FortiGuard Labs reports ransomware variants almost double in six months

Fortinet® (NASDAQ: FTNT), a global leader in broad, integrated, and automated cybersecurity solutions, announced the latest semiannual FortiGuard Labs Global Threat Landscape Report. For a detailed view of the report, as well as some important takeaways, read the blog. Highlights of the 1H 2022 report follow:

• The ransomware threat continues to adapt with more variants enabled by Ransomware-as-a-Service (RaaS).
• Work-from-anywhere (WFA) endpoints remain targets for cyber adversaries to gain access to corporate networks. Operational technology (OT) and information technology (IT) environments are both attractive targets as cyber adversaries search for opportunities in the growing attack surface and IT/OT convergence.
• Destructive threat trends continue to evolve, as evidenced by the spread of wiper malware as part of adversary toolkits.
• Cyber adversaries are embracing more reconnaissance and defense evasion techniques to increase precision and destructive weaponization across the cyber-attack chain.

 

Ransomware Variant Growth Shows Evolution of Crime Ecosystems: Ransomware remains a top threat and cyber adversaries continue to invest significant resources into new attack techniques. In the past six months, FortiGuard Labs has seen a total of 10,666 ransomware variants, compared to just 5,400 in the previous six-month period. That is nearly 100% growth in ransomware variants in half a year. RaaS, with its popularity on the dark web, continues to fuel an industry of criminals forcing organizations to consider ransomware settlements. To protect against ransomware, organizations, regardless of industry or size, need a proactive approach. Real-time visibility, protection, and remediation coupled with zero-trust network access (ZTNA) and advanced endpoint detection and response (EDR) are critical. 

Figure 1: Weekly ransomware volume over the last 12 months

 

Exploit Trends Show OT and the Endpoint Are Still Irresistible Targets: The digital convergence of IT and OT and the endpoints enabling WFA remain key vectors of attack as adversaries continue to target the growing attack surface. Many exploits of vulnerabilities at the endpoint involve unauthorized users gaining access to a system with a goal of lateral movement to get deeper into corporate networks. For example, a spoofing vulnerability (CVE 2022-26925) placed high in volume, as well as a remote code execution (RCE) vulnerability (CVE 2022-26937). Also, analyzing endpoint vulnerabilities by volume and detections reveals the relentless path of cyber adversaries attempting to gain access by maximizing both old and new vulnerabilities. In addition, when looking specifically at OT vulnerability trends, the sector was not spared. A wide range of devices and platforms experienced in-the-wild exploits, demonstrating the cybersecurity reality of increased IT and OT convergence and the disruptive goals of adversaries. Advanced endpoint technology can help mitigate and effectively remediate infected devices at an early stage of an attack. In addition, services such as a digital risk protection service (DRPS) can be used to do external surface threat assessments, find and remediate security issues, and help gain contextual insights on current and imminent threats.

 

Destructive Threat Trends Continue With Wipers Widening: Wiper malware trends reveal a disturbing evolution of more destructive and sophisticated attack techniques continuing with malicious software that destroys data by wiping it clean. The war in Ukraine fueled a substantial increase in disk wiping malware among threat actors primarily targeting critical infrastructure. FortiGuard Labs identified at least seven major new wiper variants in the first six months of 2022 that were used in various campaigns against government, military, and private organizations. This number is significant because it is close to the number of wiper variants that have been publicly detected since 2012. Additionally, the wipers did not stay in one geographical location but were detected in 24 countries besides Ukraine. To minimize the impact of wiper attacks, network detection and response (NDR) with self-learning artificial intelligence (AI) is helpful to better detect intrusions. Also backups must be stored off-site and offline.

 

Defense Evasion Remains Top Attack Tactic Globally: Examining adversarial strategies reveals takeaways about how attack techniques and tactics are evolving. FortiGuard Labs analyzed the functionality of detected malware to track the most prevalent approaches over the last six months. Among the top eight tactics and techniques focused on the endpoint, defense evasion was the most employed tactic by malware developers. They are often using system binary proxy execution to do so. Hiding malicious intentions is one of the most important things for adversaries. Therefore, they are attempting to evade defenses by masking them and attempting to hide commands using a legitimate certificate to execute a trusted process and carry out malicious intent. In addition, the second most popular technique was process injection, where criminals work to inject code into the address space of another process to evade defenses and improve stealth. Organizations will be better positioned to secure against the broad toolkits of adversaries armed with this actionable intelligence. Integrated, AI and ML-driven cybersecurity platforms with advanced detection and response capabilities powered by actionable threat intelligence are important to protect across all edges of hybrid networks.

Figure 2: Top malware tactics and techniques (endpoint)

 

AI-powered Security Across the Extended Attack Surface

 

When organizations gain a deeper understanding of the goals and tactics used by adversaries through actionable threat intelligence, they can better align defenses to adapt and react to quickly changing attack techniques proactively. Threat insights are critical to help prioritize patching strategies to better secure environments. Cybersecurity awareness and training are also important as the threat landscape changes to keep employees and security teams up-to-date. Organizations need security operations that can function at machine speed to keep up with the volume, sophistication, and speed of today’s cyber threats. AI and ML-powered prevention, detection, and response strategies based on a cybersecurity mesh architecture allow for much tighter integration, increased automation, as well as a more rapid, coordinated, and effective response to threats across the extended network.

 

Report Overview

 

This latest Global Threat Landscape Report is a view representing the collective intelligence of FortiGuard Labs, drawn from Fortinet’s vast array of sensors collecting billions of threat events observed around the world during the first half of 2022. Similar to how the MITRE ATT&CK framework classifies adversary tactics and techniques, with the first three groupings spanning reconnaissance, resource development, and initial access, the FortiGuard Labs Global Threat Landscape Report leverages this model to describe how threat actors target vulnerabilities, build malicious infrastructure, and exploit their targets. The report also covers global and regional perspectives as well as threat trends affecting IT and OT.

 

As for Thailand, FortiGuard Labs reports that compared to Q1 and Q2, HTML/Generic.31221958itr  was the top virus detected at 21.24% and 21.41%, respectively. The Mirai.Botnet was the top botnet found at 49.19% and 50.07%, respectively. For exploit threat, MS Windows HTTP.sys.UipParSeAccep_ in Q1 was the highest at 38.11%, while HTTP.URl.Java Code.Injection was found in Q2 at 31.71%.

Figure 3: In Q2, HTML/Generic.31221958itr was the top virus found at 21.41%.

 

Figure 4: In Q2, Mirai.Botnet was the top botnet detected at 50.07%.

 

Figure 5 : In Q2, HTTP.URl.Java Code.Injection was the top exploit found at 31.71%.

 

Derek Manky, Chief Security Strategist & VP Global Threat Intelligence, FortiGuard Labs summarized that, “Cyber adversaries are advancing their playbooks to thwart defense and scale their criminal affiliate networks. They are using aggressive execution strategies such as extortion or wiping data as well as focusing on reconnaissance tactics pre-attack to ensure better return on threat investment. To combat advanced and sophisticated attacks, organizations need integrated security solutions that can ingest real-time threat intelligence, detect threat patterns, and correlate massive amounts of data to detect anomalies and automatically initiate a coordinated response across hybrid networks.”