The warning to buckle up for turbulence in business IT security in 2017 proved apt. Within the first half of the year, self-propagating ransomware had hit organisations on several continents, and Asia-Pacific was among the most exposed regions.
A region at the centre of the ransomware wave
Trend Micro reported in 2017 that Asia-Pacific led the world in ransomware threats in the first half of 2017, with 35.7% of all ransomware detected globally targeting companies in the region. EMEA followed at 25.24%, then Latin America at 22.66% and North America at 15.71%.
The company said it detected 82 million ransomware threats between January and June 2017. It also blocked more than 3,000 business email compromise attempts and disclosed 382 new vulnerabilities. The top three malware families found in the region were DocDrop, DOWNAD and WannaCry.
WannaCry, May 2017
Tripwire’s review of the year dates the outbreak to 12 May 2017, when an updated WannaCry variant struck hospitals in the UK’s National Health Service, Telefonica and other high-profile targets. RFE/RL reported that the attack disrupted hospitals, banks, shops, schools and government agencies in more than 150 countries.
Marsh’s Asia-Pacific white paper says WannaCry severely disrupted businesses in major Asian economies, with China, India and Vietnam among the 20 countries hit hardest globally. The same paper put the estimated losses between hundreds of millions of dollars and US$4 billion, while the ransom actually collected was about US$150,000.
The weakness it used was already patched. WannaCry exploited EternalBlue, a vulnerability Microsoft had fixed in a security bulletin in March 2017. The Australian Strategic Policy Institute noted that it spread rapidly in Windows environments with poor software update practices.
NotPetya, June 2017
A second outbreak followed. Tripwire said news of NotPetya first broke on 27 June, when power distributors in Ukraine and the Netherlands confirmed attacks on their systems. Kaspersky’s analysis found that the malware borrowed large chunks of code from Petya but behaved as a wiper, offering no way to recover affected data, which is why it was named NotPetya.
Europol’s 2017 internet organised crime assessment said the first half of the year saw ransomware attacks on a previously unseen scale, following the emergence of self-propagating “ransomworms” such as WannaCry and Petya/NotPetya. It added that poor digital hygiene and security practices can allow such a threat to spread quickly.
Attribution and the rest of the year
The Australian Strategic Policy Institute wrote that both the NSA and Britain’s National Cyber Security Centre attributed WannaCry to North Korea, and that NotPetya was attributed to Russia. These are government attributions, not findings by the companies hit.
In October 2017, Bad Rabbit affected several organisations in Russia, Ukraine, Eastern Europe and the US. Tripwire noted that, unlike the two earlier outbreaks, it did not exploit a Microsoft vulnerability for distribution. It used drive-by attacks to deliver its dropper.
Webroot’s threat research team ranked NotPetya as the most destructive ransomware of 2017, followed closely by WannaCry and Locky, based on Windows devices infected through September 2017.
How the year was read afterwards
Microsoft’s 2018 review of threats in Asia counted three global ransomware outbreaks in 2017: WannaCrypt, Petya/NotPetya and BadRabbit, which affected corporate networks, hospitals, transport and traffic systems. It said Asia had the greatest number of ransomware encounters.
The lesson drawn in these reports was largely about basics: applying security updates promptly and keeping reliable backups. That mattered because, as the Marsh paper noted, paying the ransom in WannaCry’s early stages did not result in a decryption key being provided, so most victims rebuilt from backups or other sources.