Last week in security news, researchers revealed that the average ransomware payment surpassed $40,000 between the second and third quarters of 2019. Speaking of ransomware, security professionals explored an emerging means of distribution for the Nemty family and investigated the Buran ransomware-as-a-service (RaaS) platform. Others also observed multiple binaries of DoppelPaymer hosted on a server along with samples of TinyPOS malware and other digital threats.

Top Story of the Week: Ransomware Payments Grew in Q3 2019

In its “Q3 Ransomware Marketplace” report, Covewave found that the average ransomware payment had increased by 13 percent to $41,198 between the second and third quarters of 2019. Even so, the security firm’s researchers observed that the rate of increase for ransom payments had largely plateaued. They attributed this development to victims’ growing efforts to recover their files without paying ransomware attackers.

According to the report, victims began looking for other means of recovering their files despite the fact that they received a working decryptor after paying the ransom in 98 percent of infections. Additionally, 94 percent of victims found that the decryptor provided by attackers successfully recovered their affected data.

Source: iStock

Also in Security News

  • Digital Attack Strikes Renewable Energy Provider: Back in March, renewable energy provider SPower was the first U.S. company of its kind to suffer a digital attack against its IT infrastructure. The attack was also the first to compromise connections with power installations on U.S. soil.
  • First Wave of BlueKeep Attacks Underwhelm Security Observers: Security researchers saw a wave of attacks exploiting the BlueKeep zero-day vulnerability disclosed by Microsoft in May. But as reported by WIRED, those attacks didn’t cause as much destruction as experts feared, as they mainly consisted of installing and running a cryptocurrency miner on vulnerable machines.
  • Over 40 Million Users Exposed to Malicious Android Emoji Keyboard: Upstream blocked over 14 million suspicious transactions from 110,000 Android devices that had downloaded ai.type, an emoji keyboard. The keyboard disappeared from the Google Play store in June 2019, but the security firm noted that the 40 million users who had already installed the keyboard were still at risk.
  • Nemty Relying on Trik Botnet for Distribution: Symantec revealed that Nemty ransomware has partnered with the Trik botnet. This new technique expanded the reach of Nemty, a threat that also uses the RIG exploit kit and malspam campaigns as means of delivery.
  • Ransomware, POS Malware and Other Threats Hosted by Single C&C: Researchers at Cisco Talos uncovered a command-and-control (C&C) server that hosted several different binaries of the BitPaymer-derived DoppelPaymer ransomware family. They also found that the server contained TinyPOS malware, Mimikatz and tools for remotely connecting to Windows systems.
  • Buran Revealed to Have Evolved From Other Ransomware Families: McAfee analyzed the behavior, TTPs and artifacts of a Buran sample and determined that the ransomware was in fact an evolution of Jumper, a family that emerged two months before Buran. Jumper was the second iteration of the family’s lineage; researchers identified VegaLocker as its origin point.
  • Malvertisers Leveraged Fake Blockchain Ad to Distribute Capesand EK: Back in October, Trend Micro saw a malvertising campaign abruptly switch tactics and use a blockchain ad to begin linking to a new exploit kit instead of RIG. Researchers analyzed the exploit kit, which they named Capesand, and found it was unique in that its source code did not contain its exploit code.
  • Firefox Bug Abused by Tech Support Scammers to Prey Upon Users: Bleeping Computer found that digital fraudsters are using a Firefox browser lock bug to prevent users from closing the browser tab without viewing a fake tech support page. This scam instructed users to contact an illegitimate Windows Support line that likely tried to trick them into buying fake antivirus software.
  • Vulnerable Routers at Risk of Gafgyt Infection, DDoS Attacks: Palo Alto Networks’ Unit 42 research team uncovered an updated variant of the Gafgyt malware family. It found that the malware could target vulnerable wireless routers and enlist them into botnets for the purpose of conducting distributed denial-of-service (DDoS) attacks.

Security Tip of the Week: Defend Against a Ransomware Infection

Security professionals can help defend their organizations against a ransomware infection by using test phishing engagements to evaluate employees’ awareness of phishing attacks, one of the most common ransomware distribution vectors. Companies should also implement a backup strategy and regularly test it to make sure they can recover their files in the event of a ransomware infection.

More from

Most organizations want security vendor consolidation

4 min read - Cybersecurity is complicated, to say the least. Maintaining a strong security posture goes far beyond knowing about attack groups and their devious TTPs. Merely understanding, coordinating and unifying security tools can be challenging.We quickly passed through the “not if, but when” stage of cyberattacks. Now, it’s commonplace for companies to have experienced multiple breaches. Today, cybersecurity has taken a seat in core business strategy discussions as the risks and costs have risen dramatically.For this reason, 75% of organizations seek to…

How IBM secures the U.S. Open

2 min read - More than 15 million tennis fans around the world visited the US Open app and website this year, checking scores, poring over statistics and watching highlights from hundreds of matches over the two weeks of the tournament. To help develop this world-class digital experience, IBM Consulting worked closely with the USTA, developing powerful generative AI models that transform tennis data into insights and original content. Using IBM watsonx, a next-generation AI and data platform, the team built and managed the entire…

How the FBI Fights Back Against Worldwide Cyberattacks

5 min read - In the worldwide battle against malicious cyberattacks, there is no organization more central to the fight than the Federal Bureau of Investigation (FBI). And recent years have proven that the bureau still has some surprises up its sleeve. In early May, the U.S. Department of Justice announced the conclusion of a U.S. government operation called MEDUSA. The operation disrupted a global peer-to-peer network of computers compromised by malware called Snake. Attributed to a unit of the Russian government Security Service,…

How NIST Cybersecurity Framework 2.0 Tackles Risk Management

4 min read - The NIST Cybersecurity Framework 2.0 (CSF) is moving into its final stages before its 2024 implementation. After the public discussion period to inform decisions for the framework closed in May, it’s time to learn more about what to expect from the changes to the guidelines. The updated CSF is being aligned with the Biden Administration’s National Cybersecurity Strategy, according to Cherilyn Pascoe, senior technology policy advisor with NIST, at the 2023 RSA Conference. This sets up the new CSF to…