HP threat report finds increasing cybercrime sophistication

HP today released its latest global Threat Insights Report, providing an analysis of real-world cybersecurity attacks and vulnerabilities. 

The research shows a significant increase in the frequency and sophistication of cybercrime activity, including a 65% rise in the use of hacking tools downloaded from underground forums and filesharing websites from H2 2020 to H1 2021.

The report also found that cybercrime is more organised than ever, with underground forums providing a perfect platform for threat actors to collaborate and share attack tactics, techniques, and procedures.

“The proliferation of pirated hacking tools and underground forums are allowing previously low-level actors to pose serious risks to enterprise security,” says Dr. Ian Pratt, Global Head of Security, Personal Systems, HP Inc. “Simultaneously, users continue to fall prey to simple phishing attacks time and time again. Security solutions that arm IT departments to stay ahead of future threats are key to maximising business protection and resilience.”

Notable threats isolated by HP Wolf Security included:

The findings are based on data from HP Wolf Security, which tracks malware within isolated, micro-virtual machines to understand and capture a full infection chain and help to mitigate threats. 

• Cybercriminal collaboration is opening the door to bigger attacks against victims: Dridex affiliates are selling access to breached organisations to other threat actors, so they can distribute ransomware. The drop in Emotet activity in Q1 2021 has led to Dridex becoming the top malware family isolated by HP Wolf Security.
• Information stealers delivering nastier malware: CryptBot malware – historically used as an infostealer to siphon off credentials from cryptocurrency wallets and web browsers – is also being used to deliver DanaBot – a banking trojan operated by organised crime groups.
• VBS downloader campaign targeting business executives: A multi-stage Visual Basic Script (VBS) campaign is sharing malicious ZIP attachments named after the executive it’s targeting. It deploys a stealthy VBS downloader before using legitimate SysAdmin tools to “live off the land”, persisting on devices and delivering malware.
• From application to infiltration: A résumé-themed malicious spam campaign targeted shipping, maritime, logistics and related companies in seven countries (Chile, Japan, UK, Pakistan, US, Italy and the Philippines), exploiting a Microsoft Office vulnerability to deploy the commercially-available Remcos RAT and gain backdoor access to infected computers.

Ongoing developments in cybercrime

“The cybercrime ecosystem continues to develop and transform, with more opportunities for petty cybercriminals to connect with bigger players within organised crime, and download advanced tools that can bypass defenses and breach systems,” observes Alex Holland, Senior Malware Analyst, HP Inc.

“We’re seeing hackers adapt their techniques to drive greater monetisation, selling access on to organised criminal groups so they can launch more sophisticated attacks against organisations. Malware strains like CryptBot previously would have been a danger to users who use their PCs to store cryptocurrency wallets, but now they also pose a threat to businesses. We see infostealers distributing malware operated by organised criminal groups – who tend to favor ransomware to monetise their access.”

Other key findings in the report include:

• 75% of malware detected was delivered via email, while web downloads were responsible for the remaining 25%. Threats downloaded using web browsers rose by 24%, partially driven by users downloading hacking tools and cryptocurrency mining software.
• The most common email phishing lures were invoices and business transactions (49%), while 15% were replies to intercepted email threads. Phishing lures mentioning COVID-19 made up less than 1%, dropping by 77% from H2 2020 to H1 2021.
• The most common type of malicious attachments were archive files (29%), spreadsheets (23%), documents (19%), and executable files (19%). Unusual archive file types – such as JAR (Java Archive files) – are being used to avoid detection and scanning tools, and install malware that’s easily obtained in underground marketplaces.

“The endpoint continues to be a huge focus for cybercriminals. Their techniques are getting more sophisticated, so it’s more important than ever to have comprehensive and resilient endpoint infrastructure and cyber defense. This means utilising features like threat containment to defend against modern attackers, minimising the attack surface by eliminating threats from the most common attack vectors – email, browsers, and downloads.” concludes Pratt.