Internet Security Threat Report ISTR April 2017 Volume Contents Introduction Executive summary Big numbers Targeted attacks: Espionage, subversion, 22 & sabotage Email: Malware, spam, & phishing Web attacks, toolkits, & exploiting vulnerabilities online Cyber crime & the underground economy Ransomware: Extorting businesses & consumers New frontiers: IoT, mobile, & cloud threats Internet Security Threat Report Contents 4 Introduction 34 Exploit kits 59 Ransom demands soar 35 Web attacks 59 Infection vectors 6 Executive summary 35 Browser vulnerabilities 61 Arrival of Ransomware-as-a-Service 9 Big numbers 36 Case study 61 New techniques: Targeted attacks and “living off the land” 36 Angler: The rise and fall of an exploit kit 13 Targeted attacks: 62 Other platforms now vulnerable Espionage, subversion, 36 Further reading 62 Law enforcement takedowns & sabotage 36 Best practices 62 Further reading 14 Introduction 37 Cyber crime & the 62 Best practices 14 Key findings underground economy 16 The targeted attack 38 Introduction 63 New frontiers: landscape in 2016 38 Key findings Internet of Things, mobile, & 17 Trends and analysis cloud threats 38 Malware 17 Subversion emerges as a new motive 64 Internet of Things 39 Living off the land: PowerShell, macros, for targeted attacks and social engineering 64 Key findings 18 Sabotage attacks make a comeback 41 Botnet case study: Necurs 64 Trends and analysis 18 Living off the land 42 It’s all about the money: Financial 65 Country data 19 How Shamoon attackers used malware 66 Passwords “living off the land” tactics 43 Up to the Mac 66 The Mirai botnet 20 Economic espionage 44 Odinaff and Banswift: 67 An evolving story 21 New threats emerge The year of the targeted 67 Looking forward 21 Further reading financial heist 67 Best practices 22 Best practices 44 Banswift 68 Mobile 45 Odinaff 23 Email: Malware, spam, 68 Key findings 45 Data breaches and the & phishing underground economy 68 Mobile malware trends 24 Introduction 45 Data breaches 69 Motives and techniques 24 Key findings 45 Year in review 70 Malware and grayware rates 24 Trends and analysis 47 Data breach causes 70 Increase in runtime packers 24 Malware menace 48 Industries exposed 70 Mobile vulnerabilities 25 Phishing 50 Country data 70 Improvements in Android 26 BEC scams architecture 51 Underground Economy 27 Spam stays steady 72 Sour taste for Apple 53 Disruptions and takedowns 28 Case studies/investigations 72 Best practices 53 Avalanche 28 Changing tactics 72 Cloud 53 Bayrob 28 Ice-cold: Snowshoe and 72 Key findings 53 Lurk/Angler hailstorm techniques 72 Trends and analysis 53 Dyre 29 Tried and tested social engineering 73 Risky business 54 Further reading 30 Social engineering and new 73 Ransomware danger messaging platforms 54 Best practices 74 IoT and cloud: Potential 30 Further reading 55 Ransomware: partners in cyber crime 31 Best practices Extorting businesses 74 Living off the land & consumers 32 Web attacks, toolkits, & 74 Further reading exploiting vulnerabilities 56 Introduction 74 Best practices online 56 Key findings 75 Credits 33 Introduction 56 Trends & analysis 76 About Symantec 33 Key findings 58 Case studies/investigations 76 More Information 33 Trends and analysis 58 How ransomware can affect consumers 33 Vulnerability assessment 58 How ransomware can affect businesses Internet Security Threat Report 35 Web attacks blocked per month 55 Ransomware: Graphics, tables, 35 Classification of most frequently Extorting businesses exploited websites & consumers and charts 36 Browser vulnerabilities 56 Average global ransomware detections per day 9 Big numbers 37 Cyber crime & the 57 Global ransomware detections by month underground economy 13 Targeted attacks: 57 Ransomware detections by country 38 Unique malware variants Espionage, subversion, detected for the first time 57 New ransomware families & sabotage 38 Monthly count of unique malware 57 New ransomware variants variants first seen in 2016 14 Timeline of notable targeted 58 Ransomware variants by month attack incidents during 2016 39 Unique malware variants detected 58 Consumer vs enterprise infections 15 Notable targeted attack groups 39 Monthly count of unique 58 Consumer vs enterprise infections by month 16 Zero-day vulnerabilities, annual total malware variants in 2016 59 Average ransom demand 16 US presidential election: Timeline 40 Malware prevalence and trends 60 Major ransomware threats of attacks during 2016 40 Typical attack scenario in 2016 took the following steps 17 Vulnerabilities disclosed in 63 New frontiers: industrial control systems 41 JavaScript downloader detections per month Internet of Things, mobile, & 19 Most commonly seen tools that 41 Office macro downloader cloud threats can be misused by attackers detections per month 65 Hourly attacks on the IoT honeypot per month 20 Spear-phishing email used in DNC attacks 41 Bot activity numbers 65 Top 10 countries where 42 Downloaders delivered by 23 attacks on the Symantec IoT Email: Malware, spam, Necurs spam botnet & phishing honeypot were initiated 42 Top 10 financial Trojans 24 Overall email malware rate 66 Top 10 passwords used to attempt to 43 Financial Trojan activity by month log in to the Symantec IoT honeypot 25 Monthly email malware rate 43 Mac malware distribution per 67 Mirai’s trail of disruption in 2016 25 Email malware rate by industry month, 2014-2016 68 Number of overall mobile malware 25 Email malware rate by company size 44 Top 10 malware blocked on OS X endpoints detections per year as percentage of total infections 25 Overall phishing rate 68 Cumulative number of mobile 45 Data breaches, 2014-2016 malware families per year 26 Monthly phishing rate 46 Data breaches per month, 2014-2016 69 Mobile variants per family 26 Phishing rate by industry 46 Identities stolen by month, 2014-2016 69 Mobile malware variants by year 26 Phishing rate by company size 46 Types of data lost in breaches in 2016 69 Top mobile threats in 2016 27 BEC scams: Common subject lines 47 Top 10 causes of data breaches in 2016 70 Malware and grayware rates, 2014-2016 27 Overall spam rate 47 Top 10 causes of data breaches 70 Percentage of in-field mobile 27 Monthly spam rate by identities stolen in 2016 malware that is packed 28 Spam rate by company size 48 Top 10 sectors breached by 71 Market share of different versions 28 Spam rate by industry number of incidents of Android, January 2017 28 Downloader detections by month 48 Top 10 sub-sectors breached 71 Mobile vulnerabilities reported, by number of incidents by operating system 29 Blocked emails with WSF attachments 49 Top 10 sectors breached by 73 Most commonly used cloud 29 Typical emailed malware number of identities stolen apps in enterprises infection process 49 Top 10 sub-sectors breached by 30 Keywords used in malware spam campaigns number of identities stolen 30 Preferred languages used in spam campaigns 50 Top 10 countries by number of data breaches 50 Top 10 countries by number 32 Web attacks, toolkits, & of identities stolen exploiting vulnerabilities 51 Underground marketplace price list online 52 The underground marketplace 33 Scanned websites with vulnerabilities 33 Percentage of vulnerabilities which were critical 34 Top 10 exploit kits Internet Security Threat Report Introduction Section 00 00 Introduction Page 5 ISTR April 2017 Symantec has established the largest civilian threat In addition, Symantec maintains one of the world’s most collection network in the world, and one of the most comprehensive vulnerability databases, currently consisting of comprehensive collections of cyber security threat more than 88,900 recorded vulnerabilities (spanning more than two decades) from 24,560 vendors representing over 78,900 intelligence through the Symantec Global Intelligence products. Network™. The Symantec Global Intelligence Network Analysis of spam, phishing, and email malware trends is tracks over 700,000 global adversaries and records gathered from a variety of Symantec security technologies events from 98 million attack sensors worldwide. processing more than 2 billion emails each day, including: This network monitors threat activities in over 157 Skeptic™, Symantec Messaging Gateway for Service Providers, countries and territories through a combination Symantec CloudSOC, and the Symantec Probe Network. of Symantec products, technologies, and services, Skeptic™ is the Symantec Email and Web Security.cloud™ proprietary heuristic technology, filtering more than 336 million including Symantec Endpoint Protection™, Symantec emails, and over 2.4 billion web requests each day. Symantec DeepSight™ Intelligence, Symantec Managed also gathers phishing information through an extensive anti- Security Services™, Norton™ consumer products, fraud community of enterprises, security vendors, and partners. and other third-party data sources, generating Symantec Cloud Threat Labs provides the detailed analysis more than nine trillion rows of security data. of cloud-based threats and risks, and is developed using data from Symantec CloudSOC security technology, which in 2016 safeguarded more than 20,000 cloud apps, 176 million cloud documents, and 1.3 billion emails. Symantec CloudSOC is the company’s Cloud Access Security Broker (CASB) solution, and is designed to provide visibility, control, and protection for cloud- based apps and data. Symantec Web Application Firewall & Reverse Proxy scans one billion previously unseen web requests daily. Symantec Website Security secures 1.4 million web servers worldwide with 100 percent availability since