The IBM X-Force team examined numerous cyberthreats that shaped the threat landscape in 2017 and will continue to have an impact in 2018. The IBM X-Force Threat Intelligence Index 2018 delved into some of the biggest issues the research team uncovered in the past year.

Cloud Misconfiguration Incidents Take Center Stage

Inadvertent insiders — employees who unwittingly caused security incidents through negligent actions — took center stage in 2017. According to the latest X-Force report, they were responsible for more than two-thirds of total records compromised last year. Misconfigured cloud servers and networked backup incidents unintentionally exposed more than 2 billion records, making confidential data ripe for picking.

Read the complete 2018 IBM X-Force Threat Intelligence Index Now

More Highlights From the 2018 IBM X-Force Report

To uncover key trends in the 2017 cybersecurity threat landscape, such as the threat from inadvertent insiders, IBM X-Force research teams combed through and analyzed hundreds of millions of data points.

Below are a few important findings from the IBM X-Force Threat Intelligence Index 2018.

  • Diminishing Shellshock attacks lead to a decline in network attacks and security incidents. Top targeted industries experienced a decline in attacks and security incidents — down 18 percent and 22 percent, respectively — in 2017 over the previous year. This decline is largely attributed to a reduction in Shellshock attacks, which is a result of the diminishing available attack surface due to patching. There were 71 percent fewer Shellshock attacks in 2017 than 2016.
  • Gozi undergoes the most notable financial malware shift. The most active financial malware in 2017, Gozi (Ursnif), toppled Zeus from its No. 1 position. Gozi activity made up nearly one-fourth of the activity X-Force tracked, proving that organized crime is overtaking all other classes of threat actor in the financial malware-facilitated fraud scene.
  • Destructive ransomworm attacks WannaCry, Not Petya and Bad Rabbit cost enterprises millions. Although many chief information security officers (CISOs) were already aware and concerned about crypto-ransomware, organizations faced a new breed of this threat in 2017. The X-Force report projects that this is likely to happen again in 2018.

Read the Report to Learn More

Read the full IBM X-Force Threat Intelligence Index 2018 to discover how to keep pace with the changing threat landscape so you can make strategic decisions about cybersecurity and safeguard your business from costly cyberattacks.

 

 

Read the complete IBM X-Force Threat Intelligence Index Now

More from Threat Intelligence

Hive0137 and AI-supplemented malware distribution

12 min read - IBM X-Force tracks dozens of threat actor groups. One group in particular, tracked by X-Force as Hive0137, has been a highly active malware distributor since at least October 2023. Nominated by X-Force as having the “Most Complex Infection Chain” in a campaign in 2023, Hive0137 campaigns deliver DarkGate, NetSupport, T34-Loader and Pikabot malware payloads, some of which are likely used for initial access in ransomware attacks. The crypters used in the infection chains also suggest a close relationship with former…

Phishing kit trends and the top 10 spoofed brands of 2023

4 min read -  The 2024 IBM X-Force Threat Intelligence Index reported that phishing was one of the top initial access vectors observed last year, accounting for 30% of incidents. To carry out their phishing campaigns, attackers often use phishing kits: a collection of tools, resources and scripts that are designed and assembled to ease deployment. Each phishing kit deployment corresponds to a single phishing attack, and a kit could be redeployed many times during a phishing campaign. IBM X-Force has analyzed thousands of…

Grandoreiro banking trojan unleashed: X-Force observing emerging global campaigns

16 min read - Since March 2024, IBM X-Force has been tracking several large-scale phishing campaigns distributing the Grandoreiro banking trojan, which is likely operated as a Malware-as-a-Service (MaaS). Analysis of the malware revealed major updates within the string decryption and domain generating algorithm (DGA), as well as the ability to use Microsoft Outlook clients on infected hosts to spread further phishing emails. The latest malware variant also specifically targets over 1500 global banks, enabling attackers to perform banking fraud in over 60 countries…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today