Fast Facts February 2021 Monthly data-driven threat landscape updates Contents • Contents • FRS • FRS • Introduction – Malware Families – Banking Malware • Disclaimer • Updates & Top 5 • Updates & Top 5 • SPN • Segments • Segments • – Total Threats • Industries Industries – • Blocked – Malware Campaigns Macro Malware • • Queries • Updates & Top 5 Updates & Top 5 • – Ransomware Threats • Segments Segments • • Blocked • Industries Industries – • Protection Layers – Ransomware PoS Malware • Updates & Top 5 • Updates & Top 5 • ERS • New Families • Segments – Spam Attachments • Segments • Industries – BEC • Industries • Overall and CEO Fraud • BEC Impersonation • BEC Intent 2 © 2021 Trend Micro Inc. Contents • WRS • SHN • Appendix – C&C Server Malware – Events, Devices, and Routers – What is SPN, MARS, • Updates & Top 5 • All Events, Devices, and Routers SHN, and IoTRS? – Botnet • Top 5 Bidirectional Events – What is MARS? • Connections • Key Events and Outbound/Inbound Groups – What is SHN? • C&C Servers – Outbound Events – What is IoTRS? • MARS • Possible Outbound Attacks (Events), – What is BEC? – – Android Malware Devices, and Routers What is ZDI? – • Updates & Top 5 • Top 5 Outbound Attacks (Events) What is an Botnet, C&C • Server? • ZDI Top Possible Outbound Attacks by Device Type – Vulnerabilities – Inbound Events • Per Vendor • Possible Inbound Attacks (Events), Devices, • Zero-day and Routers • ICS • Top 5 Possible Inbound Attacks (Events) • ICS Zero-day • Top Possible Inbound Attacks by Device Type 3 © 2021 Trend Micro Inc. Introduction • In the state of a prolonged worldwide health pandemic, threat detections have remained in billions for January and February, with threat actors utilizing the virus outbreak to abuse users’ systems. – Trend Micro™ Smart Protection Network™ (SPN) has blocked a total of 6.2 billion threats. – Malware families have indicated a total of 1.1 million unique detections. – EMOTET is no longer the top malware in January and February in malware detections. – RAMNIT is back to the top banking malware, taking over the position of EMOTET. – EMOTET, RYUK, and TRICKBOT also shows a 43.0% decrease only for EMOTET. – Overall BEC attacks have increased by 28.3% – New datasets for BEC to indicate the distributions of impersonations and intents. – Trend Micro Smart Home Network (SHN) shows significant increases by 429.9% and 394.9%, for devices and routers respectively related to inbound possible attacks. – See the rest of this presentation for more of our data. 4 © 2021 Trend Micro Inc. Disclaimer • Trend Micro Research is sharing monthly threat landscape updates based on Trend Micro™ Smart Protection Network™ (SPN) security infrastructure data through Email Reputation Service (ERS), File Reputation Service (FRS), and Web Reputation Service (WRS). With SPN sensors, gathered data also come from Trend Micro researchers, the Zero Day Initiative (ZDI) team, the PH Threat Hunting team, the Mobile App Reputation Service (MARS) team, and Smart Home Network (SHN), and IoT Reputation Service (IoTRS). – The cutoff date for the monthly data is at the end of each month. For this report, the cutoff was on February 28, 2020. The numbers are their exact counts (i.e., no rounding decimals off to whole numbers or to the nearest thousand). – The data in this report is a snapshot of the data gathered from sensors and parameters Trend Micro core technology experts used during the report’s creation. As such, readers should be aware of the possibility that the figures in the report may change retrospectively due to any future enhancements applied to the sensors and parameters. Corresponding explanations shall accompany any changes in succeeding reports. – Please note that these detection numbers are from the coverage of the SPN sensors distributed globally, which is not exhaustive. Those regional rankings and figures cannot be free from such market-share influenced distribution bias. 5 © 2021 Trend Micro Inc. SPN (Smart Protection Network) Total Threats 6 © 2021 Trend Micro Inc. Total Threats - Blocked Trend Micro has blocked 6.2 billion threats in February, a 3.8% decrease from January’s 6.4 billion. 7 © 2021 Trend Micro Inc. Total Threats - Blocked While ERS has dominated the detection counts, only both WRS and FRS shows an increase of 25.4% and 10.3%, respectively. 8 © 2021 Trend Micro Inc. Total Threats - Blocked As of February, the total of threats blocked in 2021 is at 12.7 billion. 9 © 2021 Trend Micro Inc. Total Threats - Blocked (Continued) 10 © 2021 Trend Micro Inc. Total Threats - Queries The total number of queries in February had an decrease of 3.9% from January. 11 © 2021 Trend Micro Inc. Total Threats - Queries URL queries for WRS have indicated the SPN queries' top source with more than 60%. The second is FRS, while ERS is the last. 12 © 2021 Trend Micro Inc. Total Threats - Queries As of February, the threat queries in 2021 are at 861.4 billion. 13 © 2021 Trend Micro Inc. Total Threats – Queries (continued) 14 © 2021 Trend Micro Inc. Ransomware Threats The number of annual ransomware detections from 2016 to 2019 ranges from 55 million to over 1 billion. As of February, the total number of ransomware detections in 2020 is at 3.0 million. 15 © 2021 Trend Micro Inc. Ransomware Threats The number of ransomware threats blocked is 1.5 million in February, indicating a 0.8%% decrease from January. WRS dominates the Ransomware threats blocked. 16 © 2021 Trend Micro Inc. ERS (Email Reputation Service) Spam Attachments and BEC 17 © 2021 Trend Micro Inc. File Types Used as Spam Attachments Feb-21 Jan-21 1 .PDF 662,787 .PDF 1,430,887 2 .DOC 42,706 .DOC 28,462 3 .HTM 24,884 .EXE 27,509 4 .XLS 21,128 .XLS 24,659 5 .EXE 20,558 .HTML 19,301 The total count of detections for file types used in spam attachments has decreased by 47.6% from January to February .PDF was able to hold the top file type used in spam despite its 53.7% decrease. 18 © 2021 Trend Micro Inc. Business Email Compromise (BEC) While the CEO fraud attempts have increased by 9.1%, the Overall BEC attempts had grown by 28.6% from January to Feburary. 19 © 2021 Trend Micro Inc. BEC incident submission - Impersonation Datasets for both spoofed and targeted positions are not available now due to the process issue. And from January 2021, we have started monitoring the datasets like impersonation and intent from the case submissions. 20 © 2021 Trend Micro Inc. BEC incident submission – Intent Datasets for both spoofed and targeted positions are not available now due to the process issue. And from January 2021, we have started monitoring the datasets like impersonation and intent from the case submissions. 21 © 2021 Trend Micro Inc. FRS (File Reputation Service) Malware Families, Campaigns, and Ransomware 22 © 2021 Trend Micro Inc. Malware Family Feb-21 Jan-21 1 WCRY 12,524 WCRY 15,923 2 COINMINER 9,476 COINMINER 11,610 3 DOWNAD 6,691 VIRUX 7,217 4 DLOADER 6,445 DLOADER 7,178 5 NEMUCOD 6,210 DOWNAD 7,026 The number of malware families has decreased by 13.9% from January to February. As EMOTET dropped, WCRY is back to the usual top malware family detected position. 23 © 2021 Trend Micro Inc. Malware Family – Segments The consumer segment has remained the most significant number of malware detections in January and February, followed by the enterprise. 24 © 2021 Trend Micro Inc. Malware Family – Segments ENT Feb-21 Jan-21 Cons Feb-21 Jan-21 1 WCRY 12,067 WCRY 15,407 1 NEMUCOD 5,543 NEMUCOD 5,526 2 VIRUX 5,358 VIRUX 6,752 2 COINMINER 3,699 COINMINER 4,273 3 VIRUX 5,135 COINMINER 6,689 3 DLOADER 3,554 DLOADER 4,150 4 DOWNAD 4,599 DOWNAD 4,996 4 DRIDEX 2,419 LOCKY 2,567 5 EQUATED 3,322 EQUATED 4,618 5 POWLOAD 2,387 POWLOAD 2,544 SMB Feb-21 Jan-21 Others Feb-21 Jan-21 1 COINMINER 640 EMOTET 1,003 1 ADLOAD 77 LOCKY 64 2 DOWNAD 498 COINMINER 644 2 DLOADER 67 DLOADER 50 3 SALITY 324 DOWNAD 463 3 DRIDEX 40 POWLOAD 41 4 EMOTET 304 POWLOAD 385 4 LOCKY 36 Mackeeper 37 5 WCRY 290 DLOADER 381 5 POWLOAD 27 DRIDEX 29 In February, WCRY has continued to be the top malware family for the enterprise segment, while EMOTET has dropped to the fourth for SMB, and out of top 5 for customer. 25 © 2021 Trend Micro Inc. Malware – Industries Feb-21 Jan-21 1 Manufacturing 29,933 Manufacturing 76,467 2 Healthcare 28,531 Healthcare 37,359 3 Government 24,739 Government 25,949 4 Banking 18,553 Education 22,583 5 Education 17,908 Banking 21,488 6 Technology 13,188 Technology 16,060 7 Telecommunications 10,019 Telecommunications 13,336 8 Materials 8,654 Financial 7,752 9 Financial 6,272 Food and beverage 6,166 10 Food and beverage 5,976 Transportation 6,017 The manufacturing industry remains at the top with the most malware detections in February, despite a decrease of 60.9% from January. And the healthcare industry has gained the second spot in 2021. 26 © 2021 Trend Micro Inc. Malware Campaigns EMOTET, RYUK, and TRICKBOT are the three malware families with the most active campaigns. However, EMOTET shows a significant decrease of 43.0% from January to February. 27 © 2021 Trend Micro Inc. Malware Campaigns – Segments EMOTET shows a significant decrease from January to February in all segments. EMOTET’s increase in Others is negligible. 28 © 2021 Trend Micro Inc. Malware Campaigns – Industries Feb-21 Jan-21 1 Government 224 Manufacturing 183 2 Manufacturing 148 Government 175 3 Healthcare 114 Healthcare 131 4 Telecommunications 106 Financial 122 5 Food and beverage 71 Telecommunications 112 6 Education 30 Real estate 97 7 Technology 27 Food and beverage 84 8 Comm and Media 16 Technology 70 9 Banking 12 Education 59 10 Transportation 12 Transportation 35 The government has taken the top from the manufacturing industry with the highest number of malware detections, followed by the manufacturing and healthcare industries in the second and the third, respectively.