The first six months of 2019 saw organizations dealing with a broad range of incoming threats and, more urgently, tackling threats that had already gained a foothold in their systems. Malware that “lived off the land,” or took advantage of legitimate and whitelisted tools to carry out malicious actions, was prevalent. Ransomware, an old threat, refocused on particular targets. Phishing, another perennial peril, used new platforms to ensnare victims. And the number of disclosed high-impact vulnerabilities drew concern and underscored the need for a better understanding of the real-world risks faced by enterprise systems.
Our midyear security roundup highlights these and other threats that made their mark in the first half of 2019, and provides security insights to help users and organizations determine the right solutions and defense strategies against them.
In the first half of 2019, cybercriminals were more selective about their ransomware targets, concentrating mainly on multinationals, enterprises, and even government organizations. Their modus operandi involved sending employees tailored phishing emails, exploiting security gaps to gain access into the network, and then moving laterally within the network.
The LockerGoga ransomware , for example, hit a Norwegian manufacturing company and halted production in several of its plants in March, eventually resulting in over US$55 million in financial losses . And the city of Baltimore, Maryland, had incurred US$5.3 million in recovery costs after its systems were infected with the RobbinHood ransomware in May.
Some municipal organizations were evidently pressured into simply paying the ransoms in hopes of quickly restoring the affected systems used for their public services. Notably, three municipalities in Florida were struck by separate ransomware attacks over the course of several weeks: Riviera Beach , by an unidentified ransomware variant, and Lake City and Key Biscayne , both by the notorious Ryuk ransomware .
These high-profile attacks and high-value payouts were in line with the steep increase in our overall ransomware detections from the second half of 2018 to the first half of 2019, although the number of new ransomware families declined.
We also observed destructive routines beyond file encryption. Some ransomware variants, including the examples below, were designed with notable features that decreased the chances of victims recovering files and systems.
Our data showed that various ransomware families were active in the first half of the year. But the infamous WannaCry remained the most detected ransomware family, with numbers that far exceeded those of the other ransomware families combined.
As we predicted , threat actors had been increasingly “living off the land,” or abusing legitimate system administration and penetration testing tools to hide their malicious activities. Their so-called fileless threats are not as visible as traditional malware since these typically do not write to disk, are usually executed in a system’s memory, reside in the registry, or misuse normally whitelisted tools like PowerShell, PsExec, or Windows Management Instrumentation.
Here are a few notable threats we detected that used fileless techniques:
These threats had something in common: PowerShell abuse. While it is a convenient tool for system administrators, PowerShell can be used by cybercriminals to launch payloads without having to write or run a file in an affected system’s local memory.
Macro malware slightly decreased from the latter half of 2018. Most of our detections for macro-based threats were due to Powload, mainly in spam emails. Powload has evolved over the years: diversifying the payloads it delivers, employing steganography , and even using region-specific brands or vocabulary. We also saw other families of macro malware being used in spam campaigns that delivered information stealers like Trickbot and used for cyberespionage .
Our data showed that blocked access to exploit kit-related sites slightly rose from the second half of 2018, although the number for the first half of 2019 was still a far cry from when exploit kits were at their peak . Exploits kits take every opportunity they can, using old but still viable vulnerabilities and different payloads, which they adapt to their specific needs.
One notable exploit kit from the first half of 2019 was Greenflash Sundown, which was used by the ShadowGate campaign through an upgraded version capable of living off the land, that is, using an updated PowerShell loader to filelessly execute the payload . ShadowGate’s last notable activity was in April 2018, when it used Greenflash Sundown to spread cryptocurrency-mining malware in East Asia .
Phishing activities dipped in the first half of 2019. Our data showed an 18% drop in the number of times we blocked a phishing site from being accessed by a unique client IP address. Several factors could be responsible for this decline, including a rise in user awareness about phishing scams. But interestingly, within the same time frame, we noted a steep 76% increase in the number of blocked unique phishing URLs that spoofed Microsoft Office 365, specifically Outlook.
Taking further their abuse of people’s trust in known brands and tools, cybercriminals also used multiplatform social engineering threats for phishing.
Business email compromise (BEC) is a simple but increasingly costly scam that enterprises must be wary of. BEC scammers use various social engineering techniques, typically impersonating CEOs and other executives, to trick unwitting employees into transferring funds to their accounts.
BEC has been part of the threat landscape for years, and scammers have been developing new ways to take advantage of their victims. Consequently, they have also been compromising personal and vendor email accounts and spoofing lawyer email accounts . There have also been instances that support our prediction that BEC scammers would target employees farther down the company hierarchy.
Sextortion, a messaging threat focused on personal and reputational damage, had also been on the rise. Our data showed that sextortion schemes via spam more than quadrupled from the second half of 2018 to the first half of 2019, which matched the trajectory we predicted last year . This was unsurprising given that sextortion made up the majority of extortion-related complaints received by the FBI in 2018 .
Because of the personal and sensitive nature of sextortion scams, victims are likely to be coerced into acquiescing to sextortionists’ demands. One specific example in April found malicious actors attempting to extort money from Italian-speaking users by threatening them with the release of compromising videos.
The disclosure of Meltdown and Spectre at the start of 2018 opened up a new class of challenges in the mitigation and patching of vulnerabilities. In the first half of 2019, more hardware-level vulnerabilities were uncovered.
In February, researchers revealed a proof of concept showing how hackers could misuse enclaves designed to protect and access data in Intel’s Software Guard Extensions (SGX), a set of instructions found in Intel’s Core and Xeon processors.
In May, researchers disclosed several microarchitectural data sampling vulnerabilities in modern Intel processors. Their impact was demonstrated through the side-channel attacks ZombieLoad , Fallout , and Rogue In-Flight Data Load (RIDL) , with methods similar to those of Meltdown and Spectre. These side-channel attacks could enable hackers to execute code or exfiltrate data.
Risky vulnerabilities prevailed in the threat landscape of the first half of 2019. The majority of the vulnerabilities reported through our Zero Day Initiative (ZDI) program were rated high in severity, a sign of their pervasive impact.
Here are a few of the notable vulnerabilities seen in the first half of 2019 and the dangers they pose to enterprises:
Just as we predicted , botnets and worms had been fighting for control of exposed devices connected to the internet of things (IoT) . The various contenders trying to edge out and literally erase the competition — including Bashlite as well as Mirai variants like Omni , Hakai, and Yowai — had this routine in common: scanning for competitors on infected IoT devices, deleting the other malware, and embedding their own payloads.
The industrial internet of things (IIoT) has transformed how industrial facilities and critical infrastructures run , providing an unmatched boost in efficiency and visibility into enterprise operations. However, the convergence of operational technology (OT) and information technology (IT) has also brought new security risks and resulted in broader attack surfaces .
According to a survey published in March, 50% of surveyed organizations already experienced an attack on their critical infrastructures in the past two years. And in 2019, malicious actors seemed to be assessing IIoT targets. The Xenotime hacking group, believed to be behind the Triton aka Trisis malware, was seen probing the industrial control systems (ICSs) of power grids in the U.S. and Asia-Pacific region. The malware scanned for and listed its targets’ remote login portals and vulnerabilities in their networks.
Midway through, 2019 has seen many persistent and stealthy threats, ready to find and exploit vulnerabilities in processes, people, and technologies. There is no easy answer for comprehensive defense — enterprises and users have to find a multilayered approach that can address their specific security gaps. Protection is needed for gateways, networks, servers and endpoints. For enterprises that face malware using sophisticated techniques, solutions that combine human expertise and security technologies are needed to better detect, correlate, respond to, and remediate threats.
Like it? Add this infographic to your site:1. Click on the box below. 2. Press Ctrl+A to select all. 3. Press Ctrl+C to copy. 4. Paste the code into your page (Ctrl+V).
Image will appear the same size as you see above.
In the first half of this year, cybersecurity strongholds were surrounded by cybercriminals waiting to pounce at the sight of even the slightest crack in defenses to ravage valuable assets. View the report
The upheavals of 2020 challenged the limits of organizations and users, and provided openings for malicious actors. A robust cybersecurity posture can help equip enterprises and individuals amid a continuously changing threat landscape. View the 2020 Annual Cybersecurity Report
buy non vbv cc online legit cc shop 2021