Last week in security news, researchers revealed that WannaCry dominated their ransomware detections in the first quarter of 2020. Speaking of ransomware, a new variant of the REvil family garnered attention in the security community for its updated capabilities. News also emerged last week of a ransomware attack that targeted the Texas court system.

Top Story of the Week: WannaCry Still Relevant 3 Years After Global Outbreak

ESET disclosed that WannaCry, or WannaCryptor, accounted for 40.5 percent of all its ransomware detections in Q1 2020. Researchers observed this threat abusing EternalBlue, the same exploit that facilitated its global outbreak in May 2017, to target unpatched systems in Thailand, Turkey and Indonesia. Even so, it used the exploit in Q1 2020 about half as frequently as it did in the second quarter of 2019.

WannaCry’s dominance was not limited to the first few months of 2020, either. Kaspersky revealed that it was the most common ransomware strain in 2019, affecting 164,433 users and accounting for 21 percent of detected ransomware attacks that year.

Source: iStock

Also in Security News

  • Monero Miners Spread by Blue Mockingbird in Enterprise Attacks: Red Canary Intel determined that a group of similar threat activity known as “Blue Mockingbird” traced back to December 2019. A closer look revealed that this activity exploited a deserialization vulnerability (CVE-2019-18935) to target enterprise networks with the XMRig Monero miner as its payload.
  • Texas Court System Struck by Ransomware: According to ZDNet, the Office of Court Administration (OCA) revealed that ransomware had made its way through its branch network, thereby affecting the state of Texas’s court system. In response, OCA disabled its linked servers and websites to limit the damage resulting from the attack.
  • Latest Version of REvil RaaS Arrives With New Attack Capabilities: The Intel 471 malware intelligence team came across version 2.2 of the REvil ransomware-as-a-service (RaaS) family. In its analysis, it found that the threat came with a new persistence mechanism and leveraged Windows Restart Manager to terminate processes.
  • Millions of Windows- and Linux-Based Devices Vulnerable to Thunderspy Attacks: A student at the Eindhoven University of Technology first learned that malicious actors could pull off these attacks with just some portable hardware, a screwdriver and physical access to a Thunderport-equipped machine. In effect, they could target millions of Windows- and Linux-based machines with “Thunderspy” attacks.
  • Top 10 Regularly Exploited Flaws Disclosed by DHS: In mid-May, the United States Department of Homeland Security (DHS) disclosed the top 10 vulnerabilities regularly exploited by digital attackers. The top three security flaws were CVE-2017-11882, CVE-2017-0199 and CVE-2012-0158; all of them related to Microsoft’s Object Linking and Embedding (OLE) technology.
  • Ramsay Toolkit Enables Attackers to Target Air-Gapped Networks: Researchers at ESET discovered a previously undiscovered attack toolkit that they dubbed “Ramsay.” In their analysis of this threat, the researchers found that attackers could leverage the toolkit to collect and exfiltrate sensitive data from different kinds of environments, including air-gapped networks.
  • YouTube Channels Acted as C&C for New Astaroth Variant: Cisco Talos discovered a new Astaroth Trojan campaign targeting Brazilian users. Its subsequent deep dive into the malware revealed that it had leveraged various techniques, including YouTube channels as command-and-control (C&C) functionality, to avoid detection.
  • New C# Variant of Dark Crystal RAT Spotted in the Wild: FireEye received a new C# variant of the Dark Crystal RAT from the security firm’s threat intelligence team. The researchers analyzed this threat and found that two of the six executables used by the remote-access Trojan (RAT) were variants of the Plurox family.
  • New Features Added to Anubis Malware: Hold Security told Bank Info Security that the authors of Anubis had added new capabilities to their malware. Those features included an eye icon that allowed attackers to see when a victim was looking at their infected device and a new Yandex map integration to reveal the location of those devices.

Security Tip of the Week: Strengthen Your Anti-Ransomware Defenses

Security professionals can help defend their organizations against an attack at the hands of WannaCry or similar ransomware families by making sure they have an incident response (IR) plan and team in place to manage such an incident, and by practicing that plan regularly. Teams should continually update this process with the latest threat intelligence on evolving ransomware attack tactics.

More from

How to Spot a Nefarious Cryptocurrency Platform

Do you ever wonder if your cryptocurrency platform cashes in ransomware payments? Maybe not, but it might be worth investigating. Bitcoin-associated ransomware continues to plague companies, government agencies and individuals with no signs of letting up. And if your platform gets sanctioned, you may instantly lose access to all your funds. What exchanges or platforms do criminals use to cash out or launder ransomware payments? And what implications does this have for people who use exchanges legitimately? Blacklisted Exchanges and Mixers…

Are Threat Actors Using ChatGPT to Hack Your Network?

Though the technology has only been widely available for a couple of months, everyone is talking about ChatGPT. If you are one of the few people unfamiliar with ChatGPT, it is an OpenAI language model with the “ability to generate human-like text responses to prompts.” It could be a game-changer wherever AI meshes with human interaction, like chatbots. Some are even using it to build editorial content. But, as with any popular technology, what makes it great can also make…

Why Crowdsourced Security is Devastating to Threat Actors

Almost every day, my spouse and I have a conversation about spam. Not the canned meat, but the number of unwelcomed emails and text messages we receive. He gets several nefarious text messages a day, while I maybe get one a week. Phishing emails come in waves — right now, I’m getting daily warnings that my AV software license is about to expire. Blocking or filtering has limited success and, as often as not, flags wanted rather than unwanted messages.…

Bridging the 3.4 Million Workforce Gap in Cybersecurity

As new cybersecurity threats continue to loom, the industry is running short of workers to face them. The 2022 (ISC)2 Cybersecurity Workforce Study identified a 3.4 million worldwide cybersecurity worker gap; the total existing workforce is estimated at 4.7 million. Yet despite adding workers this past year, that gap continued to widen. Nearly 12,000 participants in that study felt that additional staff would have a hugely positive impact on their ability to perform their duties. More hires would boost proper…