The Revival of Ransomware: Webroot Reveals 2019’s Nastiest Threats

Dive into the Nastiest Malware of 2019:

Webroot’s 2019 Nastiest Malware includes:

Ransomware – Ransomware continued to see success by evolving a more targeted model initially adopted in previous years. SMBs remain a prime target as they struggle with limited security budget and skills. Whether its phishing attacks targeting employees or brute forcing unsecured RDP, ransomware is as effective as ever, cementing its place on our list for another year. The nastiest include:

1. Emotet – Trickbot – Ryuk (“Triple Threat”) – One of the most successful chains of 2019 in terms of financial damages. These strains have shifted their focus to more reconnaissance-based operations. They assign a value to the targeted network post infection and then send the ransom for that amount after moving laterally and deploying the ransomware.
   1. Trickbot/Ryuk – The second stage payload for Emotet in the first half of 2019, Ryuk infections that are typically delivered by Trickbot result in the mass encryption of entire networks.
   2. Dridex/Bitpaymer – Dridex is now being used as an implant in the Bitpaymer ransomware infection chain and is also being delivered as a second stage payload off of Emotet.
2. GandCrab – One the most successful instance of RaaS (ransomware-as-a-service) to date, the authors have boasted shared profits in excess of $2 billion.
3. Sodinokibi – Sodin / REvil – This combination arose after the retirement of GandCrab. It’s not uncommon for successful threat actors who receive a lot of attention to try to start new projects in an attempt remain successful.
4. Crysis/Dharma – Back for its second year on the Nastiest Malware list, this ransomware was actively distributed in the first half of 2019. Almost all infections observed were distributed through RDP compromise.

Marketing Technology News: SparkPost Hires Tech Executive Sam Holding to Lead International Business Growth

Phishing – Email-based malware campaigns increased dramatically in complexity and believability in 2019. Phishing campaigns became more personalized and extortion emails claimed to have captured lude behavior using compromised passwords. The nastiest phishing attacks include:

1. Company Impersonation – The biggest security concern at the office is often an employee, not a hacker in some remote location. The year 2019 continued to prove that failure to follow best practices – including reuse and sharing of passwords and familiarity with the top impersonated brands like Microsoft, Facebook, Apple, Google and PayPal – caused significant damage.
2. Business Email Compromise (BEC) – In 2019 there was a rise of email address hijacking and deep fakes. Individuals who are responsible for sending payments or purchasing gift cards were targeted through spoof email accounts impersonating company executives or familiar parties. Victims were tricked into giving up wire transfers, credentials, gift cards and more.

Marketing Technology News: Accenture and SAP Build Prototype that Uses Distributed Ledger Technology to Enable More Efficient, Secure and Reliable Payments Between Banks and Customers

Botnets – Botnets remained a dominant force in the infection attack chain. No other type of malware delivered more payloads of ransomware or cryptomining. The three nastiest include:

1. Emotet – The most prevalent malware of 2018 continued its dominance in 2019. Despite a brief shutdown in June, Emotet resurfaced in September as the largest botnet delivering varying malicious payloads.
2. Trickbot – Trickbot’s modular infrastructure makes it a serious threat for any network it infects. Its combination with Ryuk ransomware is one of the more devastating targeted attacks of 2019.
3. Dridex – Once considered one of the most prominent banking trojans, Dridex is now used as an implant in the infection chain with Bitpaymer ransomware.

Cryptomining & Cryptojacking – The explosive growth of cryptojacking sites in 2017-2018 is gone. Cryptomining will not die entirely, however, because it is low-risk, guaranteed money, while also less “malicious” and profitable than ransomware. The nastiest campaigns of 2019 include:

1. Hidden Bee – An exploit delivering cryptomining payloads, Hidden Bee first started last year with IE exploits and has now evolved into payloads inside JPEG and PNG images through stenography and WAV media formats flash exploits.
2. Retadup – A cryptomining worm with over 850,000 infections, Retadup was removed in August by Cybercrime Fighting Center (C3N) of the French National Gendarmerie after they took control of the malware’s command and control server.

Marketing Technology News:  Usage Insights: The 3 Keys to Software Monetization Innovation