Ransomware threats emerged as the most significant threat in the first quarter of 2016, surpassing Advanced Persistent Threats ( APT ) attacks as a trend . According to a report by Kaspersky Lab on the malware landscape in the first quarter, the company’s experts identified 2,900 new modified versions of ransomware. 
This particular size shows an increase of about 14% compared to the previous quarter. Kaspersky Lab's database currently includes approximately 15,000 modified ransomware program versions and the number continues to rise.
During the first quarter of 2016, Kaspersky Lab's security solutions blocked 372,602 ransomware attacks on users, 17% of which targeted the business sector. The number of users who suffered an attack increased by 30% compared to the fourth quarter of 2015.
One of the most widespread ransomware programs of this period was Locky. Kaspersky Lab products detected infection attempts with this Trojan in 114 countries, which remains active even in early May 2016.
Another ransomware program, called Petya, was of technical interest due to its ability to encrypt data stored on the computer, but also to replace the Master Boot Record (MBR) of the hard drive. Thus, it prevented the “infected” computers from booting the operating system.
According to Kaspersky Lab’s findings, the top three ransomware families for the first quarter were: Teslacrypt (58.4%), CTB-Locker (23.5%), and Cryptowall (3.4%). All three ransomware types are spread primarily through spam emails with malicious attachments or via links leading to “infected” websites.
“One of the reasons ransomware has become so popular is the simplicity of the ‘business model’ used by cybercriminals. Once ransomware has infected a user’s system, there is almost no chance of getting rid of it without losing personal data. Also, the demand for a ransom payment in Bitcoins makes the whole process anonymous and almost untraceable, which is particularly attractive to scammers. Another threatening trend is the Ransomware–as–a–Service (RaaS) ‘business model’, where cybercriminals pay a fee for spreading the malware or promise a percentage of the ransom paid by an ‘infected’ user,” commented Aleks Gostev, Chief Security Expert at the Global Research and Analysis Team (GReAT).
Another reason for the increase in ransomware attacks is that users believe the threat is invincible. Businesses and individuals are unaware of technological countermeasures that could help prevent the “infection” and locking of files or systems. And of course, ignorance about basic digital security rules allows criminals to profit.
In addition to the above ransomware data, Kaspersky Lab has calculated the overall level of digital threats (malware) worldwide for the first quarter of 2016. According to Kaspersky Security Network data, the malware landscape in the first quarter of 2016 was as follows:
- 21.2% of Internet users experienced web-based attacks at least once, a size lower by 1.5 percentage points compared to the fourth quarter of 2015.
- 44,5% of Kaspersky Lab solution users encountered a malicious threat at least once, an increase of 0,8 percentage points compared with the fourth quarter of 2015.
- Kaspersky Lab solutions protected 459.970 users from fraudulent attempts by digital criminals to gain access to online banking services and steal their money.
- The share of adware programs in the total mobile threat traffic reached 42.7%, a size that made adware programs the top mobile threat. Also, 4,146 new mobile Trojan programs were detected, a size increased by 1.7 times compared to the previous quarter. Additionally, the number of SMS‑Trojans continues to rise.
- The number of new mobile ransomware programs increased by 1.4 times – from 1,984 in the fourth quarter of 2015 to 2,895 in the first quarter of 2016.
The full report on the digital threat landscape (malware) in the first quarter of 2016 is available on the securelist.com.
