Fortinet: Ransomware variants nearly double in six months

Source: Fortinet. Singapore 1H22 findings from the FortiGuard Labs Global Threat Landscape Report.

Fortinet, a global player in broad, integrated, and automated cybersecurity solutions, has announced that the ransomware threat continues to adapt, with more variants enabled by ransomware-as-a-service (RaaS).

According to the company's semiannual FortiGuard Labs Global Threat Landscape Report* for 1H22:

- Work-from-anywhere (WFA) endpoints remain targets for cyber adversaries to gain access to corporate networks. 

- Operational technology (OT) and information technology (IT) environments are both attractive targets as cyber adversaries search for opportunities in the growing attack surface and IT/OT convergence. 

- Destructive threat trends continue to evolve, as evidenced by the spread of wiper malware as part of adversary toolkits. 

- Cyber adversaries are embracing more reconnaissance and defense evasion techniques to increase precision and destructive weaponisation across the cyberattack chain.

Ransomware remains a top threat, and cyber adversaries continue to invest significant resources into new attack techniques. In the past six months, FortiGuard Labs has seen a total of 10,666 ransomware variants, compared to just 5,400 in the previous six-month period. - nearly 100% growth in ransomware variants in half a year. 

RaaS, with its popularity on the dark web, continues to fuel an industry of criminals forcing organisations to consider ransomware settlements, Fortinet said, recommending that all organisations adopt a proactive approach. Real-time visibility, protection, and remediation coupled with Zero-Trust network access (ZTNA) and advanced endpoint detection and response (EDR) are critical, the company said.

The digital convergence of IT and OT and the endpoints enabling WFA remain key vectors of attack as adversaries continue to target the growing attack surface. Many exploits of vulnerabilities at the endpoint involve unauthorised users gaining access to a system, then using lateral movement to get deeper into corporate networks. For example, a spoofing vulnerability (CVE 2022-26925) placed high in volume, as well as a remote code execution (RCE) vulnerability (CVE 2022-26937).

OT devices and platforms experienced in-the-wild exploits, demonstrating the cybersecurity reality of increased IT and OT convergence. Advanced endpoint technology can help mitigate and effectively remediate infected devices at an early stage of an attack, Fortinet suggested. In addition, services such as a digital risk protection service (DRPS) can be used to perform external surface threat assessments, find and remediate security issues, and help gain contextual insights on current and imminent threats.

Trends in wiper malware - malicious software that destroys data by wiping storage clean - reveal more destructive and sophisticated attack techniques. FortiGuard Labs identified at least seven major new wiper variants in the first six months of 2022 that were used in various campaigns against government, military, and private organisations. This number is significant because it is close to the number of wiper variants that have been publicly detected since 2012, the company noted. 

Additionally, the wipers were not confined to one geographical location, but were detected in 25 countries. To minimise the impact of wiper attacks, Fortinet recommends using network detection and response (NDR) with self-learning artificial intelligence (AI) to better detect intrusions. The company also advised that backups should be stored off-site and offline.

FortiGuard Labs analysed the functionality of detected malware to track the most prevalent approaches over the last six months. Defense evasion - avoiding or otherwise rendering defenses useless - was the most employed tactic focused on the endpoint. Malware developers often use system binary proxy execution** for this, Fortinet said, masking their malicious intentions and attempting to hide commands using a legitimate certificate to execute a trusted process while carrying out malicious intent. 

The second-most popular technique was process injection, where criminals work to inject code into the address space of another process to evade defenses and improve stealth. Integrated, AI and machine learning (ML)-driven cybersecurity platforms with advanced detection and response capabilities powered by actionable threat intelligence are important to protect across all edges of hybrid networks, Fortinet stated.

While threat insights help prioritise patching strategies to better secure environments, cybersecurity awareness and training are also important, Fortinet added. Ideally, security operations should function at machine speed to keep up with the volume, sophistication, and speed of today’s cyberthreats. Additionally, AI and ML-powered prevention, detection, and response strategies based on a cybersecurity mesh architecture will allow for much tighter integration, increased automation, as well as a more rapid, coordinated, and effective response to threats across the extended network.

Details

Read the blog for takeaways from the research.

Learn about Fortinet’s free cybersecurity training.

*This Global Threat Landscape Report is a view representing the collective intelligence of FortiGuard Labs, drawn from Fortinet’s sensors collecting billions of threat events observed around the world during the first half of 2022. Similar to how the MITRE ATT&CK framework classifies adversary tactics and techniques, with the first three groupings spanning reconnaissance, resource development, and initial access, the FortiGuard Labs Global Threat Landscape Report leverages this model to describe how threat actors target vulnerabilities, build malicious infrastructure, and exploit their targets. The report also covers global and regional perspectives as well as threat trends affecting IT and OT. 

**Binary files are small files that are not text files. They are typically trusted by computers, making them a good vehicle for a cyberattack.