While more high profile attacks have dominated the headlines, the reality is that the majority of threats faced by most organizations are opportunistic in nature fueled by a pervasive Crime-as-a-Service infrastructure, according to Fortinet’s Global Threat Landscape Report.
Modern tools and Crime-as-a-Service infrastructures enable adversaries to operate on a global scale at light speed. As a result, the Internet seems not interested in geographic distances or boundaries because most threat trends appear more global than regional. Adversaries are always on the attack, looking for the element of surprise whenever possible on an international scale.
Understanding exploit trends or how ransomware works and spreads, the better we can avoid the impact caused by the next WannaCry. The malicious ransomware and its variants achieved great scale with hundreds of organizations affected across the world at once.
Just under 10% of organizations detected activity associated with ransomware. On any given day, an average of 1.2% dealt with ransomware botnets running somewhere in their environment.
The peak days of activity fell on weekends, with the hope of slipping traffic past weekend security operations staff. As the average traffic volume of various ransomware botnets increased, the average number of firms impacted by them rose as well.
Eighty-percent of organizations reported high or critical-severity exploits against their systems. The majority of these targeted vulnerabilities were released in the last five years, but no shortage of attempts was made against premillennial CVEs. Exploit distribution was pretty consistent across geographical regions, likely because a huge proportion of exploit activity is fully automated via tools that methodically scan wide swaths of the Internet probing for opportunistic openings.
Hyperconvergence and IoT Are Accelerating the Spread of Malware
As networks and users increasingly share information and resources, attacks are spreading rapidly across distributed geographic areas and a wide variety of industries. Studying malware can help provide views into the preparation and intrusion stages of these attacks.
Although protecting against mobile malware is particularly challenging because devices are not shielded on the internal network, are frequently joining public networks, and often are not under corporate ownership or control.
The prevalence of mobile malware remained steady from Q4 2016 to Q1 2017, with about 20% of organizations detecting it. More Android malware families made the top 10 list by volume or prevalence this quarter. The overall ratio among all types of malware was 8.7% for Q1 comparing to Q4’s 1.7%.