The Security Skeptic

Malware Landscape 2022: unabated malware growth, continued exploitation of IoT devices

My colleagues at Interisle and I have published a study, Malware Landscape 2022: A Study of the Scope and Distribution of Malware. The study, which analyzed 2.5 million records of distinct malware events from May 2021 to April 2022 collected by the Cybercrime Information Center, explains what malware was most prevalent, where malware was served from, and what resources criminals used to pursue their attacks.

Among the major findings in the study, we report that:

• The most frequently reported malware targets Internet of Things devices - surveillance cameras, sensors, or embedded technologies.
• Asia-Pacific networks host most IoT malware. China, India, and Australia represent 81% of malware that targeted IoT devices.
• Information stealers, ransomware, and backdoors are the most prevalent “endpoint” malware, i.e., malicious software that targets tablets, mobile phones, laptops, and PCs.
• Networks in the United States and China host the most endpoint malware and 8 of the 10 registrars with the most malware domains reported are headquartered in North America.
• Domains registered in the new Top-level Domains (TLDs) are disproportionately attractive to malware attackers. The new TLDs represent only 8% of the domain name registration market, but they contained 24% of reported malware domains. By contrast, the country code TLDs represent 39% of the market, but only 26% of the reported malware domains.

We also found that malware attackers have made effective use of cloud services, including file sharing services, code repositories, and storage services. While most uses of anonymous file sharing and code repositories are well-intentioned, malware attackers have used these services to distribute source code, attack code, and files containing compromised credentials or cryptographic keys.

For our malware studies we develop and maintain a taxonomy that is based a classification proposed by the Computer Antivirus Research Organization (CARO). Our taxonomy extends that original effort in the context of cybercrimes as defined in the Council of Europe’s Convention on Cybercrime.  

A summary of the study can be found at https://www.cybercrimeinfocenter.org/malware-landscape-2022.

 

Happy reading!

A 5-minute stakeholder intervention before the EU HLIG on #DNSabuse

I was invited to participate in an 11 March 2022 meeting of the EU High Level Internet Governance expert group to discuss domain name abuse. Following a presentation of a Study on Domain Name System (DNS) Abuse commissioned by the European Commission, I gave a 5-minute intervention. This EC study is comprehensive and well worth reading. My Interisle colleagues are proud to have our Phishing Landscape 2021 Study and other related studies mentioned in the EC study. 

The transcript follows. 

Interisle intervention to EC HLIG on DNS Abuse

Opening Remarks	Thank you for the opportunity to address you today. My name is David Piscitello. I am a partner and researcher at Interisle Consulting Group. Interisle studies domain name abuse; more precisely, we study how criminal uses domain names and Internet addresses in cyberattacks and cybercrimes. We work to identify where criminals obtain the resources that they need to conduct attacks or perpetrate crimes and to identify and observe where criminal activity is occurring on the Internet. Specifically, we provide measurements of abuse at TLD, registrar and hosting networks in annual studies and quarterly reports at the Cybercrime Information Center. Since May 2020, we have collected over 12 million phishing and malware reports. These allow us to perform historical or longitudinal analyses which can identify systemic abuses of the DNS. The Study on Domain Name System (DNS) Abuse commissioned by the European Commission cites several of our measurements and findings from our Phishing Landscape 2021 Study. Our methodologies are similar to those used by our fellow European researchers who contributed to that study. Our data corroborate the Study’s finding that criminals acquire domain names with the specific purpose of perpetrating an abuse or cybercrime. We also find that criminals acquire large numbers of domains to construct criminal infrastructures that they use or lease to others to launch cyberattacks or to host harmful content such as malware or phishing web pages. Particularly in the generic Top level domain name space, we observe that criminals exploit or benefit from characteristics of domain registration services.
Focus on domain registration	The EC’s DNS Abuse study is comprehensive, so I will summarize the domain name registration services “problem space”. Registration contact data is critically important to investigators when they are attempting to identify criminal actors, but also because it can be used to identify all the domain names that a criminal uses for a given attack. Today, much of the contact data that can be used to identify perpetrators of abuse or crimes is unavailable. Our January 2021 study (Whois Contact Data Availability) revealed that Registration contact data is redacted for 57% of all generic Top-level Domain (gTLD) names, and that Only around 11.5% of domains may belong to natural persons who are subject to GDPR. Including ‘proxy-protected’ domains, for which the identity of the domain owner is deliberately concealed, 85% of gTLD domain registrants can no longer be identified. Since the data are redacted, we cannot determine whether the data are accurate. Access to redacted contact data for lawful purposes, in the timely and uniform manner that would help mitigate abuse, is essentially non-existent and this situation worsens every day. The inability to reconcile these issues to the satisfaction of legislators, ICANN policy makers, and the public sector-private sector actors who need registration data greatly impairs efforts to mitigate DNS abuse or crime.
Weaponizing Domains	To close, I want to call attention to features of domain registration services that allow rapid registrations of domain names in large numbers.Cybercriminals take advantage of bulk registration services to weaponize large numbers of domain names.We use the term “weaponize” to refer to an act of adapting something nominally benign to serve as a tool in the pursuit of some malignant (criminal) activity. When terrorists misuse fertilizers to construct improvised explosive devices, they are “weaponizing” ammonium nitrate. When criminals divert pseudoephedrine to the manufacture of methamphetamine, they inflict harm or loss of life by weaponizing a medication intended to relieve suffering. I ask you to consider, When cybercriminals acquire and employ thousands of internet domain names to conduct cybercrimes, they are misusing domain names to cause financial loss or harm. In the extreme cases of ransomware attacks against healthcare or emergency systems or critical infrastructures, the potential harms include loss of life The EC may wish to consider whether measures similar to those employed to control other “weaponizable” commodities are necessary and appropriate. Our October 2019 study on criminal abuse of domain registration services suggests measures that might be adopted. The study is available at Interisle.net. On behalf of my colleagues at Interisle I want to again thank you for the opportunity to speak to the EU High Level Internet Governance Expert Group on the subject of DNS Abuse.We hope that we can assist you in further deliberations.