In 2016, Kaspersky Lab’s annual Mobile Virusology report found that the volume of malware aimed at mobile device users had grown more than threefold in 2015 compared with 2014. The report came from the company’s Antimalware Research group. It named ransomware, malware able to obtain unlimited rights on an infected device, and data stealers (including financial malware) as the most dangerous threats of 2015.
The 2015 figures
Kaspersky Lab detected 884,774 new malicious programs in 2015, against 295,539 in 2014. Mobile banking Trojans moved the other way: new samples fell to 7,030 from 16,586 in 2014. The company also counted 94,344 unique users attacked by mobile ransomware, a five-fold rise from 18,478 in 2014.
Ransomware in 2015
Kaspersky described 2015 as the year of ransomware. The mobile variants locked the screen with a pop-up claiming the user had committed illegal acts, and demanded a ransom of between US$12 and US$100 to unlock the device.
The share of Kaspersky mobile product users attacked by ransomware rose from 1.1 per cent in 2014 to 3.8 per cent in 2015. Attacks were registered in 156 countries, and Russia, Germany and Kazakhstan were hit hardest. Trojan-Ransom.AndroidOS.Small and its Small.o modification were the most active in Russia and Kazakhstan, and Small.o was the most widespread mobile ransomware the company detected that year.
The number of ransomware modifications rose 3.5 times. Kaspersky read this as a sign that criminals saw growing profit in blackmailing users, and it expected more complex malware and more targeted countries in 2016.
Root-capable adware Trojans
Nearly half of the 2015 top 20 Trojans were programs that displayed intrusive advertising. The most widespread were Fadeb, Leech, Rootnik, Gorpro and Ztorg. Their operators spread them through malicious web banners, fake games and other apps, including some published in official app stores. Some were presented as software preinstalled by the device maker.
Several of these programs could gain super-user (root) rights, which gave attackers almost unlimited ability to change data on the device. Once installed, they were close to impossible to remove, even by resetting the device to factory settings. Kaspersky noted that root-capable mobile malware had been known since 2011 and was very popular with criminals in 2015. It expected that to continue in 2016.
What the later data showed
Kaspersky’s own follow-up reporting bore out the ransomware trend. Its Securelist analysis of mobile ransomware found that Kaspersky’s Android security products protected 35,413 users from mobile ransomware between April 2014 and March 2015. A year later the figure was 136,532, almost four times as many. Ransomware’s share of all attacked mobile users rose from 2.04 per cent to 4.63 per cent over the same periods. Kaspersky’s April-to-March periods do not match the calendar-year figures above, so the two sets of numbers are not directly comparable.
The company’s report on 2016 compared that year with 2015. As reported by Digital Trends, it counted three times as many malicious installations in 2016 as in 2015, a total of 8.5 million. More than 150,000 unique users in 167 countries fell victim to mobile ransomware in 2016, which Kaspersky put at 1.6 times the 2015 figure. Russia, Australia and Ukraine were the most affected countries.