Today we released the third edition of the “2015 IBM X-Force Threat Intelligence Quarterly,” where we take a deeper look at the evolution of ransomware-as-a-service and how attackers continue to capitalize in this area. Alongside that update, the IBM Managed Security Services (MSS) group reminds us why the Dark Web is a threat for enterprises and how companies can better protect themselves. Finally, we provide a brief overview of the latest changes occurring with vulnerability tracking.

Ransomware Isn’t What It Used to Be

A quick search across the Security Intelligence site for the word ransomware will reveal a trove of recent blogs in which X-Force researchers have been informing readers about these evolving threats, which continue to net criminals millions of dollars each year.

In this third-quarter report, we discuss more of the evolution of ransomware. Not only are a surprising number of users still fooled by fake or rogue antivirus messages that are nothing more than animated Web ads designed to look like actual products, but many cybercriminals are embracing the technical sophistication required to create specialized ransomware that targets specific communities.

From Anonymity to Anarchy: Tor Network Provides Cover for Dark Dealings

The Dark Web is an unencrypted, anonymous network used by nefarious individuals and organizations to conduct illicit or illegal business, including launching attacks on corporate networks to exfiltrate valuable data.

In this report, we examine the genesis of The Onion Router (Tor) software, which enables anonymous communication as both an attack medium and an infrastructure for botnet command-and-control. The design of routing obfuscation in the Tor network provides illicit actors with additional protection for their anonymity.

We discuss various methods companies should take to block connections to the Dark Web from their networks in order to limit attack surfaces, as well as liability issues that arise from content originating from Tor nodes. This can include wholesale blocking at the firewall, IDS/IPS technology to flag attacks and developing a corporate policy to stop the creation of Tor relays or similar access nodes to the Dark Web.

Download the Q3 2015 IBM X-Force Threat Intelligence Quarterly

A Modern Scoring System to Assess the Latest Vulnerabilities

In May 2012, the Board of Directors of the Forum of Incident Response and Security Teams (FIRST) selected IBM as one of the security vendors to participate in the creation of v3 of the Common Vulnerability Scoring System (CVSS).

We highlight some of the critical changes of this updated schema and why it more accurately reflects the scope and impact of modern vulnerabilities. IBM adopted CVSS v3 in July 2015.

In the first half of 2015, we reported just over 4,000 new security vulnerabilities. If this trend continues throughout the rest of the year, the total projected vulnerabilities for 2015 would be about 8,000 — the lowest total since 2011.

For more information, download the third-quarter X-Force Threat Intelligence Quarterly or take a look at some of the other recent reports.

More from Threat Research

Containers, Security, and Risks within Containerized Environments

Applications have historically been deployed and created in a manner reminiscent of classic shopping malls. First, a developer builds the mall, then creates the various stores inside. The stores conform to the dimensions of the mall and operate within its floor plan. In older approaches to application development, a developer would have a targeted system or set of systems for which they intend to create an application. This targeted system would be the mall. Then, when building the application, they would…

RansomExx Upgrades to Rust

IBM Security X-Force Threat Researchers have discovered a new variant of the RansomExx ransomware that has been rewritten in the Rust programming language, joining a growing trend of ransomware developers switching to the language. Malware written in Rust often benefits from lower AV detection rates (compared to those written in more common languages) and this may have been the primary reason to use the language. For example, the sample analyzed in this report was not detected as malicious in the…

Defending Education from Cyber Threat Attackers

Threat actors — and particularly ransomware attackers — have education institutions in their crosshairs. From Vice Society’s September attack on schools in California to Snach’s late October assault on schools in Wisconsin, threat actors are not holding back when it comes to preying on schools. K-12 schools are the most vulnerable within the education industry, with many having only small staffs and even smaller budgets for defending against attacks. In addition, attacks have trickle-down effects on school staff, students and…

What Hurricane Preparedness Can Teach Us About Ransomware

Each year between June and November, many parts of the U.S. become potential targets for hurricanes. In October 2022, we had Hurricane Ian devastate Florida. To prepare for natural disasters like hurricanes, organizations are encouraged to build out and test business continuity, disaster recovery, and crisis management plans to use in the response efforts. Millions of dollars each year are spent on natural disaster preparation, but natural disasters are not the only disruption businesses face. While we can’t equate the…