Malicious Cryptomining Spikes, While Virtually All Other Malware Declines
Malware activity declined in the first quarter of 2018, with both detections for ransomware and cryptominers lower than the last quarter of 2018, according to anti-malware vendor Malwarebytes. However, major reductions in consumer instances mask an increase in both activities against businesses, the company says.
Consumer cryptominers dropped from a peak of 25 million detections in October 2017 to 16 million detections in March 2018. Business detections spiked in February 2017 to around 550,000 detections dropping down to nearly 400,000 in March — a downturn that may prove temporary due to “a shift in attack strategy”.
Ransomware detections have continued the downward trend that started in the middle of last year. Again, however, the large 34% decrease in consumer detections hides a 27% increase in business detections from the last quarter of 2107 to the first quarter of 2018.
Figures come from Malwarebytes’ Cybercrime Tactics and Techniques report (PDF) for Q1 2018. Details are gathered from the firm’s consumer and business telemetry, and enhanced with intelligence from the company’s research and data science teams. It confirms the findings of other malware researchers: that is, increasing criminal interest in cryptomining, where the proceeds of the criminal activity require less effort — and are more certain — than the collection of ransoms from ransomware victims.
They also show a shift (albeit only relative) away from consumers towards businesses. Businesses can afford to pay higher ransoms, and may be forced to pay for reasons outside of their own control (to ensure that service level and other contracts are met, or, for healthcare, to ensure continuous service to patients). At the same time, business computers will likely have greater processing capacity for illicit mining.
The one-time kings of ransomware, Locky and Cerber, have largely disappeared; “the most interesting examples of active ransomware in Q1 came in the form of GandCrab, Scarabey, and Hermes,” reports Malwarebytes. GandCrab was first spotted in January 2018, being distributed by a diversified RIG EK and the returning GrandSoft EK. It is also distributed via Necurs email spam and ElTest malware campaigns via compromised websites.
While bitcoin remains the most frequently demanded payment mechanism for ransomware, there has been some recent diversification into other cryptocurrencies. GandCrab, for example, demands payment in Dash, “likely,” says Malwarebytes, “a sign that threat actors are opting for currencies with lower transaction fees than BTC, and a touch more anonymity in the bargain.”
Scarabey, a variant of the Scarab ransomware, seeks to frighten victims into rapid payment by threatening to permanently delete files every day that the ransom remains unpaid. Malwarebytes’ analysis, however, concludes, “there’s nothing in the ransomware’s code that would allow this. It’s just a pressure-filled ruse designed to panic victims into paying faster.” The firm recommends that future claims of Scarabey’s capabilities should be treated with ‘a healthy dose of skepticism’.
Hermes was originally distributed via malicious Office documents. By March, it was using a sophisticated exploit kit called GreenFlash Sundown. “After analyzing Hermes,” notes the report, “we found it to be a fully functional ransomware. However, we cannot be sure what the real motivations of the distributors were. Looking at the full context, we may suspect that it was politically motivated rather than a profit-driven attack.”
The primary methods for illicit cryptomining are by delivered malware, or via the user’s browser (through drive-by mining or malicious extensions). In both cases, attackers seek to compromise or make use of as many computers as possible in order to maximize the mining process. The malware itself is fairly unsophisticated, but the delivery mechanisms are not. Two separate groups, for example, made use of the same exploits used in WannaCry to infect hundreds of thousands of Windows servers and generate millions of dollars in revenue.
Drive-by browser-based cryptomining really started with CoinHive in mid-September 2017. Weaknesses in the API soon led to its abuse. Visitors to compromised websites found their computers being silently used, via their browser, for cryptomining — a process that continues for as long as the visited page remains open. Some miners have developed pop-under capabilities to ensure that the mining continues in a hidden tab even after the user has ‘left’ the affected website.
As ad-blockers and security firms have got better at detecting and blocking CoinHive, criminals have gone to greater lengths to mask their activity. “The lowest number of drive-by cryptomining detections recorded in a single day,” notes Malwarebytes, “was still over 1 million.”
Cryptomining is now the second most detected malware for both businesses and consumers. Top for business is spyware, and top for consumers is adware. Ransomware is sixth for both business and consumer. Malwarebytes predicts that cryptomining will continue to grow — not least, it suggests, because both spyware and adware have the ability to drive victims to cryptomining landing pages. Indeed, this has already happened with the Trickbot spyware. The future of ransomware is not clear. While it is unlikely to go away, “whether we will see a return to the levels of distribution we observed in previous years is anyone’s guess.”
Malwarebytes has timed the announcement of a new product with the publication of this report: Malwarebytes Endpoint Protection and Response. This is in keeping with the expansion of anti-malware capabilities into full endpoint protection and response (EDR) products (Barkly did similar last week). The intention is to provide greater visibility into the context of a malware incident in order to improve the security team’s ability to respond to it.
“Many businesses don’t have the resources to bring on dedicated, highly-specialized EDR technology and talent, leaving them with a tool that simply adds to a long qu
eue of alerts, without fixing the underlying problems,” explains Marcin Kleczynski, CEO at Malwarebytes. “Endpoint Protection and Response provides proven endpoint protection with integrated detection and response capabilities via a single agent, so organizations of all sizes can easily protect their endpoints from targeted attacks, thoroughly remediate systems and rollback ransomware.”
