WatchGuard’s Internet Security Report Says Crypto Mining Malware Threats Are Rising

A new threat intelligence report by WatchGuard Technologies indicates that 98.8 percent of seemingly common Linux/Downloader malware variants were actually designed to deliver a popular Linux-based cryptocurrency miner.

The report says the cyber criminals are poised for continued growth as this is just one of several signs that malicious crypto-mining malware is becoming a top tactic among cyber criminals.

The complete WatchGuard Technologies report details delivery mechanisms for these crypto-miner attacks, and explores other prevalent security threats targeting small to midsize businesses (SMBs) and distributed enterprises today.

WatchGuard Technologies is a global leader in network security, secure Wi-Fi, and network intelligence products and services to more than 80,000 customers worldwide.

How Bad Is The Threat?

Chief Technology Officer at WatchGuard Technologies, Corey Nachreiner said its Threat Lab team has uncovered multiple indicators that suggest malicious crypto miners are becoming a mainstay in cyber criminals' arsenals, and will continue to grow more dominant in Q2.

The CTO said while ransomware and other advanced threats are still a major concern, these new crypto-miner attacks illustrate that bad actors are constantly adjusting their tactics to find new ways to take advantage of their victims.

In fact, once again in Q1, the company saw nearly half of all malware slip past basic signature-based antivirus solutions due to various obfuscation methods. One way every organization can become more secure against these sophisticated, evasive threats is to deploy defenses enabled with advanced malware prevention like our APT Blocker service.

Other Findings Of WatchGuard's Internet Security Report

The WatchGuard's Internet Security Report offers in-depth insights on the top cyber threats each quarter, along with defense recommendations SMBs can use to protect themselves.

The findings are based on data from tens of thousands of active Firebox UTM appliances around the world. The top takeaways from the Q1 2018 report include:

Several cryptocurrency miners appeared for the first time in WatchGuard's list of the top 25 malware variants. Firebox appliances have a rule called Linux/Downloader, which catches a variety of Linux “dropper” or “downloader” programs that download and run malware payloads.

The only malware sample on WatchGuard's top 10 list that hadn't appeared in a past report was Ramnit, a trojan that first emerged in 2010 and had a brief resurgence in 2016. Nearly all (98.9 percent) of WatchGuard's Ramnit detections came from Italy, indicating a targeted attack campaign.

In past reports, APAC has trailed EMEA and AMER in the number of reported malware hits by a wide margin. In Q1 2018, APAC received the most malware overall.

WatchGuard UTM appliances block malware using both legacy signature-based detection techniques and a modern, proactive behavioral detection solution – APT Blocker.

The Mimikatz Windows credential-stealing malware reappeared on WatchGuard's top 10 malware list after several quarters of absence. Two thirds of the detection of this malware was in the United States and under 0.1 percent of detections were in APAC, possibly due to the complexity of double-byte characters in countries like Japan that use a symbol-based language for passwords.