The ransomware landscape has shifted dramatically in 2017 and organizations bore the brunt of the damage caused by new, self-propagating threats such as WannaCry and Petya.
Symantec’s latest research paper on ransomware has found that businesses were the main victims of the WannaCry and Petya outbreaks, with corporate networks the ideal breeding ground for this new generation of self-propagating threats.
During the first six months of 2017, Symantec blocked just over 319,000 ransomware infections. If this infection rate continued for the full year, 2017 would be a significant increase over 2016, when a total of 470,000 infections were blocked. Contributing to this increase was a spike in blocked infections during May and June 2017, the months when the WannaCry and Petya outbreaks occurred.
Organizations in the crosshairs
The impact of WannaCry and Petya makes it quite likely that more attackers will attempt to replicate the tactics used by deploying ransomware as a worm. The propagation mechanisms employed by both ransomware families enabled the threats to spread quickly across an entire computer network.
Many consumer computers are not connected to a network, unlike those found in organizations.
While WannaCry and Petya also did have the ability to spread across the internet to other vulnerable computers, this means of transmission again largely affected other organizations. WannaCry and Petya’s disproportionate impact on organizations can be seen in infection statistics. During 2015 and 2016, businesses accounted for between 29 and 30 percent of ransomware infections. That figure shot up to 42 percent in the first half of 2017, with a major spike in business infections during May and June, the months WannaCry and Petya spread.
Organizations need to prepare themselves for the threat posed by self-propagating ransomware. The Petya outbreak demonstrated that even without EternalBlue, attackers can create worm-like ransomware that is capable of spreading across a network. While it does require more skill and the use of additional tools, such as credential stealers, the potential rewards are much greater.
Ransom demands stabilize
During the first six months of 2017, the average ransom demand seen in new ransomware families was US$544. This follows on from a period of rapid inflation in ransom demands. During 2016, the average ransom demand seen in new ransomware families increased dramatically, rising more than threefold from $294 to $1,077.
This could suggest that after a period of trial-and-error in 2016, many attackers have settled on a ransom demand of around $500 as the “sweet spot” for ransom demands. While this may not sound like a major loss for an organization, most ransom demands are for a single infected computer. If an organization finds itself with tens or hundreds of infected computers, the price demanded by attackers will quickly add up.
Now is the time to bolster defenses
According to ISTR 22, during the first six months of 2017, organizations accounted for 42 percent of all ransomware infections, which is a dramatic increase from 30 percent in 2016 and 29 percent in 2015. In term of unique ransomware detections, Hong Kong is ranked the 4th place among Asia Pacific and Japan, and the 14th place globally. Cybersecurity experts has warned users to take preventative measures. WannaCry and Petya proved that ransomware is not a predictable threat and organizations who are complacent may be caught out. Building a multi-layered defense ensures that any point of failure is mitigated by other defensive practices.
This should include not only regularly patching vulnerabilities and ensuring critical systems are backed up, but also employing multiple, overlapping, and mutually supportive defensive systems to guard against single-point failures in any specific technology or protection method.
Tips for businesses and consumers
- New ransomware variants appear on a regular basis. Always keep your security software up to date to protect yourself against them.
- Keep your operating system and other software updated. Software updates will frequently include patches for newly discovered security vulnerabilities that could be exploited by ransomware attackers, such as EternalBlue.
- Email is one of the main infection methods. Delete any suspicious-looking email you receive, especially if they contain links and/or attachments.
- Be extremely wary of any Microsoft Office email attachment that advises you to enable macros to view its content. Unless you are absolutely sure that this is a genuine email from a trusted source, do not enable macros and instead immediately delete the email.
- Backing up important data is the single most effective way of combating ransomware infection. Attackers have leverage over their victims by encrypting valuable files and leaving them inaccessible. If the victim has backup copies, they can restore their files once the infection has been cleaned up.
Victor Law is Chief Operating Officer for Enterprise Security, Greater China Region, Symantec