Last week in security news, a new report from Europol announced that ransomware is still the top cyberthreat facing users and organizations. Speaking of ransomware, researchers observed a new attack campaign from BitPaymer that abused an Apple zero-day vulnerability to target Windows users. Ransomware isn’t the only threat category that has been busy; a new malware family called SDBbot entered into the fray, and the Emotet botnet sprang back to life.

Top Story of the Week: Europol Says Ransomware Remains the Most Prominent Cyberthreat

In its annual Internet Organized Crime Threat Assessment (IOCTA) report, the European Union Agency for Law Enforcement Cooperation (Europol) found that ransomware remained the top threat in terms of prevalence and financial damage. The report didn’t paint ransomware as a static threat, however. Malwarebytes noted in its coverage of the study how many ransomware actors have moved away from “spray and pray” tactics to more targeted attacks in an attempt to maximize their profits.

As it turns out, Emsisoft observed this very same shift in terms of ransomware distribution between the second and third quarters of 2019. The security firm also saw some ransomware families dominate the field. For instance, samples of the STOP (or DJVU) family accounted for 56 percent of the 230,000 ransomware submissions received during the reporting period, whereas a Dharma variant accounted for 12 percent of submissions.

Source: iStock

Also in Security News

• Fake Performance Appraisals Incorporated Into Corporate Phishing Attacks: Kaspersky Lab observed an attack email that appeared to originate from HR and informed recipients of an upcoming performance appraisal. The email also came with a link that redirected recipients to a primitive website where they were instructed to supply their business account credentials.
• New SDBbot RAT Distributed by TA505: In September 2019, Proofpoint discovered that the TA505 threat actor had begun sending out emails to target recipients with Get2, a new downloader. This threat installed FlawedGrace, FlawedAmmyy and SDBbot, a new remote-access Trojan (RAT), as secondary payloads.
• Apple Zero-Day Vulnerability Exploited in BitPaymer Ransomware Campaign: According to Morphisec, bad actors responsible for the BitPaymer ransomware family used a new technique in August 2019 to target an automotive organization. The tactic consisted of exploiting an unquoted path vulnerability in the Apple Software Update utility that comes packaged with iTunes on Windows computers.
• Emotet Springs Back to Life With New Spam Campaigns: After tracking a three-month period of inactivity, Check Point Software watched the Emotet botnet resume its attack campaigns in August 2019. These operations consisted of spam attacks featuring emails that attempted to trick users into opening a Microsoft Word document containing malicious macros.
• Impostor Email Attacks for Healthcare Orgs Grew 300 Percent in a Year: Proofpoint revealed that healthcare organizations had received an average of 43 impostor email attacks in the first quarter of 2019 — about 300 percent higher than in Q1 2018.
• Hack of Dark Web Marketplace Revealed 26 Million Stolen Payment Cards: In September, a source contacted KrebsOnSecurity and shared a plaintext file containing a database of stolen payment cards on sale via underground web marketplace BriansClub[.]at. Those cards all originated from small retailers that digital attackers had successfully infiltrated over the previous four years.
• PortReuse Backdoor Used by Winnti Group to Target Asian Gaming Companies: While investigating a series of supply chain attacks launched by the Winnti Group, ESET detected a new packer being used by the attackers to target the Asian gaming industry. Further analysis revealed that the packer was actually the component of a previously undiscovered backdoor called PortReuse.
• Stripe Credentials Targeted by Phishing Campaign: Cofense detected a phishing email that pretended to originate from “Stripe Support,” informing the recipient that their account contained invalid details and was thus slated for suspension. Using this sense of fear, the email pressured recipients into clicking an embedded link that redirected them to a phishing page disguised as the Stripe customer login portal.

Security Tip of the Week: How to Prevent a Crypto-Ransomware Infection

Security professionals can help protect their organizations against a crypto-ransomware attack by making sure they know where critical assets are located. With this knowledge, security teams can craft a defense strategy that prioritizes certain assets (and their stored data) above others. Companies should also develop a security awareness program that seeks to change the most severe behaviors among users from a risk management perspective.