The number of Internet users that encountered encrypting ransomware more than doubled in Q3 2016, reaching 821 865 people, according to the Kaspersky Lab quarterly IT threat evolution report.
Encrypting ransomware – malware that encrypts a victim’s files and demands a ransom in exchange for file decryption – is still one of the most widespread types of activity which modern cybercriminals are involved in. It has a relatively low development cost and can yield a potentially high income if it results in successful infection.
Besides increasing their number of victims, criminals are also exploring new geographies. In Q3 the top five countries with the highest percentage of users attacked with encrypting ransomware were: Japan (4.83%), Croatia (3.71%), South Korea (3.36%), Tunisia (3.22%) and Bulgaria (3.2%). In the previous quarter, first place was held by Japan, while the second, third and fourth were held by Italy, Djibouti and Luxembourg. These three countries left the top five in Q3 to give way to others.
The main driver of growth in the number of attacked users was Trojan-Downloader.JS.Cryptoload – a family of downloaders written in the JavaScript language and capable of downloading different families of crypto ransomware. The most widespread of these in Q3 included CTB-Locker (28.34% of attacked users), Locky (9.6%) and CryptXXX (8.95%).
“Crypto ransomware continues to be one of the most dangerous threats, both to private users and to businesses. The recent jump in the number of attacked users may have been provoked by the fact that the number of modifications of ransomware we detected in Q3 – more than 32 thousand modifications – was 3.5 times more than in Q2. This may be due to the fact that security companies nowadays invest a lot of resources into being able to detect new samples of ransomware as fast as possible. Criminals must therefore avoid detection by creating more new modifications of their malware,” said Fedor Sinitsyn, ransomware expert at Kaspersky Lab.
The other key findings of the ‘IT Threat Evolution in Q3 Report’ include:
· According to KSN data, in Q3 Kaspersky Lab solutions detected and repelled a total of 171,802,109 malicious attacks from online resources located all over the world. This is slightly fewer than in the previous quarter, when 171,895,830 attacks were blocked.
· Of these, 45,169,524 were malicious URLs hosting 12,657,673 malicious objects like scripts, exploits, executable files etc.
· The number of users attacked with banking malware grew by 5.8% and reached 1,198,264.
· Browsers and Android OS remain the most frequently attacked software when it comes to exploits. 45% of exploits detected by Kaspersky Lab were aimed at browsers, and 19% of these malicious programmes were built to exploit weaknesses in the popular Android mobile operating system.
To learn more about the most significant changes in the cyberthreat landscape from July to September 2016, see the full ‘IT Threat Evolution in Q3 2016 Report’ on Securelist.com