In total, 189 ransomware families were identified

Bitdefender has released its November Threat Debrief, a monthly series analysing threat news, trends, and research from the previous month. It includes a Ransomware Report highlighting the top ransomware families detected, as well as the top countries affected including Australia, and the top trojans targeting Android during October.

Ransomware Report

Spear phishing attacks are often used as an initial attack vector, and ransomware infection is often the final stage of the kill chain. For this report, we analysed malware detections collected in October 2022 from our static anti-malware engines*. Opportunistic adversaries and some Ransomware-as-a-Service (RaaS) groups represent a higher percentage compared to groups that are more selective about their targets, since they prefer volume over higher value.

Top 10 Ransomware Families

We analysed malware detections from October 1 to October 30. In total, we identified 189 ransomware families. The number of detected ransomware families can vary each month, depending on the current ransomware campaigns in different countries. WannaCry, GandCrab, and Cerber were the top ransomware families detected, accounting for 74 per cent collectively, with REvil/Sodinokibi also making an appearance.

Top 10 Countries

In total, we detected ransomware from 150 countries in our dataset this month. Ransomware continues to be a threat that touches almost the entire world. Many ransomware attacks continue to be opportunistic, and the size of population is correlated to the number of detections. Australia was joint eighth on the list detected, accounting for five per cent, while the United States, Brazil and Iran were the top three accounting for a collective 52 per cent.

Android Trojans

Below are the top trojans targeting Android we have seen in our telemetry during October 2022.

• DN – Repacked applications taken from Google App Store and bundled with aggressive adware. Some adware downloads other malware variants.
• AYE – Malware that tries to register as the default SMS application on the first run by requesting the consent of the user. If successful, it collects the user’s incoming and outgoing messages and forwards them to a Command & Control (C&C) server.
• ACI, ACT, ACK – Polymorphic applications that impersonate legit apps (Google, Facebook, Sagawa Express …). Once installed, it locates banking applications on the device and tries downloading a trojaned version from the C&C server.
• AID – Aggressive adware that impersonates AdBlock applications. When running for the first time, it asks permission to display on top of other apps. With this permission, the application can hide from the launcher.
• LC – Malware that gathers sensitive information about a device (Device IDs, Subscriber IDs, MAC addresses) and sends them to a malicious C&C server. The C&C server responds by sending back a link to a payload which the malware downloads and executes.
• XJ – Applications that drop and install encrypted modules. This trojan grants device admin privileges, and gains access to manage phone calls and text messages. After deploying, it maintains a connection with the C&C server to receive command and upload sensitive information.
• AQQ – A dropper malware is a trojan that hides the dangerous payload inside an app as an evasion technique. If it can avoid security defences, this payload is deployed. The malicious payload is decrypted and loaded by the dropper.
• EM – Applications that exfiltrate sensitive data like SMS messages, call logs, contacts, or GPS location.

Homograph Phishing Report

Homograph attacks work to abuse international domain names (IDN). Threat actors create international domain names that spoof a target domain name. When we talk about ‘target’ of IDN homograph phishing attacks, we refer to the domain that threat actors are trying to impersonate.

MITRE Engenuity ATT&CK Evaluation for Managed Services

MITRE, an internationally recognised organisation known for the ATT&CK framework, released its first Engenuity ATT&CK® Evaluation for Managed Services results on November 9, 2022. The MITRE Evaluation tested several well-known managed detection and response (MDR) vendors, including Bitdefender. The evaluations serve as an impartial starting point to understand how managed security providers identify attacks, and what is delivered by the participants.

The original ATT&CK framework has changed the way teams develop threat models and methodologies, and how we as security analysts investigate cyber-attacks by looking for clues outside of raw indicators. Modern threat actors rely on a variety of evasion techniques, including living off the land by leveraging binaries, scripts, or libraries that are already on the target system (or can be downloaded without raising suspicion). Often, security tools detect only what they have been coded to catch, but ATT&CK forces security practitioners to look beyond those straightforward detections. Analysts apply a deep understanding of threats when uncovering malicious activity, while filtering out the noise and bringing actionable alerts to the customer. This is what makes MDR services invaluable in today’s cyber climate.

During the weeklong exercise, our globally distributed teams were able to flex their collaboration muscles and ensure the processes Bitdefender has in place are effective to deliver the best outcomes for customers. As one of our guiding principles, Bitdefender MDR operated as closely as possible to our normal procedures. The Bitdefender Labs organisation worked with our SOC analysts, investigating detections and attacker techniques, while the cyber intelligence unit (Cyber Intelligence Fusion Cell) provided additional context behind observed behaviours and potential investigational pivots to assist SOC hunts. Bitdefender MDR capitalised on lessons learned and continually strives to identify opportunities to improve our incident handling processes that ultimately make our service even better for our customers.

The Bitdefender MDR team leveraged our native security stack to detect 100 per cent of the attack steps, while providing actionable, summarised output with a clear timeline of the attack and recommended actions. The SOC used existing reporting mechanisms to deliver daily updates, as well as a post-incident report – just as we do in real-world incidents.

For evaluations of the effectiveness of our underlying technology for prevention and detection capabilities, you can review results from the previous round of MITRE ATT&CK Evaluations, or results by an independent team from AV-Comparatives. Third-party, independent testing with a well-defined methodology offers invaluable insights into the capabilities of leading cybersecurity companies so you can make informed decisions. Cybersecurity is a game of cat and mouse, with both sides continuously innovating and improving tools and techniques, and security vendors need to prove their solutions are effective, accurate, and provide consistent results.

Tags: BitdefenderRansomware