The Ransomware Surge: Unveiling the Alarming 68% Spike in Cyber Attacks Revealed by Malwarebytes' 2024 ThreatDown State of Malware Report

 Malwarebytes' 2024 ThreatDown State of Malware report highlights significant cybersecurity trends and threats, shedding light on the evolving landscape of cyber attacks. Key points from the report include:

1. Ransomware Dominance in the United States:

   - The United States was a major target for ransomware attacks in 2023, accounting for nearly half of all incidents.

   - Ransomware attacks increased by 68% during the year.

2. Big Game Ransomware and Increased Ransom Demands:

   - Big Game Ransomware attacks saw a surge in 2023, with the LockBit gang responsible for the largest known ransom demand of $80 million after targeting Royal Mail.

   - Ransomware groups adopted scrappier and more sophisticated tactics, targeting a higher volume of victims simultaneously.

   - CL0P ransomware group broke norms with short, automated campaigns using zero-day exploits, making them the second most active "big game" ransomware group.

3. Zero-Day Exploits and Sophistication:

   - The repeated use of zero-day exploits by ransomware groups, particularly by CL0P, indicated a new level of sophistication in cyber attacks.

4. Malicious Advertising Resurgence:

   - Malicious advertising, or malvertising, made a comeback in 2023, posing a threat to businesses and consumers.

   - Campaigns impersonating well-known brands like Amazon, Zoom, and WebEx delivered Windows and Mac malware through convincing ads and websites.

   - Top impersonated brands included Amazon, Rufus, Weebly, NotePad++, and Trading View.

5. Operating System Threats:

   - Android banking trojans were detected 88,500 times in 2023, disguising themselves as legitimate apps to steal banking passwords and money.

   - Malware accounted for 11% of detections on Macs, highlighting the growing significance of macOS as a target.

   - Abuse of Windows Management Instrumentation (WMI) was the top technique (27%) for Living Off the Land (LOTL) cyberattacks, where criminals use legitimate IT administration tools for malicious activities.

6. Ransomware-as-a-Service and Attack Vectors:

   - LockBit remained the most widely used ransomware-as-a-service, responsible for more attacks than its nearest competitor.

   - CL0P's automated campaigns signaled a shift in attack strategies, targeting a large number of victims simultaneously with zero-day exploits.

7. Malware and Impersonated Brands:

   - Aurora Stealer, Vidar, Redline Stealer, BatLoader, and IcedID were identified as the top five most frequently discovered malware.

   - Amazon, Rufus, Weebly, NotePad++, and Trading View were the top five most impersonated brands, demonstrating the diverse range of brands used in malicious advertising campaigns.

8. Living Off the Land Attacks:

   - Abuse of Windows Management Instrumentation (WMI) emerged as the top technique (27%) for Living Off the Land (LOTL) cyberattacks, showcasing the use of legitimate IT administration tools in malicious activities.

In response to these evolving threats, the report emphasizes the importance of organizations staying vigilant and adopting effective cybersecurity measures to protect against ransomware, malware, and phishing attacks.