RP Quarterly Threats Mar 2018

REPORT
McAfee Labs
Threats Report
March 2018
THREATS STATISTICS
Malware
Incidents
Web and Network Threats
1 McAfee Labs Threats Report, March 2018

REPORT
The McAfee Labs count of new malware in Q4 This report was researched
and written by:
reached an all-time high of 63.4 million new • Alex Bassett

• Christiaan Beek
samples. • Niamh Minihane

• Eric Peterson
• Raj Samani
• Craig Schmugar
Introduction
• ReseAnne Sims
Welcome to the McAfee Labs Threats Report March 2018. In this edition we highlight the news • Dan Sommer
and statistics gathered in Q4 of 2017 by the McAfee Advanced Threat Research and McAfee • Bing Sun
Labs teams. We have seen a remarkable end to the year, not only with the threat statistics
presented within this report, but also with the findings of some of our recent research.
One of the biggest developments in cybercrime is an increasing emphasis on

cryptocurrency hijacking, which coincided with the increased market interest in digital
currencies. The Q4 spike in Bitcoin value, which peaked in December at more than
US$19,000 per coin, prompted many actors to extend their activities into the hijacking of
Bitcoin and Monero wallets. This shift reinforces the point that cybercriminals will always
seek to combine the highest returns in the shortest time with the least risk. Security
researchers have also recently discovered Android apps used for cryptocurrency mining.
We currently see discussions in underground forums that suggest moving from Bitcoin to
Litecoin because the latter is a safer model with less chance of exposure.
Some cybercriminals are still developing botnets exploiting the Internet of Things and
borrowing and developing new code. For now, we see these botnets mostly used for denial
Follow
of service attacks. The challenge to the security industry will be to adequately defend
against such attacks as they increase in bandwidth and frequency. Share

REPORT KEY TOPIC
Key trends: Cybercriminals pivot, taking on new Cryptocurrency mining: Online currency fuels
strategies and tactics much of cybercrime, including malware purchases and
In Q4 of 2017, McAfee Labs recorded on average eight ransomware payments. Cybercriminals would rather
new malware samples per second—an increase from find outside computing power instead of using their
four new samples per second in Q3. Overall, the quarter own equipment because the price of a dedicated mining
was characterized by newer tools and schemes, such as machine could exceed $5,000. In Q4 McAfee Advanced
PowerShell malware and cryptocurrency mining, which Threat Research team analysts reported on this growth
surged along with the value of Bitcoin. industry, explaining how cybercriminals often seek to
maliciously introduce malware that will either use a
PowerShell: In 2017, McAfee Labs saw PowerShell victim’s computing power to mine for coins or simply
malware grow by 267% in Q4, and by 432% year over locate and steal the user’s cryptocurrency.
year, as the threat category increasingly became a go-to
toolbox for cybercriminals. The scripting language was Ransomware: In 2017, McAfee Labs observed 59%
irresistible, as attackers sought to use it within Microsoft increase in ransomware year over year, including
Office files to execute the first stage of attacks. 35% growth in Q4 alone. This activity included new
creative tactics from cybercriminals, who pushed the
In December, Operation Gold Dragon, a malware category past its typical objective of extorting money to
campaign targeting the 2018 Winter Olympics, disruption within corporate networks. Actors devised
was uncovered. The campaign is an exemplary strategies to create “smoke and mirrors” by distracting
implementation of PowerShell malware in an attack. defenders from actual attacks, such as the emergence
of pseudoransomware, seen in NotPetya and a Taiwan
bank heist.
In spite of ransomware’s continued growth, Q4 featured

law enforcement successes against cybercriminal
networks, with the arrest of the actors allegedly
responsible for the spread of CTB Locker ransomware.
Follow
Share

REPORT KEY TOPIC
The health care sector target: In 2017 the health care

sector experienced a 210% increase in publicly disclosed STATISTICS
security incidents compared with 2016, though incidents
decreased by 78% in Q4. In analyzing the attacks, McAfee Global Threat Intelligence
McAfee Advanced Threat Research experts concluded
that many of the incidents were caused by failures
■■ McAfee GTI received on average 48
to comply with security best practices or to address billion queries per day in Q4.
vulnerabilities in medical software. ■■ McAfee GTI protections against
malicious files increased to 45 million
Necurs and Gamut: In Q4, 97% of spam botnet traffic
per day in Q4 from 40 million in Q3.
was driven by just two botnets that allow cybercriminals
to rent access: Necurs, a recent purveyor of “lonely
■■ McAfee GTI protections against risky
girl” spam, pump-and-dump stock spam, and Locky URLs fell to 57 million per day in Q4
ransomware downloaders, surpassed Gamut, sender of from 99 million in Q3, in spite of a
job offer–themed phishing and money mule recruitment sharp increase in high-risk URLs after
emails, as most prevalent spamming botnet. December 19.
■■ McAfee GTI protections against risky IP
addresses rose to 84 million per day in
Every quarter, the McAfee Global Threat
Q4 from 48 million per day in Q3.
Intelligence cloud dashboard allows us
to see and analyze real-world attack
patterns that lead to better customer
protection. This information provides
insight into attack volumes that our
customers experience. On average McAfee
GTI analyzed each day 400,000 URLs and
800,000 files. In Q4, our customers saw the
following attack volumes:

REPORT KEY TOPIC
Key campaigns: Asymmetrical cyberwarfare To stay up to date with our research, check out our
continues to escalate social media channel—Twitter @McAfee_Labs—where
At the beginning of 2017, McAfee analysts predicted we provide analysis into new campaigns, as well as
the hard-to-solve challenges the cybersecurity industry describe new tools that you can use to better protect
would face in the coming year, naming the asymmetry your environment.
of information as a major hurdle. In short, adversaries —Raj Samani, Chief Scientist and McAfee Fellow, Advanced
have the luxury of access to research done by the Threat Research Team
technical community, and can download and use open-
source tools to support their campaigns, while the Twitter @Raj_Samani
defenders’ level of insight into cybercriminal activities
is considerably more limited, and identifying evolving
tactics often must take place after malicious campaigns
have begun. Major attacks in Q4 demonstrated that
growing asymmetrical cyberwarfare is in full effect.
November 2017: APT28, also known as Fancy Bear,

leveraged a Microsoft Office Dynamic Data Exchange
technique that had been made public just a few weeks
earlier to launch in a phishing email campaign citing the
New York City terror attacks.
December 2017: Attacks targeting organizations involved

in the Winter Olympic Games in Pyeongchang leveraged
steganography and a new tool released days before the
attack, Invoke-PSImage. Operation Gold Dragon gained a
persistent presence on victim’s systems, giving attackers
the ability to search at will and access data stored on the
device or in connected cloud accounts.
Follow
Share

REPORT
Threats Statistics
7 Malware
14 Incidents
16 Web and Network Threats

REPORT KEY TOPIC
Malware
New malware Total malware Malware data comes from

70,000,000 700,000,000 the McAfee Sample Database,
which includes malicious files
60,000,000 600,000,000
gathered by McAfee spam
50,000,000 500,000,000
traps, crawlers, and customer
40,000,000 400,000,000 submissions, as well as from
30,000,000 300,000,000 other industry sources. One
of the leading threats this
20,000,000 200,000,000
quarter was Waboot.
10,000,000 100,000,000
0 0
Q1 Q2 Q3 Q4 Q1 Q2 Q3 Q4 Q1 Q2 Q3 Q4 Q1 Q2 Q3 Q4
2016 2017 2016 2017
Source: McAfee Labs, 2018. Source: McAfee Labs, 2018.
New Mac malware Total Mac malware Two common forms of Mac
800,000 malware this quarter were
Flashback, which grabs
350,000 700,000
passwords and other data
300,000 600,000
through browsers, and
250,000 500,000 Longage, which can give a
200,000 400,000
hacker control of a system.
150,000 300,000
100,000 200,000
50,000 100,000
0 0 Follow
2016 2017 2016 2017
Share

REPORT KEY TOPIC
New mobile malware Total mobile malware The growth of Android screen-
3,000,000 locking ransomware declined
significantly this quarter. (See
2,500,000 25,000,000
separate charts on page 9.)
2,000,000 20,000,000
The Piom Trojan dropper also
1,500,000 15,000,000 slowed markedly.
1,000,000 10,000,000
500,000 5,000,000
0 0
2016 2017 2016 2017
Regional mobile malware infection rates Global mobile malware infection rates
(Percentage of mobile customers reporting infections) (Percentage of mobile customers reporting infections)
Global infection rates have
14%
declined slightly during the
12% last three quarters, even as
25%
10% percentages have increased in
20%
Australia and the Americas.
8%
15%
6%
10%
4%
5%
2%
0%
Africa Asia Australia Europe North South
0%
America America Q1 Q2 Q3 Q4 Q1 Q2 Q3 Q4
Q1 2017 Q2 2017 Q3 2017 Q4 2017 2016 2017

Follow
Share

REPORT KEY TOPIC
New ransomware Total ransomware A big contributor to

16,000,000 ransomware growth was
Ransom:Win32/Genasom.
14,000,000
12,000,000
2,500,000 10,000,000
2,000,000 8,000,000
1,500,000 6,000,000
1,000,000 4,000,000
500,000 2,000,000
0 0
2016 2017 2016 2017
New Android lockscreen malware Total Android lockscreen malware This form of ransomware
1,000,000 2,000,000 started slowly in 2016, but
burst into prominence last
800,000 1,600,000
year.
600,000 1,200,000
400,000 800,000
200,000 400,000
0 0
2016 2017 2016 2017
Follow
Share

REPORT KEY TOPIC
New malicious signed binaries Total malicious signed binaries

25,000,000
20,000,000
20,000,000
1,600,000
15,000,000
1,200,000
10,000,000
800,000
400,000 5,000,000
0 0
2016 2017 2016 2017
Certificate authorities provide digital certificates that

deliver information online once an application, or binary,
is signed and validated by the service provider that
owns the content. This trust model is undermined when
cybercriminals obtain certificates for malicious signed
binaries, or malicious applications, which make attacks
much simpler to execute.
Follow
Share

REPORT KEY TOPIC
New exploit malware Total exploit malware

16,000,000
1,200,000 14,000,000
12,000,000
1,000,000
10,000,000
800,000
8,000,000
600,000
6,000,000
400,000
4,000,000
200,000 2,000,000
0 0
2016 2017 2016 2017
Exploits take advantage of bugs and vulnerabilities in

software and hardware. Zero-day attacks are examples
of successful exploits. For a recent example, see the
McAfee Labs post “Analyzing Microsoft Office Zero-
Day Exploit CVE-2017-11826: Memory Corruption
Vulnerability.”
Follow
Share

REPORT KEY TOPIC
New macro malware Total macro malware Macro malware usually

1,600,000 arrives as a Word or Excel
document in a spam email
1,400,000
or zipped attachment. Bogus
250,000 1,200,000
but tempting filenames
200,000
1,000,000 encourage victims to open
800,000 the documents, leading
150,000
to infection if macros are
600,000
100,000
enabled.
400,000
50,000 200,000
0 0
2016 2017 2016 2017
New Faceliker malware Total Faceliker malware The Faceliker Trojan

4,800,000 manipulates Facebook clicks
to artificially “like” certain
4,200,000
content. To learn more, read
3,600,000
this post from McAfee Labs.
3,000,000 20,000,000
2,400,000
15,000,000
1,800,000
10,000,000
1,200,000
5,000,000
600,000
0 0 Follow
2016 2017 2016 2017
Share

REPORT KEY TOPIC
New PowerShell malware Total PowerShell malware PowerShell threats were

48,000 boosted by a rash of
downloaders in Q4. For more
42,000
on PowerShell and JavaScript
18,000 36,000
threats, see “The rise of script-
15,000 30,000 based malware,” in the McAfee
12,000 24,000
Labs Threats Report, September
2017.
9,000 18,000
6,000 12,000
3,000 6,000
0 0
2016 2017 2016 2017
New JavaScript malware Total JavaScript malware

7,000,000
6,000,000
5,000,000 50,000,000
4,000,000 40,000,000
3,000,000 30,000,000
2,000,000 20,000,000
1,000,000 10,000,000
0 0
2016 2017 2016 2017 Follow
Source: McAfee Labs, 2018. Source: McAfee Labs, 2018. Share

REPORT KEY TOPIC
Incidents
Publicly disclosed security incidents by region Top 10 attack vectors in 2016–2017 Security incidents data
(Number of publicly disclosed incidents) (Number of publicly disclosed incidents)
is compiled from several
350 700 sources, including
300 600 hackmageddon.com,
privacyrights.org/data-
250 500
breaches, haveibeenpwned.
200 400
com, and databreaches.net.
150 300
100 200
50 100
0 0
Q1 Q2 Q3 Q4 Q1 Q2 Q3 Q4
Unkown
Malware
Hijacking
Account
Leak
DDoS
Code Injection
Defacement
Vulnerability
W-2 Scam
Access
Unauthorized
2016 2017 The majority of attack vectors
Africa Asia Multiple are either not known or not
Americas Europe Oceania
publicly reported.
Follow
Share

REPORT KEY TOPIC
Top sectors targeted in North Top 10 targeted sectors in 2016–2017

and South America (Number of publicly disclosed incidents)
(Number of publicly disclosed incidents)
80
70 350
60 300
50 250
40 200
30 150
20 100
10 50
0 0
Public
Individuals
Health Care
Education
Finance
Multiple
Services
Online
Retail
Entertainment
Development
Software
Health Care
Public
Education
Finance
Technology
Retail
Entertainment
Hospitality
Online Services
Individuals
Q1 2017 Q2 2017 Q3 2017 Q4 2017
Follow
Share

REPORT KEY TOPIC
Web and Network Threats
New suspect URLs New malicious URLs

18,000,000 12,000,000
15,000,000 10,000,000
12,000,000 8,000,000
9,000,000 6,000,000
6,000,000 4,000,000
3,000,000 2,000,000
0 0
2016 2017 2016 2017
The McAfee® TrustedSource™ Web Database contains Malicious sites deploy code designed to hijack a
URLs (web pages) organized into categories, based on computer’s settings or activity. This category includes
web reputation, to use with filtering policies to manage self-installing applications (“drive-by” executable files),
web access. Suspect URLs are the total number of sites Trojans, and other malware that exploit vulnerabilities in
that earn High Risk or Medium Risk scores. browsers or other applications.
Follow
Share

REPORT KEY TOPIC
New malicious downloads URLs New phishing URLs

4,000,000 800,000
3,500,000 700,000
3,000,000 600,000
2,500,000 500,000
2,000,000 400,000
1,500,000 300,000
1,000,000 200,000
500,000 100,000
0 0
2016 2017 2016 2017
Malicious downloads come from sites that allow a user Phishing URLs are web pages that typically arrive in hoax
to inadvertently download code that is harmful or emails to steal user account information. These sites
annoying. This category includes screensavers, toolbars, falsely represent themselves and appear as legitimate
and file-sharing programs that contain adware, spyware, company web pages to deceive and obtain user data for
viruses, and other malicious code. Sometimes, the perpetrating fraud or theft.
malware is added without users’ knowledge, as when
they click “Yes” or “I agree” without reading the full
terms and conditions. The effects can include slower
performance, theft of passwords, and the loss or
damage of personal files.
Follow
Share

REPORT KEY TOPIC
Top malware connecting to control servers in Q4 Spam botnet prevalence by volume in Q4 Necurs—a recent purveyor of
1% 1% 1% “lonely girl” spam, pump and
dump stock spam, and Locky
ransomware downloaders—
Wapomi
21% and Gamut—sending job
Ramnit Necurs
offer–themed phishing
OnionDuke Gamut
(and possible money mule
3% China Chopper 37% Lethic
51% recruitment), in English,
3% Muieblackcat Darkmailer
German, and Italian— were
5% Mirai 60% Others
responsible for 97% of spam
5% Maazben
botnet traffic in Q4.
5% Others
7%
Top countries hosting botnet control servers in Q4 Top network attacks in Q4
United States 14%

Server message block
28% Germany
35% 4% Browser
Netherlands
5% Denial of service
Japan 44%
Brute force
Russia 8% Malware
3% China
Domain name System
3% South Korea
3% 10% Others
3% France
3%
3% 19% Others 15%
Follow
Source: McAfee Labs, 2018. Source: McAfee Labs, 2018. Share

About McAfee About McAfee Labs
McAfee is one of the world’s leading independent McAfee Labs, led by McAfee Advanced Threat Research,
cybersecurity companies. Inspired by the power is one of the world’s leading sources for threat
of working together, McAfee creates business and research, threat intelligence, and cybersecurity thought
consumer solutions that make the world a safer place. leadership. With data from millions of sensors across
By building solutions that work with other companies’ key threats vectors—file, web, message, and network—
products, McAfee helps businesses orchestrate McAfee Labs and McAfee Advanced Threat Research
cyber environments that are truly integrated, where deliver real-time threat intelligence, critical analysis, and
protection, detection, and correction of threats happen expert thinking to improve protection and reduce risks.
simultaneously and collaboratively. By protecting
www.mcafee.com/us/mcafee-labs.aspx.
consumers across all their devices, McAfee secures their
digital lifestyle at home and away. By working with other
security players, McAfee is leading the effort to unite
against cybercriminals for the benefit of all.
www.mcafee.com.
2821 Mission College Blvd. McAfee and the McAfee logo are trademarks or registered trademarks of McAfee, LLC or its subsidiaries in the US and other countries.
Santa Clara, CA 95054 Other marks and brands may be claimed as the property of others. Copyright © 2018 McAfee LLC. 3780_0318
888.847.8766 MARCH 2018
www.mcafee.com

RP Quarterly Threats Mar 2018

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

RP Quarterly Threats Mar 2018

Uploaded by

Copyright:

Available Formats

REPORT

1 McAfee Labs Threats Report, March 2018

reached an all-time high of 63.4 million new • Alex Bassett

samples. • Niamh Minihane

One of the biggest developments in cybercrime is an increasing emphasis on

2 McAfee Labs Threats Report, March 2018

In spite of ransomware’s continued growth, Q4 featured

3 McAfee Labs Threats Report, March 2018

The health care sector target: In 2017 the health care

4 McAfee Labs Threats Report, March 2018

November 2017: APT28, also known as Fancy Bear,

December 2017: Attacks targeting organizations involved

5 McAfee Labs Threats Report, March 2018

16 Web and Network Threats

6 McAfee Labs Threats Report, March 2018

New malware Total malware Malware data comes from

Source: McAfee Labs, 2018. Source: McAfee Labs, 2018.

Source: McAfee Labs, 2018. Source: McAfee Labs, 2018.

7 McAfee Labs Threats Report, March 2018

Source: McAfee Labs, 2018. Source: McAfee Labs, 2018.

Source: McAfee Labs, 2018. Source: McAfee Labs, 2018.

8 McAfee Labs Threats Report, March 2018

New ransomware Total ransomware A big contributor to

Source: McAfee Labs, 2018. Source: McAfee Labs, 2018.

Source: McAfee Labs, 2018. Source: McAfee Labs, 2018.

9 McAfee Labs Threats Report, March 2018

New malicious signed binaries Total malicious signed binaries

Source: McAfee Labs, 2018. Source: McAfee Labs, 2018.

Certificate authorities provide digital certificates that

10 McAfee Labs Threats Report, March 2018

New exploit malware Total exploit malware

Source: McAfee Labs, 2018. Source: McAfee Labs, 2018.

Exploits take advantage of bugs and vulnerabilities in

11 McAfee Labs Threats Report, March 2018

New macro malware Total macro malware Macro malware usually

Source: McAfee Labs, 2018. Source: McAfee Labs, 2018.

New Faceliker malware Total Faceliker malware The Faceliker Trojan

12 McAfee Labs Threats Report, March 2018

New PowerShell malware Total PowerShell malware PowerShell threats were

Source: McAfee Labs, 2018. Source: McAfee Labs, 2018.

New JavaScript malware Total JavaScript malware

Source: McAfee Labs, 2018. Source: McAfee Labs, 2018. Share

13 McAfee Labs Threats Report, March 2018

Source: McAfee Labs, 2018. Source: McAfee Labs, 2018.

14 McAfee Labs Threats Report, March 2018

Top sectors targeted in North Top 10 targeted sectors in 2016–2017

Q1 2017 Q2 2017 Q3 2017 Q4 2017

Source: McAfee Labs, 2018. Source: McAfee Labs, 2018.

15 McAfee Labs Threats Report, March 2018

Web and Network Threats

New suspect URLs New malicious URLs

Source: McAfee Labs, 2018. Source: McAfee Labs, 2018.

16 McAfee Labs Threats Report, March 2018

New malicious downloads URLs New phishing URLs

Source: McAfee Labs, 2018. Source: McAfee Labs, 2018.

17 McAfee Labs Threats Report, March 2018

Source: McAfee Labs, 2018. Source: McAfee Labs, 2018.

Top countries hosting botnet control servers in Q4 Top network attacks in Q4

United States 14%

Source: McAfee Labs, 2018. Source: McAfee Labs, 2018. Share

18 McAfee Labs Threats Report, March 2018

19 McAfee Labs Threats Report, March 2018

You might also like