Internet Security

Our Internet security section covers a wide range of topics including the latest online threats such as new phishing scams, changes in exploit kit activity, and up to date information on new malware and ransomware variants and social media scams.

Here you will find articles on data breaches, together with the causes of attacks and potential mitigations to reduce the risk of similar incidents occurring at your organization. Lessons can be learned from attacks on other organizations and threat intelligence can help security teams prepare for impending cyberattacks.

This section also contains news on the latest remote code execution vulnerabilities and zero day exploits that are being used to gain access to business networks, such as the network worm attacks that were used to spread WannaCry ransomware around the globe in May 2017.

In addition to mitigations – such as news of patches and software upgrades – articles are included to help organizations improve Internet security. Employees are a weak link in security defenses and frequently download malware or engage in risky behavior that could result in a network compromise. This section includes information that can be used by organizations to reduce the risk of employees inadvertently downloading malicious software or disclosing their credentials on phishing websites, turning them from liabilities into security assets.

Erebus Ransomware Attack Results in $1 Million Ransom Payment

A $1 million ransom payment has been made to cybercriminals who used Erebus ransomware to attack the South Korean web hosting firm Nayana.

Erebus ransomware was first detected in September last year and was downloaded via websites hosting the Rig exploit kit. Traffic was directed to the malicious website hosting the Rig EK via malvertising campaigns. Vulnerable computers then had Erebus ransomware downloaded. This Erebus ransomware attack is unlikely to have occurred the same way. Trend Micro suggests the attackers leveraged vulnerabilities on the comapny’s Linux servers, used a local exploit or both.

The infection spread to all 153 Linux servers used by Nayana. Those servers hosted the websites of 3,400 businesses. All of the firm’s customers appear to have been affected, with website files and databases encrypted.

Nayana was attacked on June 10, 2017 in the early hours. The hosting company responded rapidly. Law enforcement was contacted and it was initially hoped that it would be possible to crack the ransomware and decrypt files without paying the ransom. It soon became clear that was not an option.

Companies can avoid paying ransom payments following ransomware attacks by ensuring backups are made of all data. Having multiple backups increases the likelihood of files being recoverable. In this case, Nayana had an internal and external backup; however, both of those backups were also encrypted in the attack. Nayana therefore had no alternative but to negotiate with the attackers.

While ransom payments for businesses are often in the $10,000 to $25,000 price bracket, the gang behind this attack demanded an astonishing 550 Bitcoin for the keys to unlock the encryption – Approximately $1.62 million. On June 14, Nayana reported that it had negotiated a ransom payment of 397.6 Bitcoin – Approximately $1.01 million, making this the largest ransomware ransom payment reported to date.

That payment is being made in three instalments, with keys supplied to restore files on the servers in batches. When one batch of servers was successfully recovered, the second ransom payment was made. Nayana said that the recovery process would take approximately 2 weeks for each of the three batches of servers, resulting in considerable downtime for the company’s business customers. Nayana experienced some problems restoring databases but says it is now paying the final payment.

This incident shows how costly ransomware resolution can be and highlights how important it is to ensure that operating systems and software are updated regularly. Patches should be applied promptly to address vulnerabilities before they can be exploited by cybercriminals.

Simply having a backup is no guarantee that files can be recovered. If the backup device is connected to a networked machine when a ransomware attack occurs, backup files can also be encrypted. This is why it is essential for organizations to ensure one backup is always offline. It is also wise to segment networks to limit the damage caused by a ransomware attack. If ransomware is installed, only part of the network will be affected.

Corporate Phishing Emails Increased by 400% in Q2, 2017

Corporate phishing emails are one of the biggest cybersecurity risks faced by organizations. Cybercriminals are well aware that even companies with robust cybersecurity defenses are vulnerable to phishing attacks.

Phishing email volume is higher than at any other time in history. Employees are being targeted with threat actors now using sophisticated social engineering techniques to maximize the probability of employees clicking on links, opening infected email attachments or disclosing their login credentials. If corporate phishing emails are delivered to end users’ inboxes, there is a high chance that at least one employee will be fooled. All it takes is for one employee to click on a malicious link or open an infected attachment for malware to be installed or access to sensitive data be provided.

The threat from phishing attacks has been steadily increasing in recent years, although this year has seen phishing attacks soar. A recent study conducted by Mimecast has shown that cybercriminals have been stepping up their efforts in recent months. Last quarter, there was a 400% increase in corporate phishing emails according to the study.

A phishing trends & intelligence report for Q1, 2017 from the security awareness training firm PhishLabs showed that in the first quarter of 2017, overall phishing email volume increased by 20% compared to the previous quarter. 88% of phishing attacks were concentrated on five industries: payment services, financial institutions, cloud storage/file hosting firms, webmail/online services and e-commerce companies.

The anti-phishing training and phishing simulation platform provider PhishMe also noted a major increase in phishing emails in Q1, 2017. The firm’s Q1, 2017 malware review also showed there had been a 69.2% increase in botnet malware usage in the first quarter of this year.

Business email compromise attacks are also on the rise. Proofpoint’s annual Human Factor report showed BEC email attacks rose from 1% of message volume to 42% of message volume relative to emails bearing Trojans. Those attacks have cost businesses $5 billion worldwide.

These studies clearly show that corporate phishing emails are on the rise, highlighting the need for organizations to improve their defenses. The best defense against phishing emails and ransomware attacks is to ensure messages are intercepted and blocked. It is therefore essential for organizations to implement a robust spam filtering solution to prevent malicious messages from reaching end users’ inboxes.

SpamTitan conducts more than 100 checks of incoming emails, ensuring more than 99.98% of spam and malicious emails are blocked. Dual anti-virus engines are used to ensure 100% of known malware and ransomware is intercepted and prevented from being delivered to end users’ inboxes.

If you have yet to implement an advanced spam filtering solution or you are unhappy with your current provider, contact TitanHQ today to find out more about SpamTitan and how it can be used to protect your business from email attacks. SpamTitan is also available on a no obligation, 30-day free trial, allowing you to try the solution for yourself before committing to a purchase.

New Microsoft Windows XP Updates Released in Wake of WannaCry Attacks

Microsoft took the decision to issue emergency Windows XP updates to prevent exploitation of the Windows Server Message Block (SMB) vulnerability used to infect worldwide computers with ransomware on May 12, 2017.

The move came as a surprise since the operating system is no longer supported. Extended support came to an end on April 8, 2014. Yesterday, saw further Microsoft Windows XP updates released. The patches prevent further flaws in the operating system from being exploited by cybercriminals in WannaCry ransomware-style attacks.

Microsoft’s Cyber Defense Operations Center head, Adrienne Hall, said “Due to the elevated risk for destructive cyber-attacks at this time, we made the decision to take this action because applying these updates provides further protection against potential attacks with characteristics similar to WannaCrypt.”

In total, nearly 100 vulnerabilities were patched this Patch Tuesday, including 18 critical flaws that can be remotely exploited by cybercriminals to take full control of vulnerable systems. In some cases, as was the case with the WannaCry ransomware attacks, no user interaction is required for the flaws to be exploited.

One of the flaws – tracked as CVE-2017-8543 – similarly affects the Windows Server Message Block service. Microsoft says CVE-2017-8543 is being actively exploited in the wild, with Windows Server 2008, 2012, and 2016 all affected as well as more recent versions of Windows – v7, 8.1 and Windows 10. It is this flaw that has been patched for Windows Server 2003 and Windows XP. As was the case on May 12, once the attackers infect one device, they can search for other vulnerable devices. Infection can spread incredibly quickly to many other networked devices.

Some security experts have criticized Microsoft for issuing yet more Windows XP updates, arguing that this sends a message to users of outdated operating systems that it is OK not to upgrade the OS. Windows XP has many unpatched flaws, but the recent Windows XP updates suggest that if a particularly serious vulnerability is discovered that is being actively exploited, patches will be issued.

While Microsoft Windows XP updates have been released, this should not be taken as signaling a change in Microsoft’s standard servicing policies. Further patches may not be released for unsupported Windows versions, so organizations should not delay upgrading their OS. Microsoft’s general manager of its Security Response Center, Eric Doerr, said “The best protection is to be on a modern, up-to-date system that incorporates the latest defense-in-depth innovations. Older systems, even if fully up-to-date, lack the latest security features and advancements.”

In total, there were 95 updates issued this patch Tuesday. Like CVE-2017-8543, a LNK remote code execution vulnerability (CVE-2017-8464) is also being exploited in the wild.

The latest round of updates also includes a patch for a serious flaw in Microsoft Outlook (CVE-2017-8507). Typically, in order to exploit vulnerabilities an end user would be required to open a specially crafted email attachment. However, if an attacker were to send a specially crafted message to an Outlook user, simply viewing the message would allow the attacker to take full control of the machine.

Adobe has also issued a slew of updates to address 21 vulnerabilities spread across four products (Flash, Shockwave Player, Captivate and Adobe Digital editions). 15 of those vulnerabilities have been marked as critical and would allow remote code execution.

As the WannaCry ransomware attacks clearly showed, the failure to apply patches promptly leaves the door wide open to cybercriminals. These updates should therefore not be delayed, especially since two of the flaws are being actively exploited.

University of Alaska Phishing Attack Results in Exposure of 25,000 Individuals’ Data

A University of Alaska phishing attack has potentially resulted in attackers gaining access to the sensitive information of 25,000 staff, students and faculty staff.

The University of Alaska phishing attack occurred in December last year, although affected individuals have only just been notified. The phishing emails were sent to university employees. One or more individuals responded and were fooled into following the threat actors’ instructions.

Details of the exact nature of the phishing emails were not disclosed; however, as with other phishing scams, the emails appeared genuine and looked professional. By responding to the emails, the employees accidentally disclosed their usernames and passwords to the attackers. The attack resulted in ‘several’ email accounts being compromised.

The emails in the compromised accounts contained a range of sensitive information including names and Social Security numbers. In total, around 25,000 staff, students and faculty members had their information exposed.

The investigation into the University of Alaska phishing attack could not confirm whether any of the emails in the accounts were accessed or if information was copied by the attackers, although it remains a distinct possibility.

Due to the sensitive nature of data in the accounts, the University of Alaska had to inform all affected individuals by mail and offer credit monitoring and identity theft protection services. Victims will also be protected by a $1 million identity theft insurance policy.

A forensic analysis had to be conducted to determine the exact nature of the attack and which individuals had been affected – A process that took around 5 months. Staff had to be provided with additional training to improve awareness of credential phishing scams and were retrained correct handling of sensitive information. The notifications and mitigations came at a considerable cost.

The University of Alaska phishing attack was just one of many phishing attacks that have taken place in the United States over the past few months. The phishing attacks all have a common denominator. Employees were targeted, phishing emails reached inboxes, and end users followed the instructions in the emails.

Training staff to be aware of the threat of phishing can reduce susceptibility, although training did not prevent the University of Alaska phishing attack.

Even after receiving security awareness training, employees can make mistakes. A technology solution should therefore be implemented to stop phishing emails from being delivered to end users’ inboxes.

SpamTitan from TitanHQ offers excellent protection against phishing attacks, blocking more than 99.9% of spam, phishing emails and other malicious messages. SpamTitan is quick and easy to install, cost effective to implement and easy to maintain.

With SpamTitan installed, organizations can protect themselves against phishing attacks and avoid the considerable cost of data breaches.

For more information on SpamTitan and other TitanHQ security products, contact the sales team today and take the first step toward improving your defences against phishing attacks.

Samba Flaw Could Be Exploited and Used in Network Worm Attacks

A critical Samba flaw has been discovered that has potential to be exploited and used for network worm attacks similar to those that resulted in more than 300,000 global WannaCry ransomware infections.

Samba is used to provide Windows-like file and print services on Unix and Linux servers and is based on the Windows Server Message Block (SMB) protocol that was exploited in the recent WannaCry ransomware attacks. The wormable remote code execution vulnerability has been identified in versions 3.5.0 an above.

The Samba flaw – tracked as CVE-2017-7494 – has existed for around 7 years, although no known attacks are understood to have occurred. That may not remain the case for long.

Samba is commonly installed on enterprise Linux servers, with around 104,000 machines believed to be vulnerable, per a recent search conducted by Rapid7 researchers. The Samba flaw can be exploited easily, requiring just a single line of code.

The Samba vulnerability has been rated as critical, although the good news is Samba has already issued an update that addresses the vulnerability. The patch can be applied to versions 4.4 and above. Any organization that is using an unsupported version of Samba, or is unable to apply the patch, can use a workaround to address the Samba vulnerability and secure their Linux and Unix servers.

The workaround is straightforward, requiring the addition of the following parameter to the [global] section of your smb.conf

nt pipe support = no

After the parameter has been added, the smbd daemon must be restarted. This will prevent clients from accessing any named pipe endpoints.

US-CERT has advised all organizations to apply the patch or use the workaround as soon as possible to prevent the vulnerability from being exploited.

If a threat actor were to exploit the Samba flaw, it would allow them to “upload a shared library to a writable share, and then cause the server to load and execute it.” A malicious file could be remotely uploaded on any vulnerable device. That could be ransomware, a network worm, or any other malicious file. That file could then be executed with root access privileges.

NAS devices also use Samba and may also be vulnerable to attack. Malicious actors could target NAS devices and access or encrypt stored data. Many organizations use NAS devices to store backups. An attack on those devices, using ransomware for instance, could be devastating. Bob Rudis, chief data scientist at Rapid7, said “A direct attack or worm would render those backups almost useless. Organizations would have little choice but to pay the ransom demand.

A proof-of-concept exploit for the Samba vulnerability is available to the public. It is therefore only a matter of time before the vulnerability is exploited. The patch or workaround should therefore be applied ASAP to mitigate risk.

Beware of WannaCry Phishing Emails

Cybercriminals have started sending WannaCry phishing emails, taking advantage of the fear surrounding the global network worm attacks.

An email campaign has been identified in the United Kingdom, with BT customers being targeted. The attackers have spoofed BT domains and made their WannaCry phishing emails look extremely realistic. BT branding is used, the emails are well written and they claim to have been sent from Libby Barr, Managing Director, Customer Care at BT. A quick check of her name on Google will reveal she is who she claims to be. The WannaCry phishing emails are convincing, cleverly put together, and are likely to fool many customers.

The emails claim that BT is working on improving its security in the wake of the massive ransomware campaign that affected more than 300,000 computers in 150 countries on May 12, 2017. In the UK, 20% of NHS Trusts were affected by the incident and had data encrypted and services majorly disrupted by the ransomware attacks. It would be extremely hard if you live in the UK to have avoided the news of the attacks and the extent of the damage they have caused.

The WannaCry phishing emails provide a very good reason for taking prompt action. BT is offering a security upgrade to prevent its customers from being affected by the attacks. The emails claim that in order to keep customers’ sensitive information secure, access to certain features have been disabled on BT accounts. Customers are told that to restore their full BT account functionality they need to confirm the security upgrade by clicking on the upgrade box contained in the email.

Of course, clicking on the link will not result in a security upgrade being applied. Customers are required to disclose their login credentials to the attackers.

Other WannaCry phishing emails are likely to be sent claiming to be from other broadband service providers. Similar campaigns could be used to silently download malware or ransomware.

Cybercriminals often take advantage of global news events that are attracting a lot of media interest. During the Olympics there were many Olympic themed spam emails. Phishing emails were also rife during the U.S. presidential elections, the World Cup, the Zika Virus epidemic, and following every major news event.

The golden rule is never to click on links sent in email from individuals you do not know, be extremely careful about clicking links from people you do know, and assume that any email you receive could be a phishing email or other malicious message.

A single phishing email sent to an employee can result in a data breach, email or network compromise. It is therefore important for employers to take precautions. Employees should be provided with phishing awareness training and taught the tell-tale signs that emails are not genuine.  It is also essential that an advanced spam filtering solution is employed to prevent the vast majority of phishing emails from reaching end users inboxes.

On that front, TitanHQ is here to help. Contact the team today to find out how SpamTitan can protect your business from phishing, malware and ransomware attacks.

The Cost of Ransomware Attacks Estimated to Reach $5 Billion in 2017

The cost of ransomware attacks cannot be totaled by the amounts illegally earned by cybercriminals through ransom payments. In fact, the ransom payments are just a tiny fraction of the costs experienced by businesses that have been attacked with ransomware.

Take the recent WannaCry ransomware attacks as an example. The individuals behind that campaign were charging $300 per infected device to supply the keys to decrypt data. The amount gathered by those individuals was a little over $100,000 on Monday this week, even though the attacks involved data being encrypted on approximately 300,000 devices.

However, the cost of ransomware attacks is far higher. The biggest cost of ransomware attacks for most businesses is downtime while the infection is dealt with. Even if the ransom is paid, businesses often lose a week or more while the infection is removed and systems are brought back online. One Providence law firm suffered 3 months of downtime while systems remained locked!

Then there is the continued disruption while businesses catch up from the loss of productivity in the aftermath following the attack. The NHS was still experiencing disruption more than a week after the attacks on Friday 12, May.

Ransomware attacks can also involve loss of data and damage a company’s reputation. Typically, following a ransomware attack, a forensic analysis of IT systems must be conducted to ensure all traces of malware have been removed. Checks also must be performed to look for backdoors that may have been installed. Many businesses do not have the staff to perform those tasks. Cybersecurity experts must therefore be brought in. Additional cybersecurity solutions must also be purchased to ensure further attacks are prevented. The cost of ransomware attacks is therefore considerable.

The WannaCry ransomware attacks have been estimated to have cost businesses more than $1 billion. KnowB4 CEO Stu Sjouwerman said “The estimated damage caused by WannaCry in just the initial 4 days would exceed a billion dollars, looking at the massive downtime caused for large organizations worldwide.”

The cost of ransomware attacks in 2015 was an estimated $325 million, although figures from the FBI suggest that total was reached in the first quarter of the year. The final cost of ransomware attacks in the year was estimated to have reached $1 billion. Recently, Cybersecurity Ventures predicted the cost of ransomware attacks in 2017 will reach an incredible $5 billion. Given the expected costs of the recent WannaCry ransomware attacks, that could turn out to be an incredibly conservative estimate.

Cybercriminals are not concerned about the damage caused by the attacks, only the amount they can extort from businesses. The returns may be relatively low, but they are sufficiently high to make the attacks profitable. More and more individuals are also getting in on the act by using ransomware-as-a-service. Not only are ransomware attacks likely to continue, major cybercriminal gangs are likely to increase the scale of the attacks.

Businesses should be aware of the huge cost of ransomware attacks and take appropriate action to prevent those attacks from occurring. Having a backup of data may ensure that a ransom payment does not need to be made, but it will do little to prevent huge losses from being suffered if ransomware is installed.

Preventing ransomware attacks requires security awareness training for employees, advanced spam filters to stop ransomware from being delivered to end users’ inboxes, web filters to block individuals from accessing malicious URLs, endpoint protection systems to detect and block ransomware downloads, advanced firewalls and antivirus and antimalware solutions.

Fortunately, with appropriate defenses in place, it is possible to block ransomware attacks. Those solutions do come at a cost, but considering the losses from a successful ransomware attack, they are a small price to pay.

Who Conducted the WannaCry Ransomware Attacks? Link Found to North Korea

Who Conducted the WannaCry Ransomware Attacks?

The WannaCry ransomware attacks that started on Friday May 12 rapidly spread to more than 150 countries. While the attacks have been halted, IT security professionals are still scrambling to secure their systems and the search is now on for the perpetrators.

Malware researchers are analyzing the ransomware code and attack method to try to find clues that will reveal who conducted the WannaCry ransomware attacks.

At this stage in the investigation, no concrete evidence has been uncovered that links the attacks to any individual or hacking group, although a Google security researcher, Neel Mehta, has found a possible link to the Lazarus Group; a hacking organization believed to be based in China with links to North Korea.

The Lazarus Group is thought to be behind the attack on Sony Pictures in 2014 and the major heist on the Bangladesh central bank in February this year. While the link between the Lazarus Group and North Korea has not been comprehensively proven, the U.S. government is sure the group has been backed by North Korea in the past.

WannaCry Ransomware Code has been Reused

Mehta discovered parts of the ransomware code from the latest attacks were the same as code in a 2015 backdoor used by the Lazarus Group, suggesting the WannaCry ransomware attacks were conducted either by the Lazarus Group or by someone who has access to the same code.

Mehta also compared the code from the latest WannaCry ransomware variant and the backdoor to an earlier version of WannaCry ransomware from February and found code had been shared between all three. Symantec’s researchers have confirmed the code similarities.

Whether the Lazarus Group conducted the attacks is far from proven, and there is no evidence to suggest that were that to be the case, that the group had any backing from North Korea. The group could have been acting independently.

While some have called this link ‘strong evidence’, it should be explained that comparing code between malware samples does not confirm origin. Code is often reused and it is possible that the actors behind this campaign may have put in a false flag to divert attention from themselves onto the Lazarus Group and North Korea.

While the false flag idea is possible and plausible, Kaspersky Lab believes it is improbable and that the similarities in the source code point the finger of blame at the Lazarus Group.

Many Questions Remain Unanswered

The link with the Lazarus Group/North Korea is now being investigated further, but there are currently many questions unanswered.

The ransomware included a self-replicating function making it act like a worm, allowing it to rapidly spread to all vulnerable computers on a network. The sophistication of the attack suggests it was the work of a highly capable organization rather than an individual. However, the kill switch in the ransomware that was discovered by UK researcher ‘Malware Tech,’ allowed the infections to be halted. Such an ‘easily found’ kill switch would be atypical of such a sophisticated hacking group.

Previous attacks linked with the Lazarus Group have also been highly targeted. The WannaCry ransomware attacks over the weekend were purposely conducted in multiple countries, including China and Russia. The widespread nature of the attacks would be a departure from the typical attack methods used by Lazarus.

There are doubts as to whether North Korea would back an attack on its neighbours and allies, and while financially motivated attacks cannot be ruled out, past state-sponsored attacks have had a political purpose.

At this stage, it is not possible to tell who conducted the WannaCry ransomware attacks, but the latest discovery is an important clue as to who may be responsible.

WannaCry Ransomware Campaign Claims Victims in 150 Countries

On Friday May 12, a massive WannaCry ransomware campaign was launched, with the UK’s National Health Service (NHS) one of the early victims. The ransomware attack resulted in scores of NHS Trusts having data encrypted, with the infection rapidly spreading to networked devices. Those attacks continued, with 61 NHS Trusts now known to have been affected. Operations were cancelled and doctors were forced to resort to pen and paper while IT teams worked around the clock to bring their systems back online.

Just a few hours after the first reports of the WannaCry ransomware attacks emerged, the scale of the problem became apparent. The WannaCry ransomware campaign was claiming tens of thousands of victims around the world. By Saturday morning, Avast issued a statement confirming there had been more than 57,000 attacks reported in 100 countries. Now the total has increased to more than 200,000 attacks in 150 countries. While the attacks appear to now be slowing, security experts are concerned that further attacks will take place this week.

So far, in addition to the NHS, victims include the Spanish Telecoms operator Telefonica, Germany’s rail network Deutsche Bahn, the Russian Interior ministry, Renault in France, U.S. logistics firm FedEx, Nissan and Hitachi in Japan and multiple universities in China.

The WannaCry ransomware campaign is the largest ever ransomware attack conducted, although it does not appear that many ransoms have been paid yet. The BBC reports that the WannaCry ransomware campaign has already resulted in $38,000 in ransom payments being generated. That total is certain to rise over the next few days. WannaCry ransomware decryption costs $300 per infected device with no free decryptor available. The ransom amount is set to double in 3 days if payment is not made. The attackers threaten to delete the decryption keys if payment is not made within 7 days of infection.

Ransomware attacks usually involve malware downloaders sent via spam email. If emails make it past anti-spam solutions and are opened by end users, the ransomware is downloaded and starts encrypting files. WannaCry ransomware has been spread in this fashion, with emails containing links to malicious Dropbox URLs. However, the latest WannaCry ransomware campaign leverages a vulnerability in Server Message Block 1.0 (SMBv1). The exploit for the vulnerability – known as ETERNALBLUE – has been packaged with a self-replicating payload which can spread rapidly to all networked devices. The vulnerability is not a new zero day however. In fact, Microsoft patched the vulnerability in its MS17-010 security bulletin almost two months ago. The problem is many organizations have not installed the update and are vulnerable to attack.

The ETERNALBLUE exploit was reportedly stolen from the National Security Agency by Shadow Brokers, a cybercriminal gang with links to Russia. ETERNALBLUE was allegedly developed as a hacking weapon to gain access to Windows computers used by enemy states and terrorists. Shadow Brokers managed to steal the tool and published the exploit online in mid-April. While it is not known whether Shadows Brokers is behind the attack, the publication of the exploit allowed the attacks to take place.

The exploit allows the attackers to drop files on a vulnerable system, with that file then executed as a service. The dropped file then downloads WannaCry ransomware, which searches for other available networked devices. The infection spreads before files are encrypted. Any unpatched device with port 445 open is vulnerable.

The WannaCry ransomware campaign would have resulted in far more infections had it not been for the actions of a security researcher in the UK. The researcher –@MalwareTechBlog – found a kill switch to prevent encryption. The ransomware attempts to communicate with a specific domain. If communication is possible, the ransomware does not proceed with encryption. If the domain cannot be contacted, files are encrypted.

@MalwareTechBlog discovered the reference to the nonsense domain, saw that it was unregistered and bought it. By doing so, the ransomware attack was thwarted. The domain checking mechanism was presumably added to prevent the ransomware from running in a sandbox environment.

However, a new version of the ransomware without the kill switch has reportedly already been released, which could see the victim count increase substantially over the next few days. Organizations that have not applied Microsoft’s patch are advised to do so as a priority to block the attack.

The massive ransomware attack should serve as reminder to all organizations of the importance of applying patches promptly. That will be a particularly painful reminder for many organizations that fell victim to this preventable ransomware attack.

Fatboy Ransomware – A New RaaS That Sets Ransoms by Location

A new email-borne threat has recently been discovered. Fatboy ransomware is a new ransomware-as-a-service (RaaS) being offered on darknet forums in Russia. The RaaS offers would-be cybercriminals the opportunity to conduct ransomware campaigns without having to develop their own malicious code.

RaaS has proven incredibly popular. By offering RaaS, malicious code authors can infect more end users by increasing the number of individuals distributing the ransomware.  In the case of Fatboy ransomware, the code author is offering limited partnerships and is dealing with affiliates directly via the instant messaging platform Jabber.

Fatboy ransomware encrypts files using AES-256, generating an individual key for the files and then encrypting those keys using RSA-2048. A separate bitcoin wallet is used for each client and a promise is made to transfer funds to the affiliates as soon as the money is paid. By offering to deal directly with the affiliates, being transparent about the RaaS and offering support, it is thought that the code author is trying to earn trust and maximize the appeal of the service.

Further, the ransomware interface has been translated into 12 languages, allowing campaigns to be conducted in many countries around the world. Many RaaS offerings are limited geographically by language.

Fatboy ransomware also has an interesting new feature that is intended to maximize the chance of the victim paying the ransom demand. This RaaS allows attackers to set the ransom payment automatically based on the victim’s location. In locations with a high standard of living, the ransom payment will be higher and vice versa.

To determine the cost of living, Fatboy ransomware uses the Big Mac Index. The Big Mac Index was developed by The Economist as a method of determining whether currencies were at their correct values. If all currencies are at their correct value, the cost of a product in each country should be the same. The product chosen was a Big Mac. In short, the higher the cost of a Big Mac in the victim’s country, the higher the ransom demand will be.

So far, Recorded Future – the firm that discovered the ransomware variant – says the code author has generated around $5,000 in ransom payments since February. That total is likely to rise considerably as more affiliates come on board and more end users are infected. There is no known decryptor for Fatboy ransomware at this time.

New ransomware variants are constantly being developed and RaaS allows many more individuals to conduct ransomware campaigns. Unsurprisingly, the number of ransomware attacks has grown.

The cost of resolving a ransomware infection can be considerable. Businesses therefore need to ensure they have defenses in place to block attacks and ensure they can recover fast.

Backups need to be made regularly to ensure files can be easily recovered. Staff need to be trained on security best practices to prevent them inadvertently installing ransomware. Antispam solutions should also be implemented to prevent malicious emails from reaching end users’ inboxes. Fortunately, even with a predicted increase in ransomware attacks, businesses can effectively mitigate risk if appropriate defenses are implemented.

For advice on security solutions that can block ransomware attacks, contact the TitanHQ team today.

IC3 Issues Warning About Business Email Compromise Scams

The Internet Crime Complaint Center (IC3) has issued a new alert to businesses warning of the risk of business email compromise scams.

The businesses most at risk are those that deal with international suppliers as well as those that frequently perform wire transfers. However, businesses that only issue checks instead of sending wire transfers are also at risk of this type of cyberattack.

In contrast to phishing scams where the attacker makes emails appear as if they have come from within the company by spoofing an email address, business email compromise scams require a corporate email account to be accessed by the attackers.

Once access to an email account is gained, the attacker crafts an email and sends it to an individual responsible for making wire transfers, issuing other payments, or an individual that has access to employees PII/W-2 forms and requests a bank transfer or sensitive data.

The attackers often copy the format of emails previously sent to the billing/accounts department. This information can easily be gained from the compromised email account. They are also able to easily identify the person within the company who should be sent the request.

Not all business email compromise scams are concerned with fraudulent bank transfers. IC3 warns that the same scam is also used to obtain the W-2 tax statements of employees, as has been seen on numerous occasions during this year’s tax season.

Phishing scams are often sent out randomly in the hope that some individuals click on malicious links or open infected email attachments. However, business email compromise scams involve considerable research on the company to select victims and to identify appropriate protocols used by the company to make transfer requests.

Business email compromise scams often start with phishing emails. Phishing is used to get end users to reveal their login credentials or other sensitive information that can be used to gain access to business networks and perform the scam. Malware can also be used for this purpose. Emails are sent with links to malicious websites or with infected email attachments. Opening the attachments or clicking on the links downloads malware capable of logging keystrokes or provides the attackers with a foothold in the network.

IC3 warns that business email compromise scams are a major threat for all businesses, regardless of their size. Just because your business is small, it doesn’t mean that you face a low risk of attack.

Between January 2015 and December 2016, IC3 notes there was a 2,370% increase in BEC scams. While funds are most commonly sent to bank accounts in China and Hong Kong, IC3 says transfers have been made to 103 countries in the past two years.

The losses reported by businesses are staggering. Between October 2013 and December 2016, more than $5 billion has been obtained by cybercriminals. United States businesses have lost $1,594,503,669 in more than 22,000 successful scams. The average loss is $71,528.

IC3 lists the five most common types of business email compromise scams as:

  1. Businesses receiving requests from frequently used suppliers requesting transfers be made to a new bank account.This is also known as a bogus invoice scam.
  2. An executive within the company (CFO or CTO for example) requests a transfer be made by a second employee in the company. This is also known as a business executive scam.
  3. A compromised email account is used to send a payment request/invoice to a vendor in the employees contact list.
  4. The attackers impersonate an attorney used by the firm and request the transfer of funds. These scams are common at the end of the week or end of the business day. They are also known as Friday afternoon scams.
  5. A request is sent from a compromised email account to a member of the HR department requesting information on employees such as W-2 Forms or PII. These scams are most common during tax season.

There are a number of strategies that can be adopted to prevent business email compromise attacks from being successful.

IC3 recommends:

  • Using a domain-based email account rather than a web-based account for business email accounts
  • Exercising caution about the information posted to social media accounts. This is where the attackers do much of their research
  • Implement a two-step verification process to validate all transfer requests
  • Use two-factor authentication for corporate email accounts
  • Never respond to an email using the reply option. Always use forward and type in the address manually
  • Register all domains that are similar to the main domain used by the company
  • Use intrusion detection systems and spam filters that quarantine or flag emails that have been sent with extensions similar to those used by the company – Blocking emails sent from xxx_company.com if the company uses xxx-company.com for example
  • Be wary of any request that seems out of the ordinary or requires a change to the bank account usually used for transfers

Millions Affected by Google Phishing Scam

A Google phishing scam has been spreading like wildfire over the past couple of days. Emails have been sent in the millions inviting people to edit Google Docs files. The emails appear to have been sent by known individuals, increasing the likelihood of the messages being opened and the links being clicked.

In contrast to many email scams that include a link to a spoofed website, this scam directs the recipient to Google Docs. When the user arrives at the site they will be presented with a legitimate Google sign-in screen.

The Google phishing scam works within the Google platform, taking advantage of the fact that individuals can create a third-party app and give it a misleading name. In this case, the app has been named ‘Google Docs.’

This makes it appear that Google Docs is asking for permission to read, send, delete, and manage emails and access the user’s contacts. However, it is the creator of the app that is asking to be granted those permissions. If users check the developer name, they will see that all is not as it seems. Many individuals will not check, since the permission screen also includes Google logos.

Signing in will give the attacker access to the user’s Google account, including their emails, Google Docs files, and contact list. Further, signing in on the website will also result in the victim’s contact list being sent similar invitations. Unsurprisingly, many have fallen for the Google phishing scam and countless emails are still circulating.

The scam appears to have started at some point on Wednesday. Google has now issued an official statement saying it is taking action to protect users and has disabled the accounts that are being used to conduct the scam.

Google confirmed the actions it has taken in response to the phishing scam, saying “We’ve removed the fake pages, pushed updates through Safe Browsing, and our abuse team is working to prevent this kind of spoofing from happening again. We encourage users to report phishing emails in Gmail.”

Anyone who receives a request to edit a Google Doc should treat the request with suspicion, even if it has been sent from someone known to the recipient.

If you think you may have fallen for this phishing scam it is likely that emails will already have been generated and sent to your contacts. However, you can take action to block the threat by revoking the access rights you have given to the app through the Connected Apps and Sites page.

The Google phishing scam is highly convincing and clearly shows how sophisticated cybercriminals are getting in their attempts to gain access to sensitive information and why it is imperative that email users be permanently on their guard.

Does GDPR Apply to American Companies?

The General Data Protection Regulation (GDPR) is a new data privacy and security law in Europe that comes into force next year, but does GDPR apply to American companies?

As many U.S. companies have recently discovered, not only does GDPR apply to American companies, doing business within the EU will not be possible if companies fail to comply with the regulation.

How Does GDPR Apply to American Companies?

The main purpose of GDPR is to give EU citizens greater control over how their personal data is collected, protected and used. While the legislation applies to EU companies, it also applies to any company that chooses to do business in the EU. That includes any online business that own a website that is accessible by EU citizens, if that website collects user data. Since the definition of personal information has also been expanded to include online identifiers such as cookies, GDPR has implications for huge numbers of U.S businesses. To continue to do business in the EU, most companies will have to implement additional privacy protections and end-to-end data protection strategies.

A recent survey conducted by PricewaterhouseCoopers on large multinational companies in the United States shows efforts are already underway to ensure compliance with the EU regulation. More than half of surveyed firms said GDPR is now their main data protection priority, with 92% saying compliance with GDPR is a top priority this year. The cost of compliance is considerable. 77% of surveyed firms said they are planning to spend more than $1 million on GDPR compliance, with one of the main spending priorities being improving their information security defenses.

As PwC’s Jay Cline explained, non-compliance with GDPR is simply not an option. “Businesses that do not comply with GDPR face a potential 4% fine of global revenues, increasing the need to successfully navigate how to plan for and implement the necessary changes.”

Further information on GDPR can be viewed on this link: https://www.spamtitan.com/general-data-protection-regulation/

Law Firm Ransomware Attack Locks Data for Three Months

A law firm ransomware attack has resulted in business files being left encrypted and inaccessible for three months, causing considerable billing losses for the firm.

Why did the law firm not simply pay the ransom demand to regain access to their files? Well, they did. Unfortunately, the attackers took the money and did not supply viable keys to unlock the encrypted files. Instead, they had a much better idea. To issue another ransom demand to try to extort even more money from the law firm.

The law firm, Providence, RI- based Moses Afonso Ryan Ltd, was forced to negotiate with the attackers to gain access to its data. It took more than three months and ransomware payments of $25,000 to finally regain access to its files. However, the ransomware payment represented only a tiny proportion of the cost of the attack. During the three months that data were locked, the firm’s lawyers struggled to work.

Moses Afonso Ryan made a claim against its insurance policy for lost billings as a result of the attack; however, the insurer, Sentinel Insurance Co., has refused to pay the bill. The law firm claims to have lost $700,000 as a result of the attack in lost billings alone. The firm has recently filed a U.S. District Court lawsuit against its insurer claiming breach of contract and bad faith for denying the claim.

The law firm ransomware attack involved a single phishing email being opened by one of the firms’ lawyers. That email has so far cost the firm more than $725,000 and the losses will continue to rise.

Important lessons can be learned from this law firm ransomware attack. First, the importance of training all staff members on the risk of ransomware attacks and teaching security best practices to reduce the risk of attacks being successful.

Since phishing emails are now highly sophisticated and difficult to identify, technical solutions should be implemented to prevent emails from reaching employees’ inboxes. Endpoint protection systems can reduce the risk of ransomware being installed and can detect infections rapidly, limiting the damage caused.

All businesses should take care to segment their networks to ensure that a ransomware infection on a single computer does not result in an entire network being impacted.

It is also essential for backups to be performed regularly and for those backups to be tested to ensure data can be recovered. This law firm cyberattack clearly demonstrated that organizations cannot rely on attackers making good on their promise to unlock data if the ransom is paid.

There have been cases where the attackers have not been able to supply a functional key to unlock data, and numerous examples of attackers issuing further ransom demands in an attempt to extort even more money out of companies.

Web-Based Attacks Fall: Ransomware Attacks on Businesses Soar

There was some good news in the latest installment of the Symantec Internet Security Threat Report. Web-based attacks have fallen year on year, but ransomware attacks on businesses have sky rocketed. Sabotage and subversion attacks have also risen sharply in the past 12 months.

The Internet Security Threat Report shows that exploit kit and other web-based attacks fell by 30% in 2016, but over the same period, ransomware attacks on businesses increased by 36%.

Ransomware has proved popular with cybercriminals as attacks are easy to perform and money can be made quickly. If an attacker succeeds in encrypting business data, a ransom must be paid within a few days. In the United States, where the majority of ransomware attacks occur, 64% of businesses pay the ransom.

Web-based attacks on the other hand typically take longer and require considerably more technical skill. Cybercriminals must create and host a malicious site and direct end users to the site. Once malware has been downloaded, the attackers must move laterally within the network and find and exfiltrate sensitive data. The data must then be sold.

Ransomware attacks on businesses are far easier to conduct, especially using ransomware-as-a-service. All that is required is for criminals to pay to rent the ransomware, set their own terms, and distribute the malware via spam email. Many ransomware authors even provide kits with instructions on how to customize the ransomware and conduct campaigns. The appeal of ransomware is clear. It is quick, easy and profitable to conduct attacks.

The Symantec Internet Security Threat Report charts the rise in popularity of ransomware. Symantec detected 101 separate ransomware families in 2016. In 2014 and 2015 the count was just 30. Symantec’s ransomware detections increased from 340,665 in 2015 to 463,841 in 2016. Ransomware as a service has played a major role in the increase in attacks.

Ransom demands have also increased in the past year. In 2015, the average ransom demand was $294 per infected device. In 2016, the average ransomware demand had increased to $1,077.

Fortunately, good data backup policies will ensure businesses do not have to pay to unlock their data. Unfortunately, even if data can be recovered from backups, ransomware attacks on businesses are costly to resolve. Cybersecurity firms need to be hired to conduct analyses of networks to ensure all traces of ransomware (and other malware) have been removed. Those firms must also check to make sure no backdoors have been installed.

Ransomware attacks on businesses typically see computers locked for several days, causing considerable loss of revenue for companies. Customer breach notifications may also need to be issued. Ransomware attacks can cost tens or hundreds of thousands of dollars to resolve, even if no ransom is paid.

Since ransomware is primarily distributed via spam email, businesses need to ensure they have appropriate email defenses in place. An advanced spam filter with an anti-phishing component is essential, along with other endpoint protection systems.

Symantec’s figures show that spam email volume has remained constant year on year, with spam accounting for 53% of email volume in 2016.

In 2016, one in 2,596 emails involved a phishing component, down from one in 965 in 2014. Phishing attacks may be down, but malware attacks increased over the same period.

Malware-infected email attachments and malicious links to malware-infected websites accounted for one in every 131 emails in 2016, up from 1 in 220 in 2015 and 1 in 244 in 2014. In 2016, 357 million new malware variants were detected, up from 275 million in 2014.

The decline in web-based attacks is certainly good news, but it doesn’t mean the threat can be ignored. Last year there were 229,000 web-based attacks tracked by Symantec. While that is a considerable decrease from the previous year, web-based attacks still pose a significant threat to businesses.

Web-based attacks could also increase this year. The Symantec Internet Security Threat Report indicates 9% of websites have critical bugs that could be easily exploited by cybercriminals allowing them to hijack the websites. Worryingly, Symantec reports that 76% of websites contain bugs that could potentially be exploited.

The Symantec Internet Security Threat Report shows data breaches have remained fairly constant over the past two years. In 2014, widely reported to be ‘the year of the data breach’, Symantec recorded 1,523 data breaches. The following year that fell to 1,211 breaches. Last year, there was little change, with 1,209 breaches reported.

The halt in the rise in data breaches suggests organizations are getting better at protecting their networks and data. However, large data breaches are increasing. Last year there were 15 data breaches that involved the theft of more than 10 million records, up from 11 in 2014.

Protecting against data breaches and cyberattacks requires comprehensive, multi-layered security defenses. TitanHQ offers a range of cybersecurity solutions for SMEs to help them improve their security posture and protect against web-based and email-based security threats.

For more information on how you can improve your security posture, contact the TitanHQ team today.

Phishing Attacks on Schools Spike – Is Your School Doing Enough to Prevent Attacks?

In the United States, phishing attacks on schools and higher education institutions have soared in recent months, highlighting the need for improvements to be made to staff education programs and cybersecurity defenses.

Phishing refers to the practice of sending emails in an attempt to get the recipients to reveal sensitive information such as logins to email accounts, bank accounts, or other computer systems.  Typically, a link is included in the email which will direct the user to a website where information must be entered. The sites, as well as the emails, contain information to make the request look genuine.

Phishing is nothing new. It has been around since the 1980’s, but the extent to which sensitive information is stored electronically and the number of transactions that are now conducted online has made attacks much more profitable for cybercriminals. Consequently, attacks have increased. The quality of phishing emails has also improved immeasurably. Phishing emails are now becoming much harder to identify, especially by non-technical members of staff.

No organization is immune to attack, but attackers are no longer concentrating on financial institutions and healthcare organizations. The education sector is now being extensively targeted. Phishing attacks on schools are being conducted far more frequently, and all too often those attacks are succeeding.

Such is the scale of the problem that the IRS recently issued a warning following a massive rise in phishing attacks on schools. Campaigns were being conducted by attackers looking for W-2 Form data of school employees. That information was then used to submit fraudulent tax returns in school employees’ names.

Recent Phishing Attacks on Schools, Colleges, and Universities

Westminster College is one of the latest educational institutions to report that an employee has fallen for the W-2 Form phishing scam, although it numbers in dozens of schools, colleges and universities that have been attacked this year.

Phishing emails are not only concerned with obtaining tax information. Recently, a phishing attack on Denver Public Schools gave the attackers the information they needed to make a fraudulent bank transfer. More than $40,000 intended to pay staff wages was transferred to the criminal’s account.

This week, news emerged of a listing on a darknet noticeboard from a hacker who had gained access to school email accounts, teacher’s gradebooks, and the personal information of thousands of students. That individual was looking for advice on what to do with the data and access in order to make money.

Washington University School of Medicine was targeted in a phishing attack that saw the attackers gain access to patient health information. More than 80,000 patients potentially had their health information stolen as a result of that attack.

Last week, news emerged of an attempted phishing attack on Minnesota schools, with 335 state school districts and around 170 charter schools potentially attacked. In that case, the phishing attack was identified before any information was released. The attack involved an email that appeared to have been sent from the Education Commissioner. The attackers were trying to gain access to financial information.

How to Improve Defenses Against Phishing Attacks

Fortunately, there are a number of technological controls that can be implemented cheaply to reduce the risk of phishing attacks on schools being successful.

An advanced spam filtering solution with a powerful anti-phishing component is now essential. A spam filter looks for the common spam and phishing signatures and ensures suspect messages are quarantined and not delivered to end users.

It must be assumed that occasionally, even with a spam filter, phishing emails may occasionally be delivered. To prevent employees from visiting phishing websites and revealing their information, a web filtering solution can be used. Web filters can be configured to block end users from visiting websites that are known to be used for phishing. As an additional benefit, web filters can stop individuals from accessing websites known to contain malware or host illegal or undesirable material – pornography for instance.

Those solutions should be accompanied by training for all staff members on the risk from phishing and the common identifiers that can help staff spot a phishing email. Schools should also implement policies for reporting threats to the organization’s IT department. Fast reporting can limit the harm caused and prevent other staff members from responding.

IT departments should also have policies in place to ensure thwarted attacks are reported to law enforcement. Warnings should also be sent to other school districts following an attack to allow them to take action to protect themselves against similar attacks.

Any school or higher educational institution that fails to implement appropriate defenses against phishing attacks will be at a high risk of a phishing attack being successful. Not only do phishing attacks place employees at risk of fraud, they can prove incredibly costly for schools to mitigate. With budgets already tight, most schools can simply not afford to cover those costs.

If you would like further information on the range of cybersecurity protections that can be put in place to prevent phishing attacks on schools and other educational institutions, call TitanHQ today for an informal chat.

Microsoft Patches Actively Exploited Zero-Day Vulnerability in Microsoft Word

Microsoft has finally patched a zero-day vulnerability in Microsoft Word that has been exploited by cybercriminals for months. Recently, the vulnerability has been exploited by the gang behind the Dridex banking Trojan.

The remote code execution vulnerability (CVE-2017-0199) affects the Windows Object Linking and Embedding (OLE) application programming interface. The vulnerability is a logic flaw rather than a programming error, which makes defending against attacks difficult.

The bug affects RTF files. The spam email campaigns use RTF files containing an embedded OLE2Link object, which downloads an HTA (HTML Application) file containing malicious code when the document is opened. No user interaction other than opening the file is required to infect the end user’s device.

There is some debate as to how long the vulnerability has been actively exploited in the wild. Attacks may have been occurring as early as November 2016 according to SophosLabs, although certainly since the start of 2017. Over the past two months, the vulnerability has been extensively exploited to deliver the Dridex banking Trojan.

The zero-day vulnerability in Microsoft Word has been exploited for espionage purposes in Russian speaking countries, while FireEye observed the exploit being used to distribute Latentbot malware. Latentbot is an information stealer with the ability to corrupt hard drives.

Many security companies have been tracking the vulnerability, although it was McAfee that announced the existence of the actively exploited flaw on Friday last week. The flaw exists in virtually all Microsoft Word versions and does not require macros to be enabled in order for malicious code to run.

Employees are advised never to enable macros on documents unless they are 100% certain that a document is legitimate; however, this zero-day exploit does not rely on macros. Simply opening the Word document on an unpatched Office installation is likely to result in infection.

This makes the vulnerability particularly dangerous. Any end user that opens a specially crafted Word document would automatically run the code which would see the Dridex Trojan (or another malware) downloaded. One protection that can prevent the malicious code from running is to enable Protected View mode. However, the code will run when Protected View is turned off.

The malicious emails sent out in at least one campaign have the subject line “scanned data” with the RFT file attachments containing the word ‘scan’ followed by a random string of numbers, according to Proofpoint.

To protect against this exploit, the patches for both Office and Windows that were released by Microsoft on Tuesday April 11, 2017 should be applied. However, in order to apply the security update, Service Pack 2 for Office 2010 must be installed.

If it is not possible to apply the Microsoft updates immediately, you can configure your spam filter to block RTF files or add RTF files to the list of documents to block in the Microsoft Office Trust Center.

2017 IBM X-Force Threat Intelligence Index Provides Insight into Cyberattack Trends

The 2017 IBM X-Force Threat Intelligence Index has been released this week. The report provides an insight into the main cybersecurity threats faced by all industries and major cyberattack trends, data breaches and security incidents experienced by U.S. organizations in 2016.

Last year’s IBM X-Force Threat Intelligence Index showed healthcare was the industry most heavily targeted by cybercriminals. However, the 2017 IBM X-Force Threat Intelligence Index shows cybercriminals changed their focus in 2016. Last year, the financial services was hit the hardest. The healthcare dropped down to fifth place.

The healthcare industry did not suffer mega data breaches of the same scale as 2015 – which saw a 78.8 million-record cyberattack on Anthem Inc., and 10 million record+ data breaches at Premera Blue Cross and Excellus BlueCross BlueShield. However, there were security breaches aplenty. 2016 was the worst ever year for healthcare industry breaches, with more incidents reported than any other year in history.

Those breaches resulted in far fewer records being exposed or stolen. The 2017 IBM X-Force Threat Intelligence Index indicates there was an 88% drop in exposed or stolen healthcare records in 2016 compared to the previous year. Around 12 million healthcare records were exposed or stolen in 2016.

The 2017 IBM X-Force Threat Intelligence Index also shows that there was a shift in the nature of attacks, with cybercriminals targeting unstructured data rather than structured data. Data breaches involving email archives, intellectual property, and business documents all rose in 2016.

The healthcare industry may not have seen so many records exposed, but that was certainly not the case across all industry sectors. 2016 was a very bad year for cyberattacks. In 2015, around 600 million records were exposed or stolen. In 2016 the total jumped to an incredible 4 million records, helped in no small part by the 1.5 billion record breach at Yahoo and the discovery of massive data breaches at LinkedIn, MySpace, and Dropbox. It is therefore no surprise that IBM called 2016 The Year of the Mega Data Breach.

Top of the list of attacked industries in 2016 was financial services. Both the financial services and healthcare sectors saw a fall in attacks by outsiders, but attacks by malicious insiders and inadvertent actors increased in both industry sectors.

In the financial services, 5% of attacks involved malicious insiders and 53% involved inadvertent actors. In healthcare, 25% of attacks involved malicious insiders and 46% involved inadvertent actors. The financial services saw 42% of attacks conducted by outsiders. Healthcare cyberattacks by outsiders accounted for 29% of the annual total.

According to the 2017 IBM X-Force Threat Intelligence Index, the second most targeted industry was information and communications, followed by manufacturing and retail. All three industries saw increases in attacks by outsiders, which accounted for the vast majority of attacks. 96% of attacks on information and communications were by outsiders, with 91% apiece for manufacturing and retail.

The financial services sector saw a substantial rise in SQLi and OS CMDi attacks in 2016 – The most common attack method for the industry. The main attack method on the information and communications sector involved exploitation of vulnerabilities allowing attackers to trigger buffer overflow conditions. The main attack method on the manufacturing, retail and healthcare industries was also SQLi and OS CMDi attacks, which accounted for 71% of manufacturing industry cyberattacks, 50% of retail cyberattacks, and 48% of healthcare cyberattacks.

The 2017 IBM X-Force Threat Intelligence Index indicates cybercriminals favored older attack methods in 2016 such as ransomware, malware toolkits, and command injection to gain access to valuable data and resources.

Ransomware was big news in 2016. Many cybercriminals turned to ransomware as a quick and easy source of income. Figures from the FBI indicate $209 million in ransom payments were made in the first three months of 2016 alone.

Malware was also extensively used in attacks, with Android malware and banking Trojans big in 2016. Not all attacks targeted organizations for their data. DDoS attacks increased, both in frequency and severity. While attacks of 300+ Mbps were unusual in 2015, they became the norm in 2016. One attack in excess of 1 Tbps was reported.

While 2015 saw exploit kits extensively used to infect endpoints with malware, in 2016 spam email was favored. Spam was a primary attack tool of cybercriminals, especially in the second half of the year. While the first half of the year saw spam email volume remain steady, the 2017 IBM X-Force Threat Intelligence Index indicates there was a significant increase in spam volume in the second half of the year and a massive rise in the number of malicious email attachments.

The 2017 IBM X-Force Threat Intelligence Index shows the vast majority of malicious attachments were ransomware or ransomware downloaders, which accounted for 85% of malicious email attachments.

The increase in the use of spam email as an attack vector shows how important it is for organizations to improve their defenses against email attacks. An advanced spam filter is essential as is training of employees on security best practices and phishing attack prevention.

Exploit Kit Activity has Declined, but Spamming Activity Has Increased

Figures from Trustwave show there has been a steady decline in exploit kit activity over the past year. Exploit kits were once one of the biggest cybersecurity threats. In late 2015 and early 2016 exploit kits were being extensively used to spread ransomware and malware. Now exploit kit activity has virtually dropped to nothing.

Exploit kits are toolkits that are loaded onto malicious or hijacked websites that probe for vulnerabilities in browsers and plugins such as Adobe Flash Player and Java. When a new zero-day vulnerability was discovered, it would rapidly be added to exploit kits and used to silently download ransomware and malware onto web visitors’ computers. Any individuals that had failed to keep their browsers and plugins up to date would be at risk of being infected. All that would be required was make them – or fool them- into visiting a malicious website.

Links were sent via spam email, malvertising was used to redirect web visitors and websites were hacked and hijacked.  However, the effort required to develop exploits for vulnerabilities and host exploit kits was considerable. The potential rewards made the effort more than worthwhile.

Exploit kits such as Angler, Magnitude and Neutrino no longer pose such a big threat. The actors behind the Angler exploit kit, which was used to spread Locky ransomware in early 2016, were arrested. Law enforcement agencies across the world have also targeted gangs running these exploit kits. Today, exploit kit activity has not stopped entirely, but it is nowhere near the level seen in the first half of 2016.

While this is certainly good news, it does not mean that the threat level has reduced. Ransomware and malware are still major threats, all that has happened is cybercriminals have changed tactics for distributing the malicious programs. Exploit kits are not dead and buried. There has just been a lull in activity. New exploit kits are undoubtedly being developed. For the time being, exploit kit activity remains at a low level.

Now, the biggest threat comes from malicious spam email messages. Locky and other ransomware variants are now almost exclusively spread via spam email messages. Cybercriminals are also developing more sophisticated methods to bypass security controls, trick end users into opening infected email attachments, and improve infection rates.

Much greater effort is now being put into developing convincing phishing and spear phishing emails, while spam emails are combined with a wide range of social engineering tricks to get end users to open infected email attachments. End users are more knowledgeable and know not to click on suspicious email attachments such as executable files; however, malicious Word documents are another matter. Office documents are now extensively used to fool end users into installing malware.

With cybercriminals now favoring spam and phishing emails to spread malware and ransomware, businesses need to ensure their spam defenses are up to scratch. Employees should continue to be trained on cybersecurity, the latest email threats should be communicated to staff and advanced spam filters should be deployed to prevent messages from being delivered to end users.

DoubleAgent Malware Could Hijack Antivirus Software

Security researchers in Israel have developed a proof-of-concept exploit called DoubleAgent that takes advantage of vulnerabilities in antivirus products to turn them against users. The exploit could potentially be incorporated into DoubleAgent malware, although there have been no known attacks that take advantage of the flaws in AV products to the researchers’ knowledge.

The proof-of-concept was developed by Cybellum researchers, who say that most third-party Windows antivirus products are susceptible and could potentially be hijacked. To date only three AV companies have confirmed that they are developing patches to block potential DoubleAgent malware attacks – AVG, Trend Micro and Malwarebytes.

The attack involves the Microsoft Application Verifier, which is used to check for bugs in programs that run on Windows. The researchers use DLL hijack techniques to fool the verifier using a malicious DLL. They claim the technique could be used to insert a custom verifier into any application.

DoubleAgent malware may not yet have been developed to exploit the zero-day vulnerability, although the researchers say they have used their proof-of-concept to take full control of the Norton Security AV program – many other AV products are also susceptible to this type of attack.

The Cybellum-developed DoubleAgent malware could be used in a number of different attack scenarios, all of which are particularly chilling.

Since the antivirus program can be pwned by an attacker, it could be turned on the user and used as malware. Antivirus software is trusted, so any actions taken by the AV program would be treated as legitimate. The researchers warn that the AV program could be turned into a double agent and do anything the attackers wanted.

The AV solution could be instructed to whitelist certain other programs allowing an attacker to install any malware undetected. Once installed, the malware would run totally undetected and the user would be unaware that their AV software had been rendered virtually useless. The AV software would also be prevented from flagging data exfiltration or communications with the attacker’s C&C.

An attacker could cripple a company’s applications using the DoubleAgent malware. If a legitimate program used by the company is marked as malicious by its antivirus software program, it would be prevented from running. It would therefore be possible to perform Denial of Service attacks. Also, since AV software has the highest level of privileges, it could be used to perform any number of malicious actions, such as deleting data or formatting a hard drive. That means a ransomware-style attack could be performed or the company’s computer systems could be sabotaged.

Fortunately, only Cybellum has the code and AV companies that have been found to be susceptible to such an attack have been notified. Patches are therefore likely to be developed to prevent such an attack.