Ransomware Surge & Living-Off-the-Land Tactics Remain Big Threats

Data from two new vendor reports summarizing threat activity over the past few months shows that ransomware and living-off-the-land attacks continue to top the list of threats facing enterprise organizations.

One of the reports, from Singapore-based Group-IB, is based on an analysis of data gathered by the vendor's computer emergency response team.

It shows that more than half (54%) of all malicious emails in the first six months of 2019 contained ransomware — a sharp increase from just 14% during the same period last year. Ransomware activity topped all other threats between January and the end of June this year.

Meanwhile, a report from Rapid7, based on an analysis of threat activity in the third quarter of 2019, shows attackers are continuing to heavily use legitimate tools and services — PowerShell — to build on and continue malicious campaigns. The security vendor's analysis shows that phishing continues to be the top reason for organizations getting breached, but most breach detections don't happen until the malware execution stage. Here are five takeaways from the vendor reports.

Ransomware Remerges as a Major Threat
Ransomware remerged as a major threat after seemingly being on the way out most of last year. In the first half of 2018, just 14% of the attacks that Group-IB tracked were ransomware-related, a sharp drop-off from the 40% recorded in 2017. Numerous vendor reports over the past year also have reported a steady decline in overall ransomware volumes and an increasing attacker focus on low-volume targeted attacks on enterprises. Group-IB's data for the first half of 2019 suggests that overall ransomware volumes have begun rebounding once again.

Alexander Kalinin, head of Group-IB's CERT, says a majority of the ransomware attacks observed in the first half of this year were of the mass-volume spray-and-pray variety that many had assumed was dying out.

However, many of these attacks showed certain similarities with targeted attacks in terms of their preparation, he notes. "The emails targeted [a] large number of people but within a specific industry," Kalinin says. Emails containing ransomware were often drafted to be relevant to targets within a specific industry — a feature that is typically associated with targeted attacks, he says.

The most prolific ransomware strain that Group-IB tracked in the first half of 2019 was Troldesh, a malware tool that attackers used not just to encrypt files but also to mine cryptocurrency and generate phony traffic for ad-fraud campaigns, according to Group-IB.

Attackers Are Increasingly Using Delayed Action Links for Downloading Malware
To try and evade antimalware systems, cybercriminals are increasingly eschewing malicious attachments for links in emails, which when clicked download malware. Twenty-nine percent of the emails that Group-IB encountered last quarter had links to malware rather than attachments. That was double the number compared with 2018.

The links are often inactive when a victim receives an email, Kalinin says. Clicking on the links would not result in any malware being downloaded. If anything does get downloaded, it is usually a benign file. Most anti-malware tools would scan the links in real time, mark them as safe, and send the email to the user's inbox.

The links get "activated" after the basic, initial vetting is over. If security checks are not performed over again, the victim receives an email marked as safe and can get infected, he notes. "Unlike attachments, the content accessible via links can be customized and replaced over time to bypass antivirus systems' checks," Kalinin says.

Once security checks are over, a cybercriminal can replace content accessible via a link with malware. "The content accessible via such links can also be customized, depending on the victim's location, operating system, and other parameters."

PowerShell Continues to Be an Attacker Favorite
Threat actors are increasing their use of legitimate admin, penetration testing, and other tools in attack campaigns. Among the most popular living-off-the-land tools that Rapid7 observed in use last quarter were cmd dot exe, ADExplorer dot exe, procdump64 dot exe, rundll32 dot exe, and mimikatz dot exe.

Few of the legitimate tools, though, were as popular as PowerShell. Rapid7 found that attackers are increasingly exploiting PowerShell to stay hidden when executing different attacks. Among the several tactics that attackers are using to exploit PowerShell include using old, less-restrictive versions of PowerShell and by bypassing policies set to restrict PowerShell using the ExecutionPolicy bypass switch, according to the vendor.

"PowerShell is installed on all systems and is extremely powerful," says Wade Woolwine, principal threat intelligence researcher at Rapid7. "Uninstalling old versions and configuring PowerShell to run in Constrained Language Mode are two mitigations," he says. Good endpoint detection and response capabilities are a must as well, he notes.

More Than 80% of Malicious File Were Disguised as .ZIP and .RAR files
Attackers sharply ramped up their use of .zip and .rar files to distribute malware in the first half of 2019. More than eight-in-10 malicious objects that Group-IB detected in the first six months of 2019 were delivered in password-protected archived files. The most common among them were .zip (32%) and .rar (25%).

The benefit for attackers is that such files make it hard for a majority of corporate security systems to automatically identify malware contained in them, Kalinin says. In many instances, the cybercriminals included the passwords for accessing the contents in the subject of the email, in the name of the archive, or in their subsequent correspondence with the victim. "Once unzipped and opened, it would download and install malware on a victim’s computer," Kalinin says.

Healthcare and Entertainment Industries Were Big Malware Targets
A majority of the breaches that Rapid7 investigated last quarter stemmed from phishing. When the initial compromise was not detected and contained, criminals executed malware — including ransomware — on target systems. Organizations in the healthcare and entertainment sectors were especially heavily targeted in such malware attacks.

Seventy-five percent of incidents that Rapid7 investigated at entertainment organizations and 62.5% of those at healthcare organizations involved some kind of malware. Both healthcare and entertainment organizations are popular targets because they have a reputation for paying ransoms, says Woolwine. "Attackers will always go after the easy money."

Others that were relatively heavily targeted in malware attacks included organizations in the manufacturing, retail, and real estate vertical markets.

Related Content:

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's top story: "How Medical Device Vendors Hold Healthcare Security for Ransom."