Story image

Cryptomining attacks to gain prevalence in H2 2018 – WatchGuard report

02 Jul 18

Threat intelligence from Q1 2018 has found that 98.8% of seemingly common Linux/Downloader malware variants were actually designed to deliver a popular Linux-based cryptocurrency miner.

This is according to network security solutions provider WatchGuard Technologies’ latest Internet Security Report.  

This is just one of several signs that malicious cryptomining malware is becoming a top tactic among cyber criminals.

The complete report details delivery mechanisms for these cryptominer attacks and explores other prevalent security threats targeting small-to-medium businesses (SMBs) and distributed enterprises today.

“Our Threat Lab team has uncovered multiple indicators that suggest malicious cryptominers are becoming a mainstay in cyber criminals’ arsenals, and will continue to grow more dominant in Q2,” says WatchGuard Technologies chief technology officer Corey Nachreiner.

“While ransomware and other advanced threats are still a major concern, these new crypto-miner attacks illustrate that bad actors are constantly adjusting their tactics to find new ways to take advantage of their victims.

“Once again in Q1, we saw nearly half of all malware slip past basic signature-based antivirus solutions due to various obfuscation methods. One way every organisation can become more secure against these sophisticated, evasive threats is to deploy defences enabled with advanced malware prevention.”

WatchGuard’s Internet Security Report offers in-depth insights on the top cyber threats each quarter, along with defence recommendations SMBs can use to protect themselves.

The findings are based on data from tens of thousands of active Firebox UTM appliances around the world.

The top takeaways from the Q1 2018 report include:

  • Cryptocurrency miners are on the rise. Several cryptocurrency miners appeared for the first time in WatchGuard’s list of the top 25 malware variants. Firebox appliances have a rule called Linux/Downloader, which catches a variety of Linux “dropper” or “downloader” programs that download and run malware payloads. Usually, these droppers download a wide range of malware, but in Q1 2018, 98.8% of Linux/Downloader instances were trying to download the same popular Linux-based crypto miner. Evidence from Q2 so far indicates that crypto-mining malware will stay on WatchGuard’s top 25 list and may even crack the top 10 by the end of the quarter.
     
  • The Ramnit trojan makes a comeback in Italy. The only malware sample on WatchGuard’s top 10 list that hadn’t appeared in a past report was Ramnit, a trojan that first emerged in 2010 and had a brief resurgence in 2016. Nearly all (98.9%) of WatchGuard’s Ramnit detections came from Italy, indicating a targeted attack campaign. Since past versions of Ramnit have targeted banking credentials, WatchGuard advises Italians to take extra precautions with their banking information and enable multi-factor authentication for any financial accounts.
     
  • For the first time, APAC reports the highest malware volume. In past reports, APAC has trailed EMEA and AMER in the number of reported malware hits by a wide margin. In Q1 2018, APAC received the most malware overall. The vast majority of these attacks were Windows-based malware and 98% were aimed at India and Singapore.
     
  • Nearly half of all malware eludes basic antivirus (AV) solutions.  Zero-day malware (a term for malware that is able to evade traditional signature-based AV) accounted for 46% of all malware in Q1. This level of zero day-malware suggests that criminals are continuing to use obfuscation techniques to beat traditional AV services, emphasising the importance of behaviour-based defences.
     
  • Mimikatz targets the US, skips Asia Pacific. The Mimikatz Windows credential-stealing malware reappeared on WatchGuard’s top 10 malware list after several quarters of absence. Two-thirds of the detection of this malware were in the United States and under 0.1% of detections were in APAC, possibly due to the complexity of double-byte characters in countries like Japan that use a symbol-based language for passwords.

The complete Internet Security Report features a detailed breakdown of the record-breaking GitHub 1.35 Tbps DDoS attack, as well as analysis of the quarter’s top malware and network attacks, and key defence tactics for SMBs.

This quarter’s conclusions are based on anonymised Firebox Feed data from nearly 40,000 active WatchGuard UTM appliances worldwide, which blocked more than 23 million malware variants (628 per device) and over 10 million network attacks (278 per device) in Q1 2018.

Disruption in the supply chain: Why IT resilience is a collective responsibility
"A truly resilient organisation will invest in building strong relationships while the sun shines so they can draw on goodwill when it rains."
Verifi takes spot in Deloitte Asia Pacific Fast 500
"An increasing amount of companies captured by New Zealand’s Anti-Money laundering legislation are realising that an electronic identity verification solution can streamline their customer onboarding."
Businesses too slow on attack detection – CrowdStrike
The 2018 CrowdStrike Services Cyber Intrusion Casebook reveals IR strategies, lessons learned, and trends derived from more than 200 cases.
What disaster recovery will look like in 2019
“With nearly half of all businesses experiencing an unrecoverable data event in the last three years, current backup solutions are no longer fit for purpose."
Proofpoint launches feature to identify most targeted users
“One of the largest security industry misconceptions is that most cyberattacks target top executives and management.”
McAfee named Leader in Magic Quadrant an eighth time
The company has been once again named as a Leader in the Gartner Magic Quadrant for Security Information and Event Management.
Symantec and Fortinet partner for integration
The partnership will deliver essential security controls across endpoint, network, and cloud environments.
Is Supermicro innocent? 3rd party test finds no malicious hardware
One of the larger scandals within IT circles took place this year with Bloomberg firing shots at Supermicro - now Supermicro is firing back.