Cryptomining replaces ransomware as most popular cybercrime malware

Skybox Security has recently released its mid-year update to the Vulnerability and Threat Trends Report which analyses vulnerabilities, exploits and threats in play. The report, compiled by the team of security analysts at the Skybox Research Lab, aims to help organisations align their security strategy with the reality of the current threat landscape.

The mid-year update explores trends observed from January to June of 2018. One of the most significant findings is the replacement of ransomware as the cybercriminal tool of choice with crypto mining malware. In the last six months of 2017, ransomware accounted for 32 per cent of attacks, while malicious crypto miners accounted for seven per cent. By the first half of 2018, the figures had switched almost exactly: malicious crypto miners accounted for 32 per cent of attacks while ransomware dropped to eight per cent.

“In the last few years, ransomware reigned supreme as the shortcut money-maker for cybercriminals,” said Ron Davidson, Skybox CTO and Vice President of R&D. “It doesn’t require data exfiltration, just encryption to hold the data hostage and a ransom note of how the victim can pay up. With crypto miners, the criminals can go straight to the source and mine cryptocurrency themselves. There’s no question of if they’ll be paid or not.”

Cryptomining uses the computational power of compromised assets to create new blocks in the blockchain of like Bitcoin and Monero. The malicious or unauthorised crypto mining approach indeed avoids several of the drawbacks of ransomware:

• The victim doesn’t need to be notified of the attack in order to pay the ransom, so it can continue indefinitely in a stealth manner.
• Cryptocurrency can be mined over long-periods of time, rather than the cybercriminal receiving a single lump-sum ransom payment.
• There is no decision of payment on the part of the victim — the attack itself controls how much money will be generated.

“Ransomware received a lot of attention in years past, especially thanks to the likes of WannaCry, NotPetya and BadRabbit,” said Skybox Director of Threat Intelligence Marina Kidron and leader of the Research Lab behind the report. “To some extent, organisations took note and put effective precautions in place, ensuring they had reliable back-ups and even thwarting attackers with decryption programs. So cybercriminals found — in cryptomining— a path of lesser resistance. The recent uptick in the value of cryptocurrencies also made this an incredibly profitable attack option.”

Other findings in the report appear to relate to this rise in crypto mining. Internet and mobile vulnerabilities made up nearly a third of all new vulnerabilities published in the first half of 2018. Google Android had by far the most vulnerabilities during that time period, exceeding the tally of the next five most vulnerable vendors combined. Android also logged 200 more vulnerabilities than it did in the second half of 2018. Malicious crypto mining has found an advantage in targeting the app store of the global market leader in mobile devices, with billions of potential targets worldwide.

Browser-based malware is also on the rise in the first half of 2018. “Out of all software today, web browsers are considered the most prone to malicious attacks,” said Kidron. “They constantly interact with websites and applications that cybercriminals have infected with malware like crypto miners and other threats via the web, which is notoriously difficult to detect. The crypto mining malware could be active as long as the web session is active, and ‘file-less’ crypto miners also can hide from conventional security tools as there’s no download or attachment to analyse.”

No matter the payload, attackers looking to exploit vulnerabilities have more resources than ever. Not only are dark web marketplaces rich with attack tools and services, and criminal forums ripe with information, vulnerabilities themselves have skyrocketed. New vulnerabilities catalogued by MITRE’s National Vulnerability Database doubled in 2017 over the previous year, and 2018 looks to be on track to shatter even that record. The 2017 surge and continued elevated numbers is largely due to organisational improvements at MITRE and increased security research by vendors and third–parties, including vendor-sponsored bug bounty programs. But no matter the reason, organisations have to employ smarter and faster ways to find the signal in the noise and mitigate vulnerability risks before they’re used in an attack.

Skybox recommends establishing a threat-centric vulnerability management (TCVM) program to adapt to these changes in the threat landscape and those yet to come. The TCVM approach helps security practitioners focus on the small subset of vulnerabilities most likely to be used in an attack by incorporating vulnerability and threat intelligence with the context of their assets, network and security controls. This way, remediation is targeted at the greatest areas of risk while leveraging all response options — patching as well as network-based changes.