Ransomware & Malware Make Way For New Attack Vectors

There has been a major decline in ransomware and malware attacks some countries like  Ireland having some of the lowest rates globally, according to the latest threat intelligence report from Microsoft. New figures indicate that global ransomware attacks fell by 60% between March and December of last year, while malware attacks declined in general. 

Instead, threat actors are launching campaigns that rely on more covert attack techniques such as phishing and social engineering in general.

Cyber Criminals took to Crypto-Jacking last year
Crypto-jacking is the illegitimate use of a system’s resourcing powers for mining cryptocurrency. Microsoft detected far more crypto-jacking attacks than ransomware campaigns in 2018, with the average monthly detection rate for crypto-jacking reaching 0.12%, more than twice the rate for ransomware (0.05%).

Ransomware still makes headlines, however, we encounter it at much lower volumes compared to other malware, and tactics such as cryptocurrency mining. Ransomware attacks happen when bad actors encrypt and threaten to delete a user’s or organisation’s valuable information unless they pay a ransom. Ransomware has been on the decline in recent times since victims have not been paying the ransoms and companies have been able to retrieve locked up files from their backups. Still, it continues to be a threat in some regions, primarily due to a lack of security hygiene, with occasional spikes in encounter rates.

The latest Microsoft Threat Intelligence Report also reveals that hackers have pivoted to more covert means, with an increased focus on exploiting users through social engineering methods like phishing to gain access and exploit data.  Phishing rates have increased with cyber-criminals also covertly using victims’ compromised computers for crypto-currency mining.

While crypto-currency mining is not a new phenomenon, there has been an increase in its prevalence globally over the last year. In 2018, the average worldwide monthly crypto-currency coin mining encounter rate was 0.12%, compared to just 0.05% for ransomware. 

Many factors contribute to the increased popularity of mining as a payload for malware. Unlike ransomware, crypto-currency mining does not require user input, it works in the background, while the user is performing other tasks or is away from the computer and may not be noticed at all unless it degrades the computer’s performance sufficiently.

Targeting Cloud Providers 
Cloud providers such as Microsoft Azure are perennial targets for attackers seeking to compromise and weaponise virtual machines and other resources. The attacker can then use these virtual machines to launch attacks, including brute force attacks against other virtual machines, to deliver spam campaigns that can be used for email phishing attacks, for reconnaissance such as port scanning to identify new attack targets, and for other malicious activities. 

Malware
Good computer hygiene helps to mitigate the risks of malware. Typically, when we see high rates of malware, it’s a result of poor security hygiene and low user security education and awareness. Using unlicensed and/or pirated software can also be a source of malware. 

Sources that illegitimately offer free software or content, such as streaming videos, will often include malware. Some potential reasons for the overall decrease in malware encounter rates in 2018 are the growth in adoption of Windows 10, and increased use of Windows Defender for protection. Even if there is an intermittent slowdown in malware encounter rates, attackers don’t stand still, rather, they continue to evolve their techniques.

Drive-by Download
A drive-by download (DBD) is an unintentional download of malicious code to an unsuspecting user’s computer when they visit a web site. The malicious code could be used to exploit vulnerabilities in web browsers, browser add-ons, applications, and the operating system. 

Users can be infected with malware simply by visiting a website, even without attempting to download anything. In our research, we track drive-by downloads that affect web browser vulnerabilities. 

Drive-by downloads can be hosted on legitimate websites. Attackers gain access to legitimate sites through intrusion or by posting malicious code to a poorly secured web form, like a comment field on a blog. 

It can be difficult for even an experienced user to identify a compromised site from a list of search results. More advanced drive-by download campaigns can also install ransomware or even crypto-currency mining software on a victim machine.

HelpNetSecurity:         Microsoft

You Might Also Read:

Cybersecurity 2019: Predictions You Can’t Ignore:

Dealing With Malicious Emails:

 

« Wanted: An International Cyber Security Law
WannaCry Has Not Gone Away »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

North Infosec Testing (North IT)

North Infosec Testing (North IT)

North IT (North Infosec Testing) are an award-winning provider of web, software, and application penetration testing.

Clayden Law

Clayden Law

Clayden Law advise global businesses that buy and sell technology products and services. We are experts in information technology, data privacy and cybersecurity law.

Directory of Cyber Security Suppliers

Directory of Cyber Security Suppliers

Our Supplier Directory lists 7,000+ specialist cyber security service providers in 128 countries worldwide. IS YOUR ORGANISATION LISTED?

LockLizard

LockLizard

Locklizard provides PDF DRM software that protects PDF documents from unauthorized access and misuse. Share and sell documents securely - prevent document leakage, sharing and piracy.

Authentic8

Authentic8

Authentic8 transforms how organizations secure and control the use of the web with Silo, its patented cloud browser.

Vertical Structure

Vertical Structure

Vertical Structure services include Security & Penetration Testing, Information Assurance, Bespoke Training Programs and Secure Hosting.

Norton Rose Fulbright

Norton Rose Fulbright

Norton Rose Fulbright is a global business law firm. Practice areas include Data protection, Privacy and Cybersecurity.

Industrial Cyber-Physical Systems Center (iCyPhy)

Industrial Cyber-Physical Systems Center (iCyPhy)

The goal of iCyPhy is to conduct pre-competitive research on architectures and design, modeling, and analysis techniques for cyber-physical systems.

Onward Security

Onward Security

Onward Security provides security solutions including network & application assessment, product security testing and security consulting services.

Sonrai Security

Sonrai Security

Sonrai Security delivers an enterprise security platform focused on identity and data protection inside AWS, Azure, and Google Cloud.

KnectIQ

KnectIQ

Building Trust Environments in a Zero-Trust World. KnectIQ offers KIQAssure, an Ultra High Security Solution for Data in Flight.

Trail of Bits

Trail of Bits

Trail of Bits combine high-end security research with a real-world attacker mentality to reduce risk and fortify code.

VLATACOM Institute

VLATACOM Institute

Vlatacom Institute is privately owned accredited research and development institute, system integrator and turn-key solution provider. Areas of expertise include encryption and authentication.

Apptega

Apptega

Apptega is an award-Winning Cybersecurity and Compliance Platform. Our mission is to make cybersecurity and compliance easy for everyone.

BugDazz

BugDazz

BugDazz pentest as a service (PTaaS) platform helps bringing in real-time results, detail coverage, & easy remediation workflows with compliance-ready reports.

Venari Security

Venari Security

Venari is an award-winning cybersecurity SaaS provider that has developed an ETA (Encrypted Traffic Analysis) platform which fundamentally changes the way encrypted traffic is analysed.

Zaviant Consulting

Zaviant Consulting

Zaviant Consulting is a leading data security and privacy consulting firm assisting organizations comply with constantly evolving security frameworks and privacy regulations.

Prescient Solutions

Prescient Solutions

Prescient Solutions is a managed services provider, using a cloud-based model to provide IT solutions to small, mid-sized, global organizations and government entities.

Verichains

Verichains

Verichains Lab is a pioneer and leading APAC blockchain security firm with extensive expertise in the areas of security, cryptography and core blockchain technology.

NexusTek

NexusTek

NexusTek is a managed IT services provider with a comprehensive portfolio comprised of end-user services, cloud, infrastructure, cyber security, and IT consulting.

Blockfence

Blockfence

Blockfence are a seasoned crew versed in enterprise-grade cybersecurity and crypto, on a mission to collaboratively shape the future of Web3 security.