November 11, 2019 By David Bisson 3 min read

Last week in security news, researchers revealed that the average ransomware payment surpassed $40,000 between the second and third quarters of 2019. Speaking of ransomware, security professionals explored an emerging means of distribution for the Nemty family and investigated the Buran ransomware-as-a-service (RaaS) platform. Others also observed multiple binaries of DoppelPaymer hosted on a server along with samples of TinyPOS malware and other digital threats.

Top Story of the Week: Ransomware Payments Grew in Q3 2019

In its “Q3 Ransomware Marketplace” report, Covewave found that the average ransomware payment had increased by 13 percent to $41,198 between the second and third quarters of 2019. Even so, the security firm’s researchers observed that the rate of increase for ransom payments had largely plateaued. They attributed this development to victims’ growing efforts to recover their files without paying ransomware attackers.

According to the report, victims began looking for other means of recovering their files despite the fact that they received a working decryptor after paying the ransom in 98 percent of infections. Additionally, 94 percent of victims found that the decryptor provided by attackers successfully recovered their affected data.

Source: iStock

Also in Security News

  • Digital Attack Strikes Renewable Energy Provider: Back in March, renewable energy provider SPower was the first U.S. company of its kind to suffer a digital attack against its IT infrastructure. The attack was also the first to compromise connections with power installations on U.S. soil.
  • First Wave of BlueKeep Attacks Underwhelm Security Observers: Security researchers saw a wave of attacks exploiting the BlueKeep zero-day vulnerability disclosed by Microsoft in May. But as reported by WIRED, those attacks didn’t cause as much destruction as experts feared, as they mainly consisted of installing and running a cryptocurrency miner on vulnerable machines.
  • Over 40 Million Users Exposed to Malicious Android Emoji Keyboard: Upstream blocked over 14 million suspicious transactions from 110,000 Android devices that had downloaded ai.type, an emoji keyboard. The keyboard disappeared from the Google Play store in June 2019, but the security firm noted that the 40 million users who had already installed the keyboard were still at risk.
  • Nemty Relying on Trik Botnet for Distribution: Symantec revealed that Nemty ransomware has partnered with the Trik botnet. This new technique expanded the reach of Nemty, a threat that also uses the RIG exploit kit and malspam campaigns as means of delivery.
  • Ransomware, POS Malware and Other Threats Hosted by Single C&C: Researchers at Cisco Talos uncovered a command-and-control (C&C) server that hosted several different binaries of the BitPaymer-derived DoppelPaymer ransomware family. They also found that the server contained TinyPOS malware, Mimikatz and tools for remotely connecting to Windows systems.
  • Buran Revealed to Have Evolved From Other Ransomware Families: McAfee analyzed the behavior, TTPs and artifacts of a Buran sample and determined that the ransomware was in fact an evolution of Jumper, a family that emerged two months before Buran. Jumper was the second iteration of the family’s lineage; researchers identified VegaLocker as its origin point.
  • Malvertisers Leveraged Fake Blockchain Ad to Distribute Capesand EK: Back in October, Trend Micro saw a malvertising campaign abruptly switch tactics and use a blockchain ad to begin linking to a new exploit kit instead of RIG. Researchers analyzed the exploit kit, which they named Capesand, and found it was unique in that its source code did not contain its exploit code.
  • Firefox Bug Abused by Tech Support Scammers to Prey Upon Users: Bleeping Computer found that digital fraudsters are using a Firefox browser lock bug to prevent users from closing the browser tab without viewing a fake tech support page. This scam instructed users to contact an illegitimate Windows Support line that likely tried to trick them into buying fake antivirus software.
  • Vulnerable Routers at Risk of Gafgyt Infection, DDoS Attacks: Palo Alto Networks’ Unit 42 research team uncovered an updated variant of the Gafgyt malware family. It found that the malware could target vulnerable wireless routers and enlist them into botnets for the purpose of conducting distributed denial-of-service (DDoS) attacks.

Security Tip of the Week: Defend Against a Ransomware Infection

Security professionals can help defend their organizations against a ransomware infection by using test phishing engagements to evaluate employees’ awareness of phishing attacks, one of the most common ransomware distribution vectors. Companies should also implement a backup strategy and regularly test it to make sure they can recover their files in the event of a ransomware infection.

More from

Unpacking the NIST cybersecurity framework 2.0

4 min read - The NIST cybersecurity framework (CSF) helps organizations improve risk management using common language that focuses on business drivers to enhance cybersecurity.NIST CSF 1.0 was released in February 2014, and version 1.1 in April 2018. In February 2024, NIST released its newest CSF iteration: 2.0. The journey to CSF 2.0 began with a request for information (RFI) in February 2022. Over the next two years, NIST engaged the cybersecurity community through analysis, workshops, comments and draft revision to refine existing standards…

What should Security Operations teams take away from the IBM X-Force 2024 Threat Intelligence Index?

3 min read - The IBM X-Force 2024 Threat Intelligence Index has been released. The headlines are in and among them are the fact that a global identity crisis is emerging. X-Force noted a 71% increase year-to-year in attacks using valid credentials.In this blog post, I’ll explore three cybersecurity recommendations from the Threat Intelligence Index, and define a checklist your Security Operations Center (SOC) should consider as you help your organization manage identity risk.The report identified six action items:Remove identity silosReduce the risk of…

Obtaining security clearance: Hurdles and requirements

3 min read - As security moves closer to the top of the operational priority list for private and public organizations, needing to obtain a security clearance for jobs is more commonplace. Security clearance is a prerequisite for a wide range of roles, especially those related to national security and defense.Obtaining that clearance, however, is far from simple. The process often involves scrutinizing one’s background, financial history and even personal character. Let’s briefly explore some of the hurdles, expectations and requirements of obtaining a…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today