The Security Skeptic

Malware Landscape 2022: unabated malware growth, continued exploitation of IoT devices

My colleagues at Interisle and I have published a study, Malware Landscape 2022: A Study of the Scope and Distribution of Malware. The study, which analyzed 2.5 million records of distinct malware events from May 2021 to April 2022 collected by the Cybercrime Information Center, explains what malware was most prevalent, where malware was served from, and what resources criminals used to pursue their attacks.

Among the major findings in the study, we report that:

• The most frequently reported malware targets Internet of Things devices - surveillance cameras, sensors, or embedded technologies.
• Asia-Pacific networks host most IoT malware. China, India, and Australia represent 81% of malware that targeted IoT devices.
• Information stealers, ransomware, and backdoors are the most prevalent “endpoint” malware, i.e., malicious software that targets tablets, mobile phones, laptops, and PCs.
• Networks in the United States and China host the most endpoint malware and 8 of the 10 registrars with the most malware domains reported are headquartered in North America.
• Domains registered in the new Top-level Domains (TLDs) are disproportionately attractive to malware attackers. The new TLDs represent only 8% of the domain name registration market, but they contained 24% of reported malware domains. By contrast, the country code TLDs represent 39% of the market, but only 26% of the reported malware domains.

We also found that malware attackers have made effective use of cloud services, including file sharing services, code repositories, and storage services. While most uses of anonymous file sharing and code repositories are well-intentioned, malware attackers have used these services to distribute source code, attack code, and files containing compromised credentials or cryptographic keys.

For our malware studies we develop and maintain a taxonomy that is based a classification proposed by the Computer Antivirus Research Organization (CARO). Our taxonomy extends that original effort in the context of cybercrimes as defined in the Council of Europe’s Convention on Cybercrime.  

A summary of the study can be found at https://www.cybercrimeinfocenter.org/malware-landscape-2022.

 

Happy reading!

Interisle Study Reveals Alarming Rise in Online Abuse and Identifies Exploitable Links in Cybercriminal Supply Chains

My Interisle colleagues and I today published our 2024 Cybercrime Suppy Chain study.

We analyzed 16 million cybercrime events to expose a dramatic rise in criminal exploitation of name, address, hosting, and financial supply chains.

Our year-over-year findings show that cybercriminals exploit lax policies to easily and cheaply obtain resources for phishing, malware, and spam campaigns.

In our report, we provide actionable insights for those aiming to curb cybercrime.

Among the major findings in the study, Interisle reports that:

• The total number of malware, phishing, and spam attacks grew year-over-year by nearly 54%, to nearly 16.3 million attacks. Spam doubled, from 4 million to 8 million attacks.
• Consumption of domain name resources by cybercriminals increased 81%. Over 8.6 million unique domains were used in cyberattacks compared to 4.8 million last year.
• Over 2.6 million domains used in cyberattacks were registered in bulk, a 106% increase compared to last year.
• Nearly 1.2 million subdomain hostnames were found to be used in attacks, an increase of over 114% compared to last year.
• New generic top-level domains (gTLDs) accounted for 37% of cybercrime domains reported while holding only 11% of the total domain name market.
• The number of IPv4 addresses reported for hosting cybercrime nearly doubled in both China and India.

Efforts to make it more difficult and costly for criminals to acquire these resources, conduct crimes, and “launder” criminal proceeds would help reduce the profitability and allure of the business.

Among our recommendations:

• Implement rigorous identify verification / certification requirements for parties wishing to bulk register domain names.
• Limit the number of accounts and subdomains that a customer can register with free or inexpensive web hosting (subdomain) providers.
• Expand the deployment of automated systems to screen for suspicious resource registration and use patterns.
• Create “Trusted Reporter” programs across industry to facilitate swift suspension of cybercrime resources identified by recognized and trusted cybercrime monitors.
• Penalize service providers that consistently and disproportionately supply cybercriminals with attack resources or incentivize them to stop.

We note that sustainable change will only occur if a broad range of stakeholders (including governments, where necessary) step up and implement real-world solutions to reduce criminal access to resources.

The Cybercrime Supply Chain 2024 report is available at https://interisle.net/CybercrimeSupplyChain2024.pdf.

Interisle publishes measurements of where criminals obtain resources they use to perpetrate cybercrimes at the Cybercrime Information Center and offers cybercrime awareness videos at https://www.youtube.com/@cybercrimeinfocenter.

Malware quarterly reports for July-September 2024 is now posted at the Cybercrime Information Center. For the period...

• Malware identified as targeting endpoint devices increased 277% over the prior period.
• WordPress blog sites used for malware accounted for nearly all the malicious documents reported for this period.
• We continue to see an uptick in malicious scripts.
• IPv4 addresses reported for exhibiting characteristics of attackware and traffic injectors increased 38% to just under 1 million.
• ASNs in China and India again have the most IPv4 addresses reported for hosting malware.

More malware trends for the period at https://www.cybercrimeinfocenter.org/malware-trends-july-september-2024.

For historical reporting of malware activity, see https://www.cybercrimeinfocenter.org/malware-activity.