Australia amongst top targeted countries for ransomware

Australia became one of the most targeted countries for ransomware attacks for the first time, according to a new report.

Bitdefender has released its November Threat Debrief, a monthly series analysing threat news, trends, and research from the previous month. 

It includes a Ransomware Report highlighting the top ransomware families detected, as well as the top countries affected, and the top trojans targeting Android during October.

Spear phishing attacks are often used as an initial attack vector, and ransomware infection is often the final stage of the kill chain. For this report, Bitdefender analysed malware detections collected in October 2022 from our static anti-malware engines*. Opportunistic adversaries and some Ransomware-as-a-Service (RaaS) groups represent a higher percentage compared to groups that are more selective about their targets, since they prefer volume over higher value.

Top 10 Ransomware Families

Bitdefender analysed malware detections from October 1 to October 30. In total, it identified 189 ransomware families. The number of detected ransomware families can vary each month, depending on the current ransomware campaigns in different countries. WannaCry, GandCrab, and Cerber were the top ransomware families detected, accounting for 74% collectively, with REvil/Sodinokibi also making an appearance.

Top 10 Countries

In total, Bitdefender detected ransomware from 150 countries in our dataset this month. Ransomware continues to be a threat that touches almost the entire world. Many ransomware attacks continue to be opportunistic, and the size of population is correlated to the number of detections. Australia was joint eighth on the list detected, accounting for 5%, while the United States, Brazil and Iran were the top three accounting for a collective 52%.

Android Trojans

Top trojans targeting Android during October 2022:

Downloader.DN – Repacked applications taken from Google App Store and bundled with aggressive adware. Some adware downloads other malware variants.
SMSSend.AYE – Malware that tries to register as the default SMS application on the first run by requesting the consent of the user. If successful, it collects the user's incoming and outgoing messages and forwards them to a Command & Control (C&C) server.
Banker.ACI, ACT, ACK – Polymorphic applications that impersonate legit apps (Google, Facebook, Sagawa Express ...). Once installed, it locates banking applications on the device and tries downloading a trojanised version from the C&C server.
HiddenApp.AID – Aggressive adware that impersonates AdBlock applications. When running for the first time, it asks permission to display on top of other apps. With this permission, the application can hide from the launcher.
Triada.LC – Malware that gathers sensitive information about a device (Device IDs, Subscriber IDs, MAC addresses) and sends them to a malicious C&C server. The C&C server responds by sending back a link to a payload which the malware downloads and executes. 
Banker.XJ – Applications that drop and install encrypted modules. This trojan grants device admin privileges, and gains access to manage phone calls and text messages. After deploying, it maintains a connection with the C&C server to receive command and upload sensitive information.
Agent.AQQ – A dropper malware is a trojan that hides the dangerous payload inside an app as an evasion technique. If it can avoid security defences, this payload is deployed. The malicious payload is decrypted and loaded by the dropper.
SpyAgent.EM – Applications that exfiltrate sensitive data like SMS messages, call logs, contacts, or GPS location.

Homograph Phishing Report

Homograph attacks work to abuse international domain names (IDN). Threat actors create international domain names that spoof a target domain name. When Bitdefender talks about 'target' of IDN homograph phishing attacks, it refers to the domain that threat actors are trying to impersonate. 

myetherwallet.com, facebook.com, and paypal.com topped out the 'top 10 spoofed domains' in October, with google.com and hotmail.com also featuring.

MITRE Engenuity ATT&CK Evaluation for Managed Services

MITRE, an internationally recognised organisation known for the ATT&CK framework, released its first Engenuity ATT&CK Evaluation for Managed Services results on November 9, 2022. The MITRE Evaluation tested several well-known managed detection and response (MDR) vendors, including Bitdefender. The evaluations serve as an impartial starting point to understand how managed security providers identify attacks, and what is delivered by the participants.

The original ATT&CK framework has changed the way teams develop threat models and methodologies, and how we as security analysts investigate cyber-attacks by looking for clues outside of raw indicators. Modern threat actors rely on a variety of evasion techniques, including living off the land by leveraging binaries, scripts, or libraries that are already on the target system (or can be downloaded without raising suspicion). Often, security tools detect only what they have been coded to catch, but ATT&CK forces security practitioners to look beyond those straightforward detections. Analysts apply a deep understanding of threats when uncovering malicious activity, while filtering out the noise and bringing actionable alerts to the customer. This is what makes MDR services invaluable in today's cyber climate.

During the weeklong exercise, Bitdefender's globally distributed teams were able to flex their collaboration muscles and ensure the processes Bitdefender has in place are effective to deliver the best outcomes for customers. As one of its guiding principles, Bitdefender MDR operated as closely as possible to its normal procedures. 

The Bitdefender Labs organisation worked with its SOC analysts, investigating detections and attacker techniques, while the cyber intelligence unit (Cyber Intelligence Fusion Cell) provided additional context behind observed behaviours and potential investigational pivots to assist SOC hunts. 

"Bitdefender MDR capitalised on lessons learned and continually strives to identify opportunities to improve our incident handling processes that ultimately make our service even better for our customers," the company says.

"The Bitdefender MDR team leveraged our native security stack to detect 100% of the attack steps, while providing actionable, summarised output with a clear timeline of the attack and recommended actions. The SOC used existing reporting mechanisms to deliver daily updates, as well as a post-incident report - just as we do in real-world incidents."