Growing Sophistication of Malware

A majority of ransomware families deployed in the wild is of the cookie-cutter variety. Even ransomware that uses obfuscation to get around some kind of detection usually ends up being detectable when it starts to actually encrypt files. However, some threat actors are using very sophisticated tools, says Andrew Brandt, principal researcher at Sophos. As one example, he points to ransomware that use “kill lists” to try and terminate anti-malware tools.

Another example is ransomware that sets itself up as a service running in Windows’ built-in Safe Mode, then reboots the system into Safe Mode before beginning to encrypt the hard drive, he says. “Booting into Safe Mode effectively terminates nearly all endpoint protection tools,” Brandt says. Sophos recently spotted the Safe Boot feature added to Snatch, a ransomware sample used in targeted attacks that the security vendor has been tracking for a year.

“Among the most notable advancements is an increase in ransomware attackers employing automated active attack techniques,” Brandt says. These are attacks where threat-actors use automated malware to quickly profile an infected environment and laterally spread within a targeted network or trigger simultaneous infections across multiple machines within the same environment, Brandt says.

Many of the most troublesome recent ransomware campaigns — including those involving Ryuk, Lockergoga, Robbinhood, and Sodinokibi — have involved the use of active attack techniques, according to Sophos.

If all this wasn’t enough, some believe that mobile devices could start getting targeted as well.

Data from the 2019 Verizon Data Breach Investigations Report shows users as more susceptible to phishing attacks on mobile devices, and another report about Chinese hackers breaching 10 global cellular providers.

Ransomware attacks target mobile applications running on Android are expected in 2020.

The same combination of factors – unsupported, outdated, and unpatched systems – that led to the surge in ransomware attacks on local governments and others will drive attacks on mobile devices.

Here is the complete article from Jai Vijayan the Senior Editor at Computerworld