Cybercrime in 2017 was a tumultuous year “full of twists and turns”, with new (but old) infection methods, a major return to social engineering, and ups and downs in ransomware.
These conclusions come from the ‘Cybercrime tactics and techniques: 2017 state of malware’ report (PDF) published today by Malwarebytes.
“We look at our own detection telemetry and what we find in our honeypots to see what the criminals are pushing out,” Malwarebytes director of malware intelligence, Adam Kujawa, told SecurityWeek, “and we see what trends are apparent.” The report covers the period of January to November 2017 and compares it to the same period for 2016.
In some cases, those trends are surprising. Ransomware figured heavily in 2017; but with nuances. Over the year, detections for consumers increased by 93% over 2016, and by 90% for businesses. But those figures disguise a decline in consumer ransomware and an increase in business ransomware over the last few months of 2017.
It’s not clear why this happened, but Kujawa conjectures that improving awareness of ransomware and better defenses is making it harder for the criminals to get a good return from consumers. At the same time, while succeeding against business is even more difficult than infecting consumers, the potential return is much higher per victim. Earlier this month, Hancock Health paid $55,000 to recover from a SamSam ransomware attack.
At the same time as ransomware declined at the end of the year, “We saw,” said Kujawa, “a significant increase in spyware, banking trojans, hijackers and even adware.” He also pointed to a one-month dramatic spike in ransomware detections in September coinciding with an equally dramatic dip in spyware detections. “It indicates that the same type of campaign was being used to distribute both spyware and ransomware,” he suggested.
For consumers, adware is now the most-detected threat — representing around 40% of all consumer detections (it’s the second most-detected threat for businesses). Anti-malware firms have been increasingly active against all forms of unwanted apps; and Malwarebytes has been in the vanguard of this. In November it won a court case brought by Enigma Software, supplier of SpyHunter, which Malwarebytes it detects and blocks as unwanted software.
Concurrent with the adware market becoming more difficult, there has been a reduction in the number of players. But, commented Kujawa, “despite there being less players in the game, the attacks themselves are more sophisticated — we see adware, something we regularly classify as a PUP, using root kit functionality to block security software from running, or just blocking the ability to remove it at all.”
The report specifies Smart Service, which is bundled with adware and PUPs to prevent their removal. It hooks into the Windows CreateProcess function, so it can inspect new processes before they run. It also “protects certain processes from being terminated, and stops the user from removing critical files and registry keys.”
Apart from adware, the decline in ransomware for business was replaced by an upsurge in spyware and banking trojans. For all malware, the primary tactics of infection changed from 2016 to 2017. “In 2016 we saw lots and lots of exploit kits (also in 2015),” said Kujawa. “Now suddenly spreading malware through email is popular again. It’s based on tricking the user into opening something. There’s less attacking the computer (exploit kits delivering malware without the user being aware) and more attacking the person (social engineering emails).”
For the consumer, the big growth malware in 2017 has been crypto-miners. Exploit kits, drive-by attacks, phishing and malicious spam attacks have all pushed miners. “We blocked one of the primary pushers of this technology, CoinHive,” explained Kujawa, “and that turned out to be our #1 detection over many months. We’re talking about multi-million detections per day — averaging about 8 million per day, but I’ve seen it go up to 12 million and even 20 million on occasion.”
One area that did not show an expected increase during 2017 was botnet activity. “The last year showed a steady decline in detections for botnet malware, a huge shift from what we saw in 2016,” notes the report. “This aligns for both business and consumer customer telemetry.”
There’s likely little comfort in this. “Declines,” adds the author, “are likely due to a shift in focus away from the desktop, aiming at IoT devices such as routers or smart appliances instead.” We learned the potential for large IoT-based botnets at the end of 2016, with the Mirai attacks. “While there was a lack of massive IoT attacks in 2017, attackers have been spending their time focused on developing new tools to take advantage of IoT with cryptocurrency mining, spam-spreading botnets, and likely more DDoS attacks.”
Ransomware is currently showing a downward trend. Crypto-mining may not survive the volatility in market prices (Bitcoin is currently trading at around $11,000; down from nearly $20,000 just a few weeks ago) and the likelihood of greater international cryptocurrency regulation. But Malwarebytes warns they could be replaced by something new and potentially more worrying.
“It is not farfetched,” says the report, “to think we may see DDoS attacks against large organizations, like airline companies and power utilities, demanding a ransom payment to call off an army of botnet-infected IoT devices.” Ransomware might decline, merely to be replaced by larger DDoS ransoms.
Related: Fighting Back Against the Cyber Mafia
Related: 150,000 IoT Devices Abused for Massive DDoS Attacks on OVH
