Trend Micro Q1 2015 roundup finds Australia and New Zealand the target of increasing ransomware attacks

SYDNEY, 20 May 2015 – Australia ranked second in the world for countries with the highest number of ransomware detections in Q1 2015, according to Trend Micro’s latest ‘Bad ads and zero-days: reemerging threats challenge trust in supply chains and best practices.’ Australia held six percent of the world’s ransomware detections. 

Users from Australia and New Zealand suffered from ransomware attacks as TorrentLocker attacks inched their way from market to market. Other crypto-ransomware variants seen this past quarter also showed marked improvements. The number of ransomware infections in Q1 against the previous quarter went down from 72 percent to 52 percent for consumers, while enterprises jumped from 16 percent to 28 percent in the quarter, and small businesses from six percent to 14 percent. 

“Ransomware is very much top of mind for IT managers in Australia and New Zealand as we see fresh campaigns from cybercriminals regularly,” said Dhanya Thakkar, managing director at Trend Micro Asia Pacific. “With attacks specifically targeting users in Australia and New Zealand, our customers and partners need to know the details of each new outbreak as they appear, as well as how to identify and block ransomware within their organisation.” 

A combination of newer and older threat variations defined the cybersecurity landscape in the first quarter of 2015. Malvertising, zero-day vulnerability exploitation, “old-school” macro malware and the decade-old FREAK vulnerability are just a few of the highlights in Trend Micro’s new report. 

From an industry perspective, healthcare and retail point-of-sale systems have also seen an uptick in threat activity. The report reinforces how complacency can present major cybersecurity risks in an era where the margin for error has been significantly diminished. 

“Even though we are early in the year, it is clear 2015 is shaping up to be noteworthy in terms of volume, ingenuity and sophistication of attacks,” continued Thakker. “The rise in attacks against the healthcare industry, combined with the rise in malvertisements, reflects that technology users are being assailed from all angles. It is clear businesses and individuals alike need to be proactive in protecting against threats. An aggressive and different security posture is critical to keep financial, personal and intellectual property safe.” 

Adware also topped the list of mobile threats, with Trend Micro now documenting more than five million Android threats to date — nearing the predicted total of eight million by the close of 2015. In fact, top malicious and high-risk apps blocked by Trend Micro were adware related, reflecting this increase. Tim Falinski, Consumer, Director, ANZ at Trend Micro, said, “Considering we’ve seen more than half the predicted Android threats for 2015 in Q1 alone, consumers need to be wary of underestimating the security threats their mobile devices expose them to. With Australian and New Zealanders being some of the most prevalent smartphone users in the world, we must remain vigilant and protect ourselves from these threats.” 

Trend Micro researchers also found zero-day exploits targeting Adobe software utilised malvertisements and no longer required victims to visit or interact with malicious sites to become infected. 

The healthcare industry experienced a notable rise in cyber-attacks, in addition to iOS™ and point-of-sale (PoS) systems continuing to be targeted. Since exploitations in these areas have been in their infancy for several years, researchers believe this rise is primarily due to a lack of preparedness—a sisable oversight that should be addressed. 

Australia ranked second in the world for countries with the highest number of PoS RAM Scraper infections in Q1, with 10% of the world’s PoS RAM Scraper infections, after the US with 23%. 

“The number of PoS-RAM-scraper detections more than doubled since we started tracking them last year, which could be attributed to improvements to existing PoS malware,” continued Thakker. “PoS malware are going to be mainstays in the security industry just like scareware and ransomware. This is especially true for countries such as Australia and New Zealand where most people prefer cards over cash.” 

“The question we have to ask is, ‘are we doing enough to protect ourselves from security threats?’” added Thakker. “While we need to constantly update our systems to protect against new attacks, the first quarter of 2015 clearly showed we need to also watch out for older threats, and how no industry or system should feel exempt.” 

Report highlights include: 

* Healthcare industry hit by massive attacks: Major healthcare service providers, such as Premera Blue Cross and Anthem, suffered data breaches that exposed millions of customers’ financial and medical data. 

* Old threatsinvigorated withnewtargeted attack tools, tactics and procedures: Rocket Kitten and those behind Operation Pawn Storm set their sights on new targets, proving that targeted attacks are evolving.

* Exploit kits grew in sophistication: Exploit kits constantly add new exploits to their arsenals, adding to their allure to expert and novice attackers.Australia ranked third in the world for countries most affected by exploit-kit-related attacks in Q1, with five percent of the world’s exploit-kit-related attacks.

* Crypto-ransomware volume soared, expands to enterprises: Crypto-ransomware expanded their target base to enterprise users, no longer exclusively pursuing consumers.

* Macro malware, old but still effective: The resurgence of macro malware suggest cybercriminals are taking advantage of user security complacency, through reliance on Microsoft Office^®defaults.Australia ranked fifth in the world for countries with the highest number of macro malware infections in Q1 2015, with five percent of the world’s macro malware detections.

* Decade-Old FREAK security flaw brought on patch management challenges: As more vulnerabilities emerge in open source OSs and applications, IT administrators will find it increasingly difficult to mitigate risks.

Australia ranked third in the world for countries that posted the highest number of users who clicked malicious URLs throughout the quarter, with five percent of the world’s malicious URL clicks.

Australia also ranked third in the world for countries with the highest number of command and control (C&C) server connections for Q1, with five percent of the world’s C&C server connections.

For the complete report, please visit: http://www.trendmicro.com.au/vinfo/au/security/research-and-analysis/threat-reports/roundup/

A blog post regarding the report can be viewed here: http://blog.trendmicro.com/1q-2015-security-roundup/

About Trend Micro