Cybercriminals are showing remarkable adaptability and pursuing new avenues of attack, exploiting vulnerabilities, gaining unauthorised access, compromising sensitive information and defrauding individuals.
Besides, sextortion scam emails have made a comeback and there is an alarming growth of deceptive Android loan apps, said ESET, a global cybersecurity firm, which has released its latest Threat Report.
One of the reasons for shifts in attack patterns is stricter security policies introduced by Microsoft, particularly on opening macro-enabled files, which summarises threat landscape trends seen in ESET telemetry from December 2022 through May 2023.
Shrinking attack surface
ESET telemetry data also suggests that operators of the once-notorious Emotet botnet have struggled to adapt to the shrinking attack surface, possibly indicating that a different group acquired the botnet. In the ransomware arena, actors increasingly reused previously leaked source code to build new ransomware variants.
During the first half of 2023, sextortion email scams made a comeback, and ESET observed an alarming growth in the number of deceptive Android loan apps.
According to the report, in a new attempt to bypass Microsoft security measures, attackers substituted Office macros with weaponised OneNote files in H1 2023, leveraging the capability to embed scripts and files directly into OneNote.
In response, Microsoft adjusted the default setup, prompting cybercriminals to continue exploring alternative intrusion vectors, with intensifying brute-force attacks against Microsoft SQL servers potentially representing one of the tested replacement approaches.
Covering variants
“Regarding the leaked source code of ransomware families such as Babyk, LockBit, and Conti, these allow amateurs to engage in ransomware activities, but at the same time enable us as defenders to cover a broader range of variants with a more generic or well-known set of detections and rules,” says ESET Chief Research Officer Roman Kováč.
While cryptocurrency threats have been steadily declining in ESET telemetry – not even being resurrected by the recent increase in bitcoin's value – cryptocurrency-related cybercriminal activities continue to persist, with cryptomining and cryptostealing capabilities being increasingly incorporated into more versatile malware strains.
This evolution follows a pattern observed in the past, such as when keylogger malware was initially identified as a separate threat, but eventually became a common capability of many malware families.
Looking at other threats focused on financial gain, ESET researchers observed the comeback of so-called sextortion scam emails, exploiting people’s fears related to their online activities, and an alarming growth in deceptive Android loan apps masquerading as legitimate personal loan services and taking advantage of vulnerable individuals with urgent financial needs.-- TradeArabia News Service
&uuid=(email))