Search
Homepage This page's url is: -crn- Rankings and Research Companies Channelcast Marketing Matters CRNtv Events WOTC Jobs HPE Zone Intel Partner Connect Digital Newsroom Dell Technologies World Newsroom Dell Technologies Newsroom IBM Newsroom The IoT Integrator Lenovo Newsroom NetApp Data Fabric Intel Tech Provider Zone

Report: Ransomware, Botnets On The Rise

Fortinet reports a rise in SMS ransomware attacks that force victims to submit an expensive text message to retrieve access to their systems blocked by hijackers.

botnet

One of the biggest threats this month was the emergence of an SMS-based ransomware attack, according to the Fortinet Threatscape report. The attack, dubbed DigiPog, is an SMS blocker that locks out a system and kills off popular applications such as IE and FireFox. To unblock the system, a user will be required to enter a code into a provided field, obtained by sending an SMS message to a provided premium number. In exchange, the attackers grant the victim the code needed to unlock and use their system, experts said.

"Your system is completely locked out," said Derek Manky, cybersecurity and threat researcher at Fortinet's FortiGuard Labs. "It's all about monetization with the more dominant ransomware."

In this particular attack, the hackers reap the monetary rewards when users send an SMS message to the provided number, Manky said. However, it will just be a matter of time before these kinds of ransomware attacks evolve into targeted attacks aimed at obtaining specific classified information, such as intellectual property or military blueprints, he added.

Meanwhile, the upwards spike in ransomware is in part powered by an influx of botnet activity, according to the report. Researchers identified both the Bredolab and Pushdo botnets behind the ransomware attacks. In addition, researchers identified a new botnet loader, Sasfis, which Manky said began appearing about six month ago. Over the last few months, security researchers have seen Sasfis significantly expand, landing the botnet in fifth place on Fortinet's Top 100 attack list.

"If (attackers) can grow a botnet and rent it out as a service, there are more affected endpoints, and they have more power," Manky said. "That's what we've seen with Sasfis."

Finally, the Fortinet report found a sharp rise in attacks resulting from a critical vulnerability in Microsoft's Internet Explorer. Microsoft issued an emergency out-of-band patch repairing the flaw on Tuesday, but not before attackers exploited the vulnerability by launching malicious attacks delivered by drive-by downloads. The attacks, which exploited holes in IE 6 and IE 7, accounted for one-fourth of the malicious activity seen in March, researchers said.

"Typically when we see an out-of-band patch, it's usually a very serious issue," Manky said.

And Manky said that the attacks exploiting the critical IE flaw will continue to increase, spreading on users' unpatched PCs. Manky compared this round of IE attacks to the infamous Internet worm Conficker, which flourished and ultimately infected more than a million computers worldwide, even after Microsoft released an emergency patch fixing the flaw.

"There is definitely an issue with patch management there," he said. "Even a month down the road, we will still see successful attacks (exploiting the IE flaw)."

Manky added that the rise in IE attacks underscored the necessity for users to keep on top of patch management.

"The patches are there and available, but not noticed. That really is the one place where we obviously educate and focus on in terms of highlighting how important it is," he said. "You look at these threats like Conficker and Gumblar, they're very, very dangerous. That's the biggest thing—to have the patch management in place."

Back to Top

related stories

Video

 

sponsored resources