Even cybercriminals need to slow down every so often.
The latest quarterly threat summary from Proofpoint Inc. found that there was actually some calm after the storm by the time June rolled around, following some mounting threat activity in the preceding months.
“Attackers like to take breaks some times,” said Patrick Wheeler, director of threat intelligence at Proofpoint. According to the report, the first five months of the year were dominated by malicious email campaigns of unprecedented volume, and new ransomware variants emerged quickly. In addition, Dridex actors were distributing Locky ransomware and repeatedly shifted tactics with new loaders, document attachment types, and new techniques to evade detection.
But suddenly, there was a lull. At the end of May, one of the largest botnets in the world suddenly went dark, and this brought the Dridex and Locky distribution to a near halt. At the same time, the hugely popular Angler exploit kit — an all-in-one toolkit that largely automates web-based cyber attacks — also went silent. In fact, exploit kit traffic observed by Proofpoint dropped by 96 per cent between April and mid-June.
Ransomware remains a major threat, according to the report. While Locky dominated email, CryptXXX dominated EK traffic. Among email attacks that used malicious document attachments, 69 per cent featured the new Locky ransomware in Q2, compared to 24 per cent in Q1. Wheeler described the ransomware growth in this quarter as “explosive.” Overall, the number of new ransomware variants grew by a factor of 5 to 6 since Q4 2015.
That’s why the lull in June should not be taken as a sign that enterprises can get complacent. “In general, when you see a new technique take off it’s because it’s working well.” Wheeler said it’s still important to have solutions in place that don’t just look into signature- based attacks.
Given the sheer volume of attacks coming through email, Proofpoint recommends investing in mail gateway solutions capable of detecting and preventing advanced attacks and those that do not involve malware to help minimize the number of threats coming into the network. Once these threats are in the network, malware and malicious traffic may be more difficult to detect and distinguish from legitimate business traffic.
Another interesting takeaway from Proofpoint’s quarterly report was that as many as 10 million Android devices were infected by a mobile exploit kit targeting multiple vulnerabilities to compromise devices, install fake apps, and push advertising to users without their consent. In particular, Proofpoint saw apps that used a “cocktail” approach, blending multiple vulnerabilities, each capable of taking over a device, to compromise as many versions of devices as possible.