DOCSLIB.ORG

2020 Vulnerability and Threat Trends

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text

Load more

2020 VULNERABILITY AND THREAT TRENDS Mid-Year Update RESEARCH REPORT About This Report All information and data in this report without explicit reference is provided by the Skybox® Research Lab, a team of security analysts who daily scour data from dozens of security feeds and sources as well as investigate sites in the dark web. The Research Lab validates and enhances data through automated as well as manual analysis, with analysts adding their knowledge of attack trends, cyber events and TTPs of today’s attackers. Their ongoing investigations determine which vulnerabilities are being exploited in the wild and used in distributed crimeware such as ransomware, malware, exploit kits and other attacks exploiting client– and server–side vulnerabilities. This analysis is incorporated in Skybox® Security’s vulnerability management solution, which prioritizes the remediation of exposed and actively exploited vulnerabilities over that of other known vulnerabilities. For more information on the methodology behind the Skybox Research Lab and to keep up with the latest vulnerability and threat intelligence, visit www.vulnerabilitycenter.com. References to figures from this year refer to data sets from January 1 through June 30, 2020. CONTENTS Executive Summary 4 Key Findings 5 Results 6 Vulnerabilities and Exploits 7 20,000+ New Vulnerability Reports Likely in 2020 7 Middle-of-the-Pack Severity Could Create Major Risks 9 50% Increase in Mobile OS Vulnerabilities 10 Business Apps Join Ranks of Most Vulnerable Products 11 Microsoft Inherits Vulnerabilities as it Moves to Edge Chromium 13 Threats and Malware 14 New OT Advisories Increase 14 New Ransomware and Trojan Samples Soar 15 How COVID-19 has Emboldened Criminal Use of Ransomware 16 Insights 17 Attackers Target Critical Infrastructure 18 Multi-Vendor Vulnerabilities Maintain a Strong Presence 19 Public Sector Fears Increase Over Legacy Windows Vulnerabilities 20 Recommendations 21 Establish Risk–Based Vulnerability Management 22 Strengthen Cloud Network Security 23 Mitigating Risk of Ransomware 24 Protect Your OT Network 25 Conclusion 26 About Skybox Security 27 3 EXECUTIVE SUMMARY The COVID–19 crisis has made a significant impact on the cybersecu- rity landscape. The sector’s existing challenges — including the cyberse- curity skills shortage, under–resourced security programs and increas- ingly fragmented estates — have been exacerbated as organizations scramble to enable their remote workforce and secure expanded network perimeters. While this critical work has been taking place, cybercriminals and nation–state threat actors have been working hard to capitalize on the chaos. The 2020 Vulnerability and Threat Trends Report Mid-Year Update shows how criminals have taken advantage of the disruption caused by the pandemic. While organizations were vulnerable and distracted, hackers developed new ransomware samples and advanced existing tools to attack critical infrastructure — including vital research labs and health care organizations. The sophistication of the malware and methods used by attackers over the first half of 2020 highlight just how complex cybersecurity management has become. Add to this the 20,000 new vulnerabilities likely to be reported in 2020, and it’s clear that the burden placed on security teams is only going to increase — even if we manage to enter a post–COVID reality later this year. If organizations do not have full visibility over their entire security environment, and if they are unable to focus remediation on their most exposed vulnerabilities, then they could fall victim to attack at a time when business continuity, brand trust and fiscal stability are paramount. The report emphasizes the need for organizations to adopt risk–based strategies so that they can manage the mass of new vulnerability reports and deal with heightened threat levels. It is only through gaining full and unerring network visibility, modeling the environment and analyzing exposure that organizations will be able to gain the insight and focus that they need to emerge from the pandemic unscathed. 4 KEY FINDINGS 20,000+ New Vulnerability Reports Likely in 2020 Over 9,000 new vulnerabilities have been reported in the first six months of 2020 (a 22–percent increase on reports published over the same period in 2019), and we are on track to see more than 20,000 new vulnerabilities this year — a new record. This will be a figure that defines the complex landscape within which security professionals operate. 50% Increase in Mobile Vulnerabilities Highlights Dangers of Blurring Line Between Corporate and Personal Networks Vulnerabilities on mobile OSs increased by 50 percent, driven solely by Android flaws. This rise has come at the same time as home networks and personal devices increasingly intersect with corporate networks as a result of the move towards a mass, remote workforce. These trends should focus the need for organizations to improve access controls and gain visibility of all ingress and egress points to their network infrastructure. Ransomware and Trojans Thrive During COVID–19 Crisis The creation of new ransomware and malware samples has soared during the COVID–19 crisis, a time that has also seen a significant increase in exploits taking advantage of Remote Desktop Protocol (RDP). These tools are enabling cyberattackers to capitalize on individual concerns and take advantage of overwhelmed security teams. Attacks on Critical Infrastructure Adding to the Chaos Attacks on national infrastructures, pharmaceutical firms and health care companies have increased as criminals become emboldened by chaos spurred by the pandemic. These attacks have added to the turbulence and could hamper countries’ abilities to respond to the health crisis. 5 RESULTS 6 VULNERABILITIES & EXPLOITS 20,000+ New Vulnerability Reports Likely in 2020 The first half of 2020 saw a major increase in new vulnerability reports (9,799 in 2020 compared to 7,318 in 2019, representing a 34–percent increase). This figure also exceeds the previous high reported in the first six months of 2018 (8,485) and indicates a record–smashing tally for 2020. Extrapolating forward from previous years’ trends, it is likely that more than 20,000 vulnerabilities will be assigned in 2020. While possible that all new vulnerabilities may not be published, annotated and analyzed by the National Vulnerability Database (NVD) until years later, the likelihood of hitting the watershed 20,000 figure reaffirms the uphill battle that security teams across the world are having to fight: making sense of which vulnerabilities pose the greatest risk to their organization. 20,000 18,000 16,000 14,000 12,000 10,000 16,512 17,307 8,000 14,644 6,000 9,799 4,000 6,494 6,449 2,000 0 2015 2016 2017 2018 2019 2020 Total per published year Total per ID year >1.5 years late FIG 1 | New CVEs by year and the year those vulnerabilities were identified. 7 25,000 20,000 15,000 10,000 5,000 0 2011 2000 2001 2002 2003 2004 2005 2006 2007 2008 2009 2010 2012 2013 2014 2015 2016 2017 2018 2019 2020 FIG 2 | CVEs allocated by the MITRE Corporation per year from 2000 through 2019. Dotted line is assuming exponential growth in 2020. The ramp–up in vulnerabilities between 2016 and It’s important to remember that higher vulnerability 2017 can be seen in this context as a continuation counts don’t necessarily mean that technology is of an upward trend that began years earlier. At the becoming less secure; rather, the more likely same time, the number of vulnerabilities whose scenario is that more efforts are being put into publish date was more than a full year after its ID vulnerability research by vendors and third parties. year increased by two orders of magnitude — from However, higher vulnerability counts can further 54 to 2825 — between the first halves of 2016 and complicate an organization’s prioritization and 2017, then settled down to just over 1000 in 2018 remediation processes. To deal with the inevitable H1, and continued along that trajectory with 377 in increase of vulnerability occurrences within an 2019 H1. These facts taken together suggest that organization, security programs need to have there was substantial catching–up in processing established processes to contextualize vulnerabilities older vulnerabilities beginning in 2017, which has based on exposure, exploitability and other factors since leveled out. to keep remediation focused on critical risks. 8 Middle–of–the–Pack Severity Could Create Major Risks Although organizations are naturally inclined to prioritize the remediation of The need for an intelligent and more automated approach to remediation is evident when looking at critical– and high–severity vulnerabilities the spread of CVSS scores by category. The severity before medium–severity instances, this spread for new vulnerabilities reported in the first generic approach to prioritization could six months of 2020 looks very similar to 2019’s allow attackers to take advantage of any figures. Vulnerabilities with a high severity score exposed medium vulnerabilities. Criminals compose 42 percent of the total vulnerability count, know that medium–severity flaws can sit with medium–severity vulnerabilities following unpatched within an organization’s behind with 40 percent of the total. Critical– severity vulnerabilities make up 15 percent of all systems for a long period; depending on new reports. where these flaws exist, they could give an attacker access to a critical asset or enable lateral movement. 100% 1,495 90% 1,140 While CVSS scores are useful for 80% understanding the properties of a 70% 4,115 vulnerability in isolation, they are created 60% 3,271 without contextual understanding of an 50% 40% individual organization’s security 30% environment. This is context that needs 3,877 20% 2,846 to be ingrained in the way that security 10% programs are run; security teams need to 77 199 113 0% 3 understand which of their vulnerabilities 2019 2020 are unprotected by security controls and Unknown Low Medium High Critical exposed to threat origins — regardless FIG 3 | New vulnerabilities’ CVSS scores split by severity level of CVSS score — to lower their overall risk profile.
Recommended publications
  • Ransom Where?

    Ransom Where?

    Ransom where? Holding data hostage with ransomware May 2019 Author With the evolution of digitization and increased interconnectivity, the cyberthreat landscape has transformed from merely a security and privacy concern to a danger much more insidious by nature — ransomware. Ransomware is a type of malware that is designed to encrypt, Imani Barnes Analyst 646.572.3930 destroy or shut down networks in exchange [email protected] for a paid ransom. Through the deployment of ransomware, cybercriminals are no longer just seeking to steal credit card information and other sensitive personally identifiable information (PII). Instead, they have upped their games to manipulate organizations into paying large sums of money in exchange for the safe release of their data and control of their systems. While there are some business sectors in which the presence of this cyberexposure is overt, cybercriminals are broadening their scopes of potential victims to include targets of opportunity1 across a multitude of industries. This paper will provide insight into how ransomware evolved as a cyberextortion instrument, identify notorious strains and explain how companies can protect themselves. 1 WIRED. “Meet LockerGoga, the Ransomware Crippling Industrial Firms” March 25, 2019; https://www.wired.com/story/lockergoga-ransomware-crippling-industrial-firms/. 2 Ransom where? | May 2019 A brief history of ransomware The first signs of ransomware appeared in 1989 in the healthcare industry. An attacker used infected floppy disks to encrypt computer files, claiming that the user was in “breach of a licensing agreement,”2 and demanded $189 for a decryption key. While the attempt to extort was unsuccessful, this attack became commonly known as PC Cyborg and set the archetype in motion for future attacks.
  • The Evolution of Ransomware

    The Evolution of Ransomware

    The evolution of ransomware SECURITY RESPONSE The evolution of ransomware Kevin Savage, Peter Coogan, Hon Lau Version 1.0 – August 6, 2015 Never before in the history of human kind have people across the world been subjected to extortion on a massive scale as they are today. CONTENTS OVERVIEW ..............................................................................3 Key information ......................................................................5 Types of ransomware .............................................................5 How ransomware has evolved ...............................................7 Targets for ransomware .......................................................13 Systems impacted by ransomware ......................................14 Ransomware: How it works ..................................................18 Ransom techniques ..............................................................27 How widespread is the problem of ransomware .................33 What does the future hold for ransomware? .......................37 Conclusion ............................................................................45 Appendix ..............................................................................47 Mitigation strategies ............................................................51 Symantec detections for common ransomware families 54 Resources .............................................................................56 OVERVIEW Never before in the history of human kind have people across the world been
  • Monthly Threat Report November 2020

    Monthly Threat Report November 2020

    NTT Ltd. Global Threat Intelligence Center Monthly Threat Report November 2020 hello.global.ntt report | GTIC Monthly Threat Report: November 2020 Contents Feature article: Security in the app economy 03 Spotlight article: The Trickbot takedown 07 Spotlight article: Snapshot of threats to retail 08 About NTT Ltd.’s Global Threat Intelligence Center 09 2 | © Copyright NTT Ltd. hello.global.ntt report | GTIC Monthly Threat Report: November 2020 Security in the app economy Lead Analyst: Zach Jones, Sr. Director of Detection Research, WhiteHat Security, US It used to be simple; a retailer Attack vectors and security spending when organizations are trying to enable was a retailer and a bank was are misaligned customer access in our ‘there’s an app for that’ world. The problem is that a bank. Initially, the role of According to our 2020 NTT Ltd. represents a pipeline where benign and Global Threat Intelligence Report, 33% software in non-technology malicious traffic alike enter networks of observed attacks globally were sectors stayed behind the straight through firewalls and DMZs. The application-specific and 22% of attacks protocol was never designed for secure scenes, supporting the core were web-application based. This means application delivery so building HTTP competencies of that industry, a total of 55% of attacks detected globally applications is prone to error. Threat like inventory management occurred at the application layer. for retailers and account actors will continue to abuse these virtual According to Gartner Group, the 2020 front doors and windows. They are easy management for banks. Security Market Segment spend is to access and are often the weakest link This is no longer the case.
  • CYBER ATTACK TRENDS Mid Year Report 2021 CONTENTS

    CYBER ATTACK TRENDS Mid Year Report 2021 CONTENTS

    CYBER ATTACK TRENDS Mid Year Report 2021 CONTENTS 04 EXECUTIVE SUMMARY 07 TRIPLE EXTORTION RANSOMWARE—THE THIRD-PARTY THREAT 11 SOLARWINDS AND WILDFIRES 15 THE FALL OF AN EMPIRE—EMOTET’S FALL AND SUCCESSORS 19 MOBILE ARENA DEVELOPMENTS 2 22 COBALT STRIKE STANDARDIZATION 26 CYBER ATTACK CATEGORIES BY REGION 28 GLOBAL THREAT INDEX MAP 29 TOP MALICIOUS FILE TYPES—WEB VS. EMAIL CHECK POINT SOFTWARE MID-YEAR REPORT 2021 31 GLOBAL MALWARE STATISTICS 31 TOP MALWARE FAMILIES 34 Top Cryptomining Malware 36 Top Mobile Malware 38 Top Botnets 40 Top Infostealers Malware 42 Top Banking Trojans 44 HIGH PROFILE GLOBAL VULNERABILITIES 3 47 MAJOR CYBER BREACHES (H1 2021) 53 H2 2021: WHAT TO EXPECT AND WHAT TO DO 56 PREVENTING MEGA CYBER ATTACKS 60 CONCLUSION CHECK POINT SOFTWARE MID-YEAR REPORT 2021 EXECUTIVE SUMMARY CHECK POINT SOFTWARE’S MID-YEAR SECURITY REPORT REVEALS A 29% INCREASE IN CYBERATTACKS AGAINST ORGANIZATIONS GLOBALLY ‘Cyber Attack Trends: 2021 Mid-Year Report’ uncovers how cybercriminals have continued to exploit the Covid-19 pandemic and highlights a dramatic global 93% increase in the number of ransomware attacks • EMEA: organizations experienced a 36% increase in cyber-attacks since the beginning of the year, with 777 weekly attacks per organization • USA: 17% increase in cyber-attacks since the beginning of the year, with 443 weekly attacks per organization • APAC: 13% increase in cyber-attacks on organizations since the beginning of the year, with 1338 weekly attacks per organization In the first six months of 2021, the global rollout of COVID-19 vaccines gave hope that we will be able to live without restrictions at some point—but for a majority of organizations internationally, a return to pre-pandemic ‘norms’ is still some way off.
  • Global Security Report End Year 2020 Executive Summary

    Global Security Report End Year 2020 Executive Summary

    Global Security Report End Year 2020 Executive Summary The Zix | AppRiver Global Security Report for 2020 highlights the threats and trends Zix | AppRiver Security analysts saw throughout the year. In 2020, analysts saw attackers shift their tactics to take advantage of the unprecedented situation the world faced due to the Covid-19 pandemic. These attacks: • Aimed to take advantage of uncertainty surrounding the pandemic and the shift to “work from home” throughout much of the year. • Leveraged other world events, like the contentious US election, to distribute their attacks. • Multiplied "living off the land” attacks across many new and otherwise legitimate services. • Continued shift from high volume email blasts to a much more focused and customized attack style. • Posed impersonation attacks as internal executive communications and were persistent throughout 2020. In this report, we will take a deep dive into many of the threats and trends we saw in email security as well as discuss examples of prevalent attacks and explore potential impacts. Introduction Threat actors have always leveraged both local and world events to help spread their attacks. Never more so than in 2020. Early in the year, as the global pandemic came to fruition, attackers began launching spam, phishing and malware attacks utilizing interest in the pandemic. It wasn’t long before they had begun crafting attacks centered around the surge in remote work. Later in the year they took advantage of the contentious US Election cycle to distribute attacks. In 2020, Attackers continued to embrace the use of more targeted attacks versus the large volume email blasts we have seen in the past.
  • Threat Landscape Report

    Threat Landscape Report

    QUARTERLY Threat Landscape Report Q3 2020 NUSPIRE.COM THIS REPORT IS SOURCED FROM 90 BILLION TRAFFIC LOGS INGESTED FROM NUSPIRE CLIENT SITES AND ASSOCIATED WITH THOUSANDS OF DEVICES AROUND THE GLOBE. Nuspire Threat Report | Q2Q3 | 2020 Contents Introduction 4 Summary of Findings 6 Methodology and Overview 7 Quarter in Review 8 Malware 9 Botnets 15 Exploits 20 The New Normal 28 Conclusion and Recommendations 31 About Nuspire 33 3 | Contents Nuspire Threat Report | Q3 | 2020 Introduction In Q2 2020, Nuspire observed the increasing lengths threat actors were going to in order to capitalize on the pandemic and resulting crisis. New attack vectors were created; including VPN usage, home network security issues, personal device usage for business purposes and auditability of network traffic. In Q3 2020, we’ve observed threat actors become even more ruthless. Shifting focus from home networks to overburdened public entities including the education sector and the Election Assistance Commission (EAC). Many school districts were forced into 100% virtual or hybrid learning models by the pandemic. Attackers have waged ransomware attacks at learning institutions who not only have the financial resources to pay ransoms but feel a sense of urgency to do so in order to avoid disruptions during the school year. Meanwhile, the U.S. Elections have provided lures for phishers to attack. Nuspire witnessed Q3 attempts to guide victims to fake voter registration pages to harvest information while spoofing the Election Assistance Commission (EAC). Like these examples, cybercriminals taking advantage of prominent media themes are expected. We anticipate our Q4 2020 Threat Report 4 | Introduction Nuspire Threat Report | Q3 | 2020 to find campaigns leveraging more of the United report each quarter is a great step to gain that States Presidential election as well.
  • APT and Cybercriminal Targeting of HCS June 9, 2020 Agenda

    APT and Cybercriminal Targeting of HCS June 9, 2020 Agenda

    APT and Cybercriminal Targeting of HCS June 9, 2020 Agenda • Executive Summary Slides Key: • APT Group Objectives Non-Technical: managerial, strategic • APT Groups Targeting Health Sector and high-level (general audience) • Activity Timeline Technical: Tactical / IOCs; requiring • TTPs in-depth knowledge (sysadmins, IRT) • Malware • Vulnerabilities • Recommendations and Mitigations TLP: WHITE, ID#202006091030 2 Executive Summary • APT groups steal data, disrupt operations, and destroy infrastructure. Unlike most cybercriminals, APT attackers pursue their objectives over longer periods of time. They adapt to cyber defenses and frequently retarget the same victim. • Common HPH targets include: • Healthcare Biotechnology Medical devices • Pharmaceuticals Healthcare information technology • Scientific research • HPH organizations who have been victim of APT attacks have suffered: • Reputational harm Disruption to operations • Financial losses PII/PHI and proprietary data theft • HC3 recommends several mitigations and controls to counter APT threats. TLP: WHITE, ID#202006091030 3 APT Group Objectives • Motivations of APT Groups which target the health sector include: • Competitive advantage • Theft of proprietary data/intellectual capital such as technology, manufacturing processes, partnership agreements, business plans, pricing documents, test results, scientific research, communications, and contact lists to unfairly advance economically. • Intelligence gathering • Groups target individuals and connected associates to further social engineering
  • Crimeware on the Net

    Crimeware on the Net

    Crimeware on the Net The “Behind the scenes” of the new web economy Iftach Ian Amit Director, Security Research – Finjan BlackHat Europe, Amsterdam 2008 Who Am I ? (iamit) • Iftach Ian Amit – In Hebrew it makes more sense… • Director Security Research @ Finjan • Various security consulting/integration gigs in the past – R&D – IT • A helping hand when needed… (IAF) 2 BlackHat Europe – Amsterdam 2008 Today’s Agenda • Terminology • Past vs. Present – 10,000 feet view • Business Impact • Key Characteristics – what does it look like? – Anti-Forensics techniques – Propagation methods • What is the motive (what are they looking for)? • Tying it all up – what does it look like when successful (video). • Anything in it for us to learn from? – Looking forward on extrusion testing methodologies 3 BlackHat Europe – Amsterdam 2008 Some Terminology • Crimeware – what we refer to most malware these days is actually crimeware – malware with specific goals for making $$$ for the attackers. • Attackers – not to be confused with malicious code writers, security researchers, hackers, crackers, etc… These guys are the Gordon Gecko‟s of the web security field. The buy low, and capitalize on the investment. • Smart (often mislead) guys write the crimeware and get paid to do so. 4 BlackHat Europe – Amsterdam 2008 How Do Cybercriminals Steal Business Data? Criminals’ activity in the cyberspace Federal Prosecutor: “Cybercrime Is Funding Organized Crime” 5 BlackHat Europe – Amsterdam 2008 The Business Impact Of Crimeware Criminals target sensitive business data
  • Q3 Malware Trends: Ransomware Extorts Education, Emotet and Crypto Mining Malware Evolve, and Android Malware Persists Cyber Threat Analysis

    Q3 Malware Trends: Ransomware Extorts Education, Emotet and Crypto Mining Malware Evolve, and Android Malware Persists Cyber Threat Analysis

    CYBER THREAT ® ANALYSIS By Insikt Group CTA-2020-1105 Q3 MALWARE TRENDS: RANSOMWARE EXTORTS EDUCATION, EMOTET AND CRYPTO MINING MALWARE EVOLVE, AND ANDROID MALWARE PERSISTS CYBER THREAT ANALYSIS Key Judgments • More threat actors will very likely adopt the ransomware extortion model as long as it remains profitable. • Educational institutions continue to be a prime target for ransomware operators. We believe that disruptions caused by the COVID-19 pandemic have made the networks of universities and school districts attractive targets because these organizations feel increased pressure to stay operational with minimal disruptions and are therefore more likely to pay ransoms quickly. • Reports of NetWalker attacks increased, and reports of Sodinokibi attacks decreased. However, it is possible that victims of Sodinokibi attacks are simply paying the ransom more often. Based on activity on underground forums, we suspect that the operators of Sodinokibi are continuing to expand their operations. • While we expect Emotet’s operators to continue to employ major pauses, it is highly likely that Emotet will continue to be This report is an extension of analysis Recorded Future released, which outlined a major threat and impact organizations across a variety of the trends in malware use, distribution, and development throughout Q1 and Q2 industries throughout the end of the year and into 2021. 2020. Insikt Group used the Recorded Future® Platform to look at mainstream news, security vendor reporting, technical reporting around malware, vulnerabilities, and • In Q3 2020, threat actors have increasingly augmented their security breaches, and dark web and underground forums from July 1 to September cryptocurrency mining malware by adding functionalities 30, 2020, to examine major trends to malware impacting desktop systems and mobile such as credential stealing or access capabilities.
  • Comptia® Security+ SY0-601 Cert Guide

    Comptia® Security+ SY0-601 Cert Guide

    CompTIA® Security+ SY0-601 Cert Guide Omar Santos Ron Taylor Joseph Mlodzianowski A01_Santos_Fm_pi-plii_1.indd 1 01/06/21 2:49 pm CompTIA® Security+ SY0-601 Cert Guide Editor-in-Chief Copyright © 2022 by Pearson Education, Inc. Mark Taub All rights reserved. No part of this book shall be reproduced, stored in Product Line Manager a retrieval system, or transmitted by any means, electronic, mechanical, Brett Bartow photocopying, recording, or otherwise, without written permission from the publisher. No patent liability is assumed with respect to the use of the Executive Editor information contained herein. Although every precaution has been taken in Nancy Davis the preparation of this book, the publisher and author assume no respon- Development Editor sibility for errors or omissions. Nor is any liability assumed for damages Christopher A. Cleveland resulting from the use of the information contained herein. ISBN-13: 978-0-13-677031-2 Managing Editor ISBN-10: 0-13-677031-2 Sandra Schroeder Library of Congress Control Number: 2021935686 Senior Project Editor ScoutAutomatedPrintCode Tonya Simpson Copy Editor Trademarks Chuck Hutchinson All terms mentioned in this book that are known to be trademarks or ser- vice marks have been appropriately capitalized. Pearson IT Certification Indexer cannot attest to the accuracy of this information. Use of a term in this book Erika Millen should not be regarded as affecting the validity of any trademark or service mark. Proofreader Abigail Manheim Warning and Disclaimer Technical Editor Every effort has been made to make this book as complete and as accurate Chris Crayton as possible, but no warranty or fitness is implied.
  • Malware to Crimeware

    Malware to Crimeware

    I have surveyed over a decade of advances in delivery of malware. Over this daVid dittRich period, attackers have shifted to using complex, multi-phase attacks based on malware to crimeware: subtle social engineering tactics, advanced how far have they cryptographic techniques to defeat takeover gone, and how do and analysis, and highly targeted attacks we catch up? that are intended to fly below the radar of current technical defenses. I will show how Dave Dittrich is an affiliate information malicious technology combined with social security researcher in the University of manipulation is used against us and con- Washington’s Applied Physics Laboratory. He focuses on advanced malware threats and clude that this understanding might even the ethical and legal framework for respond- ing to computer network attacks. help us design our own combination of [email protected] technical and social mechanisms to better protect us. And ye shall know the truth, and the truth shall make you free. The late 1990s saw the advent of distributed and John 8:32 coordinated computer network attack tools, which were primarily used for the electronic equivalent of fist fighting in the streets. It only took a few years for criminal activity—extortion, click fraud, denial of service for competitive advantage—to appear, followed by mass theft of personal and financial data through quieter, yet still widespread and auto- mated, keystroke logging. Despite what law-abid- ing citizens would desire, crime does pay, and pay well. Today, the financial gain from criminal enter- prise allows investment of large sums of money in developing tools and operational capabilities that are increasingly sophisticated and highly targeted.
  • 2020 Trends & 2021 Outlook

    2020 Trends & 2021 Outlook

    2020 trends w/ & 2021 outlook THREAT REPORT Q4 2020 WeLiveSecurity.com @ESETresearch ESET GitHub Contents 3 FOREWORD 4 FEATURED STORY 7 NEWS FROM THE LAB 9 APT GROUP ACTIVITY 15 STATISTICS & TRENDS 16 Top 10 malware detections 17 Downloaders 19 Banking malware 21 Ransomware 23 Cryptominers 25 Spyware & backdoors 27 Exploits 29 Mac threats 31 Android threats 33 Web threats 35 Email threats 38 IoT security 40 ESET RESEARCH CONTRIBUTIONS ESET THREAT REPORT Q4 2020 | 2 Foreword Welcome to the Q4 2020 issue of the ESET Threat Report! 2020 was many things (“typical” not being one of them), and it sure feels good to be writing The growth of ransomware might have been an important factor in the decline of banking about it in the past tense. malware; a decline that only intensified over the last quarter of the year. Ransomware and other malicious activities are simply more profitable than banking malware, the operators of As if really trying to prove a point, the pandemic picked up new steam in the last quarter, which already have to grapple with the heightening security in the banking sector. There was, bringing the largest waves of infections and further lockdowns around the world. Amid the — however, one exception to this trend: Android banking malware registered the highest detection chaos, the long-anticipated vaccine rollouts brought a collective sigh of relief or, at least, levels of 2020 in Q4, fueled by the source code leak of the trojan Cerberus. a glimmer of hope somewhere in the not-too-far-distant future. With the pandemic creating fertile ground for all kinds of malicious activities, it is all but In cyberspace, events also took a dramatic turn towards the end of the year, as news of the obvious that email scammers would not want to be left out.