Last week in security news, researchers revealed that WannaCry dominated their ransomware detections in the first quarter of 2020. Speaking of ransomware, a new variant of the REvil family garnered attention in the security community for its updated capabilities. News also emerged last week of a ransomware attack that targeted the Texas court system.

Top Story of the Week: WannaCry Still Relevant 3 Years After Global Outbreak

ESET disclosed that WannaCry, or WannaCryptor, accounted for 40.5 percent of all its ransomware detections in Q1 2020. Researchers observed this threat abusing EternalBlue, the same exploit that facilitated its global outbreak in May 2017, to target unpatched systems in Thailand, Turkey and Indonesia. Even so, it used the exploit in Q1 2020 about half as frequently as it did in the second quarter of 2019.

WannaCry’s dominance was not limited to the first few months of 2020, either. Kaspersky revealed that it was the most common ransomware strain in 2019, affecting 164,433 users and accounting for 21 percent of detected ransomware attacks that year.

Source: iStock

Also in Security News

  • Monero Miners Spread by Blue Mockingbird in Enterprise Attacks: Red Canary Intel determined that a group of similar threat activity known as “Blue Mockingbird” traced back to December 2019. A closer look revealed that this activity exploited a deserialization vulnerability (CVE-2019-18935) to target enterprise networks with the XMRig Monero miner as its payload.
  • Texas Court System Struck by Ransomware: According to ZDNet, the Office of Court Administration (OCA) revealed that ransomware had made its way through its branch network, thereby affecting the state of Texas’s court system. In response, OCA disabled its linked servers and websites to limit the damage resulting from the attack.
  • Latest Version of REvil RaaS Arrives With New Attack Capabilities: The Intel 471 malware intelligence team came across version 2.2 of the REvil ransomware-as-a-service (RaaS) family. In its analysis, it found that the threat came with a new persistence mechanism and leveraged Windows Restart Manager to terminate processes.
  • Millions of Windows- and Linux-Based Devices Vulnerable to Thunderspy Attacks: A student at the Eindhoven University of Technology first learned that malicious actors could pull off these attacks with just some portable hardware, a screwdriver and physical access to a Thunderport-equipped machine. In effect, they could target millions of Windows- and Linux-based machines with “Thunderspy” attacks.
  • Top 10 Regularly Exploited Flaws Disclosed by DHS: In mid-May, the United States Department of Homeland Security (DHS) disclosed the top 10 vulnerabilities regularly exploited by digital attackers. The top three security flaws were CVE-2017-11882, CVE-2017-0199 and CVE-2012-0158; all of them related to Microsoft’s Object Linking and Embedding (OLE) technology.
  • Ramsay Toolkit Enables Attackers to Target Air-Gapped Networks: Researchers at ESET discovered a previously undiscovered attack toolkit that they dubbed “Ramsay.” In their analysis of this threat, the researchers found that attackers could leverage the toolkit to collect and exfiltrate sensitive data from different kinds of environments, including air-gapped networks.
  • YouTube Channels Acted as C&C for New Astaroth Variant: Cisco Talos discovered a new Astaroth Trojan campaign targeting Brazilian users. Its subsequent deep dive into the malware revealed that it had leveraged various techniques, including YouTube channels as command-and-control (C&C) functionality, to avoid detection.
  • New C# Variant of Dark Crystal RAT Spotted in the Wild: FireEye received a new C# variant of the Dark Crystal RAT from the security firm’s threat intelligence team. The researchers analyzed this threat and found that two of the six executables used by the remote-access Trojan (RAT) were variants of the Plurox family.
  • New Features Added to Anubis Malware: Hold Security told Bank Info Security that the authors of Anubis had added new capabilities to their malware. Those features included an eye icon that allowed attackers to see when a victim was looking at their infected device and a new Yandex map integration to reveal the location of those devices.

Security Tip of the Week: Strengthen Your Anti-Ransomware Defenses

Security professionals can help defend their organizations against an attack at the hands of WannaCry or similar ransomware families by making sure they have an incident response (IR) plan and team in place to manage such an incident, and by practicing that plan regularly. Teams should continually update this process with the latest threat intelligence on evolving ransomware attack tactics.

More from

Most organizations want security vendor consolidation

4 min read - Cybersecurity is complicated, to say the least. Maintaining a strong security posture goes far beyond knowing about attack groups and their devious TTPs. Merely understanding, coordinating and unifying security tools can be challenging.We quickly passed through the “not if, but when” stage of cyberattacks. Now, it’s commonplace for companies to have experienced multiple breaches. Today, cybersecurity has taken a seat in core business strategy discussions as the risks and costs have risen dramatically.For this reason, 75% of organizations seek to…

How IBM secures the U.S. Open

2 min read - More than 15 million tennis fans around the world visited the US Open app and website this year, checking scores, poring over statistics and watching highlights from hundreds of matches over the two weeks of the tournament. To help develop this world-class digital experience, IBM Consulting worked closely with the USTA, developing powerful generative AI models that transform tennis data into insights and original content. Using IBM watsonx, a next-generation AI and data platform, the team built and managed the entire…

How the FBI Fights Back Against Worldwide Cyberattacks

5 min read - In the worldwide battle against malicious cyberattacks, there is no organization more central to the fight than the Federal Bureau of Investigation (FBI). And recent years have proven that the bureau still has some surprises up its sleeve. In early May, the U.S. Department of Justice announced the conclusion of a U.S. government operation called MEDUSA. The operation disrupted a global peer-to-peer network of computers compromised by malware called Snake. Attributed to a unit of the Russian government Security Service,…

How NIST Cybersecurity Framework 2.0 Tackles Risk Management

4 min read - The NIST Cybersecurity Framework 2.0 (CSF) is moving into its final stages before its 2024 implementation. After the public discussion period to inform decisions for the framework closed in May, it’s time to learn more about what to expect from the changes to the guidelines. The updated CSF is being aligned with the Biden Administration’s National Cybersecurity Strategy, according to Cherilyn Pascoe, senior technology policy advisor with NIST, at the 2023 RSA Conference. This sets up the new CSF to…