Examining the 2022 malware landscape

Geopolitical tensions and the biggest battle in Europe for many years have outlined the malware panorama in 2022.

Recorded Future has been capturing international risk info from the web, darkish internet, and technical sources for over a decade. The agency combines this huge quantity of information with AI and human experience to identify threats early and supply actionable insights to safety professionals.

Toby Wilmington, Supervisor – Gross sales Engineering at Recorded Future, supplied his evaluation of the malware panorama over the primary half of 2022 throughout a session at this yr’s Cyber Safety & Cloud Expo Europe.

“We’re beginning to see the world turn into a mirrored image of the web,” says Wilmington. “So affect operations, issues which are occurring on-line, are beginning to have a geopolitical or kinetic affect — bombs being dropped, as an illustration.”

Recorded Future is getting its information from safety vendor reporting, communication platforms like Telegram and Discord, social media, and extra.

With its darkish internet assortment skills, the corporate is ready to see what risk actors are speaking about to allow them to assist the great guys keep forward. Such info might embody what malware is being offered, what ransoms are being requested, and what penetration testing instruments are getting used. 

As well as, Recorded Future is bringing in community visitors evaluation information to see who’s being impacted by cyberattacks, what applied sciences are being focused, what infrastructure is getting used, and to who it may be attributed.

All of this information is pulled collectively in real-time to offer a much more full image of the malware panorama than was historically doable. Because of this, cybersecurity can turn into way more proactive than reactive.

Wiper variants

Following Russia’s invasion of Ukraine, 9 distinct variants of the Wiper malware started circulating that have been designed to disrupt the defending nation’s operations.

In response to Wilmington, the malware variants grew more and more simplistic over time which “appeared to indicate the hostile authorities having fun with much less time and fewer assets to develop malware towards key geopolitical targets.”

Wilmington presents a timeline of Wiper variants used round conflicts:

“We’re seeing nation states desirous to isolate particular nations and convey operations down,” provides Wilmington.

Ransomware

Ransomware additionally continues to plague international safety groups.

Conti is likely one of the most notorious types of ransomware because of the velocity with which encrypts information and spreads to different programs. In Could 2021, the Conti ransomware assault on Eire’s well being service led to weeks of disruption with a projected value of $100 million.

When Russia invaded Ukraine, Conti Group introduced its help for Russia. Nonetheless, roughly 60,000 messages from inner chat logs have been leaked by an nameless one who indicated their help for Ukraine, together with supply code and different information utilized by the group.

In April this yr, Conti ransomware was used towards the federal government of Costa Rica in a five-day intrusion. On eighth Could, Costa Rica was compelled to declare a nationwide emergency because the intrusion had prolonged to a number of authorities our bodies.

Wilmington claims the Conti assault on Costa Rica was enabled “as a part of a disbandment that allowed particular person members to help different ransomware gangs.”

Regardless of Conti making headlines, Wilmington says probably the most prolific operators are these behind the Lockbit 3.0 and Hive ransomware households.

Recorded Future recognized that the FIN7 ransomware group created a faux cybersecurity agency known as Bastion Safe to recruit IT specialists and deploy PoS-exploitation instruments. Whereas the group can be regarded as Russian, Wilmington notes that such a tactic is usually employed by North Korea.

Infostealers

One frequent malware kind that Recorded Future has seen a “actual rise” in use of over latest years is infostealers. This stolen data is then offered on the darkish internet.

Wilmington highlights that infostealers take a fingerprint out of your browser after which something that’s executed in that window might be taken, and other people can then buy that on-line.

“I can say, ‘If I purchase this credential for $20, what does it give me entry to? And does it include a session cookie as nicely so I can really soar round?’” explains Wilmington.

In response to Wilmington, Raccoon Stealer was one of the widespread infostealers this yr. Nonetheless, it “went on a hiatus” in March 2022.

Menace actors then switched from Raccoon to Mars Stealer, MetaStealer, BlackGuard, RedLine, and Vidar. On the finish of H1 2022, Raccoon Stealer 2.0 emerged and spiked once more in recognition.

Wilmington goes on to indicate a graph of the top-referenced malware utilized in cyberattacks over H1 2022. Cobalt Strike takes the lead by a large margin:

Vulnerabilities

On vulnerabilities, unsurprisingly it was Log4Shell – which might be nonetheless inflicting many sleepless nights – that was by far the top-referenced vulnerability in H1 2022:

Microsoft vulnerability Follina took second place, adopted by ProxyShell to spherical out the highest three referenced vulnerabilities. ProxyShell, it’s value noting, has been utilized by Conti associates to hack into Microsoft Trade servers and compromise company networks.

Recorded Future applies danger scores to vulnerabilities primarily based on whether or not they’re actively being exploited within the wild, both primarily based on open-source reporting or the corporate’s inner honeypot.

Wilmington notes that Home windows is generally probably the most affected vendor however, in H1 2022, the listing has been largely dominated by vulnerabilities affecting Linux:

“Usually, we see Microsoft proper on the prime by way of vulnerabilities,” explains Wilmington. “It’s fairly fascinating that Linux has been the primary focus firstly of this yr.”

Recorded Future usually sees round 2-4 weeks from a vulnerability being found to it being weaponised. Utilizing early intelligence like Recorded Future offers may give the business a fairly substantial window to counter rising threats earlier than they trigger injury.

Toby Wilmington was talking at this yr’s Cyber Safety & Cloud Expo Europe. Yow will discover out extra details about the worldwide collection right here.

Need to be taught extra about cybersecurity and the cloud from business leaders? Take a look at Cyber Safety & Cloud Expo happening in Amsterdam, California, and London.

Discover different upcoming enterprise expertise occasions and webinars powered by TechForge right here.

Tags: cobalt strike, conti, cyber safety, cyber safety & cloud expo, cybersecurity, fin7, follina, infosec, infostealer, log4shell, malware, proxyshell, raccoon stealer, recorded future, toby wilmington, vulnerabilities, wiper