Cybercriminals are evolving their attack methods to increase their success rates and to accelerate infections

Fortinet announced the findings of its latest Global Threat Landscape Report. The research reveals cybercriminals are evolving their attack methods to increase their success rates and to accelerate infections.

While ransomware continues to impact organizations in destructive ways, there are indications that some cybercriminals now prefer hijacking systems and using them for cryptomining rather than holding them for ransom. For a detailed view of the findings and some important takeaways for CISOs read the blog. Highlights of the report follow:

Cybercrime attack methods evolve to ensure success at speed and scale 
Data indicates that cybercriminals are getting better and more sophisticated in their use of malware and leveraging newly announced zero-day vulnerabilities to attack at speed and scale. While the number of exploit detections per firm dropped by 13 percent in Q1 of 2018, the number of unique exploit detections grew by over 11 percent, and 73 percent of companies experienced a severe exploit.

Spike in Cryptojacking: Malware is evolving and becoming more difficult to prevent and detect. The prevalence of cryptomining malware more than doubled from quarter to quarter, growing from 13 percent to 28 percent.

Additionally, cryptojacking was quite prevalent in the Middle East, Latin America, and Africa. Cryptomining malware is also showing incredible diversity for such a relatively new threat. Cybercriminals are creating stealthier fileless malware to inject infected code into browsers with less detection. Miners are also targeting multiple operating systems as well as different cryptocurrencies, including Bitcoin, Dash, and Monero. They are also fine-tuning and adopting delivery and propagation techniques from other threats based on what was successful or unsuccessful to improve future success rates.

Targeted Attacks for Maximum Impact: The impact of destructive malware remains high, particularly as criminals combine it with designer attacks. For these types of more targeted attacks, criminals conduct significant reconnaissance on an organization before launching an attack, which helps them to increase success rates.

Afterwards, once they penetrate the network, attackers spread laterally across the network before triggering the most destructive part of their planned attack. The Olympic Destroyer malware and the more recent SamSam ransomware are examples of where cybercriminals combined a designer attack with a destructive payload for maximum impact.

Ransomware Continues to Disrupt: The growth in both the volume and sophistication of ransomware continues to be a significant security challenge for organizations. Ransomware continues to evolve, leveraging new delivery channels such as social engineering, and new techniques such as multi-stage attacks to evade detection and infect systems.

GandCrab ransomware emerged in January with the distinction of being the first ransomware to require Dash cryptocurrency as a payment. BlackRuby and SamSam were two other ransomware variants that emerged as major threats during the first quarter of 2018.

Multiple Attack Vectors: Although the side channel attacks dubbed Meltdown and Spectre dominated the news headlines during the quarter, some of the top attacks targeted mobile devices or known exploits on router, web or Internet technologies. 21 percent of organizations reported mobile malware, up 7 percent, demonstrating that IoT devices continue to be targeted.

Cybercriminals continue to recognize the value of exploiting known vulnerabilities that haven’t been patched along with recently discovered zero-days for increased opportunity. Microsoft continued to be the number one target for exploits, and routers took the number two spot in total attack volume. Content Management Systems (CMS) and web-oriented technologies were also heavily targeted.

Cyber Hygiene - More Than Just Patching: Measuring how long botnet infections persist based on the number of consecutive days in which continued communications are detected reveals that hygiene involves more than just patching. It is also about cleanup. Data showed that 58.5 percent of botnet infections are detected and cleaned up the same day. However, 17.6 percent of botnets persist for two days in a row, and 7.3 percent in last three days. About 5 percent persist for more than a week.

As an example, the Andromeda botnet was taken down in Q4 2017 but data from Q1 found it continued to show up prominently in both volume and prevalence.

Attacks Against Operational Technology (OT): While OT attacks are a smaller percentage of the overall attack landscape, the trends are concerning. This sector is increasingly becoming connected to the Internet, with serious potential ramifications for security. Currently, the vast majority of exploit activity is directed against the two most common industrial communication protocols, primarily because they are so widely deployed.

Data shows that in Asia ICS exploit attempts appear to be somewhat more prevalent when compared to ICS exploit activity across other regions.

Fighting evolving cybercrime requires integrated security 
The threat data in this quarter’s report reinforces many of the prediction trends unveiled by the Fortinet FortiGuard Labs global research team for 2018 demonstrating that the best defense against intelligent and automated threats is an integrated, broad, and automated security fabric.

A highly aware and pro-active security defense system is needed to keep pace with the next generation of automated and AI-based attacks.

Gavin Chow, Network and Security strategist, Fortinet Asia Pacific, said: "In India, exploits targeting known vulnerabilities in enterprise web systems running Apache Struts (CVE-2017-5638), Oracle WebLogic Server (CVE-2017-10271, CVE-2017-3506) and older IIS 6.0 web servers (CVE-2017-7269) were the most prevalent in Q1 2018. This is followed closely by exploits targeting vulnerabilities in Red Hat JBoss Application Server (CVE-2017-12149) and IoT devices such as Linksys and D-Link home routers.

"JavaScript-based cryptojacking malware was also the most prevalent in this region along with the malware leveraging a known Microsoft Office exploit (CVE 2017-11882) that is used to gain control of a victim's system to perform other malicious activity. Even though the Andromeda Botnet infrastructure was already taken down in Q4 2017 in continued to be the most prevalent BOT.

"The key takeaway here is that attackers are targeting known vulnerabilities that already have fixes available and system owners who are not aware of these risks would continue to be exposed to these attacks.”