Story image

Cyber attacks develop complexity, target Windows sysad tools - report

05 Dec 2018

Sophos has launched its 2019 Threat Report providing insights into emerging and evolving cybersecurity trends. 

The report, produced by SophosLabs researchers, explores changes in the threat landscape over the past 12 months, uncovering trends and how they are expected to impact cybersecurity in 2019.

In the report, Sophos CTO Joe Levy states, “The threat landscape is undoubtedly evolving; less-skilled cyber criminals are being forced out of business, the fittest among them step up their game to survive and we’ll eventually be left with fewer, but smarter and stronger, adversaries.

“These new cybercriminals are effectively a cross-breed of the once esoteric, targeted attacker, and the pedestrian purveyor of off-the-shelf malware, using manual hacking techniques, not for espionage or sabotage, but to maintain their income streams.”

The SophosLabs 2019 Threat Report focuses on these key cybercriminal behaviours and attacks:

Capitalist cybercriminals are turning to targeted ransomware attacks that are premeditated and reaping millions of dollars in ransom.

2018 saw the advancement of hand-delivered, targeted ransomware attacks that are earning cybercriminals millions of dollars.

These attacks are different than ‘spray and pray’ style attacks that are automatically distributed through millions of emails.

Targeted ransomware is more damaging than if delivered from a bot, as human attackers can find and stake out victims, think laterally, troubleshoot to overcome roadblocks, and wipe out backups so the ransom must be paid.

This “interactive attack style,” where adversaries manually manoeuvre through a network step-by-step, is now increasing in popularity.

Sophos experts believe the financial success of SamSam, BitPaymer and Dharma to inspire copycat attacks and expect more happen in 2019.

Cyber criminals are using readily available Windows systems administration tools 

This year’s report uncovers a shift in threat execution, as more mainstream attackers now employ Advanced Persistent Threat (APT) techniques to use readily available IT tools as their route to advance through a system and complete their mission – whether it’s to steal sensitive information off the server or drop ransomware:

  • Turning admin tools into cyber  attack tools
    In an ironic twist, or Cyber Catch-22, cybercriminals are utilising essential or built-in Windows IT admin tools, including Powershell files and Windows Scripting executables, to deploy malware attacks on users.
     
  • Cybercriminals are playing Digital Dominos
    By chaining together a sequence of different script types that execute an attack at the end of the event series, hackers can instigate a chain reaction before IT managers detect a threat is operational on the network, and once they break in it’s difficult to stop the payload from executing.
  • Cybercriminals have adopted newer Office exploits to lure in victims
    Office exploits have long been an attack vector, but recently cybercriminals have cut loose old Office document exploits in favour of newer ones.
     
  • EternalBlue becomes a key tool for cryptojacking attacks
    Patching updates appeared for this Windows threat more than a year ago, yet the EternalBlue exploit is still a favourite of cybercriminals; the coupling of EternalBlue to cryptomining software turned the activity from a nuisance hobby into a potentially lucrative criminal career. Lateral distribution on the corporate networks allowed the cryptojacker to quickly infect multiple machines, increasing payouts to the hacker and heavy costs to the user.

The continued threat of mobile and IoT malware

Malware’s impact extends beyond the organisation’s infrastructure as we see the threat from mobile malware grow apace.

With illegal Android apps on the increase, 2018 has seen an increased focus in malware being pushed to phones, tablets and other IoT devices.

As homes and businesses adopt more internet-connected devices, criminals have been devising new ways to hijack those devices to use as nodes in huge botnet attacks.

In 2018, VPNFilter demonstrated the destructive power of weaponised malware that affects embedded systems and networked devices that have no obvious user interface.

Elsewhere, Mirai Aidra, Wifatch, and Gafgyt delivered a range of automated attacks that hijacked networked devices to use as nodes in botnets to engage in distributed denial-of-service attacks, mine cryptocurrency and infiltrate networks.

Security flaw in Xiaomi electric scooters could have deadly consequences
An attacker could target a rider, and then cause the scooter to suddenly brake or accelerate.
Four ways the technology landscape will change in 2019
Until now, organisations have only spoken about innovative technologies somewhat theoretically. This has left people without a solid understanding of how they will ultimately manifest in our work and personal lives.
IDC: Top 10 trends for NZ’s digital transformation
The CDO title is declining, 40% of us will be working with bots, the Net Promoter Score will be key to success, and more.
Kiwi partner named in HubSpot’s global top five
Hype & Dexter is an Auckland-based agency that specialises in providing organisations with marketing automation solutions.
Moustache Republic expands Aussie presence with new exec
The Kiwi digital commerce partner has appointed a Sydney-based director to oversee the expansion of the company’s Australian footprint.
Epson’s new EcoTank range with two years printing per tank
With 11 new EcoTank printers that give an average user two years of printing and cost just $17.99/colour to refill, Epson is ready to change the game.
Te reo Māori goes global via language app called Drops
If you’re keen to learn a few words of Māori – or as much as 90% of the language, you may want to check out an Android and iOS app called Drops.
Reckon Group announces a steady profit in 2018
Reckon continued its investment in growth throughout the year with a development spend of $14.3 million.