Cryptolocker Cracked! According to Kaspersky Lab 2015 Enterprise Threat Landscape Review, the tools used for cyberattacks against businesses were different from those used against consumers. 
These include the greater exploitation of legitimate software programs and malware that carried valid digital signatures to keep malicious files hidden for longer. Kaspersky Lab experts also observed a steady increase in the number of corporate users attacked by ransomware.
More specifically, Kaspersky Lab experts found that more than half (58%) of corporate computers received at least one attempt to “infect” them with malware, with the relevant percentage increasing by three percentage points compared to 2014. One in three (29%) corporate computers was exposed at least once to Internet attacks, with exploitation of standard office applications occurring three times more often than attacks against consumers.
New trends in digital attacks
Additionally, 26% of corporate computers faced local threats, such as “infection” from USB sticks or other removable media. Experts also recorded a 7% increase in the use of exploits targeting the Android platform, confirming the growing interest of hackers in the data stored on employees’ mobile devices.
These attacks were carefully planned, with cybercriminals spending considerable time researching the target company’s contacts and suppliers, as well as the personal interests and browsing habits of each employee. This information was then used to identify legitimate websites, which were then hacked and used to distribute malware. These attacks are often repeated over time.
“The future digital landscape for businesses includes a new attack vector: infrastructure. This is because almost all of an organization’s valuable data is stored on servers located in datacenters. We also expect regulators to impose stricter security standards, which could lead to the arrest of more cybercriminals in 2016,” said Yury Namestnikov, Senior Security Researcher at Kaspersky Lab’s Global Research and Analysis Team.
"Chasing" money
In 2015, cybercriminals and APT attack groups focused on actions against financial services organizations, such as banks, investment funds, stock exchanges and exchange platforms, including those handling cryptocurrencies.
Among the most significant attacks of this kind was that of the Carbanak group, which penetrated banking networks, looking for critical systems that would allow them to withdraw money. A successful attack alone could bring in profits of $2.5 - $10 million. Also, the digital espionage group Wild Neutron spent a large part of 2015, “hunting” investment firms, organizations that accept and use Bitcoin, and companies involved in mergers and acquisitions.
Differentiation
Kaspersky Lab experts have observed an increasing diversification of attack targets. For example, in 2015, the Chinese APT group Winnti changed its targets from computer gaming companies to pharmaceuticals and telecommunications.
Thefts from POS
Point-of-sale (POS) terminals used by retailers and other consumer goods companies were another target of attacks in 2015. More specifically, Kaspersky Lab products prevented over 11,500 attempts to compromise POS devices. The company has identified ten “families” of programs designed to steal data from POS terminals. Seven of them appeared for the first time in 2015.
The rise of ransomware
The number of cryptolocker attacks doubled in 2015, with Kaspersky Lab detecting such programs on over 50,000 corporate systems. This could reflect the fact that ransoms received by organizations can be much higher compared to those received by individuals. There is also a higher likelihood that the ransom will actually be paid when it comes to organizations. Many companies simply cannot operate if the information located on various critical computers or servers is encrypted or if they cannot access it.
Kaspersky Lab recommends that businesses take steps to reduce risk and increase their knowledge of the latest threats. The basic security principles for corporate networks remain the same and include: educating employees, establishing strict security procedures, and fully utilizing new technologies and techniques, as each additional layer of protection reduces the risk of a network breach. To eliminate the threat of ransomware infection, companies should use exploit protection tools and ensure that their security solutions include behavioral detection methods, such as Kaspersky Lab System Watcher.
The full version of the relevant report is available on the Securelist.com.
