Ransomware Gangs and Malware: Three Major Activity Trend Predictions

Deep Instinct has released its 2022 Bi-Annual Cyber Threat Report, focusing on key malware and ransomware trends and tactics since the first half of 2022, and providing critical takeaways and predictions for the evolving cybersecurity threat landscape.

"2022 has been another record year for cybercriminals and ransomware gangs. As we know, these attackers are constantly using new and improved tactics that evade traditional cyber defenses to achieve their goals." - Mark Vaitzman, Team Leader, Deep Instinct Threat Research Lab

▌Malware and Ransomware Trends in the First Half of 2022

▶ Structural Changes in Criminal Gangs

Some of the most prevalent activities observed include changes in ransomware gangs, including LockBit, Hive, BlackCat, and Conti. The latter spawned "Conti Splinters" consisting of Quantum, BlackBasta, and BlackByte. Following the decline of Conti, these three prominent former affiliate groups operate independently.

▶ Constantly Evolving Malware Campaigns

The report highlights the reasons for major changes in Emotet, Agent Tesla, NanoCore, and others. For example, Emotet uses highly obfuscated VBA macros to avoid detection.

▶ As Microsoft Closes One Avenue, Attackers Seek Others

Researchers found that as Microsoft disabled macros by default in Office files, the use of malware documents, previously the number one attack vector, has decreased. Attackers observed are pivoting and implementing other methods to deploy their malware, such as LNK, HTML, and archive email attachments.

▶ Key Exploitable Vulnerabilities

Vulnerabilities like SpoolFool, Follina, and DirtyPipe highlight the exploitability of Windows and Linux systems, despite efforts to enhance their security. Analysis of the Known Exploited Vulnerabilities Catalog published by CISA shows that the number of exploited in-the-wild vulnerabilities surges every 3-4 months, with the next peak expected as the end of the year approaches.

▶ Data Exfiltration Attacks Expand to Third Parties

Criminal groups are leveraging data exfiltration in their attack flows to demand ransom for the leaked data. With fewer remedies in the event of sensitive data exfiltration, many criminal gangs are going even further, demanding ransom from third-party companies if the leaked data contains their sensitive information.

Undeniably, ransomware attacks remain a serious threat to organizations, as there are currently 17 leaked databases operated by criminal groups who use this data to launch attacks on third-party companies, most notably through social engineering, credential theft, and triple extortion attacks.

▌Three Specific Predictions

▶ Insiders and Affiliate Programs

Attackers look for the weakest link. As cybersecurity continues to innovate, some attackers choose to target weak spots or simply pay insiders. Groups like Lapsus$ do not rely on exploits, but rather look for insiders willing to sell data access within their organizations.

▶ Protestware is on the Rise

The trend of protestware has increased, which can be defined as self-sabotaging software weaponized with malware capabilities in an attempt to harm all or part of its users. The Russia-Ukraine war has led to a surge in protestware, the most famous example being the node-ipc wiper, a popular NPM package. Discovering such supply chain attacks is not easy, and they are usually only detected after affecting multiple victims.

▶ End-of-Year Attacks

Although we have not yet heard of major vulnerabilities in 2022 similar to Log4J or the 2021 Exchange cases, the number of CVEs publicly assigned to reported vulnerabilities increases year by year. Due to the large number of unpatched systems with 2021 CVEs, attackers are still exploiting older vulnerabilities during 2022.

Proactive defense is the best defensive posture against all unknown attacks. We recommend verifying the effectiveness of your defense system before an intrusion occurs. The Cyber Security Measure and Verification Platform (Senxun) helps enterprises accurately assess their defense capabilities with visual and quantitative data results by simulating the attack methods of real ransomware groups.

To target ransomware, Senxun has also launched a ransomware defense assessment service to help you conduct a technical assessment of your ransomware defense capabilities. Our assessment service covers all attack phases of the entire ransomware attack kill chain, identifying risks for enterprises at each attack phase.

| Reference Source

https://www.helpnetsecurity.com/2022/11/10/malware-ransomware-trends/