Kaspersky Lab on Business Threats: 2015 Saw the Number of Cryptolocker Attacks Double

Kaspersky Lab on Business Threats: 2015 Saw the Number of Cryptolocker Attacks Double

The tools used by cyber-criminals against businesses in 2015 were different to those used against consumers, according to Kaspersky Lab's review of corporate threats in the last twelve months.  They included greater exploitation of legitimate software programs and malware being signed with valid digital signatures to keep malicious files hidden for longer. Kaspersky Lab's experts also observed a steady rise in the number of corporate users attacked by ransomware. 

Kaspersky Lab's experts found that in 2015 well over half (58 per cent) of corporate PCs were hit with at least one attempted malware infection, up three percentage points on 2014.  One in three (29 per cent) business computers were exposed at least once to an Internet-based attack; with the exploitation of standard office applications seen three times as often as in consumer attacks.

Further, 41 per cent of business computers faced local threats, such as from infected USB sticks or other compromised removable media.  The experts also noted a seven per cent increase in the share of exploits targeting the Android platform, confirming hackers' growing interest in data stored on employees' mobile devices.

These attacks were found to be carefully planned, with cyber-criminals taking time to investigate a target company's contacts and suppliers and even the personal interests and browsing habits of individual employees. This insight was then used to identify legitimate websites for compromise and malware distribution, with the attacks often repeated over time.

Hunting down the money
In 2015, cyber-criminals and advanced persistent threats (APT) groups focused a great deal of attention on financial services organisations, such as banks, investment funds, and both stock and currency exchanges, including those handling cryptocurrencies.

These attacks included Carbanak, which penetrated the networks of banks, seeking out critical systems that would allow it to withdraw money. One successful attack alone would bring in as much as £1.6 - £6.6 million.  The cyber-espionage group, Wild Neutron also spent much of 2015 hunting down investment companies as well as organisations working with the cryptocurrency Bitcoin and companies involved in mergers and acquisitions.

Kaspersky Lab's experts observed a growing diversification in attack targets. For example, in 2015, the Chinese APT, Winnti APT switched targets from companies involved in computer games to those in pharmaceuticals and telecommunications.

"The future cyber-landscape for business includes a new attack vector: infrastructure, because almost all of an organisation's valuable data is stored on servers in data centers. We also expect tougher safety standards from regulators, which could lead to more cyber-criminals being arrested in 2016,"- says Yury Namestnikov, Senior Security Researcher at Global Research and Analysis Team, Kaspersky Lab.

Stealing at point of sale
Point-Of-Sale terminals, used by retailers and other consumer-facing organisations were another target for attack in 2015, with Kaspersky Lab products blocking more than 11,500 attempts to hack into PoS devices.  The company knows of ten families of programs designed to steal data from PoS terminals, and seven of them appeared for the first time this year.

The rise and rise of ransomware 
2015 also saw a doubling of the number of cryptolocker attacks, with Kaspersky Lab detecting cryptolockers on more than 50 thousand corporate machines. This could reflect the fact that ransoms received from organisations can be far larger than those received from individuals.  There is also a greater likelihood of the ransom being paid. Many companies simply cannot function if the information on several critical computers or servers is encrypted and inaccessible.

"Organisations that have fallen victim to a cryptolocker can find themselves faced with a ransom demand to stop a DDoS-attack, decrypt files, or maintain the confidentiality of any stolen information. Because the evidence shows that cyber-criminals don't always honor the agreement once the ransom has been paid - as happened in the case of the DDoS-attacks on Proton-mail, many of those affected should call in law enforcement and computer security experts, "- says Yury Namestnikov, Senior Security Researcher at Global Research and Analysis Team, Kaspersky Lab. 

Kaspersky Lab recommends that companies take steps to reduce risk and to increase their knowledge of the latest threats.  The basic principles of security in corporate networks remain the same: train employees, establish robust security processes and make full use of new technologies and techniques as each additional layer of protection reduces the risk of network penetration.

To eliminate the threat of ransomware infection, companies should use protection against exploits and ensure that their security solutions include behavioral detection methods, such as Kaspersky Lab's System Watcher.

For further information: 

  • Read how to reduce the risk of APT infection here
  • Find mitigation strategies here
  • Use Threat Intelligence services. For example, Kaspersky Lab provides Kaspersky Intelligence Service. Timely adjustment and verification of networks based on this data helps to protect you from attacks or to identify an attack in the early stages.

Read the full report on http://Securelist.com/

About Kaspersky Lab

Kaspersky Lab is one of the world's fastest-growing cybersecurity companies and the largest that is privately-owned. The company is ranked among the world's top four vendors of security solutions for endpoint users (IDC, 2014). Since 1997 Kaspersky Lab has been an innovator in cybersecurity and provides effective digital security solutions and threat intelligence for large enterprises, SMBs and consumers. Kaspersky Lab is an international company, operating in almost 200 countries and territories across the globe, providing protection for over 400 million users worldwide. 

Kaspersky Lab: http://www.kaspersky.co.uk/

Related News

Bitcoin Malware Attacks Declined This Year, Says Kaspersky

According to a new report by Kaspersky Lab, an online security company, bitcoin malware has still been circulated for the year but the number of attacks has declined. These attacks usually come in the form of malicious emails that encrypt ransomware on computers and demand bitcoin payments to unlock the files or remove malware. The company's report on cybersecurity threats showed that bitcoin malware attacks accounted for 9% of financial bugs detected. Programs that stole funds from bitcoin wallets accounted for 6%. In comparison to Kaspersky's Q2 report last year, illicit bitcoin malware....

Kaspersky Data Shows Bitcoin Malware Attacks Declining in 2015

A new report from Kaspersky Lab has found developers continue to target users with malware geared toward illicitly generating or stealing bitcoin, though rates have fallen over the past year. According to the company's report on cybersecurity threats, bitcoin mining malware accounted for 9% of financial bugs detected. Programs designed to steal bitcoins from wallets accounted for 6%. Source: Kaspersky Lab. These figures suggest a possible decline in activity. According to Kaspersky Lab's Q2 report from last year, detection rates for illicit mining programs and wallet stealers accounted for....

Number of Ransomware Attacks More Than Doubled In Q3 2016

Nearly 1.2 million money-stealing malware incidents were discovered in Q3 of 2016. Additionally, over 821,000 unique device crypto ransomware attacks were successfully blocked. Every time a report related to ransomware is published, there is a growing reason for concern. Although the public knows about this threat, the number of attacks continues to increase. In fact, a new Kaspersky Labs report indicates things are starting to get out hand rather quickly. In Q3 of 2016, there have been 3.5 times as many ransomware modifications as before. Criminals seem to be enjoying themselves when it....

Report: Bitcoin Targeted in 22% of Financial Malware Attacks

Security firm Kaspersky Lab has found that bitcoin is the target in more than one fifth of all malware attacks aimed at victims' money. According to Kaspersky's latest threat report, entitled 'IT Threat Evolution Q2 2014', bitcoin mining malware accounted for 14% of attacks in the second quarter of 2014, while bitcoin wallet stealers accounted for 8%. Keyloggers, which can be used to compromise both bitcoin and banking services, also made the list, with 4% of all attacks attributed to various forms of key logging malware. Traditional banking malware still leads the way with 74%, but....

Kaspersky Lab Says That Cryptocurrency Is The Future Of A United Society

The international community is not ready to use cryptocurrency, though it is a great invention. This is according to Evgeny Kaspersky, the head of the largest privately-owned cybersecurity company and international software security group Kaspersky Lab. Once cryptocurrencies develop to the point where they can replace national currencies, governments will ban them immediately says Evgeny. Kaspersky Lab provides cybersecurity services, including anti-virus for over 300 million users and over 250,000 corporate clients worldwide. Evgeny Kaspersky stated during the Kaspersky Digital Radio....