Bitdefender has released its November Threat Debrief, a monthly series analysing threat trends and research from the previous month. It includes a Ransomware Report highlighting the top ransomware families detected, and the top countries affected including Australia, and the top trojans targeting Android during October. Spear phishing attacks are often used as an initial attack vector, and ransomware infection is often the final stage of the kill chain.
What were the findings of the Bitdefender’s survey?
For the October Ransomware report, we analysed malware detections collected in October 2022 from our static anti-malware engines. Opportunistic adversaries and some Ransomware-as-a-Service (RaaS) groups represent a higher percentage compared to groups that are more selective about their targets as they prefer volume over higher value.
Top 10 Ransomware Families
We analysed malware detections from 1st -30th October. We identified 189 ransomware families. The number of detected ransomware families can vary each month, depending on the ransomware campaigns in different countries. WannaCry, GandCrab, and Cerber were the families detected, accounting for 74% collectively, with REvil/Sodinokibi also joining the list.
Top 10 Countries
We detected ransomware from 150 countries in our dataset this month. Ransomware continues to be a threat that touches almost the entire world. Many ransomware attacks continue to be opportunistic, and the size of population is correlated to the number of detections. Australia was joint eighth on the list detected, accounting for five per cent, while the United States, Brazil and Iran were the top three accounting for a collective 52%.
Android Trojans
Below are the top trojans targeting Android during October 2022.
- Downloader.DN – Repacked applications taken from Google App Store and bundled with aggressive adware. Some adware downloads other malware variants.
- SMSSend.AYE – Malware that tries to register as the default SMS application on the first run by requesting the consent of the user. If successful, it collects the user’s incoming and outgoing messages and forwards them to a Command & Control (C&C) server.
- Banker.ACI, ACT, ACK – Polymorphic applications that impersonate legit apps (Google, Facebook, Sagawa Express …). Once installed, it locates banking applications on the device and tries downloading a trojanised version from the C&C server.
- HiddenApp.AID – Aggressive adware that impersonates AdBlock applications. When running for the first time, it asks permission to display on top of other apps. With this permission, the application can hide from the launcher.
- Triada.LC – Malware that gathers sensitive information about a device (Device IDs, Subscriber IDs, MAC addresses) and sends them to a malicious C&C server. The C&C server responds by sending back a link to a payload which the malware downloads and executes.
- Banker.XJ – Applications that drop and install encrypted modules. This trojan grants device admin privileges, and gains access to manage phone calls and text messages. After deploying, it maintains a connection with the C&C server to receive command and upload sensitive information.
- Agent.AQQ – A dropper malware is a trojan that hides the dangerous payload inside an app as an evasion technique. If it can avoid security defences, this payload is deployed. The malicious payload is decrypted and loaded by the dropper.
- SpyAgent.EM – Applications that exfiltrate sensitive data like SMS messages, call logs, contacts, or GPS location.
Homograph Phishing Report
Homograph attacks work to abuse international domain names (IDN). Threat actors create international domain names that spoof a target domain name. When we talk about ‘target’ of IDN homograph phishing attacks, we refer to the domain that threat actors are trying to impersonate. You can read more about this type of attack in any of the previous reports.
myetherwallet.com, facebook.com, and paypal.com topped out the ‘top 10 spoofed domains’ in the month of October, with google.com and hotmail.com also featuring.
What is the cybersecurity expertise of Bitdefender?
MITRE, an internationally recognised organisation known for the ATT&CK framework, released its first Engenuity ATT&CK® Evaluation for Managed Services results on November 9, 2022. The MITRE Evaluation tested several well-known managed detection and response (MDR) vendors, like Bitdefender. The evaluations serve as an impartial starting point to understand how managed security providers identify attacks, and what is delivered by the participants.
The original MITRE Engenuity ATT&CK framework has changed the way teams develop threat models and methodologies, and how we as security analysts investigate cyber-attacks by looking for clues outside of raw indicators. Modern threat actors rely on a variety of evasion techniques, including living off the land by leveraging binaries, scripts, or libraries that are already on the target system (or can be downloaded without raising suspicion).
Often, security tools detect only what they have been coded to catch, but ATT&CK forces security practitioners to look beyond those detections. Analysts apply a deep understanding of threats when uncovering malicious activity, while filtering out the noise and bringing actionable alerts. This is what makes MDR services invaluable in today’s cyber climate.
During the weeklong exercise, Bitdefender’s globally distributed cybersecurity teams were able to flex their collaboration muscles and ensure the processes Bitdefender has in place are effective to ultimately deliver the best outcomes for its customers. As one of our guiding principles, Bitdefender MDR operated as closely as possible to our normal procedures.
Bitdefender Labs worked with our SOC analysts, investigating detections and attacker techniques, while the cyber intelligence unit (Cyber Intelligence Fusion Cell) provided context behind observed behaviours and potential investigational pivots to assist SOC hunts.
Bitdefender MDR capitalised on lessons learned and strives to identify opportunities to improve incident handling processes that make their service better for our clients. The MDR team leveraged our native security stack to detect 100% of the attack steps, while providing actionable, summarised output with a clear timeline of the attack and recommended actions.
The SOC used existing reporting mechanisms to deliver daily updates, and a post-incident report – just as we do in real-world incidents. For evaluations of the effectiveness of our underlying tech for prevention and detection capabilities, you can review the previous round of MITRE ATT&CK Evaluations, or results by an independent team from AV-Comparatives.
Third-party, independent testing with a well-defined methodology offers invaluable insights into the capabilities of leading firms so you can make informed decisions. Cybersecurity is a game of cat and mouse, with both sides innovating and improving tools and techniques, and security vendors need to prove their solutions are effective and provide consistent results.
