Despite the rise of Internet of Things (IoT) networks and always-connected mobile devices, cybercriminals are sticking with tried-and-true strategies.

As noted by BetaNews, email phishing and drive-by downloads were the most common threat vectors of 2017, maintaining their top spots from the year before. New threat intelligence data also revealed a threefold increase in ransomware over the last year fueled in large part by variants such as NotPetya and WannaCry.

Industry Cybercrime Trends

ZDNet reported that healthcare was the primary target for ransomware scams last year. In fact, 8 of the top 10 ransomware families were consistently involved in healthcare attacks.

The food industry, meanwhile, topped threat actors’ priority list and attracted 50 percent of all reported attacks, down just 1 percent from 2016, according to the “Cylance 2017 Threat Report.” In 2017, hospitality moved into second spot with 19 percent.

On the attacker side of threat intelligence, the market is shifting gears to offer ransomware-as-a-service (RaaS) tools that would-be cybercriminals can purchase for less than $50. The authors simply take a percentage of any successful ransomware scheme.

Threat Actors Keep It Simple

As noted by the Cylance report, simple techniques, such as phishing, and common malware strains, such as Locky, continue to pay off for attackers. Reported but unpatched vulnerabilities are one problem: With multiple malware strains now available for a reasonable price, malicious actors can easily find software designed to exploit known issues.

Also consider the use of Locky ransomware, which remains largely unchanged since its inception. According to the report, “This old malware didn’t need to take a new approach. The authors behind Locky just had to tweak the only part of the process that can never be fixed — the end user.”

Despite the success of tried-and-true attacks, however, Forbes pointed out that there’s also an uptick in “single-use, highly targeted malware attacks.” This code is designed to carry out a singular purpose on corporate networks and isn’t active in the wild. Instead, it activates once and only once to complete its assigned task.

In fact, 70 percent of the attacked blocked by Cylance were never seen again. As a result, existing lists of malicious code, such as CVE, won’t list this kind of custom-built malware, making it possible for attackers to act with greater impunity. The Cylance report put it simply: “The fact of the matter is that public repositories of signatures are by no means comprehensive, complete, up to date or a reliable record of all the malware that could impact an organization.”

In addition, crypto-mining efforts are gaining ground since many security tools don’t recognize this lightweight software as threatening and visible impact to networks is often minimal. As noted by the Cylance report, crypto-mining tools saw a 504 percent boost through 2017 and are on track for similar growth this year.

Threat Intelligence Takeaway

While more threat actors are designing custom-built malware to beat corporate defenses, the bulk of attacks leverage well-known ransomware tools and common threat vectors. Phishing and drive-by downloads continue to work as employees struggle to identify scam email efforts and malicious links, while the rise of crypto-mining tools reduces the complexity of new attacks.

The bottom line is that while sophisticated software is on the rise, simple remains successful for malicious actors.