IOT devices at home latest target for cryptojacking: Fortinet

Fortinet, a global leader in broad, integrated, and automated cybersecurity solutions, recently announced the findings of its latest Global Threat Landscape Report.

The research reveals cyber criminals are becoming smarter and faster in how they leverage exploits to their advantage. They are also maximising their efforts by targeting an expanding attack surface and by using iterative approaches to software development facilitating the evolution of their attack methodologies. Highlights of the report follow:

Virtually No Firm is Immune from Severe Exploits: Analysis focused on critical and highseverity detections demonstrates an alarming trend with 96 percent of firms experiencing at least one severe exploit. Almost no firm is immune to the evolving attack trends of cyber criminals. In addition, nearly a quarter of companies saw cryptojacking malware, and only six malware variants spread to over 10 percent of all organisations. Fortiguard Labs also found 30 new zero-day vulnerabilities during the quarter.

Cryptojacking Moves to IOT Devices in the Home: Mining for cryptocurrency continues, cyber criminals added IOT devices, including media devices in the home to their arsenals. They are an especially attractive target because of their rich source of computational horsepower, which can be used for malicious purposes. Attackers are taking advantage of them by loading malware that is continually mining because these devices are always on and connected. In addition, the interfaces for these devices are being exploited as modified web browsers, which expands the vulnerabilities and exploit vectors on them. Segmentation will be increasingly important for devices connected to enterprise networks as this trend continues.

Botnet Trends Demonstrate the Creativity of Cyber Criminals: Data on botnet trends gives a valuable post-compromise viewpoint of how cybercriminals are maximising impact with multiple malicious actions. ‘WICKED’, a new Mirai botnet variant, added at least three exploits to its arsenal to target unpatched IOT devices. Vpnfilter, the advanced nationstate-sponsored attack that targets SCADA/ ICS environments by monitoring MODBUS SCADA protocols, emerged as a significant threat. It is particularly dangerous because it not only performs data exfiltration, but can also render devices completely inoperable, either individually or as a group.

Malware Developers Leverage Agile Development: Malware authors have long relied on polymorphism to evade detection. Recent attack trends show they are turning to agile development practices to make their malware even more difficult to detect and to counter the latest tactics of anti-malware products. Gandcrab had many new releases this year, and its developers continue to update this malware at a rapid pace. While automation of malware attacks presents new challenges, so does agile development because of the skills and processes to roll out new evading releases of attack methods.

Effective Targeting of Vulnerabilities: Adversaries are selective in determining what vulnerabilities they target. With exploits examined from the lens of prevalence and volume of related exploit detections, only 5.7 percent of known vulnerabilities were exploited in the wild. If the vast majority of vulnerabilities won’t be exploited, organisations should consider taking a much more proactive and strategic approach to vulnerability remediation.

Education and Government Application Usage: When comparing application count usage across industries, government use of Saas applications is 108 percent higher than the mean and is second to education in the total number of applications used daily, 22.5 percent and 69 percent higher than the mean, respectively. The likely cause for the higher usage in these two industry segments is a greater need for a wider diversity of applications. These organisations will require a security approach that breaks down silos between each of these applications, including their multi-cloud environments, for transparent visibility and security controls.

Report Methodology

The Fortinet Global Threat Landscape Report is a quarterly view that represents the collective intelligence of Fortiguard Labs drawn from Fortinet’s vast array of sensors during Q2 2018. Research data covers global, regional, industry sector, and organisational perspectives. It focuses on three central and complementary aspects of that landscape, namely application exploits, malicious software, and botnets. It also examines important zero-day vulnerabilities and infrastructure trends to add context about the trajectory of cyber attacks affecting organisations over time. To complement the report, Fortinet publishes a free, subscriptionbased Threat Intelligence Brief that reviews the top malware, virus, and web-based threats discovered every week, along with links to valuable Fortiguard Labs threat research.

Commenting on this report, Fortinet India and SAARC Regional Vice President Rajesh Maurya said: “Cyber adversaries are relentless. Increasingly, they are automating their toolsets and creating variations of known exploits. Of late, they are also more precise in their targeting, relying less on blanket attempts to find exploitable victims. Urgently, organisations must pivot their security strategy to address these tactics. Organisations should leverage automated and integrated defenses to address the problems of speed and scale, utilise highperformance behaviour-based detection, and rely on Ai-informed threat intelligence insights to focus their efforts on patching vulnerabilities that matter.”