Pandalabs Annual Report 2018 Panda Security | Pandalabs Annual Report 2018
Total Page：16
File Type：pdf, Size：1020Kb
November, 2018 PandaLabs Annual Report 2018 Panda Security | PandaLabs Annual Report 2018 1. Introduction 3. Cyber-news 2018 2. PandaLabs: Threat Data in 2018 4. Data breaches - Pre-execution detections 5. Cybersecurity predictions 2019 - Examples of cases investigated by the laboratory - Malware incidents escalated to PandaLabs - The “Threat Mitigation Funnel” Panda Security | PandaLabs Annual Report 2018 Introduction: The State of Cybersecurity Panda Security | PandaLabs Annual Report 2018 4 Introduction: the State of Cybersecurity 2017 was the year when the word ransomware Most successful types of stopped being a term exclusive to cybersecurity attacks against companies experts and IT departments. The enormous media attention that attacks such as WannaCry and in 2018 Petya/GoldenEye received turned this type of threat into one of the key trends for businesses last year. However, as professionals in the sector know, highly publicized events must never serve as a risk indicator, nor influence on any security related decision. In this annual report, we at PandaLabs, Panda Security’s anti-malware laboratory, have reviewed the threat data gathered in the laboratory from our sensor sources. We include here data from endpoint security solutions deployed on our clients’ Prevalence of devices; the trends observed by our analysts whilst malware attacks they were providing file classification and threat hunting services; as well as the most relevant cybersecurity incidents reported around the world. And the information compiled in 2018 continues to reflect the prevalence of malware attacks, with 9 million malicious URLs and 2.4 million attacks blocked per million endpoints per month. 20.7% of machines studied experienced at least one malware attack during the period analyzed. Attacks utilizing RDP PandaLabs can state that the threats of file- based malware is not a problem for Panda Security, with infections trending to zero. This is due to the adoption of the model of 100% classification of all executable processes on systems, which can block any program that is unknown to Panda Security from running until it has been classified. In return, cybercriminals are evolving towards more insidious attacks, abusing existing software tools once they B manage to make their way onto the network. This leads us to believe that this kind of attack will increase in the future. Boom of cryptojacking and Ransomware as a Service Panda Security | PandaLabs Annual Report 2018 5 While traditional techniques – phishing, It is no surprise, therefore, that given this ransomware, business email compromise – seem to budgetary limitation, most corporate endpoints be as fruitful as ever, the boom of attacks utilizing are still protected by “traditional” technologies, RDP, combined with other social engineering which are not suitable for the cybersecurity techniques, is consolidated as an entry vector challenges of today. for attackers. If we add to this the boom of cryptojacking and Ransomware as a Service that Neither is it surprising how successful many we have seen this year, we have the three main attackers are, given that on average it takes them attack types that have successfully undermined much less time to compromise systems than company networks in 2018. it takes for them to be discovered. This lack of balance, along with a chronic lack of professionals The main target for attackers is still the endpoint. in the sector, will, once again, continue to This is where the most sensitive information is represent the main challenges for organizations stored, and where they can abuse credentials that when it comes to cybersecurity. allow them to carrying out lateral movements and attacking other networks and systems. However, the security budget for endpoint protection is approximately one third of that provided for network security. -Source: Gartner- Google trends: This chart confirms the fact that the GDPR has probably been the topic that has been of most interest in terms of search volume. GDPR Cambridge Analytica Meltdown y Spectre Panda Security | PandaLabs Annual Report 2018 PandaLabs: Threat Data in 2018 Panda Security | PandaLabs Annual Report 2018 7 PandaLabs: Threat Data in 2018 However, most malware is stopped from running signatures (specific and generic), heuristics, on the endpoint because phishing emails and behavior/context-based analysis, in-memory anti- URLs related to malware, the most common entry exploit, and the 100% Attestation and Threat vectors, are stopped by Panda Security. Hunting and Investigation services. These layers of protection are delivered both locally and from the In this report, we will present the threat data cloud. Figure 1 represents the set of techniques corresponding to the most significant layers of used depending on the attack method protection, as reported by our installed base of endpoint-based corporate products, which are: Figure 1. Protection technologies, attack methods and phases Pre-execution detections Most malware detected on protected endpoints On average, over 2.4 million malware files were in companies is identified using signatures and detected and over 9 million malware-related URLs heuristics. However, most malware is stopped from were blocked monthly per million endpoints. Most running on the endpoint because phishing emails of them were only seen once. and URLs related to malware are blocked. While the total amount of malware files that arrive at Analyzing the malware, the attack vectors and the endpoint is constantly growing (over 60% malicious codes on the rise in 2018, we can see from the start to the end of the period), the risk that the prevalence of the malware categories that file-based threats pose for our clients has detected in this stage hasn’t changed much over reduced dramatically, to marginal levels. This is the last year. Trojans and ransomware represent due to the efficiency of the integrated services, most of these threats. Relative to this, the via products and services, and in particular due blocking of Malware-related URLs (through direct to the “100% attestation” approach that Panda web interactions or through embedded URLs in Security has taken, which, by default, prevents emails) happens at over 3.7 times the rate of the execution of unknown executables until they malware file detections, representing the biggest are classified by PandaLabs. vector of entry for threats to the endpoint, together with brute-force attacks against RDP, an attack vector predicted at the start of the year. Panda Security | PandaLabs Annual Report 2018 8 Malware URLs blocked every Malware month per million 2,4 files 9 MILLION endpoints, per MILLION month We believe Internet-facing RDP connectivity Pre-execution classifications. represents a growing risk today for many organizations, which are unaware of their exposure. Since new types of malware are created and Falling victim to this attack technique means published more quickly than detection capabilities continually being scanned by cybercriminals are added, there is always a detection gap. This in search of easy opportunities to get onto generates inevitable infections of some “patient the company’s networks. The data recorded zero” users who don’t have a more robust or by PandaLabs corroborates the fact that complete protection. approximately 40% of our mid to large clients are subject to this kind of RDP attack every month. In order to close that gap and minimize infection risk for customers, in 2015, Panda Security As for the most common entry vectors and introduced a “100% Attestation Service”, which malicious codes this year, email continues to ensures that all Portable Executable (PE) files be one of the most popular vectors for attack trying to execute on the endpoints must be campaigns, although many of them end up in the classified as trusted by PandaLabs before being spam folder before they get to the endpoint. Users, allowed to run. This security service acts as the particularly when using mobile devices, are more last line of defense against file-based malware. exposed to malicious URLs or infected websites. In the period January-November, a monthly In this regard, websites infected with Coinhive average of approximately 5.8 million different code are becoming a more pervasive threat, as a executable files were observed per million less aggressive form of cryptomining. Coinhive, endpoints. While most of the files are repeated initially designed to allow website owners to earn from month to month, approximately 20% of them extra income without running advertisements, each month were unknown the first time they has emerged as a leading threat this year, with tried to run. 100% (99.98%) of these files were its code being installed on hacked sites without automatically classified, and an average of 1.3% the knowledge of the owners. This unauthorized were classified as malware. cryptomining service drains CPU cycles and power from devices for as long as the user visits the infected site. In fact, cryptomining has grown 3.5 times more than during the same period last year, whereas ransomware grew 2.5 times in the PandaLabs same period. In 2018, Monero miners represent Identified almost 70% of the total number of cryptominers identified. 5,8 MILLION per month Executable files Per million endpoints Panda Security | PandaLabs Annual Report 2018 9 Detection of attacks through behavioural The behavioural and contextual analysis and contextual analysis module The behavioral analysis module, which blocks blocked actions based on their context of execution, can recognize hundreds of combinations of processes, process relationships, actions, etc., which are indicative of early stage attacks of various types (ransomware, miners, script-based attacks, among 15 others). Paradoxically, due to the early prevention Thousand/month of the threat, it is impossible for us to determine the final nature of the threat, given that attackers Malicious actions may also use a combination of techniques Per million within the same attack. The introduction of endpoints these prevention techniques represented a major success in the fight against dangerous threats for our customers, such as ransomware.