Ransomware continues to be a major threat. This slidedeck looks at the first six months of 2017, examines why enterprises are being increasingly impacted by ransomware, and reviews the effect of high-profile incidents such as WannaCry and Petya. For more on this area, read Symantec Security Response's blog and whitepaper: https://www.symantec.com/connect/blogs/businesses-most-risk-new-breed-ransomware

1. Presenter
Date
Ransomware 2017:
New threats emerge

2. 2Copyright © 2017 Symantec Corporation
o The advent of worm-type ransomware is a new and highly disruptive avenue of attack
o Businesses in particular are most at risk from worm-type threats, which can spread in
minutes across poorly secured networks
o Infection numbers are continuing to trend upwards in the first six months of 2017,
powered by the WannaCry and Petya outbreaks
o Average ransom appears to have stabilized at $544, indicating attackers may have
found their “sweet spot”
o The U.S. is still the country most affected by ransomware, followed by Japan, Italy,
India, Germany, Netherlands, UK, Australia, Russia, and Canada
Key findings

3. 3Copyright © 2017 Symantec Corporation
Overview: New Ransomware families
0
20
40
60
80
100
120
2014 2015 2016 2017 (to date)
• 98 new families in 2016
• 16 new families in year to date – Jan to Jun 2017
• Rate of new families appearing has begun to slow

4. 4Copyright © 2017 Symantec Corporation
Overview: Ransomware infections by month
0
10,000
20,000
30,000
40,000
50,000
60,000
70,000
80,000
90,000
Trend Line
• Infection numbers continue to trend upwards
• Helped in no small part by May 2017 - WannaCry

5. 5Copyright © 2017 Symantec Corporation
Impact of WannaCry/Petya
0
10,000
20,000
30,000
40,000
50,000
60,000
70,000
80,000
90,000
Total Without WannaCry and Petya

6. 6Copyright © 2017 Symantec Corporation
Overview: Detections by country, Jan – Jun 2017
Other
Countries
31%
United States
29%
Japan
9%
Italy
8%
India
4%
Germany
4%
Netherlands
3%
UK
3%
Australia
3%
Russia
3%
Canada
3%
• Same top ten countries
• Very little change, most are +/- 1%
• Except U.S., down from 34% to 29%

7. 7Copyright © 2017 Symantec Corporation
o Self-propagating, ransomware as a worm
o WannaCry: Used leaked “EternalBlue” exploit to spread rapidly through organizations
and across the internet
o Petya: Used EternalBlue, but also other techniques to spread to patched computers, i.e.
stealing credentials
o Impact of both outbreaks means other attackers may attempt copycat threats
New breed of threat: WannaCry and Petya

8. 8Copyright © 2017 Symantec Corporation
WannaCry and Petya: Organizations bear the brunt
70%
30%
2016
Consumer Enterprise
58%
42%
2017 (TO DATE)
Consumer Enterprise
• Balance of Enterprise vs. Consumer infections shifts dramatically between 2016 and 2017

9. 9Copyright © 2017 Symantec Corporation
WannaCry and Petya linked to this spike
0
10,000
20,000
30,000
40,000
50,000
60,000
Jan-16 Feb-16 Mar-16 Apr-16 May-16 Jun-16 Jul-16 Aug-16 Sep-16 Oct-16 Nov-16 Dec-16 Jan-17 Feb-17 Mar-17 Apr-17 May-17 Jun-17
Consumer Enterprise
• Enterprise infections jumped dramatically during May and June 2017, the
months when WannaCry and Petya hit

10. 10Copyright © 2017 Symantec Corporation
o Worm-like propagation mechanisms designed to enable the ransomware to spread
quickly across an entire computer network
o Many consumer computers are not connected to a network, unlike those found in
organizations
o While WannaCry and Petya also did have the ability to spread across the internet to
other vulnerable computers, this means of transmission again largely affected other
organizations
o Most home internet routers would have blocked infection attempts involving the
EternalBlue exploit
Why were enterprises disproportionally affected?

11. 11Copyright © 2017 Symantec Corporation
Main sources of ransomware continue to be:
o Email
o Exploit kits
Organizations in particular need to worry about:
o Targeted attacks
Worms are not the only threat: How ransomware is spread

12. 12Copyright © 2017 Symantec Corporation
How ransomware is spread: Email
o Number one distribution channel is massive malicious spam campaigns
o Spam campaigns run by botnets comprising 1,000s of compromised computers
o Major botnets capable of sending 1 million+ emails daily
o Most use simple social engineering tactics, subject lines such as
• Invoice
• Delivery notification
• Receipt

13. 13Copyright © 2017 Symantec Corporation
o Many exploit kit operators suffered disruption in past year
o However, still a major ransomware distribution channel
o Attackers can redirect users to exploit kits in a number of different ways:
• Malicious links in spam email or social media posts
• Malvertisements
• Redirected web traffic from traffic distribution services
o RIG exploit kit was one of the most active exploit kit operations involved in spreading
ransomware so far in 2017
How ransomware is spread: Exploit kits

14. 14Copyright © 2017 Symantec Corporation
How ransomware is spread: Exploit kits
0
2,000,000
4,000,000
6,000,000
8,000,000
10,000,000
12,000,000
14,000,000
• After falling steadily for most of 2016, web attacks have begun to trend upwards again,
indicating a resurgence in exploit kit activity

15. 15Copyright © 2017 Symantec Corporation
o Growing threat to organizations
o Still small in number but potentially much more serious
o Professional attackers may attempt to:
• Move across network and identify targets of value
• Encrypt multiple computers
• Prevent restoration by encrypting or deleting backups
How ransomware is spread: Targeted attacks

16. 16Copyright © 2017 Symantec Corporation
o Targeted ransomware attacks display high degree of technical
competence
o Use similar tactics to those used by cyber espionage groups
• “Living off the land”—using freely available, legitimate network
administration software and operating system features to help gain a
foothold and move through a network
• Stealing credentials and using them for lateral movement
• Conducting advance reconnaissance to learn more about the target’s
network
How ransomware is spread: Targeted attacks

17. 17Copyright © 2017 Symantec Corporation
Cost of ransomware: Average ransom demand
$0
$200
$400
$600
$800
$1,000
$1,200
2014 2015 2016 2017 (to date)
o $544: average ransom demand from new ransomware families in first 6 months of 2017
o Down from 2016 when there was 3x increase in ransom demands
o Attackers may have settled on “sweet spot” for ransom demands

18. 18Copyright © 2017 Symantec Corporation
“According to research carried out by the
Norton Cyber Security Insight team, 34%
of victims will pay the ransom. This
proportion rises to 64% of victims in the
U.S., providing some indication as to why
the country is so heavily targeted….”
How many people pay?

19. 19Copyright © 2017 Symantec Corporation
o Major corporations have said Petya will impact on financial results:
o FedEx – delivery and logistics
o AP Moller-Maersk – Danish shipping giant
o Beiersdorf – German consumer products maker (Nivea cosmetics etc.)
o Mondelez International – Chocolate maker (Cadburys, Oreos etc.)
o Reckitt Benckiser – Pharmaceuticals
Financial and reputational damage

20. 20Copyright © 2017 Symantec Corporation 20Copyright © 2017 Symantec Corporation
Thank you