The IT Nerd

McAfee Inc. today released its McAfee Labs Threats Report: April 2017, which details the challenges facing threat intelligence sharing efforts, probes the architecture and inner workings of Mirai botnets, assesses reported attacks across industries, and reveals growth trends in malware, ransomware, mobile malware and other threats in Q4 2016.

• Volume. A massive signal-to-noise problem continues to plague defenders trying to triage, process, and act on the highest-priority security incidents.
• Validation. Attackers may file false threat reports to mislead or overwhelm threat intelligence systems, and data from legitimate sources can be tampered with if poorly handled.

• Quality. If vendors focus just on gathering and sharing more threat data, there is a risk that much of it will be duplicative, wasting valuable time and effort. Sensors must capture richer data to help identify key structural elements of persistent attacks.

• Speed. Intelligence received too late to prevent an attack is still valuable, but only for the cleanup process. Security sensors and systems must share threat intelligence in near real time to match attack speeds.
• Correlation. The failure to identify relevant patterns and key data points in threat data makes it impossible to turn data into intelligence and then into knowledge that can inform and direct security operations teams.

• Triage and prioritization. Simplify event triage and provide a better environment for security practitioners to investigate high-priority threats.
• Connecting the dots. Establish relationships between indicators of compromise so that threat hunters can understand their connections to attack campaigns.
• Better sharing models. Improve ways to share threat intelligence between our own products and with other vendors.

• Malware growth. The number of new malware samples slowed 17 per cent in Q4, while the overall count grew 24 per cent in 2016 to 638 million samples.
• Mobile malware. The number of new mobile malware samples declined 17 per cent in Q4, while total mobile malware grew 99 per cent in 2016.
• Ransomware growth. The number of new ransomware samples dropped 71 per cent in Q4, mostly due to a drop in generic ransomware detections, as well as a decrease in the activity of the Locky and CryptoWall strains. The number of total ransomware samples grew 88 per cent in 2016
• Mac OS malware. Although still small compared to Windows threats, the number of new Mac OS malware samples grew 245 per cent in Q4 due to adware bundling. Total Mac OS malware grew 744 per cent in 2016.

• Spam botnets. Spam email messages from the top 10 botnets dropped 24 per cent in Q4 to 181 million emails. They generated 934 million spam messages in 2016 overall.

• Reported security incidents. McAfee counted 197 publicly-disclosed security incidents in Q4 and 974 publicly-disclosed security incidents in 2016. Security incidents are events that compromise the integrity, confidentiality, or availability of information assets. Some, but not all, of these incidents are breaches. Breaches are incidents that result in the confirmed disclosure (not just potential exposure) of data.

• Public sector cyber-attacks. The public sector experienced the greatest number of incidents by far, but McAfee believes this may be the result of stricter requirements for reporting incidents, as well as an increase in attacks related to the U.S. election process, mostly voter database incidents and defacing of election websites.
• Banking and gaming attacks. A Q3 jump in incidents in the software development sector was due to the rise in attacks on gaming platforms. In the finance sector, the SWIFT attacks on the banking sector led to a Q2 jump in incidents.
• Botnet activity. The KelihosC botnet, a recent purveyor of phony pharmaceuticals and Russianautomotive supplies (such as “winter and summer tires at competitive prices”), increased its overall volume during Q4.