Magazine menu Close Magazine menu

malware

Latest stories

cybersecurity predictions

What a year of changing cyberthreats can tell business

  • min read
    • For business leaders, knowing what's changing in cybersecurity helps you recruit the right people with the right skills today for what you'll soon need. Kaspersky's 2022 Security Bulletin (free download) analyzes which attacks their global cloud service Kaspersky Security Network (KSN) has detected, blocked and disabled over the past year. There are some numbers your business will want to know about. 15 percent of users had a malware attack Kaspersky Security Network blocked malware-class attacks on some 15 percent of users in 2022, or around 1 in 7. This shows just how common malware is. The malware class of attacks covers familiar cybercrime tools like viruses, trojans and ransomware. The countries where Kaspersky's software blocked the most malware attacks in 2022 were Tunisia, Taiwan and Algeria. 506 million web-based attacks Web-based attacks result from users downloading files that then trigger a cyberattack. These might come from websites made by cybercriminals, infected online resources within user-created content (like online forums) or legitimate resources that cybercriminals have hacked. Cybersecurity education can be a powerful tool in preventing web-based attacks. Heathrow Airport has a novel staff cybersecurity education that carefully targets those needing it most with 10-minute online learning modules. 1.4 million cryptocurrency mining attempts Cryptocurrency mining is very much on the rise. Kaspersky Security Network detected around 1.4 million attempts to install mining software in the past year. Mining means digitally solving complex mathematical problems that verify cryptocurrency transactions, which also earns cryptocurrency. It slows devices and uses much electricity. In November 2022, Kaspersky announced they'd seen a 230 percent growth in cryptocurrency mining in the third quarter of 2022 compared with the same period in the year before. 102 million attempts to visit malicious URLs Malicious URLs are a common tool in 'phishing' attacks – when cybercriminals send emails inducing recipients to click on links, downloading malware. Endpoint security is vital in protecting against phishing, as is employee cyber-awareness. 377,000 attempts to steal money These attacks were often in the form of 'banking Trojans'. In early 2022 a particularly sophisticated money-stealing Trojan popped up that masquerades as a banking app and imitates phone conversations with bank employees. The app fooled many, highlighting the need to teach employees 'cyber hygiene' – like remembering to pause and think before downloading anything. Those who provide legitimate apps or financial services might also reflect on how they can show customers their products are trustworthy. These big numbers in cybersecurity over the past year show how threats to business are growing and changing. Cybercriminals always find new ways to get through consumers' and employees' defenses. By combining hiring the right people with robust cybersecurity education and strong security solutions, your business will greatly reduce its chances of a serious attack succeeding. Then, you can spend your time on what you do best.
enterprise cyberthreats 2022

Five indispensable cyberthreat insights for enterprises

  • min read
    • Cyberthreats and cybercriminals' methods change all the time. Each year, we see things we've never seen before. Understanding what cyber researchers are finding can help your enterprise stay ahead of evolving cyberthreats, preventing costly data breaches and malicious damage. Kaspersky has the biggest global network of cybersecurity research and analyst teams, collaborating closely with product research and development. With expert researchers distributed across the globe, we see can escalate and respond to local situations fast. Here, we share some of our recent observations your business can act on today. 1. Ransomware is stepping it up a notch Fabio Assolini, Senior Security Researcher, Global Research and Analysis Team (GReAT,) Latin America, says: "This year, ransomware is no less active. Cybercriminals keep threatening retailers and enterprises worldwide. Watching these tendencies gives us threat intelligence to fight cybercrime today and helps us prepare for what we may see in the months to come. "Our research groups ransomware into three big trends: Ransomware that adapts to be able to infect different platforms, ransomware becoming more "industrialized" and cybercriminals taking sides in geopolitical conflicts. But despite its ever-increasing sophistication and targeting, there's still much enterprises can do to stay safe." What to do: Find out about the five best steps your business can take to fight ransomware – from keeping software up to date, to ensuring your Security Operations team has access to the latest threat intelligence. 2. Advanced Persistent Threats are coming out of the woodwork An Advanced Persistent Threat (APT) involves sneaky, sophisticated hacking techniques. It may hide malicious software in your system for a long time, stealing information or waiting for the moment to cause maximum damage. Kaspersky tracks more than 900 groups of APTs. David Emm, Principal Security Researcher, GReAT Global, says: "We became aware of a firmware-level APT compromise through our firmware scanner logs. The attackers had modified a single component to intercept the machine's boot sequence and introduce a sophisticated infection chain. The chain leaves no traces on the hard drive, as its components operate in memory only – a fileless attack with a small footprint." The researchers named the new ATP MoonBounce and have linked it to a known threat actor. What to do: Arm employees with the knowledge they need to protect your organization. Get APT threat reports on SecureList. 3. Apps can make Internet of Things devices even more vulnerable The Internet of Things (IoT) is a fast-growing ecosystem – forecasts predict we'll use more than 75 billion IoT devices by 2025. Among these, companion apps for internet-connected cars have attracted special attention. In early 2022, a 19-year-old hacker shared how he had accessed and controlled more than a dozen Tesla cars through their apps. The vulnerability of IoT devices, increasingly part of manufacturing and industry processes, has long been known. Our interest in transparency recently spurred Kaspersky analysts to look at car-controlling apps, finding their security and openness often lacking. What to do: Dan Demeter, Senior Security Researcher, GReAT Europe, Middle East and Africa says: "For an ongoing well-established security perimeter, we recommend periodic checks and updates for all applications used withing the perimeter, whether it's a consumer or a business environment. Remove any obsolete or not used apps from these environments as soon as possible." Demeter also highlights better practice among some vehicle companion apps. "Some use specially designed solutions from automakers, which, for example, make it impossible to unlock the doors remotely. With access to the vehicle's data through the manufacturer's website, there's no need to give credentials to an app, and users can revoke access any time." 4. Geopolitical tensions are raising denial-of-service risk Distributed Denial of Service (DDoS) attacks are cybercriminals' go-to targeted attack. They overwhelm a server, service or network with a flood of traffic, so you can't give your customers reliable online service. The Russia-Ukraine conflict has triggered a spate of DDoS attacks in both countries, targeting critical infrastructure, media and state-run services. Hacktivist groups have instigated some of these attacks, distributing apps, software and even games which can teach cybercrime skills to those with other aims, like extortion. Kaspersky researchers have noted a sharp rise in DDoS attacks across the board. What to do: Researchers advise businesses and nation states to prepare for DDoS attacks before they happen, through investing in suitable security controls and preparing defensive strategies with national internet service providers (ISPs.) Maher Yamout, Senior Security Researcher, GReAT Middle East, Turkey and Africa, says: "Deploy cyber defenses in advance. When an attack comes, it's too late. You never know when an emergency will happen, so today's the day to take care of your anti-DDoS protection." Threat intelligence also plays an important role in preventing DDoS attacks. Kaspersky is the only global threat intelligence provider with a major presence and expertise in Russia, where most advanced persistent threats and attacks originate. Security teams should subscribe to Kaspersky SecureList to stay up-to-date. 5. Malware keeps upping the ante Malware is common and costly. Over the past year, Kaspersky software prevented at least one malware attack on 20 percent of our users. Recently we've seen plenty of new and rehashed techniques aimed at disguising malware or letting it do more damage. Dr Amin Hasbini, Unit Head of GReAT Middle East, Turkey and Africa, says: "Since its discovery in 2014, we've seen the malware Emotet – originally designed to steal banking credentials – in many other forms, like as a delivery system for other malware and and botnet executable, using small employee mistakes to create big incidents. It mostly spreads nowadays through malicious email spam." What to do: Malware attacks often start with an employee making a small error of judgment, like clicking a link in a dodgy email, so one of the best ways to stay safe is to thoroughly educate all your staff in cybersecurity. Kaspersky research in partnership with Longitude, a Financial Times company, found leaders whose cybersecurity training programs can keep pace with the threat landscape say their companies are better prepared for a cyberattack. Immersive cybersecurity training is a powerful way to engage your workforce with learning in an age when there is much competition for their attention. Advanced cyberthreats are common. They have a big impact on business reputation and bottom line. When business leaders take cybersecurity action, they avoid spending more time later mopping up a cyberattack's damage. When choosing your cybersecurity vendor, look for those that participate in third-party tests and reviews, win awards and achieve top scores in independent tests. What's clear is that advanced threats are ever-changing, so having the most up-to-date threat intelligence will always be crucial for your business.  
ATTACHMENT Dglobal cybersecurity priorities

COVID-19 has changed global cybersecurity. What must nations do now?

  • min read
    • During the pandemic, lockdowns and 'shelter in place' orders around the world have done much good. They've not only saved lives, they've shown us our cities without pollution and let businesses realize employees working from home can be more business benefit than business challenge. I spoke about the growing cyberthreat landscape and what we must do about it as part of a high-level leaders discussion on international cybersecurity during the United Nations Internet Governance Forum (IGF) 2020. During the pandemic, cybercriminals used new-found time to hone their skills and test out new methods. We saw a sharp rise in cybercrime of all kinds, from malware to advanced persistent threats (APT.) New hacking groups came on the scene, and with them, new kinds of attacks. New attacks and actors unmasked Here's just a sample of the expansion of cybercrime our researchers detected since the coronavirus pandemic came into our lives. This year we've seen unique malicious file detection rise 20 to 25 percent a day. Most threats, like malware, are relatively easy to deal with. But when what we're seeing is a rise in more professional cybercrime gangs, that's a different story. Kaspersky researchers are now monitoring more than 200 cybercrime gangs who've been launching hyper-targeted attacks against targets such as banks and governments. We've also seen more 'juniors' entering cybercrime. While they're easy to stop now, many will graduate from hacker kindergarten and join the pros. With the increasing use of the internet of things, the number of points where cybercriminals can attack has grown exponentially. We know they're willing and able. Take, for example, one of the most successful global attacks, the 2016 Mirai malware attack on domain name system provider Dyn. It took down hundreds of news websites around the world. How should nations respond to the new threat landscape? The cybersecurity impact of the pandemic has two parts. First, people are at greater risk of cyber-intrusion thanks to working from home and spending more time online. Second, there are more cybercriminals, and they've become better at what they do. Meanwhile, the digital economy has been growing fast. Many businesses decided to use the breathing space and necessity of the pandemic to digitalize new parts of their business. So we're at a place and time when organizations and their customers need to feel confident in these new ways of buying and delivering services. Building that confidence will help economies thrive. So how do we get there? I've got three priorities. Leaders discuss international cybersecurity in the United Nations Internet Governance Forum (IGF) 2020 1. Secure technology by design We can make technologies much more difficult and expensive to compromise, but they must be designed that way from the start. We have operating systems in devices already on the market that are so secure we had to devise a new way of talking about them – so we call this cyber-immunity. The chances of an attack on these systems succeeding means the cost to the criminal of a successful cyberattack is higher than the damage caused. To make critical infrastructure safer, we could deploy cyber-immune technologies across the network. The time to do it is now. 2. Enforcing cybersecurity law on an international level International cooperation is crucial for hunting down cybercriminals, but it looks as though the world isn't going in a 'cooperation' direction – it's becoming more fragmented. We need a space in cybersecurity where nations can cooperate safely, without geopolitical fractures getting in the way. 3. High-level cooperation requires high-level cybersecurity education As well as needing to overcome our differences, international cooperation against cybercrime will require 'cyber diplomats' to stay continually informed about the changing threat landscape. Good news for those imagining a boring slide talk in a dark basement – cybersecurity education keeps pace with innovation and developments in learning science. For example, learning through immersive gamified simulations like Kaspersky Interactive Protection Simulation (KIPS) is popular and effective. While the world recovers from the shocks of the COVID-19 pandemic, we must recognize much has changed, not least in cyberthreats. We need a new era of international cooperation to hunt cybercriminals. We need to make sure 'cyber diplomats' (those who develop and enforce national and international policy against cybercrime) fully understand the threats. As professional cybercrime gangs hone their skills, I predict we'll see cyberattacks grow at every level, harming business and governments. Thankfully, technology keeps evolving, and no one is powerless. Adopting cyber-immune systems will help nations keep the lights, water and internet running at times of crisis and beyond.
optimum EDR MDR

How to know what level of endpoint protection you need

  • min read
    • Endpoints – meaning, any end of a digital communications connection, like servers, laptops and mobile devices – are cybercriminals' favorite way to get inside your infrastructure. Market data analysis firm IDC's 2019 study found 70 percent of breaches started on an endpoint. There are a few types of threats: Traditional or commodity, evasive or complex, targeted and advanced persistent threats (APTs.) Classic Endpoint Protection Platforms (EPPs) do a great job at protecting against traditional threats like malware, but evasive and advanced threats are becoming more common as more cybercriminals get hold of advanced tools. Those digitizing their business also often want to add a few more security strings to their bow. And these days, cybercriminals aim advanced and complex threats at all kinds of businesses, not just household-name companies and nation states. That's why adding Endpoint Detection and Response (EDR) to your EPP is fast becoming the standard. And then, Managed Detection and Response (MDR) offers a way to achieve the same protection in a different way. We'll cover what these advanced options do, their benefits and which types of organizations need them. What is endpoint detection and response (EDR) and when do you need it? Once you've got an EPP you're happy with, think about whether you need EDR on top. EDR offers organizations of all sizes greater ability to protect themselves against complex and advanced threats. Although they're less common than traditional threats, they're costly and disruptive to business. EDR gives you better visibility of and instant response to complex threats. It continually monitors endpoints, aiming to identify, investigate and respond. Your EDR may include tools like advanced detection engines, real-time analytics and the ability to hunt, investigate and centrally respond to evasive threats across the protected infrastructure. There should be applied threat intelligence and visibility into endpoints. Level up your endpoint protection with detection and response gives a full list of what to expect. EDR gives you tools for visibility, investigation and response. Your team can see what's happening on all endpoints and understand the scale of the threat. Investigation capabilities let you understand the root cause of a threat. Threat-hunting tools let your cybersecurity experts actively seek out any threats hiding in your infrastructure. After detecting and analyzing the threat, a fast response matters. Each organization is different. While some might have extensive cybersecurity expertise, others need a simpler solution. If your business has in-house cybersecurity expertise, you may benefit from better threat discovery, threat hunting and centralized incident response, such as Kaspersky Endpoint Detection and Response Expert, also available as part of Kaspersky Anti-Targeted Attack Platform. Alternatively, Kaspersky Endpoint Detection and Response Optimum is a simpler solution for the smaller cybersecurity team on their way to building an incident response processes. When do you need managed detection and response (MDR?) EDR provides advanced defensive capabilities, but you need to have your own cybersecurity experts to use it. MDR, on the other hand, means external experts manage your defense. With MDR, skilled professionals give you continuous protection 24 hours a day, seven days a week. It's ideal for organizations that struggle to find expertise or with limited in-house resources. Many organizations that opt for MDR are small- to medium-sized. For large organizations, MDR means you can outsource detecting, validating and prioritizing incidents rather than having as many cybersecurity specialists in house. If you're not sure whether EDR or MDR is best for your business, this infographic lays out the benefits of each. Endpoints are often vulnerable because they're what we use to create, communicate and store information. Our people using them can be manipulated by social engineering or make the wrong decision during moments of inattention, so security awareness training will help strengthen your endpoints. Whether you want to strengthen your internal defenses or use expert guidance to combat the latest threats, Kaspersky can help. For effective threat detection and response and round-the-clock security monitoring without prohibitive costs or complexity, upgrade to our cloud-native Kaspersky Optimum Security.
endpoint detection response automation

Level up your endpoint protection with detection and response

  • min read
    • Effective – and cost-effective – cybersecurity is an art of balance. Complex cyberthreats are becoming more common, but every organization faces different risks. How likely are you to be attacked and by which threats? How should you use your time, money and resources to address these? How much expertise do you have, and how much could you expand it? Getting these answers right is where minimizing cybersecurity risk and improving efficiency begins. Recently, having more employees working from home has highlighted the importance of endpoint protection. The growing incidence of more disruptive advanced and complex threats adds further concern. Organizations of every size need safe and reliable ways to communicate and share information. But that's not all. Many businesses now find they're at greater risk now attacks are more complex and frequent so they're looking for a more advanced security tool: Endpoint Detection and Response (EDR.) All EDR products aim to better identify, investigate and respond to advanced and complex threats like ransomware and fileless threats. It's an extra layer on top of endpoint protection that's continuously looking for and responding to advanced threats. What does EDR do? EDR can have a range of capabilities, depending on the product and vendor. There may be a detection engine, for example, analyzing threats using machine learning and executing possible threats in a sandbox. It may include a real-time analytics engine, monitoring memory and searching for behavior patterns. The most important EDR feature may be visibility into your endpoints. With visibility, you can investigate past attacks or current threats on endpoints. You can involve cybersecurity experts in threat hunting using advanced tools. And once you've identified and analyzed threats, you can respond fast, preferably in an automated way, saving time and resources. EDR doesn't replace your Endpoint Protection Platform (EPP.) If you feel your EPP isn't up to the job, upgrade it before you add EDR into the mix. Multi-layered threat response saves time Cyberthreats are best addressed with multiple layers. As the threat enters the host, an endpoint protection engine uses approaches like structural machine-learning models and behavior analysis to identify and neutralize traditional threats. EDR comes into play after EPP has filtered out most malware through these automated processes. It lets you concentrate resources on the more dangerous complex and advanced threats. Using EDR's investigation, threat hunting and response capabilities, your cybersecurity team can efficiently address these more serious threats. For example, when a threat is detected, a cybersecurity officer can perform a root cause analysis to see if it's a complex threat and find out where it came from. If it is a complex threat, they can respond right away and set up a task to search for similar threats, automatically applying the same response. According to Kaspersky's IT Security risks survey, 28 percent of companies using EDR could detect cyberattacks immediately after or within a few hours of an incident. How EDR saves time and resources Automating and simplifying processes saves time and resources, and improves security. Even partial automation leads to faster responses, which could be crucial to mitigate a more serious impact for cases like ransomware. Together with a more simplified workflow, less will get missed because of 'alert fatigue' from dealing with many similar incidents. You can then give more attention to incidents that need human intervention, using EDR's enhanced visibility, investigation and response capabilities. You should see a happier IT team, freed from routine tasks and able to work better. They can deal with complex incidents quickly and efficiently, significantly improving your security and preventing business disruption. Choosing the right EDR for your business All EDR tools on the market are different. Some provide better threat hunting, while others focus on streamlining workflow and better integration. Here are some examples of Kaspersky products that could help. For better threat visibility, investigation and response capabilities when your IT department doesn't have access to highly skilled security officers, use Kaspersky Endpoint Detection and Response Optimum. For better threat discovery, threat hunting and centralized incident response when you have a specialized security team, try Kaspersky Endpoint Detection and Response, perhaps as part of Kaspersky Anti-Targeted Attack Platform. The broadening landscape of advanced and complex attacks has made many companies reexamine their endpoint protection. These businesses realize they need to do more to reduce the risk from cyberattacks. In a market where there's strong competition for cybersecurity skills, EDR capabilities help make the best use of your team's abilities. Investigation tools and visibility into all endpoints are intelligent additions to your endpoint security.
switching cybersecurity questions

10 questions to find out if your endpoint security measures up

  • min read
    • The digital perimeter around businesses has changed a lot in the past decade, with cloud computing, bring-your-own-device (BYOD) and the internet of things (IoT,) to name but a few. For many, this has meant a radical rethink of their endpoint protection. Companies might do the same because they've outgrown their provider or lost trust when the protection has let them down. If you're thinking about changing your cybersecurity dance partner while you're in good company, it's important to think through your decision. And it's important to take stock and question if your current solution is going to be good enough to face oncoming threats. Kaspersky's white paper, Time to switch — updating endpoint security: Why now is the time to act, recommends you ask these questions. 1. What do independent test results say? If another vendor is claiming their product is better than what you've got, be sure to check whether their claims match up with what independent test labs find. These labs use cybersecurity experts to examine and evaluate features rigorously. Look at different labs' results carefully, because there are differences in the performance of different products. For example, AV-Test gave only one company's endpoint protection top marks in detecting fileless attacks. Look at the results of several tests and see which products consistently score near the top of the list. 2. Can your threat prevention cope with the most sophisticated attacks? With threats becoming ever more sophisticated by the day, products designed a decade back may not be able to cope with them. Endpoint protection that has a behavioral engine does the job. A behavioral engine detects fileless threats at the execution stage by analyzing execution patterns, spotting the fileless attack among a myriad of legitimate processes. It then isolates the threat and restores user data. It also blocks vulnerabilities to prevent this happening in the first place. 3. Is it giving you enough management flexibility? Older endpoint security technologies may not be designed for a heavily clouded IT sky. The cloud has led many companies to change how they do things, such as moving away from a centralized data center view of the world. They find it saves money and is more flexible. Security tools should be able to control new attack vectors that come with infrastructure change as well as the old ones. No company wants to get lost in a forest of different management tools. Your solution should handle it all – cloud and on-premise – equally well from a central console, also known as a 'single pane of glass.' 4. Does it support remote work? The lockdowns around the world that followed the COVID-19 pandemic showed employees must be able to work from home, among other places. Corporate networks need to be secure and resistant to attack from outside, but by definition, remote workers are outside that network. Existing software may not be able to handle it. For secure remote working, your endpoint protection platform must be able to secure endpoints remotely. This is especially challenging when employees are using older operating systems. 5. Got automation? Reducing human interaction gives your organization a boost in controlling unwanted activity. This is particularly true when using cloud because allocating workload becomes more complex. There are modern security systems geared for this, often using artificial intelligence (AI.) AI-driven tools like Adaptive Anomaly Control bring automation to the task of sorting legitimate from nefarious activity, and constantly improves with machine learning. Businesses find these kinds of tools can significantly reduce staffing costs and related overheads. 6. Can it meet specialized needs? On top of fileless attack protection, endpoint security most often comes unstuck on desktop firewall, ransomware protection and anti-exploit technology. As an example of why this matters, ransomware is a growing threat facing all organizations. To be effective, the software must protect not only impacted files, but also the disk to keep the master boot record intact. Look at your specific needs and see if your security vendor offers that level of protection. 7. Is there enhanced visibility with endpoint detection and response (EDR?) You need to be able to act fast on threats. To be effective, threat blocking should be married with analyzing the root cause. EDR blocks threats and ensures attacks don't hit other parts of the corporate infrastructure. It lets you see into all endpoints, for protection and threat analysis. And no matter how complex the attack, security managers have a real-time view of the threat. All this means faster response to a security incident. 8. Does it have an effective sandbox for advanced threat protection? Where threats are designed to bypass endpoint detection, sandboxes give an extra layer of security to automate detection and response. The sandbox isolates and detonates malicious applications, to analyze and detect even advanced exploits in targeted attacks. It can be costly, because it usually requires a cybersecurity specialist. Sandboxes are most effective when they're easy to install and operate, scalable and don't need specialist staff. Some endpoint products can't quickly identify and neutralize threats, for example, rules that detect and block similar malware attacks. Security managers should consider whether their current product gives enough control. If not, there are others out there that do. 9. Does it have data protection with encryption management? Integrated tools for data encryption come in two forms: Full-disk encryption (FDE,) preventing data leakage when a laptop is lost and file-level encryption (FLE,) protecting files when they're transferred in untrusted channels. You can also set policies that only certain users can see unencrypted files. 10. Does it have vulnerability management and system hardening? Many attacks happen through software vulnerabilities that could've been patched. It seems basic, but not every endpoint solution can check your system for preparedness and strength. Effective patch management makes sure you find security vulnerabilities early and take pre-emptive measures. System hardening reduces the chance of an incident by intelligently disabling some higher risk features and applications. Companies are adjusting their IT infrastructure to support growth and respond to a changing world. Many will find their security products are no longer fit for a new business paradigm. It's time to look again at whether your current protection is enough. An effective endpoint security product should be able to meet all strains placed upon it. It will handle cloud and on-premises traffic with ease, all from a common platform. It will use automation to reduce the need for human intervention. The vendor should be able to back their claims with reputable lab tests. Even with updates, having an older endpoint security system may mean your business struggles against today's threats. Switching to an automated, comprehensive system, your company will be better able to cope with sophisticated attacks.
by Innovating leaders.
Innovative tech.
About Secure Futures

Secure Futures magazine is your go-to business guide for opinions, trends and insight into the world of technology and cybersecurity. We help your business to bring on the future. Brought to you by Kaspersky, the global cybersecurity experts.

  • For all other countries