As readers of this online security magazine largely understand, Cryptocurrency mining is the process by which transactions are verified and tallied to the public ledger, known as the blockchain, and also the means through which new currency is released. Anyone with access to the internet and suitable computer processing power can participate in mining. The mining operation involves compiling recent transactions into blocks and trying to solve a computationally difficult puzzle. The participant who first solves the puzzle gets to place the next block on the blockchain and claim the rewards. The rewards, which incentivize mining, are both the transaction fees associated with the transactions compiled in the block as well as newly released currency.
New research from WatchGuard Technologies shows that cryptomining malware increased during Q1 2018 and will most likely continue growing in prevalence over the coming quarters. WatchGuard’s quarterly Internet Security Report found that 98.8 percent of common Linux/Downloader dropper and downloader malware variants caught by its Firebox UTM appliances in Q1 were designed to deliver a popular cryptominer payload.
Threat intelligence from Q1 2018 revealed that 98.8 percent of seemingly common Linux/Downloader malware variants were actually designed to deliver a popular Linux-based cryptocurrency miner. This is just one of several signs that malicious crypto-mining malware is becoming a top tactic among cybercriminals. The complete report details delivery mechanisms for these crypto-miner attacks and explores other prevalent security threats targeting small to midsize businesses (SMBs) and distributed enterprises today.
“Our Threat Lab team has uncovered multiple indicators that suggest malicious cryptominers are becoming a mainstay in cybercriminals’ arsenals and will continue to grow more dominant in Q2,” said Corey Nachreiner, chief technology officer at WatchGuard Technologies. “While ransomware and other advanced threats are still a major concern, these new crypto-miner attacks illustrate that bad actors are constantly adjusting their tactics to find new ways to take advantage of their victims. In fact, once again in Q1, we saw nearly half of all malware slip past basic signature-based antivirus solutions due to various obfuscation methods. One way every organization can become more secure against these sophisticated, evasive threats is to deploy defenses enabled with advanced malware prevention like our APT Blocker service.”
WatchGuard’s Internet Security Report offers insights on the top cyber threats each quarter, along with defense recommendations SMBs can use to protect themselves. The findings are based on data from tens of thousands of active Firebox UTM appliances around the world. The top takeaways from the Q1 2018 report include:
- Cryptocurrency miners are on the rise. Several cryptocurrency miners appeared for the first time in WatchGuard’s list of the top 25 malware variants. Firebox appliances have a rule called Linux/Downloader, which catches a variety of Linux “dropper” or “downloader” programs that download and run malware payloads. Usually, these droppers download a wide range of malware, but in Q1 2018, 98.8 percent of Linux/Downloader instances were trying to download the same popular Linux-based crypto miner. Evidence from Q2 so far indicates that crypto-mining malware will stay on WatchGuard’s top 25 list and may even crack the top 10 by the end of the quarter.
- The Ramnit trojan makes a comeback in Italy. The only malware sample on WatchGuard’s top 10 list that hadn’t appeared in a past report was Ramnit, a trojan that first emerged in 2010 and had a brief resurgence in 2016. Nearly all (98.9 percent) of WatchGuard’s Ramnit detections came from Italy, indicating a targeted attack campaign. Since past versions of Ramnit have targeted banking credentials, WatchGuard advises Italians to take extra precautions with their banking information and enable multi-factor authentication for any financial accounts.
- For the first time, APAC reports the highest malware volume. In past reports, APAC has trailed EMEA and AMER in the number of reported malware hits by a wide margin. In Q1 2018, APAC received the most malware overall. The vast majority of these attacks were Windows-based malware and 98 percent were aimed at India and Singapore.
- Nearly half of all malware eludes basic antivirus (AV) solutions. WatchGuard UTM appliances block malware using both legacy signature-based detection techniques and a modern, proactive behavioral detection solution – APT Blocker. When APT Blocker catches a malware variant, it means the legacy AV signatures missed it. This zero-day malware (a term for malware that is able to evade traditional signature-based AV) accounted for 46 percent of all malware in Q1. This level of zero-day malware suggests that criminals are continuing to use obfuscation techniques to beat traditional AV services, emphasizing the importance of behavior-based defenses.
- Mimikatz targets the US, skips Asia Pacific. The Mimikatz Windows credential-stealing malware reappeared on WatchGuard’s top 10 malware list after several quarters of absence. Two thirds of the detection of this malware was in the United States and under 0.1 percent of detections were in APAC, possibly due to the complexity of double-byte characters in countries like Japan that use a symbol-based language for passwords.
The complete Internet Security Report features a detailed breakdown of the record-breaking GitHub 1.35 Tbps DDoS attack, as well as analysis of the quarter’s top malware and network attacks, and key defense tactics for SMBs.
For more information, download the full report here.
Steven Bowcut, CPP, PSP is the Editor-in-Chief for Brilliance Security Magazine
