May 18, 2020 By David Bisson 3 min read

Last week in security news, researchers revealed that WannaCry dominated their ransomware detections in the first quarter of 2020. Speaking of ransomware, a new variant of the REvil family garnered attention in the security community for its updated capabilities. News also emerged last week of a ransomware attack that targeted the Texas court system.

Top Story of the Week: WannaCry Still Relevant 3 Years After Global Outbreak

ESET disclosed that WannaCry, or WannaCryptor, accounted for 40.5 percent of all its ransomware detections in Q1 2020. Researchers observed this threat abusing EternalBlue, the same exploit that facilitated its global outbreak in May 2017, to target unpatched systems in Thailand, Turkey and Indonesia. Even so, it used the exploit in Q1 2020 about half as frequently as it did in the second quarter of 2019.

WannaCry’s dominance was not limited to the first few months of 2020, either. Kaspersky revealed that it was the most common ransomware strain in 2019, affecting 164,433 users and accounting for 21 percent of detected ransomware attacks that year.

Source: iStock

Also in Security News

  • Monero Miners Spread by Blue Mockingbird in Enterprise Attacks: Red Canary Intel determined that a group of similar threat activity known as “Blue Mockingbird” traced back to December 2019. A closer look revealed that this activity exploited a deserialization vulnerability (CVE-2019-18935) to target enterprise networks with the XMRig Monero miner as its payload.
  • Texas Court System Struck by Ransomware: According to ZDNet, the Office of Court Administration (OCA) revealed that ransomware had made its way through its branch network, thereby affecting the state of Texas’s court system. In response, OCA disabled its linked servers and websites to limit the damage resulting from the attack.
  • Latest Version of REvil RaaS Arrives With New Attack Capabilities: The Intel 471 malware intelligence team came across version 2.2 of the REvil ransomware-as-a-service (RaaS) family. In its analysis, it found that the threat came with a new persistence mechanism and leveraged Windows Restart Manager to terminate processes.
  • Millions of Windows- and Linux-Based Devices Vulnerable to Thunderspy Attacks: A student at the Eindhoven University of Technology first learned that malicious actors could pull off these attacks with just some portable hardware, a screwdriver and physical access to a Thunderport-equipped machine. In effect, they could target millions of Windows- and Linux-based machines with “Thunderspy” attacks.
  • Top 10 Regularly Exploited Flaws Disclosed by DHS: In mid-May, the United States Department of Homeland Security (DHS) disclosed the top 10 vulnerabilities regularly exploited by digital attackers. The top three security flaws were CVE-2017-11882, CVE-2017-0199 and CVE-2012-0158; all of them related to Microsoft’s Object Linking and Embedding (OLE) technology.
  • Ramsay Toolkit Enables Attackers to Target Air-Gapped Networks: Researchers at ESET discovered a previously undiscovered attack toolkit that they dubbed “Ramsay.” In their analysis of this threat, the researchers found that attackers could leverage the toolkit to collect and exfiltrate sensitive data from different kinds of environments, including air-gapped networks.
  • YouTube Channels Acted as C&C for New Astaroth Variant: Cisco Talos discovered a new Astaroth Trojan campaign targeting Brazilian users. Its subsequent deep dive into the malware revealed that it had leveraged various techniques, including YouTube channels as command-and-control (C&C) functionality, to avoid detection.
  • New C# Variant of Dark Crystal RAT Spotted in the Wild: FireEye received a new C# variant of the Dark Crystal RAT from the security firm’s threat intelligence team. The researchers analyzed this threat and found that two of the six executables used by the remote-access Trojan (RAT) were variants of the Plurox family.
  • New Features Added to Anubis Malware: Hold Security told Bank Info Security that the authors of Anubis had added new capabilities to their malware. Those features included an eye icon that allowed attackers to see when a victim was looking at their infected device and a new Yandex map integration to reveal the location of those devices.

Security Tip of the Week: Strengthen Your Anti-Ransomware Defenses

Security professionals can help defend their organizations against an attack at the hands of WannaCry or similar ransomware families by making sure they have an incident response (IR) plan and team in place to manage such an incident, and by practicing that plan regularly. Teams should continually update this process with the latest threat intelligence on evolving ransomware attack tactics.

More from

Ransomware payouts hit all-time high, but that’s not the whole story

3 min read - Ransomware payments hit an all-time high of $1.1 billion in 2023, following a steep drop in total payouts in 2022. Some factors that may have contributed to the decline in 2022 were the Ukraine conflict, fewer victims paying ransoms and cyber group takedowns by legal authorities.In 2023, however, ransomware payouts came roaring back to set a new all-time record. During 2023, nefarious actors targeted high-profile institutions and critical infrastructure, including hospitals, schools and government agencies.Still, it’s not all roses for…

What should an AI ethics governance framework look like?

4 min read - While the race to achieve generative AI intensifies, the ethical debate surrounding the technology also continues to heat up. And the stakes keep getting higher.As per Gartner, “Organizations are responsible for ensuring that AI projects they develop, deploy or use do not have negative ethical consequences.” Meanwhile, 79% of executives say AI ethics is important to their enterprise-wide AI approach, but less than 25% have operationalized ethics governance principles.AI is also high on the list of United States government concerns.…

Hive0051 goes all in with a triple threat

13 min read - As of April 2024, IBM X-Force is tracking new waves of Russian state-sponsored Hive0051 (aka UAC-0010, Gamaredon) activity featuring new iterations of Gamma malware first observed in November 2023. These discoveries follow late October 2023 findings, detailing Hive0051's use of a novel multi-channel method of rapidly rotating C2 infrastructure (DNS Fluxing) to deliver new Gamma malware variants, facilitating more than a thousand infections in a single day. An examination of a sample of the lures associated with the ongoing activity reveals…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today