Categories
Security

2021 State of Malware Report finds cyberthreats more evolved than ever

Last year, threat actors took advantage of the COVID-19 public health crisis in ways previously unimaginable, not only seizing on confusion and fear during the initial months of the pandemic, but retooling attack methods, reneging on promises, strengthening malware, and extorting victims to the tune of $100 million — in short, in 2020, cyberthreats evolved.

That’s what the Malwarebytes Labs team discovered in the 2021 State of Malware Report, which offers a comprehensive analysis of consumer and business malware detections, trends, and attacks over the last year. The report includes in-depth coverage of the impact of COVID-19 on the threat landscape, cybercriminal attack methods, and their growing enterprise.

By April 2020, half the world’s population had been ordered to stay home, and IT teams found themselves scrambling to switch entire workforces to full-time remote work practically overnight. New security “perimeters” were strung together as best as possible, but they were soon penetrated by threat actors who had ditched their old tactics and placed a new emphasis on gathering intelligence. The report found:

  • In 2020, malware detections on Windows business computers decreased by 24 percent overall, likely due to improved targeting by cybercriminals and far fewer people working in offices.
  • However, malware detections on Mac business computers increased by 31 percent last year.
  • Detections for hack tools and rogue tools on Windows business computers increased dramatically — by 173 and 158 percent, respectively, in 2020.
  • Spyware also increased by 51 percent on business computers in 2020, with 440,368 detections.

What began as a global health crisis soon became a global economic crisis too, with almost no business left unscathed. The fate of industry sectors was mirrored in the number of cyberattacks they suffered. As the manufacturing and automotive sectors contracted, attackers simply turned to agriculture and other essential industries instead. Ransomware gangs reneged on early promises to stay away from hospitals and hit new lows, attacking hospitals and medical facilities in organized campaigns.

  • More traditional enterprise targets, such as education, healthcare/medical, and automotive all experienced drops in detections by varying degrees — education fell 17 percent, healthcare dropped 22 percent, and the automotive industry decreased by 18 percent.
  • But the agriculture industry suffered through a 607 percent increase in malware detections, while malware detections in the food and beverage industry increased by 67 percent.

Through it all, there is one form of business that seems to have thrived in 2020 — the creation and operation of malicious software. The pace of innovation picked up as many older variants debuted with fancy upgrades while other entirely new malware families emerged. Deployment of custom intrusion tools, new exploits, and the use of commercial pen testing tools allowed criminals to map out and infect networks faster than ever before. Ransomware gangs continued to learn from each other and evolve too, with a new “double extortion” tactic emerging, which saw cybercriminal groups extorting more money with threats to leak sensitive data than from decrypting compromised computers. According to the report:

  • Despite decreasing in frequency by 89 percent in 2020, Emotet morphed one last time to drop its infection chain into existing email threads and managed to compromise 250 Universal Health Services (UHS) hospitals with Ryuk ransomware.
  • TrickBot dropped by 68 percent on business endpoints, but upgraded its primary bot functionality, as well as its distribution framework, adding the ZeroLogon exploit to its arsenal.
  • The top Windows malware variants aimed at businesses in 2020 included a hack tool called KMS that increased by over 2,000 percent!
  • New ransomware families released in 2020 that both encrypt and extort are Egregor, Sodinokibi, and Wasted Locker.

If 2020 taught us anything, it’s that cybercrime stops for nothing. There are no targets and no opportunities for exploitation that are beyond the pale.

Thankfully, the year had another lesson for us: There are heroes everywhere. Healthcare professionals, teachers, and other essential workers rightly deserve the loudest acclaim, but it was the folks in IT who got kids into their virtual classrooms and connected remote workers and families around the globe in 2020. I also want to offer an enormous thank you to the unsung army of sysadmins and security professionals who moved mountains to keep those millions of connected people safe online as the world turned upside down around them.

To learn more, check out the full 2021 State of Malware Report here: https://resources.malwarebytes.com/files/2021/02/MWB_StateOfMalwareReport2021.pdf

For a look back at the most enticing cyberattacks of 2020, check out this Labs blog: https://blog.malwarebytes.com/security-world/2020/12/the-most-enticing-cyberattacks-of-2020/

And for the strangest cyberattacks of 2020, take a look here: https://blog.malwarebytes.com/security-world/2020/12/the-strangest-cybersecurity-events-of-2020-a-look-back/

Categories
Security

Don’t drink the water — it’s been hacked

That’s a scary title, isn’t it? It could have been the headline in newspapers this week had it not been for the watchful eye of a water treatment plant operator in Oldsmar, Florida.

Last week, a hacker (or group of hackers) attempted to poison a Florida city’s water supply by accessing a dormant remote access software platform. If it hadn’t been caught in time, at least 15,000 people could have been affected.

Law enforcement, including the FBI, the Secret Service, and the Pinellas County Sheriff’s Office are currently investigating how the threat actor got in and who would want to do this. What we know so far is that a plant operator at the Oldsmar water treatment facility noticed someone remotely accessing the computer system he was monitoring — once at about 8:00am and again at 1:30pm — to open the function that controls the amount of sodium hydroxide (lye) in the water.

Lye is used to treat acidity in water by raising its pH levels and removing heavy metals. Too much lye in the water could cause skin burns and rashes — and the hacker changed the lye ration from about 100 parts per million to 11,100 parts per million. This is obviously a significant and potentially dangerous increase. After the attacker left the system, the operator quickly reduced the lye concentration level back to normal, so there was no adverse effect on the water. Importantly, the water treatment plant had redundancies in place, so if the operator had missed the hacker’s intrusion, the system would have caught the change in time.

So, what was this? A test by nation-state actors? An attempt to severely harm the townspeople of Oldsmar? As of this writing, there are no indications that this was targeted attack. The Pinellas County Sheriff’s office doesn’t have a suspect but is following leads — none of which point to terrorism. It may simply have been an act of vandalism. Vulnerable Internet-connected Industrial Control Systems (ICS) are not difficult to find.

In the case of the Oldsmar water treatment facility, the attack was neither successful nor sophisticated. A remote access software tool was either exposed to the open Internet or accessed via brute force/password. (Although law enforcement say they don’t know how hackers got onto the system, a CNN source counters that a password was required to operate the software remotely.) Unfortunately, a sophisticated attack isn’t required to render a dangerous result, and what happened at Oldsmar simply highlights how many critical infrastructure systems are vulnerable.

IT and security professionals charged with securing vital infrastructure needn’t panic — the first priority here isn’t shielding against complex zero-days or advanced persistent threats. Instead, it’s the kind of grunt work facing all in cybersecurity today, such as patching, air-gapping, and enforcing two-factor authentication. My advice for anyone in infrastructure or others using remote access software:

  • Be careful with how much remote access software you deploy on your network. You should never leave this software unused for long periods, especially if it’s left open to the Internet.
  • Ensure that the remote access software you do have is configured properly. Open it only to staff that require remote access, and require they access it using a strong password and 2FA.
  • Remote Desktop Protocol (RDP) should be kept closed or used with protection, such as our Brute Force Protection module in Malwarebytes Nebula.

To learn more about the hack of the Florida city water facility, read our blog on Malwarebytes Labs:
https://blog.malwarebytes.com/hacking-2/2021/02/hackers-try-to-poison-florida-citys-drinking-water/

Categories
Security

Emotet bites the dust… or does it?

If I never hear the name “Emotet” again, I’d be a pretty happy guy. But it’s worth bringing up this bad boy one more time to announce its demise — or at least the beginning of its end.

On January 27, Europol announced that law enforcement agencies from eight countries seized control of the Emotet botnet in a coordinated effort, putting a stop to more than six years of torment from one of the world’s most dangerous forms of malware.

Although the culprit has been metaphorically locked up, the final blow won’t be delivered until April 25, when an update pushed out to all infected servers will wipe them clean of Emotet once and for all. How did law enforcement finally shut down this banking-Trojan-turned-beast? Why are they waiting until April to wipe it out? What are the ethical pitfalls of pushing code — even “good” code — onto these infected networks?

Law enforcement bests Emotet in TKO

The notorious Emotet botnet, which first appeared as a banking Trojan in 2014, is known for its consistent ability to shapeshift, which allowed it to avoid detection and drop other vicious malware in its wake. Over the more recent years, it wreaked havoc on organizations with other partners, including the equally dangerous TrickBot and Ryuk ransomware.

On January 27, Emotet met its match when agencies from the United States, United Kingdom, Germany, the Netherlands, and more gained control of its infrastructure and took it down from the inside. In a statement announcing the action, Europol described Emotet’s infrastructure as involving several hundred servers across the world, all of which had different functionalities: to manage computers of the infected victims, to spread to new ones, to serve other criminal groups, and to make the network more resilient against takedown attempts.

The global effort to bring down Emotet’s complex web of servers and controllers, dubbed Operation Ladybird, should not be underestimated. Law enforcement coordinated with security researchers from the private sector to take over Emotet’s C&C infrastructure — located in more than 90 countries — while simultaneously arresting at least two of the cybercriminal crew members behind it.

“Unlike the recent and short-lived attempt to take down TrickBot, authorities have made actual arrests in Ukraine and have also identified several other individuals that were customers of the Emotet botnet,” said Jérôme Segura, Director of Threat Intelligence for Malwarebytes. “This is a very impactful action that likely will result in the prolonged success of this global takedown.”

In its press release, Europol described the approach to Emotet’s take-down as “unique and new.” While details of how Operation Ladybird were able to disrupt the Emotet botnet are still emerging, we do know that infected machines have been redirected toward the law enforcement-controlled infrastructure. This effectively removes the threat posed by Emotet by preventing it from contacting the infrastructure it uses to receive updates and deliver malware.

Shortly after the Emotet infrastructure was seized, Dutch authorities deployed an update: a special cleanup payload with code to remove the malware from infected computers on April 25. Why so far away? The lengthy delay gives system administrators time for forensic analysis and to check for other infections that Emotet may have left behind. After Emotet uninstalls itself on April 25, these investigations will be harder to carry out.

But pushing code via botnet, even with the best of intentions, has always been a thorny topic. In this case, law enforcement took control of one of the most significant botnets of the decade — but instead of dismantling it, they pushed an update that will likely impact many thousands of organizations and endpoints — without consent. The end result is positive, of course. But what about the ramifications? The DOJ actually distanced itself from the update, stating in its affidavit that “foreign law enforcement agents, not FBI agents, replaced the Emotet malware, which is stored on a server located overseas, with the file created by law enforcement.”

What are your thoughts about the downfall of Emotet? Do you think this is the last we’ll hear of it? Do you believe it was a good idea to deploy the Emotet update, even without consent?

To read the Department of Justice’s official release on the operation that took down Emotet: https://www.justice.gov/opa/pr/emotet-botnet-disrupted-international-cyber-operation