Malicious Cryptocurrency Miners Gaining Momentum

WatchGuard’s Q1 2018 Internet Security Report reveals a rise in crypto-miner attacks and geographically targeted malwarecampaigns 

WatchGuard® Technologies’ latest Internet Security Report reveals that 98.8 percent of seemingly common Linux/Downloader malware variants in Q1 2018 were actually designed to deliver a popular Linux-based cryptocurrency miner. This is just one of several signs that malicious crypto-mining malware is becoming a top tactic among cyber criminals. The report details delivery mechanisms for these crypto-miner attacks and explores other prevalent security threats targeting small to medium sized businesses (SMBs) and distributed enterprises.

The findings are based on anonymised threat intelligence from nearly 40,000 active WatchGuard UTM appliances worldwide, which blocked more than 23 million malware variants (628 per device) and over 10 million network attacks (278 per device) in Q1 2018. 

“Our Threat Lab team has uncovered multiple indicators that suggest malicious crypto miners are becoming a mainstay in cyber criminals’ arsenals and will continue to grow more dominant,” said Corey Nachreiner, chief technology officer at WatchGuard Technologies. “While ransomware and other advanced threats are still a major concern, these new crypto-miner attacks illustrate that bad actors are constantly adjusting their tactics to find new ways to take advantage of their victims. Once again, we saw nearly half of all malware slip past basic signature-based antivirus solutions due to various obfuscation methods. One way every organisation can become more secure against these sophisticated, evasive threats is to deploy defences enabled with advanced malware prevention.”

Other key findings in the latest WatchGuard Internet Security Report include:

• For the first time, APAC reports the highest malware volume.In past reports, APAC has trailed EMEA and AMER inthe number of reported malware hits by a wide margin. In Q1 2018, APAC received the most malware overall and the vast majority of these attacks were Windows-based malware and 98 percent were aimed at India and Singapore.
• Nearly half of all malware eludes basic antivirus (AV) solutions. WatchGuard UTM appliances block malware using both legacy signature-based detection techniques and a modern, proactive behavioural detection solution – APT Blocker. When APT Blocker catches a malware variant, it means the legacy AV signatures missed it. This zero daymalware – a term for malware that is able to evade traditional signature-based AV – accounted for 46 percent of all malware in Q1. This level of zero day malware suggests that criminals are continuing to use obfuscation techniquesto beat traditional AV services, emphasising the importance of behaviour-based defences.
• Mimikatz targets the US and skips Asia Pacific.The Mimikatz Windows credential-stealing malware reappeared on WatchGuard’s top 10 malware list after several quarters of absence. Two thirds of the detection of this malware wasin the United States and under 0.1 percent of detections were in APAC, possibly due to the complexity of double-byte characters in countries like Japan that use a symbol-based language for passwords.
• The Ramnit trojan makes a comeback in Italy.The only malware sample on WatchGuard’s top 10 list that hadn’t appeared in a past report was Ramnit, a trojan that first emerged in 2010 and had a brief resurgence in 2016. Nearly all (98.9 percent) of WatchGuard’s Ramnit detections came from Italy, indicating a targeted attack campaign. Since past versions of Ramnit have targeted banking credentials, WatchGuard advises Italians to take extra precautions with their banking information and enable multi-factor authentication for any financial accounts.

The complete Internet Security Report features a detailed breakdown of the record-breaking GitHub 1.35 Tbps DDoS attack, as well as analysis of the quarter’s top malware and network attacks, and key defence tactics for SMBs.