Ransomware attacks growing rapidly, organizations are struggling

The percentage of ransomware attacks increased from 5.5%, to 10.5% of all recognized malware attacks from July to December 2016, according to Check Point.

Check Point researchers detected a number of key trends during the period:

• The Monopoly in the Ransomware Market – thousands of new ransomware variants were observed in 2016, and in recent months we witnessed a change in the ransomware landscape as it became more and more centralized, with a few significant malware families dominating the landscape.
• DDoS Attacks via IoT Devices – in August 2016, the infamous Mirai Botnet was discovered – a first of its kind- the Internet-of-Things (IoT) Botnet, which attacks vulnerable Internet-enabled digital such as video recorders (DVR) and surveillance cameras (CCTV). It turns them into bots, using the compromised devices to launch multiple high-volume Distributed Denial of Service (DDoS) attacks. It is now clear that vulnerable IoT devices are in use in almost every home, and massive DDoS attacks that are based on such will persist.
• New File Extensions Used in Spam Campaigns – the most prevalent infection vector used in malicious spam campaigns throughout the second half 2016 was downloaders based on Windows Script engine (WScript). Downloaders written in Javascript (JS) and VBScript (VBS) dominated the mal-spam distribution field, together with similar yet less familiar formats such as JSE, WSF, and VBE.

Top malware during H2 2016

1. Conficker (14.5% of all malware attacks) – Worm that allows remote operations and malware download. The infected machine is controlled by a botnet, which contacts its Command & Control server to receive instructions.

2. Sality (6.1%) – Virus that allows remote operations and downloads of additional malware to infected systems by its operator. Its main goal is to persist in a system and provide means for remote control and installing further malware.

3. Cutwail (4.6%) – Botnet mostly involved in sending spam e-mails, as well as some DDOS attacks. Once installed, the bots connect directly to the command and control server, and receive instructions about the emails they should send. After they are done with their task, the bots report back to the spammer exact statistics regarding their operation.

4. JBossjmx (4.5%) – Worm that targets systems having a vulnerable version of JBoss Application Server installed. The malware creates a malicious JSP page on vulnerable systems that executes arbitrary commands. Moreover, another Backdoor is created that accepts commands from a remote IRC server.

5. Locky (4.3%) – Ransomware, which started its distribution in February 2016, and spreads mainly via spam emails containing a downloader disguised as a Word or Zip file attachment, which then downloads and installs the malware that encrypts the user files.

Top ransomware during H2 2016

The percentage of ransomware attacks out of all recognized attacks globally almost doubled in H2 2016, from 5.5% to 10.5%. The most common variants were:

1. Locky (41% of all ransomware attacks) – The third most common ransomware in H1, which increased dramatically in the second half of the year.

2. Cryptowall (27%) – Ransomware that started as a Cryptolocker doppelgänger, but eventually surpassed it. After the takedown of Cryptolocker, Cryptowall became one of the most prominent ransomwares to date. Cryptowall is known for its use of AES encryption and for conducting its C&C communications over the Tor anonymous network. It is widely distributed via exploit kits, malvertising and phishing campaigns.

3. Cerber (23%) – the world’s biggest ransomware-as-a-service scheme. Cerber is a franchise scheme, with its developer recruiting affiliates who spread the malware for a cut of the profits.

Maya Horowitz, Threat Intelligence Group Manager at Check Point commented: “The report demonstrates the nature of today’s cyber environment, with ransomware attacks growing rapidly. This is simply because they work, and generate significant revenues for attackers. Organizations are struggling to effectively counteract the threat: many don’t have the right defenses in place, and may not have educated their staff on how to recognize the signs of a potential ransomware attack in incoming emails.

“Additionally our data demonstrates that a small number of families are responsible for the majority of attacks, while thousands of other malware families are rarely seen,” continued Horowitz. “Most cyber threats are global and cross-regional, yet the APAC region, stands out as its Top Malware Families chart includes 5 families which do not appear in the other regional charts.”

Top mobile malware during H2 2016

1. Hummingbad (60% of all mobile attacks) – Android malware first revealed by Check Point research team that establishes a persistent rootkit on the device, installs fraudulent applications and with slight modifications could enable additional malicious activity such as installing a key-logger, stealing credentials and bypassing encrypted email containers used by enterprises.

2. Triada (9%) – Modular Backdoor for Android which grants superuser privileges to downloaded malware, and helps it to get embedded into system processes. Triada has also been seen spoofing URLs loaded in the browser.

3. Ztorg (7%) – Trojan that uses root privileges to download and install applications on the mobile phone without the user’s knowledge.

Top banking malware

1. Zeus (33%) – Trojan that targets Windows platforms and often used to steal banking information by man-in-the-browser keystroke logging and form grabbing.

2. Tinba (21%) – Banking Trojan that steals the victim’s credentials using web-injects, activated as the users try to login to their bank website.

3. Ramnit (16%) – Banking Trojan that steals banking credentials, FTP passwords, session cookies and personal data.