Last week in security news, a new report from Europol announced that ransomware is still the top cyberthreat facing users and organizations. Speaking of ransomware, researchers observed a new attack campaign from BitPaymer that abused an Apple zero-day vulnerability to target Windows users. Ransomware isn’t the only threat category that has been busy; a new malware family called SDBbot entered into the fray, and the Emotet botnet sprang back to life.

Top Story of the Week: Europol Says Ransomware Remains the Most Prominent Cyberthreat

In its annual Internet Organized Crime Threat Assessment (IOCTA) report, the European Union Agency for Law Enforcement Cooperation (Europol) found that ransomware remained the top threat in terms of prevalence and financial damage. The report didn’t paint ransomware as a static threat, however. Malwarebytes noted in its coverage of the study how many ransomware actors have moved away from “spray and pray” tactics to more targeted attacks in an attempt to maximize their profits.

As it turns out, Emsisoft observed this very same shift in terms of ransomware distribution between the second and third quarters of 2019. The security firm also saw some ransomware families dominate the field. For instance, samples of the STOP (or DJVU) family accounted for 56 percent of the 230,000 ransomware submissions received during the reporting period, whereas a Dharma variant accounted for 12 percent of submissions.

Source: iStock

Also in Security News

  • Fake Performance Appraisals Incorporated Into Corporate Phishing Attacks: Kaspersky Lab observed an attack email that appeared to originate from HR and informed recipients of an upcoming performance appraisal. The email also came with a link that redirected recipients to a primitive website where they were instructed to supply their business account credentials.
  • New SDBbot RAT Distributed by TA505: In September 2019, Proofpoint discovered that the TA505 threat actor had begun sending out emails to target recipients with Get2, a new downloader. This threat installed FlawedGrace, FlawedAmmyy and SDBbot, a new remote-access Trojan (RAT), as secondary payloads.
  • Apple Zero-Day Vulnerability Exploited in BitPaymer Ransomware Campaign: According to Morphisec, bad actors responsible for the BitPaymer ransomware family used a new technique in August 2019 to target an automotive organization. The tactic consisted of exploiting an unquoted path vulnerability in the Apple Software Update utility that comes packaged with iTunes on Windows computers.
  • Emotet Springs Back to Life With New Spam Campaigns: After tracking a three-month period of inactivity, Check Point Software watched the Emotet botnet resume its attack campaigns in August 2019. These operations consisted of spam attacks featuring emails that attempted to trick users into opening a Microsoft Word document containing malicious macros.
  • Impostor Email Attacks for Healthcare Orgs Grew 300 Percent in a Year: Proofpoint revealed that healthcare organizations had received an average of 43 impostor email attacks in the first quarter of 2019 — about 300 percent higher than in Q1 2018.
  • Hack of Dark Web Marketplace Revealed 26 Million Stolen Payment Cards: In September, a source contacted KrebsOnSecurity and shared a plaintext file containing a database of stolen payment cards on sale via underground web marketplace BriansClub[.]at. Those cards all originated from small retailers that digital attackers had successfully infiltrated over the previous four years.
  • PortReuse Backdoor Used by Winnti Group to Target Asian Gaming Companies: While investigating a series of supply chain attacks launched by the Winnti Group, ESET detected a new packer being used by the attackers to target the Asian gaming industry. Further analysis revealed that the packer was actually the component of a previously undiscovered backdoor called PortReuse.
  • Stripe Credentials Targeted by Phishing Campaign: Cofense detected a phishing email that pretended to originate from “Stripe Support,” informing the recipient that their account contained invalid details and was thus slated for suspension. Using this sense of fear, the email pressured recipients into clicking an embedded link that redirected them to a phishing page disguised as the Stripe customer login portal.

Security Tip of the Week: How to Prevent a Crypto-Ransomware Infection

Security professionals can help protect their organizations against a crypto-ransomware attack by making sure they know where critical assets are located. With this knowledge, security teams can craft a defense strategy that prioritizes certain assets (and their stored data) above others. Companies should also develop a security awareness program that seeks to change the most severe behaviors among users from a risk management perspective.

More from

Data Privacy: How the Growing Field of Regulations Impacts Businesses

The proposed rules over artificial intelligence (AI) in the European Union (EU) are a harbinger of things to come. Data privacy laws are becoming more complex and growing in number and relevance. So, businesses that seek to become — and stay — compliant must find a solution that can do more than just respond to current challenges. Take a look at upcoming trends when it comes to data privacy regulations and how to follow them. Today's AI Solutions On April…

Why Zero Trust Works When Everything Else Doesn’t

The zero trust security model is proving to be one of the most effective cybersecurity approaches ever conceived. Zero trust — also called zero trust architecture (ZTA), zero trust network architecture (ZTNA) and perimeter-less security — takes a "default deny" security posture. All people and devices must prove explicit permission to use each network resource each time they use that resource. Using microsegmentation and least privileged access principles, zero trust not only prevents breaches but also stymies lateral movement should a breach…

5 Golden Rules of Threat Hunting

When a breach is uncovered, the operational cadence includes threat detection, quarantine and termination. While all stages can occur within the first hour of discovery, in some cases, that's already too late.Security operations center (SOC) teams monitor and hunt new threats continuously. To ward off the most advanced threats, security teams proactively hunt for ones that evade the dashboards of their security solutions.However, advanced threat actors have learned to blend in with their target's environment, remaining unnoticed for prolonged periods. Based…

Third-Party App Stores Could Be a Red Flag for iOS Security

Even Apple can’t escape change forever. The famously restrictive company will allow third-party app stores for iOS devices, along with allowing users to “sideload” software directly. Spurring the move is the European Union’s (EU) Digital Markets Act (DMA), which looks to ensure open markets by reducing the ability of digital “gatekeepers” to restrict content on devices. While this is good news for app creators and end-users, there is a potential red flag: security. Here’s what the compliance-driven change means for…