Ransomware Doesn't Pay in 2018 as Cybercriminals Turn to Cryptojacking

IBM Security in their annual 2019 IBM X-Force Threat Intelligence Index found that increased security measures and awareness are driving cybercriminals to alter their techniques in search of a better return on investment. As a result, the report details two major shifts, including decreased reliance on malware and a decline in ransomware, as criminals increased their use of other cybercrime techniques with the potential for greater ROI.

IBM X-Force also observed that the number of cryptojacking attacks were nearly double those of ransomware attacks in 2018. With the price of cryptocurrencies like Bitcoin hitting a high of nearly $20,000 going into 2018, lower-risk/lower-effort attacks secretly using a victim's computing power were on the rise. In fact, IBM spam researchers only tracked one ransomware campaign in 2018 from one of the world's largest malware spam distribution botnet, Necurs.

The IBM X-Force Threat Intelligence Index also found that cybercriminals were changing their stealth techniques to gain illegal profits. IBM X-Force saw an increase in the abuse of administrative tools, instead of the use of malware. More than half of cyberattacks (57 percent) leveraged common administration applications like PowerShell and PsExec to evade detection, while targeted phishing attacks accounted for nearly one third (29 percent) of attacks.

IBM X-Force Threat Intelligence Index comprises insights and observations from monitoring 70 billion security events per day in more than 130 countries. In addition, data is gathered and analyzed from multiple sources including X-Force IRIS, X-Force Red, IBM Managed Security Services, and publicly disclosed data breach information. IBM X-Force also runs thousands of spam traps around the world and monitors tens of millions of spam and phishing attacks daily while analyzing billions of web pages and images to detect fraudulent activity and brand abuse.

Additional findings include that phishing campaigns made heavy use of targeted Business Email Compromise scams, which accounted for 45 percent of the phishing attacks tracked by X-Force. The transportation industry became the second-most attacked sector in 2018 moving up the ranks from 10th in 2017. Nearly one third (42,000) of all 140,000 vulnerabilities tracked by IBM X-Force, were reported in just the past three years. Publicly disclosed misconfiguration incidents increased 20 percent year-over-year. Interestingly, there was a 52 percent decrease in the number of records compromised due to this threat vector.

Cybercriminals have developed tools and tactics to infect both corporate servers and individual users with coin-mining malware to mine cryptocurrencies. In turn, these infections hijack computing power, resulting in increased CPU usage and slowed devices. This cryptojacking trend is virtually exploding, and cybercriminals have the advantage as the two of the most common infection vectors are phishing and injecting code into websites with weak security controls.

IBM X-Force has discovered that illicit cryptojacking attacks are on the rise while ransomware seems to be on the decline. Over the course of 2018, attempts to install ransomware on X-Force monitored devices in Q4 declined to less than half (45 percent) of the attempts in Q1. Instead, cryptojacking attacks more than quadrupled in the same timeframe by 450 percent.

Increasing awareness of cybersecurity issues and stricter security controls are making it harder for cybercriminals to establish footholds on target systems. As a result, the use of malicious software in attacks appears to be on the decline. In cases where networks were compromised by attackers, IBM X-Force saw a shift to cybercriminals abusing administrative tools, instead of malware, to achieve their goals. The Financial Services industry remained the most attacked sector of 2018 accounting for 19 percent of all attacks observed by IBM X-Force IRIS. However, the Transportation Industry, which did not even make the top 5 list last year, moved to the second most attacked sector in 2018, with attempted attacks increasing three-fold since the year prior.