DOCSLIB.ORG

Fileless Cyberattacks: Analysis and Classification

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Fileless Cyberattacks: Analysis and Classification Received: 10 March 2020 | Revised: 21 July 2020 | Accepted: 10 September 2020 DOI: 10.4218/etrij.2020-0086 ORIGINAL ARTICLE Fileless cyberattacks: Analysis and classification GyungMin Lee1 | ShinWoo Shim2 | ByoungMo Cho2 | TaeKyu Kim2 | Kyounggon Kim1,3 1School of Cybersecurity, Korea University, Seoul, Rep. of Korea Abstract 2Intelligent SW Research Center, LIG Nex1, With cyberattack techniques on the rise, there have been increasing developments Seoul, Rep. of Korea in the detection techniques that defend against such attacks. However, cyber attack- 3 Department of Forensic Sciences, Naif ers are now developing fileless malware to bypass existing detection techniques. To Arab University for Security Sciences, combat this trend, security vendors are publishing analysis reports to help manage Riyadh, Kingdom of Saudi Arabia and better understand fileless malware. However, only fragmentary analysis reports Correspondence for specific fileless cyberattacks exist, and there have been no comprehensive analy- Kyounggon Kim, School of Cybersecurity, Korea University, Seoul, Rep. of Korea. ses on the variety of fileless cyberattacks that can be encountered. In this study, Email: [email protected] we analyze 10 selected cyberattacks that have occurred over the past five years in which fileless techniques were utilized. We also propose a methodology for classifi- Funding information This research was supported by LIG Nex1. cation based on the attack techniques and characteristics used in fileless cyberattacks. Finally, we describe how the response time can be improved during a fileless attack using our quick and effective classification technique. KEYWORDS classification, cyber security, cyberattack, fileless malware 1 | INTRODUCTION owing to the fact that they cannot be detected by vaccines and can circumvent even the best efforts of security analysts. The infrastructure in Estonia was brought down by a cyberat- However, despite the analysis of individual fileless malware tack from a suspected Russian state-sponsored hacker group conducted by security companies, studies on fileless cyberat- in April 2007 [1]. Nations with strong cyber superstructures, tacks in their entirety remain insufficient. Therefore, in this such as China, North Korea, and Russia, have reinforced their paper, such attacks are analyzed, summarized, and classified cyberattack capabilities [2]. The sources of such cyberattacks based on cases that have emerged since the mid-2010s. are now moving from individuals to organized hackers sup- The following are the three main contributions of this ported by governments, and their cyberattacks are progress- study. ing into more complex and advanced initiatives, which were previously unlikely to develop from individual hackers [3]. • An analysis of the detailed attack techniques of 10 types of Before cyberattacks evolved into more intricate attacks, fileless cyberattacks. simple security solutions such as virus protectors could be • A mapping of the cyber kill chain attack stage with each used to block them; however, attackers began to utilize var- fileless cyberattack technique. ious attack strategies to improve their effectiveness. Since • A suggested classification methodology for the 10 fileless 2014, fileless cyberattacks have been continuously on the rise cyberattacks. This is an Open Access article distributed under the term of Korea Open Government License (KOGL) Type 4: Source Indication + Commercial Use Prohibition + Change Prohibition (https://www.kogl.or.kr/info/license.do#05-tab). 1225-6463/$ © 2020 ETRI 332 | wileyonlinelibrary.com/journal/etrij ETRI Journal. 2021;43(2):332–343. LEE ET AL. | 333 The rest of this paper is organized as follows. In Section 2, analyzed various relevant attacks and tools such as Phasebot, we review related studies to the current research. In Section Gootkit, and Emotet and examined the strategies used by 3, we present our methodology for classifying fileless cyber- each attack [6]. Furthermore, by analyzing various attacks, attacks and describe a detailed procedure and analysis of the they suggested four strategies for defending against fileless results for each methodology. In Section 4, we discuss fileless cyberattacks. cyberattacks compared with traditional malware. In Section Kumar and sudhakar investigated seven representative 5, some concluding remarks are provided along with an out- fileless cyberattack samples and classified them based line of the potential implications of this study and sugges- on persistent techniques [7]. They classified attack sam- tions for future studies in this field. ples based on an investigation of the attack vectors for each cyberattack. The categories were determined as fol- lows: memory resident malware that resides in the system 2 | LITERATURE REVIEW memory, window registry malware that hides in the system registry, and rootkit fileless malware. They extended their Various studies on fileless cyberattacks have been con- study and suggested a framework for countermeasures that ducted. For example, to identify fileless cyberattacks can be used when fileless cyberattacks are executed on a against Linux-based Internet-of-Things machines, Dang system. and others designed a software- and hardware-based honey In addition, O’Murchu and others analyzed in detail how pot and collected data on malicious code for approximately Poweliks changed in 2015 [8]. The researchers analyzed one year [4]. They confirmed that among the malicious and compared the specific functions from Poweliks 1.0, the code collected, 10% were fileless cyberattacks, which were earliest version, to Poweliks 1.7, a relatively recent version, then classified into eight groups using the characteristics and checked the fileless cyberattack specifics of Poweliks. of the corresponding attacks. They analyzed the attacks by According to a Symantec analysis, Poweliks uses mecha- focusing on their characteristics and methods of defense. nisms that protect the registry keys and strategies developed Sanjay and others classified fileless cyberattacks into two to obtain CLSID information and authority elevation, thereby categories: memory- and script-based attacks [5]. In addition, making it difficult for users to identify infections. to overcome their defense mechanism, they classified the Lee and others analyzed Poweliks and Kovter, which can be strategies used by fileless cyberattacks into four categories. described as representative fileless malware [9,10]. Through They also listed the mechanisms that can be used for detect- their analysis, they described how fileless malware conceals ing or even defending against fileless cyberattacks. The repre- its activity using the registry and memory and suggested a sentative technique of fileless cyberattacks introduced herein method for detecting fileless malware based on such use. involves a document containing a malicious code, and the de- tection and defense technique involves the use of an analysis program such as Yara or an operating system function such as 3 | METHODOLOGY Microsoft Enhanced Mitigation Experience. Rivera and inocencio comprehensively analyzed Our detailed methodology is illustrated in Figure 1. We col- Poweliks, a representative fileless cyberattack. They also lected public fileless cyberattack samples at public sites such Analyzing published analysis of samples Mapping attack … techniques with MITRE ATT&CK Collecting fileless Analyzing cuckoo sandbox cyberattack samples result of samples Fileless Checking attack Measure the number of Categorization and cyberattack techniques for each kill techniques for each attack classification FIGURE 1 Methodology for classification chain step classification of fileless cyberattacks 334 | LEE ET AL. as Hybrid Analysis and GitHub and then analyzed the tech- 3.2.1 | Poweliks niques used by fileless malware through open source intel- ligence. We then used Cuckoo Sandbox to extract the results In 2014, Poweliks was the very first fileless malicious code of a fileless cyberattack analysis. Next, we used the collected to be detected. This code spreads through malicious host information to map the fileless malware attack techniques files attached to emails. According to the security com- using the ATT&CK kill chain published by MITRE and ana- pany, G Data, malicious files have been delivered through lyzed the attack techniques. Finally, we scored and classified email messages impersonating the international freight the fileless cyberattacks. transportation company, UPS [11]. These spurious UPS files infiltrate PCs using the macro vulnerability of MS Word. Poweliks is a fileless attack because its information 3.1 | Collecting fileless cyberattack cases is stored in the registry to avoid detection by users and to ensure permanent infection. As presented in Table 1, in this study, we investigated and collected a variety of known fileless cyberattacks as sam- ples. These samples were collected using either the cyber- 3.2.2 | Rozena attack dataset published by GitHub or the dataset published by Hybrid Analysis, which is a German dataset of malicious Rozena, which was discovered in 2015, deceives users by code. disguising itself as a normal MS Word file. According to When users upload malicious code samples, the afore- a 2018 report by a German security company [12], Rozena mentioned website analyzes the code that uses various an- runs through several PowerShell scripts and shows fileless ti-virus products. On the Hybrid Analysis website, users characteristics in that it inserts the malicious code
Load more

Recommended publications
  • Ransom Where?
    Ransom where? Holding data hostage with ransomware May 2019 Author With the evolution of digitization and increased interconnectivity, the cyberthreat landscape has transformed from merely a security and privacy concern to a danger much more insidious by nature — ransomware. Ransomware is a type of malware that is designed to encrypt, Imani Barnes Analyst 646.572.3930 destroy or shut down networks in exchange [email protected] for a paid ransom. Through the deployment of ransomware, cybercriminals are no longer just seeking to steal credit card information and other sensitive personally identifiable information (PII). Instead, they have upped their games to manipulate organizations into paying large sums of money in exchange for the safe release of their data and control of their systems. While there are some business sectors in which the presence of this cyberexposure is overt, cybercriminals are broadening their scopes of potential victims to include targets of opportunity1 across a multitude of industries. This paper will provide insight into how ransomware evolved as a cyberextortion instrument, identify notorious strains and explain how companies can protect themselves. 1 WIRED. “Meet LockerGoga, the Ransomware Crippling Industrial Firms” March 25, 2019; https://www.wired.com/story/lockergoga-ransomware-crippling-industrial-firms/. 2 Ransom where? | May 2019 A brief history of ransomware The first signs of ransomware appeared in 1989 in the healthcare industry. An attacker used infected floppy disks to encrypt computer files, claiming that the user was in “breach of a licensing agreement,”2 and demanded $189 for a decryption key. While the attempt to extort was unsuccessful, this attack became commonly known as PC Cyborg and set the archetype in motion for future attacks.
    [Show full text]
  • Monthly Threat Report November 2020
    NTT Ltd. Global Threat Intelligence Center Monthly Threat Report November 2020 hello.global.ntt report | GTIC Monthly Threat Report: November 2020 Contents Feature article: Security in the app economy 03 Spotlight article: The Trickbot takedown 07 Spotlight article: Snapshot of threats to retail 08 About NTT Ltd.’s Global Threat Intelligence Center 09 2 | © Copyright NTT Ltd. hello.global.ntt report | GTIC Monthly Threat Report: November 2020 Security in the app economy Lead Analyst: Zach Jones, Sr. Director of Detection Research, WhiteHat Security, US It used to be simple; a retailer Attack vectors and security spending when organizations are trying to enable was a retailer and a bank was are misaligned customer access in our ‘there’s an app for that’ world. The problem is that a bank. Initially, the role of According to our 2020 NTT Ltd. represents a pipeline where benign and Global Threat Intelligence Report, 33% software in non-technology malicious traffic alike enter networks of observed attacks globally were sectors stayed behind the straight through firewalls and DMZs. The application-specific and 22% of attacks protocol was never designed for secure scenes, supporting the core were web-application based. This means application delivery so building HTTP competencies of that industry, a total of 55% of attacks detected globally applications is prone to error. Threat like inventory management occurred at the application layer. for retailers and account actors will continue to abuse these virtual According to Gartner Group, the 2020 front doors and windows. They are easy management for banks. Security Market Segment spend is to access and are often the weakest link This is no longer the case.
    [Show full text]
  • CYBER ATTACK TRENDS Mid Year Report 2021 CONTENTS
    CYBER ATTACK TRENDS Mid Year Report 2021 CONTENTS 04 EXECUTIVE SUMMARY 07 TRIPLE EXTORTION RANSOMWARE—THE THIRD-PARTY THREAT 11 SOLARWINDS AND WILDFIRES 15 THE FALL OF AN EMPIRE—EMOTET’S FALL AND SUCCESSORS 19 MOBILE ARENA DEVELOPMENTS 2 22 COBALT STRIKE STANDARDIZATION 26 CYBER ATTACK CATEGORIES BY REGION 28 GLOBAL THREAT INDEX MAP 29 TOP MALICIOUS FILE TYPES—WEB VS. EMAIL CHECK POINT SOFTWARE MID-YEAR REPORT 2021 31 GLOBAL MALWARE STATISTICS 31 TOP MALWARE FAMILIES 34 Top Cryptomining Malware 36 Top Mobile Malware 38 Top Botnets 40 Top Infostealers Malware 42 Top Banking Trojans 44 HIGH PROFILE GLOBAL VULNERABILITIES 3 47 MAJOR CYBER BREACHES (H1 2021) 53 H2 2021: WHAT TO EXPECT AND WHAT TO DO 56 PREVENTING MEGA CYBER ATTACKS 60 CONCLUSION CHECK POINT SOFTWARE MID-YEAR REPORT 2021 EXECUTIVE SUMMARY CHECK POINT SOFTWARE’S MID-YEAR SECURITY REPORT REVEALS A 29% INCREASE IN CYBERATTACKS AGAINST ORGANIZATIONS GLOBALLY ‘Cyber Attack Trends: 2021 Mid-Year Report’ uncovers how cybercriminals have continued to exploit the Covid-19 pandemic and highlights a dramatic global 93% increase in the number of ransomware attacks • EMEA: organizations experienced a 36% increase in cyber-attacks since the beginning of the year, with 777 weekly attacks per organization • USA: 17% increase in cyber-attacks since the beginning of the year, with 443 weekly attacks per organization • APAC: 13% increase in cyber-attacks on organizations since the beginning of the year, with 1338 weekly attacks per organization In the first six months of 2021, the global rollout of COVID-19 vaccines gave hope that we will be able to live without restrictions at some point—but for a majority of organizations internationally, a return to pre-pandemic ‘norms’ is still some way off.
    [Show full text]
  • Global Security Report End Year 2020 Executive Summary
    Global Security Report End Year 2020 Executive Summary The Zix | AppRiver Global Security Report for 2020 highlights the threats and trends Zix | AppRiver Security analysts saw throughout the year. In 2020, analysts saw attackers shift their tactics to take advantage of the unprecedented situation the world faced due to the Covid-19 pandemic. These attacks: • Aimed to take advantage of uncertainty surrounding the pandemic and the shift to “work from home” throughout much of the year. • Leveraged other world events, like the contentious US election, to distribute their attacks. • Multiplied "living off the land” attacks across many new and otherwise legitimate services. • Continued shift from high volume email blasts to a much more focused and customized attack style. • Posed impersonation attacks as internal executive communications and were persistent throughout 2020. In this report, we will take a deep dive into many of the threats and trends we saw in email security as well as discuss examples of prevalent attacks and explore potential impacts. Introduction Threat actors have always leveraged both local and world events to help spread their attacks. Never more so than in 2020. Early in the year, as the global pandemic came to fruition, attackers began launching spam, phishing and malware attacks utilizing interest in the pandemic. It wasn’t long before they had begun crafting attacks centered around the surge in remote work. Later in the year they took advantage of the contentious US Election cycle to distribute attacks. In 2020, Attackers continued to embrace the use of more targeted attacks versus the large volume email blasts we have seen in the past.
    [Show full text]
  • The Middle East Under Malware Attack Dissecting Cyber Weapons
    The Middle East under Malware Attack Dissecting Cyber Weapons Sami Zhioua Information and Computer Science Department King Fahd University of Petroleum and Minerals Dhahran, Saudi Arabia [email protected] Abstract—The Middle East is currently the target of an un- have been designed by the same unknown entity 1. The next precedented campaign of cyber attacks carried out by unknown malware of this lineage was Flame [7] which was discovered parties. The energy industry is praticularly targeted. The in May 2012 by Kaspersky Lab while investigating another attacks are carried out by deploying extremely sophisticated malware. The campaign opened by the Stuxnet malware in piece of malware called Wiper [8]. Flame features very 2010 and then continued through Duqu, Flame, Gauss, and unusual characteristics such as large size, large number of Shamoon malware. This paper is a technical survey of the modules, self adapting, etc. As Duqu, Flame’s objective is attacking vectors utilized by the three most famous malware, data collection and espionnage. Gauss [9] is another data namely, Stuxnet, Flame, and Shamoon. We describe their main stealing malware discovered in June 2012 by Kaspersky Lab modules, their sophisticated spreading capabilities, and we discuss what it sets them apart from typical malware. The focusing on banking information. Flame and Gauss exhibit main purpose of the paper is to point out the recent trends striking similarities and several technical evidences indicate infused by this new breed of malware into cyber attacks. that they come from the same “factories” that produced Stuxnet and Duqu [9]. The latest malware-based attack Keywords-Malwares; Information Security; Targeted At- tacks; Stuxnet; Duqu; Flame; Gauss; Shamoon targeting the middle east was the Shamoon attack on Saudi Aramco [10].
    [Show full text]
  • Threat Landscape Report
    QUARTERLY Threat Landscape Report Q3 2020 NUSPIRE.COM THIS REPORT IS SOURCED FROM 90 BILLION TRAFFIC LOGS INGESTED FROM NUSPIRE CLIENT SITES AND ASSOCIATED WITH THOUSANDS OF DEVICES AROUND THE GLOBE. Nuspire Threat Report | Q2Q3 | 2020 Contents Introduction 4 Summary of Findings 6 Methodology and Overview 7 Quarter in Review 8 Malware 9 Botnets 15 Exploits 20 The New Normal 28 Conclusion and Recommendations 31 About Nuspire 33 3 | Contents Nuspire Threat Report | Q3 | 2020 Introduction In Q2 2020, Nuspire observed the increasing lengths threat actors were going to in order to capitalize on the pandemic and resulting crisis. New attack vectors were created; including VPN usage, home network security issues, personal device usage for business purposes and auditability of network traffic. In Q3 2020, we’ve observed threat actors become even more ruthless. Shifting focus from home networks to overburdened public entities including the education sector and the Election Assistance Commission (EAC). Many school districts were forced into 100% virtual or hybrid learning models by the pandemic. Attackers have waged ransomware attacks at learning institutions who not only have the financial resources to pay ransoms but feel a sense of urgency to do so in order to avoid disruptions during the school year. Meanwhile, the U.S. Elections have provided lures for phishers to attack. Nuspire witnessed Q3 attempts to guide victims to fake voter registration pages to harvest information while spoofing the Election Assistance Commission (EAC). Like these examples, cybercriminals taking advantage of prominent media themes are expected. We anticipate our Q4 2020 Threat Report 4 | Introduction Nuspire Threat Report | Q3 | 2020 to find campaigns leveraging more of the United report each quarter is a great step to gain that States Presidential election as well.
    [Show full text]
  • Duqu the Stuxnet Attackers Return
    Uncovering Duqu The Stuxnet Attackers Return Nicolas Falliere 4/24/2012 Usenix Leet - San Jose, CA 1 Agenda 1 Revisiting Stuxnet 2 Discovering Duqu 3 Inside Duqu 4 Weird, Wacky, and Unknown 5 Summary 2 Revisiting Stuxnet 3 Key Facts Windows worm discovered in July 2010 Uses 7 different self-propagation methods Uses 4 Microsoft 0-day exploits + 1 known vulnerability Leverages 2 Siemens security issues Contains a Windows rootkit Used 2 stolen digital certificates Modified code on Programmable Logic Controllers (PLCs) First known PLC rootkit 4 Cyber Sabotage 5 Discovering Duqu 6 Boldi Bencsath Announce (CrySyS) emails: discovery and “important publish 25 page malware Duqu” paper on Duqu Boldi emails: Hours later the “DUQU DROPPER 7 C&C is wiped FOUND MSWORD 0DAY INSIDE” Inside Duqu 8 Key Facts Duqu uses the same code as Stuxnet except payload is different Payload isn‟t sabotage, but espionage Highly targeted Used to distribute infostealer components Dropper used a 0-day (Word DOC w/ TTF kernel exploit) Driver uses a stolen digital certificate (C-Media) No self-replication, but can be instructed to copy itself to remote machines Multiple command and control servers that are simply proxies Infections can serve as peers in a peer-to-peer C&C system 9 Countries Infected Six organizations, in 8 countries confirmed infected 10 Architecture Main component A large DLL with 8 or 6 exports and 1 main resource block Resource= Command & Control module Copies itself as %WINDIR%\inf\xxx.pnf Injected into several processes Controlled by a Configuration Data file Lots of similarities with Stuxnet Organization Code Usual lifespan: 30 days Can be extended 11 Installation 12 Signed Drivers Some signed (C-Media certificate) Revoked on October 14 13 Command & Control Module Communication over TCP/80 and TCP/443 Embeds protocol under HTTP, but not HTTPS Includes small blank JPEG in all communications Basic proxy support Complex protocol TCP-like with fragments, sequence and ack.
    [Show full text]
  • APT and Cybercriminal Targeting of HCS June 9, 2020 Agenda
    APT and Cybercriminal Targeting of HCS June 9, 2020 Agenda • Executive Summary Slides Key: • APT Group Objectives Non-Technical: managerial, strategic • APT Groups Targeting Health Sector and high-level (general audience) • Activity Timeline Technical: Tactical / IOCs; requiring • TTPs in-depth knowledge (sysadmins, IRT) • Malware • Vulnerabilities • Recommendations and Mitigations TLP: WHITE, ID#202006091030 2 Executive Summary • APT groups steal data, disrupt operations, and destroy infrastructure. Unlike most cybercriminals, APT attackers pursue their objectives over longer periods of time. They adapt to cyber defenses and frequently retarget the same victim. • Common HPH targets include: • Healthcare Biotechnology Medical devices • Pharmaceuticals Healthcare information technology • Scientific research • HPH organizations who have been victim of APT attacks have suffered: • Reputational harm Disruption to operations • Financial losses PII/PHI and proprietary data theft • HC3 recommends several mitigations and controls to counter APT threats. TLP: WHITE, ID#202006091030 3 APT Group Objectives • Motivations of APT Groups which target the health sector include: • Competitive advantage • Theft of proprietary data/intellectual capital such as technology, manufacturing processes, partnership agreements, business plans, pricing documents, test results, scientific research, communications, and contact lists to unfairly advance economically. • Intelligence gathering • Groups target individuals and connected associates to further social engineering
    [Show full text]
  • Q3 Malware Trends: Ransomware Extorts Education, Emotet and Crypto Mining Malware Evolve, and Android Malware Persists Cyber Threat Analysis
    CYBER THREAT ® ANALYSIS By Insikt Group CTA-2020-1105 Q3 MALWARE TRENDS: RANSOMWARE EXTORTS EDUCATION, EMOTET AND CRYPTO MINING MALWARE EVOLVE, AND ANDROID MALWARE PERSISTS CYBER THREAT ANALYSIS Key Judgments • More threat actors will very likely adopt the ransomware extortion model as long as it remains profitable. • Educational institutions continue to be a prime target for ransomware operators. We believe that disruptions caused by the COVID-19 pandemic have made the networks of universities and school districts attractive targets because these organizations feel increased pressure to stay operational with minimal disruptions and are therefore more likely to pay ransoms quickly. • Reports of NetWalker attacks increased, and reports of Sodinokibi attacks decreased. However, it is possible that victims of Sodinokibi attacks are simply paying the ransom more often. Based on activity on underground forums, we suspect that the operators of Sodinokibi are continuing to expand their operations. • While we expect Emotet’s operators to continue to employ major pauses, it is highly likely that Emotet will continue to be This report is an extension of analysis Recorded Future released, which outlined a major threat and impact organizations across a variety of the trends in malware use, distribution, and development throughout Q1 and Q2 industries throughout the end of the year and into 2021. 2020. Insikt Group used the Recorded Future® Platform to look at mainstream news, security vendor reporting, technical reporting around malware, vulnerabilities, and • In Q3 2020, threat actors have increasingly augmented their security breaches, and dark web and underground forums from July 1 to September cryptocurrency mining malware by adding functionalities 30, 2020, to examine major trends to malware impacting desktop systems and mobile such as credential stealing or access capabilities.
    [Show full text]
  • No Random, No Ransom: a Key to Stop Cryptographic Ransomware
    No Random, No Ransom: A Key to Stop Cryptographic Ransomware Ziya Alper Genç, Gabriele Lenzini, and Peter Y.A. Ryan Interdisciplinary Centre for Security Reliability and Trust (SnT) University of Luxembourg Abstract. To be effective, ransomware has to implement strong encryp- tion, and strong encryption in turn requires a good source of random numbers. Without access to true randomness, ransomware relies on the pseudo random number generators that modern Operating Systems make available to applications. With this insight, we propose a strategy to miti- gate ransomware attacks that considers pseudo random number generator functions as critical resources, controls accesses on their APIs and stops unauthorized applications that call them. Our strategy, tested against 524 active real-world ransomware samples, stops 94% of them, including WannaCry, Locky, CryptoLocker and CryptoWall. Remarkably, it also nullifies NotPetya, the latest offspring of the family which so far has eluded all defenses. Keywords: ransomware, cryptographic malware, randomness, mitigation. 1 Introduction Ransomware is a malware, a malicious software that blocks access to victim’s data. In contrast to traditional malware, whose break-down is permanent, ransomware’s damage is reversible: access to files can be restored on the payment of a ransom, usually a few hundreds US dollars in virtual coins. Despite being relatively new, this cyber-crime is spreading fast and it is believed to become soon a worldwide pandemic. According to [24], a US Govern- ment’s white paper dated June 2016, on average more than 4,000 ransomware attacks occurred daily in the USA. This is 300-percent increase from the previous year and such important increment is probably due to the cyber-crime’s solid business model: with a small investment there is a considerable pecuniary gain which, thanks to the virtual currency technology, can be collected reliably and in a way that is not traceable by the authorities.
    [Show full text]
  • 2020 Trends & 2021 Outlook
    2020 trends w/ & 2021 outlook THREAT REPORT Q4 2020 WeLiveSecurity.com @ESETresearch ESET GitHub Contents 3 FOREWORD 4 FEATURED STORY 7 NEWS FROM THE LAB 9 APT GROUP ACTIVITY 15 STATISTICS & TRENDS 16 Top 10 malware detections 17 Downloaders 19 Banking malware 21 Ransomware 23 Cryptominers 25 Spyware & backdoors 27 Exploits 29 Mac threats 31 Android threats 33 Web threats 35 Email threats 38 IoT security 40 ESET RESEARCH CONTRIBUTIONS ESET THREAT REPORT Q4 2020 | 2 Foreword Welcome to the Q4 2020 issue of the ESET Threat Report! 2020 was many things (“typical” not being one of them), and it sure feels good to be writing The growth of ransomware might have been an important factor in the decline of banking about it in the past tense. malware; a decline that only intensified over the last quarter of the year. Ransomware and other malicious activities are simply more profitable than banking malware, the operators of As if really trying to prove a point, the pandemic picked up new steam in the last quarter, which already have to grapple with the heightening security in the banking sector. There was, bringing the largest waves of infections and further lockdowns around the world. Amid the — however, one exception to this trend: Android banking malware registered the highest detection chaos, the long-anticipated vaccine rollouts brought a collective sigh of relief or, at least, levels of 2020 in Q4, fueled by the source code leak of the trojan Cerberus. a glimmer of hope somewhere in the not-too-far-distant future. With the pandemic creating fertile ground for all kinds of malicious activities, it is all but In cyberspace, events also took a dramatic turn towards the end of the year, as news of the obvious that email scammers would not want to be left out.
    [Show full text]
  • A Decade of WMI Abuse – an Overview of Techniques in Modern Malware
    WHITEPAPER Security A Decade of WMI Abuse – an Overview of Techniques in Modern Malware www.bitdefender.com Bitdefender Whitepaper A Decade of WMI Abuse – an Overview of Techniques in Modern Malware Contents Foreword ____________________________________________________________________________________________________ 3 WMI Overview _____________________________________________________________________________________________________________ 3 Malicious scenarios ________________________________________________________________________________________________________ 3 Execution ____________________________________________________________________________________________________________________ 3 Persistence __________________________________________________________________________________________________________________ 4 Defense Evasion _____________________________________________________________________________________________________________ 4 Discovery ____________________________________________________________________________________________________________________ 4 Lateral Movement ___________________________________________________________________________________________________________ 4 Command and Control ______________________________________________________________________________________________________ 5 Exfiltration ___________________________________________________________________________________________________________________ 5 Technical Analysis. Malware Collection _______________________________________________________________________
    [Show full text]