransomware campaigns, with shifts in initial access vectors, campaign management and technical innovations in the code.

While spear phishing remained popular, ransomware attacks increasingly targeted exposed remote access points, such as Remote Desktop Protocol (RDP); these credentials can be cracked through a brute-force attack or bought on the cyber-criminal underground. RDP credentials can be used to gain admin privileges, granting full rights to distribute and execute malware on corporate networks.

McAfee researchers also observed actors behind ransomware attacks using anonymous email services to manage their campaigns versus the traditional approach of setting up command-and-control (C2) servers. Authorities and private partners often hunt for C2 servers to obtain decryption keys and create evasion tools. Thus, the use of email services is perceived by threat actors to be a more anonymous method of conducting criminal business.

In addition to  Dharma (also known as Crysis), GandCrab and Ryuk, other notable ransomware families of the quarter include Anatova, which was exposed by McAfee Advanced Threat Research before it had the opportunity to spread broadly and Scarab, a persistent and prevalent ransomware family with regularly discovered new variants. 

“After a periodic decrease in new families and developments at the end of 2018, the first quarter of 2019 was game on again for ransomware, with code innovations and a new, much more targeted approach,” said Christiaan Beek, McAfee lead scientist and senior principal engineer.....Paying ransoms supports cyber-criminal businesses and perpetuates attacks. There are other options available to victims of ransomware. Decryption tools and campaign information are available through tools such as the No More Ransom project.”

Q1 2019 Threats Activity

  • Attack Vectors. Malware led disclosed attack vectors, followed by account hijacking and targeted attacks.
  • Crypto-Mining. New coin mining malware increased 29%. McAfee ATR observed CookieMiner malware targeting Apple users, attempting to obtain bitcoin wallets credentials. As a by-product, the malware also gained access to passwords and browsing data. Total coin mining malware samples grew 414% over the past four quarters.
  • Fileless Malware. New JavaScript malware declined 13%, while total malware grew 62% over the past four quarters. New PowerShell malware increased 460% due to the use of down-loader scripts. Total malware grew 76% over the past four quarters.
  • IoT. Cybercriminals continued to leverage lax security in IoT devices. New malware samples increased 10%; total IoT malware grew 154% over the past four quarters.
  • Malware Overall. New malware samples increased by 35%. New Mac OS malware samples declined by 33%.
  • Mobile malware. New mobile malware samples decreased 15%, total malware grew 29% over the past four quarters.
  • Security Incidents. McAfee Labs counted 412 publicly disclosed security incidents, an increase of 20% from Q4. Thirty-two percent of all publicly disclosed security incidents took place in the Americas, followed by 13% in Europe and 13% in Asia-Pacific.
  • Regional Targets. Disclosed incidents targeting the Asia-Pacific region increased 126%, Americas declined nearly 3% and Europe decreased nearly 2%.
  • Vertical Industry Activity. Disclosed incidents impacting individuals spiked 78%, education sector increased 50%, healthcare increased 18%, public sector decreased 10%, and financial sector increased 89%.
  • Targeted Attacks. McAfee identified a high number of campaigns that effectively minimised the data reconnaissance required to successfully execute attacks. 

Actors primarily focused on large organisations in the Government/Administration sector, followed by Finance, Chemical, Defense, and Education sectors. Initial access was gained by spear-phishing in 68% of attacks and 77% relied upon specific user actions for attack execution.

  • Underground. More than 2.2 billion stolen account credentials were made available on the cyber-criminal underground over the course of the quarter. 

The largest dark market, Dream Market, announced its plan to close, citing a large number of DDoS attacks. Law enforcement successfully seized and closed operations of xDedic, one of the largest RDP shops reportedly selling access to approximately 70,000 hacked machines.

McAfee:    HelpNetSecurity:     Oodaloop      HealthITSecurity:     BusinessWire

You Might Also Read:

The Top 5 Malware Attack Types:

Ransomware & Malware Make Way For New Attack Vectors:

 

 

« Cyber War In The Middle East Is Escalating
UK Cyber Crime Is Increasing In 2019 »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Cyber Security Supplier Directory

Cyber Security Supplier Directory

Our Supplier Directory lists 6,000+ specialist cyber security service providers in 128 countries worldwide. IS YOUR ORGANISATION LISTED?

NordLayer

NordLayer

NordLayer is an adaptive network access security solution for modern businesses — from the world’s most trusted cybersecurity brand, Nord Security. 

Practice Labs

Practice Labs

Practice Labs is an IT competency hub, where live-lab environments give access to real equipment for hands-on practice of essential cybersecurity skills.

ZenGRC

ZenGRC

ZenGRC - the first, easy-to-use, enterprise-grade information security solution for compliance and risk management - offers businesses efficient control tracking, testing, and enforcement.

MIRACL

MIRACL

MIRACL provides the world’s only single step Multi-Factor Authentication (MFA) which can replace passwords on 100% of mobiles, desktops or even Smart TVs.

Reed Smith LLP

Reed Smith LLP

Reed Smith LLP is an international law firm with offices in the USA, Europe, Middle East and Asia. Practice areas include Information Technology, Privacy & Data Security.

Infoblox

Infoblox

Infoblox solutions help businesses automate complex network control functions to reduce costs, increase security and maximize uptime.

National Agency for the Security of Information Systems (ANSSI) - France

National Agency for the Security of Information Systems (ANSSI) - France

The role of Agence Nationale de la Sécurité des Systèmes d'Information (ANSSI) is to foster a coordinated, ambitious, pro-active response to cybersecurity issues in France.

Paramount Computer Systems

Paramount Computer Systems

Paramount is a regional leader in the Middle East for cybersecurity solutions and consulting services.

Executive Women's Forum (EWF)

Executive Women's Forum (EWF)

The Executive Women's Forum is the largest member organization serving emerging leaders and influential female executives in the Information Security, Risk Management and Privacy industries.

PrivateCore

PrivateCore

We protect data-in-use from hackers trying to steal data such as encryption keys, certificates, intellectual property.

Cybertech

Cybertech

Cybertech Conference & Exhibition presents commercial problem solving strategies and solutions for the global cyber threat that meet the diverse challenges for a wide range of sectors.

Department of Energy - Cybersecurity, Energy Security, and Emergency Response (CESER)

Department of Energy - Cybersecurity, Energy Security, and Emergency Response (CESER)

The Office of Cybersecurity, Energy Security, and Emergency Response (CESER) addresses the emerging threats of tomorrow while protecting the reliable flow of energy to Americans today.

KeepSolid

KeepSolid

KeepSolid is a Virtual Private Network services provider offering secure encrypted access to the internet.

NJVC

NJVC

NJVC delivers IT automation, optimization and security to empower mission-enabling IT for customers with secure requirements.

Cyturus Technologies

Cyturus Technologies

Cyturus Technologies delivers cybersecurity business risk quantification services using our proprietary Adaptive Risk Model (ARM).

Infuse Technology

Infuse Technology

Infuse Technology provide the highest level of cybersecurity support, implementing practical solutions to protect against cyber-attacks, from simple phishing scams to complex data security breaches.

Secuna Software Technologies

Secuna Software Technologies

Secuna is the most trusted Cybersecurity Testing Platform in the Philippines. Our pool of vetted security researchers will find and ethically report security vulnerabilities in your product.

Profian

Profian

Profian’s hardware-based solutions maintain your data's confidentiality and integrity in use, providing true confidential computing to meet regulatory and audit requirements.

CLEAR

CLEAR

With more than 17 million members and a growing network of partners across the world, CLEAR's identity platform is transforming the way people live, work, and travel.

AUCyber

AUCyber

AUCyber is a leading provider of managed cyber security solutions and consultancy services, specialising in supporting Australian organisations and Government agencies.