2015: A Big Year for Malware

Anyone who kept up with cybersecurity news in 2015 already knows it was a big year for malware and the cybercriminal gangs that develop it. Malware sophistication reached new heights with Dyre, Shifu and other gang-owned codes, revealing that the stereotypical lone-wolf hacker has been replaced by highly organized cybercrime. Indeed, today’s fraudsters are very professional and focused, and they are diversifying their targets in order to achieve bigger paydays.

With all the advances made in cybercrime throughout recent months, there is little reason to suspect that the evolution of increasingly complex malware strains and the magnitude of cybercriminal activity will slow down in 2016.

In a new white paper released by the Information Security Media Group, IBM Security Executive Security Advisor Limor Kessem discussed how malware evolved in the past year, the variants that concern her most and where organizations are now most vulnerable to attack.

What We Learned

In 2015, existing Trojans added new evasion features and theft mechanisms. New malware that emerged was increasingly modular and advanced, meaning it was able to better impersonate victims and hide its intentions in real time. Perhaps most alarmingly, this growing sophistication has revealed itself not only in banking Trojans, but also in mobile malware realms, as well.

One trend to watch in the mobile arena, Kessem cautioned in the paper, is overlay malware. In an overlay attack, fraudsters place a nearly identical fake application screen on top of a legitimate application, deceiving users into revealing personal data such as payment terminal logins, banking credentials or even credit card details.

With cybercriminals becoming more organized and developing more sophisticated and dangerous malware tactics, it’s no surprise that traditional defenses are struggling to keep up. As just one example, antivirus software cannot reliably detect morphed or rewrapped malware and therefore leaves the endpoint open to exploitation. This stronghold, whether on a personal or corporate device, is where the eventual fraud takes place.

Kessem emphasized that, in a world where malware evolves both rapidly and frequently, malware defenses must also be based on dynamic intelligence. Counteracting the most advanced malware codes requires an agility that is lacking in many current solutions.

Read the white paper to learn more about the latest advances in malware attacks

More from Advanced Threats

Black Hat 2022 Sneak Peek: How to Build a Threat Hunting Program

You may recall my previous blog post about how our X-Force veteran threat hunter Neil Wyler (a.k.a “Grifter”) discovered nation-state attackers exfiltrating unencrypted, personally identifiable information (PII) from a company’s network, unbeknownst to the security team. The post highlighted why threat hunting should be a baseline activity in any environment. Before you can embark on a threat hunting exercise, however, it’s important to understand how to build, implement and mature a repeatable, internal threat hunting program. What are the components…

Top-Ranking Banking Trojan Ramnit Out to Steal Payment Card Data

Shopping online is an increasingly popular endeavor, and it has accelerated since the COVID-19 pandemic. Online sales during the 2021 holiday season rose nearly 9% to a record $204.5 billion. Mastercard says that shopping jumped 8.5% this year compared to 2020 and 61.4% compared to pre-pandemic levels. Cyber criminals are not missing this trend. The Ramnit Trojan, in particular, is out for a shopping spree that’s designed to take over people’s online accounts and steal their payment card data. IBM…

Detections That Can Help You Identify Ransomware

One of the benefits of being part of a global research-driven incident response firm like X-Force Incidence Response (IR) is that the team has the ability to take a step back and analyze incidents, identifying trends and commonalities that span geographies, industries and affiliations. Leveraging that access and knowledge against the ransomware threat has revealed tools, techniques and procedures that can often be detected through the default Windows event logs (WELs). In particular, the X-Force IR team has identified several…

How to Report Scam Calls and Phishing Attacks

With incidents such as the Colonial Pipeline infection and the Kaseya supply chain attack making so many headlines these days, it can be easy to forget that malicious actors are still preying on individual users. They're not using ransomware to do that so much anymore, though. Not since the rise of big game hunting, anyway. This term marks ransomware actors' shift away from attacks against individual users and towards operations targeting large enterprises, noted CNBC. But attacks like phishing and…