ISTR 23 is Symantec's annual threat report about the cyber security threat landscape. Find out about the new trend of cryptojacking, what ransomware criminals are up to now, and why you still need to be mobile security aware. Read the full report here: http://go.symantec.com/istr

1. Internet Security
Threat Report
Volume
23

2. Internet Security Threat Report Volume 23 | Copyright © 2018 Symantec Corporation SYMANTEC PROPRIETARY– Limited Use Only
Agenda
Coin Mining2
Shift in Cyber Crime3
Targeted Attacks4
Supply Chain Attacks5
Mobile Threats6
Questions & Answers7
Introduction1
2

3. Internet Security
Threat Report
Coin Mining
Volume
23

4. Internet Security Threat Report Volume 23 | Copyright © 2018 Symantec Corporation SYMANTEC PROPRIETARY– Limited Use Only
Cryptocurrency malware
Coin mining malware:
• Misuses local resources to mine cryptocurrencies with CPUs and
GPUs
• Number of blocked samples increased by 8,500% in 2017
• Focus is not on Bitcoin
• Preference for coins that can still be mined with a CPU e.g. Monero
• Monero is also more anonymous than Bitcoin
Criminals adapt known scam schemes
for the age of cryptocurrencies
• Attacks against crypto exchanges
• Wallet theft
• Phishing
• Tech support scams
• Fake mobile apps 4

5. Internet Security Threat Report Volume 23 | Copyright © 2018 Symantec Corporation SYMANTEC PROPRIETARY– Limited Use Only
As the price of cryptocurrencies
increased, attackers’ interest in them
grew as well
Monero price
(average)
Detection count
for coinminers
on the endpoint
Internet Security Threat Report Volume 23 | Copyright © 2018 Symantec Corporation SYMANTEC PROPRIETARY– Limited Use Only 5

6. Internet Security Threat Report Volume 23 | Copyright © 2018 Symantec Corporation SYMANTEC PROPRIETARY– Limited Use Only
Three main impacts of cryptocurrency
mining
2 out of 3 victims are consumers,
but targeting of organizations is increasing
• Slower device
• CPU usage at 100%
DEVICE PERFORMANCE
• High energy
consumption
• Fast battery drain
• Hard on mobile devices
ENERGY CONSUMPTION
• Reflects badly on
security posture
SECURITY POSTURE
6

7. Internet Security Threat Report Volume 23 | Copyright © 2018 Symantec Corporation SYMANTEC PROPRIETARY– Limited Use Only
In-browser coin mining a.k.a. Cryptojacking
Scripts that mine cryptocurrencies in your browser while you browse a site
o Very simple for the attacker, add one script line to website
o No exploits needed, client is not “hacked”
o Seen in 2011, but boosted by Coinhive script in Sept 2017
o Some instances are non-malicious e.g. ad replacements
o Try to hide as long as possible, e.g. with pop-under windows
<script src="https://some-website.tld/mining-script.js"></script>
Internet Security Threat Report Volume 23 | Copyright © 2018 Symantec Corporation SYMANTEC PROPRIETARY– Limited Use Only 7

8. Internet Security Threat Report Volume 23 | Copyright © 2018 Symantec Corporation SYMANTEC PROPRIETARY– Limited Use Only
In-browser coin mining a.k.a. Cryptojacking
o In-browser mining increased by 34,000% in
2017 (24% of all web attacks in December
2017)
o 8 Million blocked in December 2017
o Not just Windows — threats exist on OS X,
Linux, mobile, and IoT
- Mobile apps incorporating cryptocurrency mining
code increased by 34 percent in 2017
- Mirai IoT bot variant with cryptocurrency mining
capabilities (April 2017)
- Works in Office documents, other script languages,
browser extensions and widgets
Coin mining
activity
increased
dramatically
in 2017
8

9. Internet Security Threat Report Volume 23 | Copyright © 2018 Symantec Corporation SYMANTEC PROPRIETARY– Limited Use Only
Predictions for Cryptojacking
TARGETING ORGANIZATIONS
Targeting of corporate or
organizational networks in
order to harness the power of
servers or supercomputers.
CLOUD HIJACKING
Cloud services offer the
possibility of high-powered
mining. This has a possible
financial impact on cloud
customers where they pay
based on CPU usage.
BOTNETS
Distributed mining, either
through conventional
botnets of malware-
infected computers and
IoT devices or browser-
based coinminers, hosted
on websites.
9

10. Internet Security
Threat Report
Cyber crime is
changing … Volume
23

11. Internet Security Threat Report Volume 23 | Copyright © 2018 Symantec Corporation SYMANTEC PROPRIETARY– Limited Use Only
Cybercriminals try to find new ways to generate revenue
Ransomware market correction
• Detections stable at 1,242 per day in 2017 (-2%)
• Downloader detections increased by 92%
• 46% increase in new ransomware variants
• Average ransom down to $522 from $1,070
Shift to other attacks
• To coin mining e.g. VenusLocker shifted from
ransomware to crypto mining
• To financial Trojans e.g. Emotet activity
increased by 2,000% in Q4
Trends in cyber crime
Internet Security Threat Report Volume 23 | Copyright © 2018 Symantec Corporation SYMANTEC PROPRIETARY– Limited Use Only 11

12. Internet Security Threat Report Volume 23 | Copyright © 2018 Symantec Corporation SYMANTEC PROPRIETARY– Limited Use Only
Necurs botnet reappeared
o Very active spam botnet:
- 67,000 malicious
emails per day
- Maximum of 392,000 spam
emails per day in October
o Pivoted from ransomware
(Locky) to financial Trojans
o Tried crypto coin pump
& dump spams in 2017
o Currently expermenting
with coin mining
0
100
200
300
400
500
600
700
800
Jan-16
Feb-16
Mar-16
Apr-16
May-16
Jun-16
Jul-16
Aug-16
Sep-16
Oct-16
Nov-16
Dec-16
Jan-17
Feb-17
Mar-17
Apr-17
May-17
Jun-17
Jul-17
Aug-17
Sep-17
Oct-17
Nov-17
Dec-17
Email malware rate 2016-2017 (1 in)
Necurs’
absence at the
start of 2017 is
clearly visible
12

13. Internet Security
Threat Report
Targeted
attacks Volume
23

14. Internet Security Threat Report Volume 23 | Copyright © 2018 Symantec Corporation SYMANTEC PROPRIETARY– Limited Use Only
Targeted Attack Trends
• Analysis of TTPs of 140 groups tracked by
Symantec
• 10% increase in targeted attacks in 2017
• Primary motive is espionage, followed by financial
and disruption
• Continuing to opt for “Living off the Land”
techniques
“Attacks carried out by organized groups,
directed at a specific target or targets”
14

15. Internet Security Threat Report Volume 23 | Copyright © 2018 Symantec Corporation SYMANTEC PROPRIETARY– Limited Use Only
Targeted Attacks by the Numbers
24%
of all targeted
attacks started with
Watering hole attacks
71%
of all targeted
attacks started with spear
phishing – the oldest trick
in the book
27%
of targeted attack
groups have been known to
use zero-day vulnerabilities
at any point in the past
42organizations
compromised on
average per group
4malicious tools
used on average
per group
11%
of all attacks
designed to destroy
and disrupt
15

16. Internet Security
Threat Report
Supply Chain
Attacks Volume
23

17. Internet Security Threat Report Volume 23 | Copyright © 2018 Symantec Corporation SYMANTEC PROPRIETARY– Limited Use Only
Attacking the software supply chain ...
Fewer exploitable zero day
vulnerabilities available
Only 27% of targeted attack
groups ever used zero days
Definition: Implanting a piece of malware into an
otherwise legitimate software package at its usual
distribution location; This can occur during
production at the software vendor, at a third-party
storage location, or through redirection.
... an extension of the “Living off the Land” attack trend
Trojanized updates are
difficult to identify
Trusted domain, digitally signed,
and trusted update process
17

18. Internet Security Threat Report Volume 23 | Copyright © 2018 Symantec Corporation SYMANTEC PROPRIETARY– Limited Use Only
One attack per
month in...
NotPetya
M.E.Docs, 96%
of initial
infections in
Ukraine
CCleaner
Multi staged,
selecting
interesting
targets for
follow-up
Internet Security Threat Report Volume 23
Copyright © 2018 Symantec Corporation
SYMANTEC PROPRIETARY– Limited Use Only
18

19. Internet Security Threat Report Volume 23 | Copyright © 2018 Symantec Corporation SYMANTEC PROPRIETARY– Limited Use Only
Hidden
Difficult for victims
to identify attacks as
trusted processes are
hijacked
Privileges
May provide attacker
with elevated privileges
during installation
Why?
Fast
number of infections can
grow quickly as users
update automatically
Focus
Targeting of specific
regions or sectors
Reach
Infiltration of isolated
targets, such as those in
industrial environments
Trust
Infiltration of well-
protected organizations
by leveraging a trusted
channel
19

20. Internet Security Threat Report Volume 23 | Copyright © 2018 Symantec Corporation SYMANTEC PROPRIETARY– Limited Use Only
Three different methods
to achieve their goal
Internet Security Threat Report Volume 23
Copyright © 2018 Symantec Corporation
SYMANTEC PROPRIETARY– Limited Use Only
20

21. Internet Security
Threat Report
Mobile Threats
Volume
23

22. Internet Security Threat Report Volume 23 | Copyright © 2018 Symantec Corporation SYMANTEC PROPRIETARY– Limited Use Only
Mobile Malware Continues to Surge
24,000 malicious
mobile applications blocked
each day
99.9% of malware
discovered on third-party
app stores
22

23. Internet Security Threat Report Volume 23 | Copyright © 2018 Symantec Corporation SYMANTEC PROPRIETARY– Limited Use Only
79%
24%
15% 12%
77%
27%
20%
2%
0%
10%
20%
30%
40%
50%
60%
70%
80%
90%
100%
2016 2017
Mobile Malware Continues to Surge
Unfortunately mobile devices are rarely kept up-to-date
iOS devices
on newest
Major
Version
iOS devices
on newest
Minor
Version
Android
devices on
newest Major
Version
Android
devices on
newest Minor
Version
23

24. Internet Security Threat Report Volume 23 | Copyright © 2018 Symantec Corporation SYMANTEC PROPRIETARY– Limited Use Only
Privacy on mobile phones
App categories that have
the most malicious
mobile apps are: 20% Music & Audio
27% Lifestyle
Leaky Apps – what
sensitive information do
they most often leak? 37% Device Location
63% Phone Number
20% Percent increase in grayware in 2017
24

25. Internet Security Threat Report Volume 23 | Copyright © 2018 Symantec Corporation SYMANTEC PROPRIETARY– Limited Use Only
Internet of Things (IoT)
Main attack vector:
• Weak default
passwords
• Misconfiguration
2017
50K
2016
6K
600%
Increase in Attacks
25

26. Internet Security
Threat Report
Questions?
Volume
23

27. Internet Security
Threat Report
Thank You!
go.symantec.com/ISTR
Volume
23