May 18, 2020 By David Bisson 3 min read

Last week in security news, researchers revealed that WannaCry dominated their ransomware detections in the first quarter of 2020. Speaking of ransomware, a new variant of the REvil family garnered attention in the security community for its updated capabilities. News also emerged last week of a ransomware attack that targeted the Texas court system.

Top Story of the Week: WannaCry Still Relevant 3 Years After Global Outbreak

ESET disclosed that WannaCry, or WannaCryptor, accounted for 40.5 percent of all its ransomware detections in Q1 2020. Researchers observed this threat abusing EternalBlue, the same exploit that facilitated its global outbreak in May 2017, to target unpatched systems in Thailand, Turkey and Indonesia. Even so, it used the exploit in Q1 2020 about half as frequently as it did in the second quarter of 2019.

WannaCry’s dominance was not limited to the first few months of 2020, either. Kaspersky revealed that it was the most common ransomware strain in 2019, affecting 164,433 users and accounting for 21 percent of detected ransomware attacks that year.

Source: iStock

Also in Security News

  • Monero Miners Spread by Blue Mockingbird in Enterprise Attacks: Red Canary Intel determined that a group of similar threat activity known as “Blue Mockingbird” traced back to December 2019. A closer look revealed that this activity exploited a deserialization vulnerability (CVE-2019-18935) to target enterprise networks with the XMRig Monero miner as its payload.
  • Texas Court System Struck by Ransomware: According to ZDNet, the Office of Court Administration (OCA) revealed that ransomware had made its way through its branch network, thereby affecting the state of Texas’s court system. In response, OCA disabled its linked servers and websites to limit the damage resulting from the attack.
  • Latest Version of REvil RaaS Arrives With New Attack Capabilities: The Intel 471 malware intelligence team came across version 2.2 of the REvil ransomware-as-a-service (RaaS) family. In its analysis, it found that the threat came with a new persistence mechanism and leveraged Windows Restart Manager to terminate processes.
  • Millions of Windows- and Linux-Based Devices Vulnerable to Thunderspy Attacks: A student at the Eindhoven University of Technology first learned that malicious actors could pull off these attacks with just some portable hardware, a screwdriver and physical access to a Thunderport-equipped machine. In effect, they could target millions of Windows- and Linux-based machines with “Thunderspy” attacks.
  • Top 10 Regularly Exploited Flaws Disclosed by DHS: In mid-May, the United States Department of Homeland Security (DHS) disclosed the top 10 vulnerabilities regularly exploited by digital attackers. The top three security flaws were CVE-2017-11882, CVE-2017-0199 and CVE-2012-0158; all of them related to Microsoft’s Object Linking and Embedding (OLE) technology.
  • Ramsay Toolkit Enables Attackers to Target Air-Gapped Networks: Researchers at ESET discovered a previously undiscovered attack toolkit that they dubbed “Ramsay.” In their analysis of this threat, the researchers found that attackers could leverage the toolkit to collect and exfiltrate sensitive data from different kinds of environments, including air-gapped networks.
  • YouTube Channels Acted as C&C for New Astaroth Variant: Cisco Talos discovered a new Astaroth Trojan campaign targeting Brazilian users. Its subsequent deep dive into the malware revealed that it had leveraged various techniques, including YouTube channels as command-and-control (C&C) functionality, to avoid detection.
  • New C# Variant of Dark Crystal RAT Spotted in the Wild: FireEye received a new C# variant of the Dark Crystal RAT from the security firm’s threat intelligence team. The researchers analyzed this threat and found that two of the six executables used by the remote-access Trojan (RAT) were variants of the Plurox family.
  • New Features Added to Anubis Malware: Hold Security told Bank Info Security that the authors of Anubis had added new capabilities to their malware. Those features included an eye icon that allowed attackers to see when a victim was looking at their infected device and a new Yandex map integration to reveal the location of those devices.

Security Tip of the Week: Strengthen Your Anti-Ransomware Defenses

Security professionals can help defend their organizations against an attack at the hands of WannaCry or similar ransomware families by making sure they have an incident response (IR) plan and team in place to manage such an incident, and by practicing that plan regularly. Teams should continually update this process with the latest threat intelligence on evolving ransomware attack tactics.

More from

How will the Merck settlement affect the insurance industry?

3 min read - A major shift in how cyber insurance works started with an attack on the pharmaceutical giant Merck. Or did it start somewhere else?In June 2017, the NotPetya incident hit some 40,000 Merck computers, destroying data and forcing a months-long recovery process. The attack affected thousands of multinational companies, including Mondelēz and Maersk. In total, the malware caused roughly $10 billion in damage.NotPetya malware exploited two Windows vulnerabilities: EternalBlue, a digital skeleton key leaked from the NSA, and Mimikatz, an exploit…

3 Strategies to overcome data security challenges in 2024

3 min read - There are over 17 billion internet-connected devices in the world — and experts expect that number will surge to almost 30 billion by 2030.This rapidly growing digital ecosystem makes it increasingly challenging to protect people’s privacy. Attackers only need to be right once to seize databases of personally identifiable information (PII), including payment card information, addresses, phone numbers and Social Security numbers.In addition to the ever-present cybersecurity threats, data security teams must consider the growing list of data compliance laws…

ICS CERT predictions for 2024: What you need to know

4 min read - As we work through the first quarter of 2024, various sectors are continuously adapting to increasingly complex cybersecurity threats. Sectors like healthcare, finance, energy and transportation are all regularly widening their digital infrastructure, resulting in larger attack surfaces and greater risk exposure.Kaspersky just released their ICS CERT Predictions for this year, outlining the key cybersecurity challenges industrial enterprises will face in the year ahead. The forecasts emphasize the persistent nature of ransomware threats, the increasing prevalence of cosmopolitical hacktivism, insights…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today