Check Point Cyber ​​Attack Trends 2018 Mid-Year Report: Hackers Target Cloud Infrastructure

Check Point recently released ” Cyber ​​Attack Trends 2018 Mid-Year Report”, pointing out that cybercriminals are using cryptocurrency (Cryptomining) malware to attack corporate attacks, thereby increasing illegal sources of income. At the same time, cloud infrastructure has gradually become a hot target.

Between January and June 2018, the number of organisations affected by Cryptomining malware doubled to 42%, compared to 20.5% in the second half of 2017. Cryptomining malware can make cybercriminals use up to 65% CPU power, hijacking the victim’s CPU or GPU power and existing resources to mine cryptocurrency. The three most common malware variants in the first half of 2018 were cryptocurrency mining software.

There is another new trend during this period, and Check Point has detected an increasing number of attacks against cloud infrastructure. As companies move more IT assets and data into the cloud, criminals are turning to the cloud to take advantage of its dominant computing power.

The Trends in Cyber Attacks: The 2018 Report details several essential types of malware – Cryptomining, ransomware, malware for banking and mobile. These findings are based on Insight Point ThreatCloud intelligence data from January to June 2018 and describe the primary tactics of cyber criminals attacking businesses.

Maya Horowitz, Manager of Threat Intelligence at Check Point, said: “The trend of cybercrime in the first half of this year continues our forecast at the end of 2017 while making full use of the crypto mining malware that is not easily detected to maximise profits. We also found that for cloud-based Complex attacks on facilities and multi-platform environments are growing. These multi-faceted, fast, large-scale fifth-generation attacks are becoming more frequent, and organisations need to adopt multi-layered network security policies to prevent these attacks from occupying their networks and data.

Major Cryptominers in the first half of 2018

1. Coinhive (30%) – A Cryptominer mining software that performs Monero online mining operations without the user’s permission when the user visits the web page. Coinhive only appeared once in September 2017, but 12% of organisations worldwide were attacked.
2. Crytoploot (23%) – A JavaScript Cryptominer mining software that performs Monero online mining operations without the user’s permission when the user visits the web page.
3. JSEcoin (17%) – Web-based Cryptominer, which performs Monero online mining without the user’s permission when the user visits the web page.

Major ransomware in the first half of 2018

1. Locky (40%) – This ransomware is primarily spread through spam spoofed as attachments to Word or Zip archives, enticing the victim to install malware.
2. WannaCry (35%) – The ransomware was widely distributed in May 2017, using the Windows operating system SMB vulnerability EternalBlue to spread rapidly across the network.
3. Globeimposter (8% ) – spread through spam campaigns, malvertising and exploit kits. After encryption, the ransomware appends the .crypt extension to each encrypted file.

Major mobile malware in the first half of 2018

1. Triada (51%) – A modular backdoor for Android that grants the hyper user access to malware downloads to embed malware into system processes. Triada also loads fraudulent URLs in the browser
2. Lokibot (19%) – A mobile banking Trojan for Android smartphones that turns into malware when a victim tries to remove their admin rights.
3. Hidad (10%) – An Android malware that repackages legitimate apps and publishes them to third-party app stores. It provides access to crucial security details built into the operating system, allowing attackers to steal sensitive user data.

Major bank malware in the first half of 2018

1. Ramnit (29%) – A banking Trojan that steals bank certificates, FTP passwords, session cookies and personal data.
2. Dorkbot (22%) – A banking Trojan that steals victim credentials via web-injects and activates when a user attempts to log in to their bank account.
3. Zeus (14%) – A Trojan for Windows platforms that typically steals bank information through keystroke logging and form fetching in the browsers of these platforms.

You can download the full Check Point here.