October 21, 2019 By David Bisson 3 min read

Last week in security news, a new report from Europol announced that ransomware is still the top cyberthreat facing users and organizations. Speaking of ransomware, researchers observed a new attack campaign from BitPaymer that abused an Apple zero-day vulnerability to target Windows users. Ransomware isn’t the only threat category that has been busy; a new malware family called SDBbot entered into the fray, and the Emotet botnet sprang back to life.

Top Story of the Week: Europol Says Ransomware Remains the Most Prominent Cyberthreat

In its annual Internet Organized Crime Threat Assessment (IOCTA) report, the European Union Agency for Law Enforcement Cooperation (Europol) found that ransomware remained the top threat in terms of prevalence and financial damage. The report didn’t paint ransomware as a static threat, however. Malwarebytes noted in its coverage of the study how many ransomware actors have moved away from “spray and pray” tactics to more targeted attacks in an attempt to maximize their profits.

As it turns out, Emsisoft observed this very same shift in terms of ransomware distribution between the second and third quarters of 2019. The security firm also saw some ransomware families dominate the field. For instance, samples of the STOP (or DJVU) family accounted for 56 percent of the 230,000 ransomware submissions received during the reporting period, whereas a Dharma variant accounted for 12 percent of submissions.

Source: iStock

Also in Security News

  • Fake Performance Appraisals Incorporated Into Corporate Phishing Attacks: Kaspersky Lab observed an attack email that appeared to originate from HR and informed recipients of an upcoming performance appraisal. The email also came with a link that redirected recipients to a primitive website where they were instructed to supply their business account credentials.
  • New SDBbot RAT Distributed by TA505: In September 2019, Proofpoint discovered that the TA505 threat actor had begun sending out emails to target recipients with Get2, a new downloader. This threat installed FlawedGrace, FlawedAmmyy and SDBbot, a new remote-access Trojan (RAT), as secondary payloads.
  • Apple Zero-Day Vulnerability Exploited in BitPaymer Ransomware Campaign: According to Morphisec, bad actors responsible for the BitPaymer ransomware family used a new technique in August 2019 to target an automotive organization. The tactic consisted of exploiting an unquoted path vulnerability in the Apple Software Update utility that comes packaged with iTunes on Windows computers.
  • Emotet Springs Back to Life With New Spam Campaigns: After tracking a three-month period of inactivity, Check Point Software watched the Emotet botnet resume its attack campaigns in August 2019. These operations consisted of spam attacks featuring emails that attempted to trick users into opening a Microsoft Word document containing malicious macros.
  • Impostor Email Attacks for Healthcare Orgs Grew 300 Percent in a Year: Proofpoint revealed that healthcare organizations had received an average of 43 impostor email attacks in the first quarter of 2019 — about 300 percent higher than in Q1 2018.
  • Hack of Dark Web Marketplace Revealed 26 Million Stolen Payment Cards: In September, a source contacted KrebsOnSecurity and shared a plaintext file containing a database of stolen payment cards on sale via underground web marketplace BriansClub[.]at. Those cards all originated from small retailers that digital attackers had successfully infiltrated over the previous four years.
  • PortReuse Backdoor Used by Winnti Group to Target Asian Gaming Companies: While investigating a series of supply chain attacks launched by the Winnti Group, ESET detected a new packer being used by the attackers to target the Asian gaming industry. Further analysis revealed that the packer was actually the component of a previously undiscovered backdoor called PortReuse.
  • Stripe Credentials Targeted by Phishing Campaign: Cofense detected a phishing email that pretended to originate from “Stripe Support,” informing the recipient that their account contained invalid details and was thus slated for suspension. Using this sense of fear, the email pressured recipients into clicking an embedded link that redirected them to a phishing page disguised as the Stripe customer login portal.

Security Tip of the Week: How to Prevent a Crypto-Ransomware Infection

Security professionals can help protect their organizations against a crypto-ransomware attack by making sure they know where critical assets are located. With this knowledge, security teams can craft a defense strategy that prioritizes certain assets (and their stored data) above others. Companies should also develop a security awareness program that seeks to change the most severe behaviors among users from a risk management perspective.

More from

IBM identifies zero-day vulnerability in Zyxel NAS devices

12 min read - While investigating CVE-2023-27992, a vulnerability affecting Zyxel network-attached storage (NAS) devices, the IBM X-Force uncovered two new flaws, which when used together, allow for pre-authenticated remote code execution. Zyxel NAS devices are typically used by consumers as cloud storage devices for homes or small to medium-sized businesses. When used together, the flaws X-Force discovered allow a remote attacker to execute arbitrary code on the device with superuser permissions and without requiring any credentials. This results in complete control over the…

What cybersecurity pros can learn from first responders

4 min read - Though they may initially seem very different, there are some compelling similarities between cybersecurity professionals and traditional first responders like police and EMTs. After all, in a world where a cyberattack on critical infrastructure could cause untold damage and harm, cyber responders must be ready for anything. But are they actually prepared? Compared to the readiness of traditional first responders, how do cybersecurity professionals in incident response stand up? Let’s dig deeper into whether the same sense of urgency exists…

Unified endpoint management for purpose-based devices

4 min read - As purpose-built devices become increasingly common, the challenges associated with their unique management and security needs are becoming clear. What are purpose-built devices? Most fall under the category of rugged IoT devices typically used outside of an office environment and which often run on a different operating system than typical office devices. Examples include ruggedized tablets and smartphones, handheld scanners and kiosks. Many different industries are utilizing purpose-built devices, including travel and transportation, retail, warehouse and distribution, manufacturing (including automotive)…

Stealthy WailingCrab Malware misuses MQTT Messaging Protocol

14 min read - This article was made possible thanks to the hard work of writer Charlotte Hammond and contributions from Ole Villadsen and Kat Metrick. IBM X-Force researchers have been tracking developments to the WailingCrab malware family, in particular, those relating to its C2 communication mechanisms, which include misusing the Internet-of-Things (IoT) messaging protocol MQTT. WailingCrab, also known as WikiLoader, is a sophisticated, multi-component malware delivered almost exclusively by an initial access broker that X-Force tracks as Hive0133, which overlaps with TA544. WailingCrab…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today