IBM Security: Cybercriminals focusing on cryptojacking

IBM Security has announced results from the annual 2019 IBM X-Force Threat Intelligence Index, which found that increased security measures and awareness are driving cybercriminals to alter their techniques in search of a better return on investment.

As a result, the report details two major shifts, including a surprising move away from ransomware and a decreased reliance on malware overall.

IBM X-Force noted a significant decline in ransomware used in attacks.

In fact, IBM spam researchers only tracked one ransomware campaign in 2018 from one of the world's largest malware spam distribution botnet, Necurs.

IBM X-Force also observed that the number of cryptojacking attacks – the illegal use of an organisation's or individual's computing power without their knowledge to mine cryptocurrencies – were nearly double the amount of ransomware attacks in 2018.

With the price of cryptocurrencies like Bitcoin hitting a high of nearly $20,000 going into 2018, lower-risk/lower-effort attacks secretly using a victim's computing power were seen as more profitable.

The IBM X-Force Threat Intelligence Index also found that cybercriminals were changing their stealth techniques to gain illegal profits.

IBM X-Force saw an increase in the abuse of operating system tools, instead of the use of malware.

More than half of cyber attacks (57%) leveraged common administration applications like PowerShell and PsExec to evade detection, while targeted phishing attacks accounted for nearly one-third (29%) of attacks.

IBM X-Force Threat Intelligence Index comprises insights and observations from monitoring 70 billion security events per day in more than 130 countries.

In addition, data is gathered and analysed from multiple sources including X-Force IRIS, X-Force Red, IBM Managed Security Services, and publicly disclosed data breach information.

IBM X-Force also runs thousands of spam traps around the world and monitors tens of millions of spam and phishing attacks daily while analysing billions of web pages and images to detect fraudulent activity and brand abuse.

Additional findings include:

• Vulnerability reporting on the rise: Nearly one third (42,000) of all 140,000 vulnerabilities tracked by IBM X-Force over the last 30 years, were reported in just the past three years. In fact, IBM X-Force Red finds an average of 1,440 unique vulnerabilities, per organisation.  
• Misconfigurations still plague organisations: Publicly disclosed misconfiguration incidents increased 20% year-over-year. Interestingly, there was a 52% decrease in the number of records compromised due to this threat vector.  
• BEC continues to pay the bills: Phishing campaigns made heavy use of targeted Business Email Compromise (BEC) scams, which accounted for 45% of the phishing attacks tracked by X-Force.  
• Transportation emerges as industry to watch (forcyber attackss): The transportation industry became the second-most attacked sector in 2018 – moving up the ranks from 10th in 2017.

IBM X-Force incident response and intelligence services (IRIS) global lead Wendi Whitmore says, "If we look at the drop in the use of malware, the shift away from ransomware, and the rise of targeted campaigns, all these trends tell us that return on investment is a real motivating factor for cybercriminals.

"We see that efforts to disrupt adversaries and make systems harder to infiltrate are working," Whitmore adds.

"While 11.7 billion records were leaked or stolen over the last three years, leveraging stolen personally identifiable information (PII) for profit requires more knowledge and resources, motivating attackers to explore new illicit profit models to increase their return on investment.

"One of the hottest commodities is computing power tied to the emergence of cryptocurrencies. This has led to corporate networks and consumer devices being secretly highjacked to mine for these digital currencies.

The rise of criminal PowerShell power users

Increasing awareness of cybersecurity issues and stricter security controls are making it harder for cybercriminals to establish footholds on target systems.

As a result, the use of malicious software in attacks appears to be on the decline.

More than half (57%) of attacks analysed by X-Force in 2018 revealed threat actors did not rely on file system resident malware.

Those who made the most frequent use of malware were major cybercriminal gangs and advanced persistent threat (APT) groups.

In cases where networks were compromised by attackers, IBM X-Force saw a major shift to cybercriminals abusing existing operating system tools – instead of malware to achieve their goals.

Core to these techniques is the advanced use of PowerShell, a built-in operating system tool capable of executing code from memory and providing administrative access directly to a device's core.

IBM X-Force IRIS has also observed attackers running Windows Management Interface Command (WMIC) queries, which are then used to automate the remote execution of PowerShell commands and scripts, among other functions designed to run queries, search databases, access user directories, and connect to systems of interest.

Cybercriminals hack systems to make money on business' dime

Cybercriminals are not ones to spend money on expensive hardware or legitimately mine cryptocurrency.

Instead, they have developed various tools and tactics to infect both corporate servers and individual users with coin-mining malware to perform the work for them.

In turn, these infections hijack computing power, resulting in increased CPU usage and slowed devices.

This cryptojacking trend is virtually exploding, and cybercriminals have the advantage as two of the most common infection vectors are phishing and injecting code into websites with weak security controls.

IBM X-Force has discovered that illicit cryptojacking attacks are on the rise while ransomware seems to be on the decline.

Over the course of 2018, attempts to install ransomware on X-Force monitored devices in Q4 (Oct.- Dec.) declined to less than half (45%) of the attempts in Q1.

Instead, cryptojacking attacks more than quadrupled in the same timeframe by 450%.

Transportation industry an increasing cybercrime target

Cybercriminals aren't just changing how they hack, but also who they target.

The Financial industry remained the most attacked sector of 2018 accounting for 19% of all attacks observed by IBM X-Force IRIS.

However, the Transportation Industry—which did not even make the top five list last year—moved to the second most attacked sector in 2018, with attempted attacks increasing three-fold since the year prior.

It is not just a matter of the sheer volume of attacks, but also in the caliber of victims.

X-Force saw more public disclosures in 2018 than in previous years in the transportation industry. These disclosures likely encouraged hackers as they may reveal that these companies are vulnerable to cyber attacks and that they hold valuable data such as customer data, payment card information, PII, and loyalty reward accounts.

The report features data IBM collected between January 1, 2018 and December 31, 2018, to deliver insightful information about the global threat landscape and inform security professionals about the threats most relevant to their organisations.