sb-nz logo
Story image

Ransomware modifications double year-on-year in Q2 2019 - Kaspersky

26 Aug 2019

Kaspersky researchers detected 16,017 new ransomware modifications in Q2 2019 – including ones belonging to eight new malware families.

This is more than double the number of new samples detected a year ago, in Q2 2018 (7,620).

The Kaspersky IT Threat Evolution Q2 2019 report also highlights that more than 230,000 users were attacked during the quarter, along with other key findings.

A Trojan-Ransom can be equally successful in both private and corporate attacks, as its functionality is simple yet highly effective.

These Trojans encrypt files on a user’s computer and demand a ransom for the files to be released. The increase in malicious modifications and the appearance of new families is a dangerous sign that criminal activity is intensifying, with new malware versions emerging.

The second quarter of the year experienced a high number of infection attempts.

According to Kaspersky data, 232,292 unique users were targeted by such attacks – 46% more than a year ago, in Q2 2018 (158,921).

The countries with the largest share of attacked users were Bangladesh (9%), Uzbekistan (6%) and Mozambique (4%).

The ransomware family that attacked users most often in Q2 2019 (23.4% cases) was still WannaCry. Even though Microsoft released a patch for its operating system to close the vulnerability exploited by the ransomware two months prior to the start of the widespread and destructive attacks two years ago, it still remains in the wild.

Another major actor was Gandcrab with 13.8% share, despite its creators announcing that GandCrab wasn’t going to be distributed from the second half of the quarter.

Kaspersky security researcher Fedor Sinitsyn says, “In this quarter we observed an increase in the number of new ransomware modifications, even though the Gandcrab family closed down in early June. The GandCrab ransomware family has long been one of the most popular cryptors amongst cybercriminals.

“For more than 18 months it has stayed in the list of the most rampant ransomware families we detect, but even its decline did not lower the statistics, as there are still other numerous widespread Trojans.

Sinitsyn adds, “The GandCrab case is a good illustration of how effective ransomware can be, with its creators stopping their malicious activity after claiming they made a tremendous amount of money by extorting funds from their victims.

“We expect new actors to replace GandCrab and urge everyone to protect their devices by installing software updates regularly and choosing a reliable security solution.”

To reduce the risk of infection, Kaspersky advises private users to:

  • Always update your operating system to eliminate recent vulnerabilities and use a robust security solution with updated databases
  • Not pay the ransom if you find your files have been encrypted with cryptomalware. This will only encourage cybercriminals to continue and infect more people’s devices. It is better to find a decryptor on the internet – some are available for free.
  • Always have fresh backup copies of your files, so you can replace them in case they are lost (e.g. due to malware or a broken device) and store them not only on the device but also in cloud storage for greater reliability.

Other report findings include:

  • Kaspersky detected and repelled 717,057,912 malicious attacks from online resources located in around 200 countries and territories around the world (26% decrease compared to Q2 2018)
  • Attempted malware infections that aim to steal money via online access to bank accounts were registered on 228,206 user computers (six percent growth compared to Q2 2018)
  • Kaspersky’s antivirus file detected a total of 240,754,063 unique malicious and potentially unwanted objects (25% growth compared to Q2 2018)

Kaspersky mobile security products also detected 753,550 malicious installation packages (57% decrease compared to Q2 2018)

Story image
Top security threats for 2021
2021 will see several themes develop into full blown security threats, many of them borne from the struggles of pandemic-stricken 2020, writes Wontok head of technology Mick Esber.More
Story image
SASE vs zero trust – or the best of both worlds
Zero trust and SASE work together by converging a least-privilege access strategy with an architecture that simplifies how highly distributed users, BYOD, and cloud resources are secured.More
Story image
Cybersecurity spending to increase following SolarWinds hacking
Hackers breached software provider SolarWinds, directly infecting the company’s Orion software as well as several local, state and federal agencies.More
Story image
Hornetsecurity acquires Altaro, the latest in acquisition spree
The move is a culmination of a medley of acquisitions made by Hornetsecurity recently, following the January 2019 acquisition of Spamina, a Spanish cloud email security company, as well as EveryCloud, its British market partner, in early 2020.More
Story image
The current state of ransomware — and its future
Discoveries made by analysts at Sophos have unearthed a new development: ransomware code appears to have been shared across ‘families’, and some of the ransomware groups seemed to work in collaboration more than in competition with one another. More
Story image
UPDATED: RBNZ ascribes data breach to third-party file sharing service
“The nature and extent of information that has been potentially accessed is still being determined, but it may include some commercially and personally sensitive information,” says RBNZ Governor.More