A Constant State of Flux: Trend Micro 2020 Annual Cybersecurity Report

Ransomware

A comparison of the numbers of new ransomware families in 2019 and 2020

The 10 industries most targeted by ransomware attacks in 2020

The newcomer Egregor, which made its mark in the latter months of the year, notably employed the double extortion technique as it went after high-profile targets, including major organizations in retail, gaming, and human resources.

Supply-chain attacks

While organizations might have enhanced their security, malicious actors could still find ways to their systems by compromising their partners within their supply chains instead. By taking advantage of the established relationship and trust between a target organization and its partners, supply-chain attackers could gain a foothold in the organization’s systems.

One of the most highly publicized supply-chain attacks in recent memory came to light in December in the form of the attack involving Orion, a widely used network management system software developed by SolarWinds. The malicious actors behind the attack inserted a vulnerability into certain builds of Orion that could allow attackers to compromise servers running the software. Once the relevant update was pushed to customers, the attackers were able to deploy backdoors that gave them complete access to the affected networks and allowed them to perform various malicious activities. Given the nature of some of the targets, including top US government agencies, the attack could have far-reaching consequences.

Covid-19 scams

Remote-work challenges

As organizations implemented remote-work arrangements in response to the pandemic, virtual private networks (VPNs) became valuable tools in protecting network connections from external threats. But like any software, VPN solutions could also be host to vulnerabilities, which, if exploited, could enable attackers to steal proprietary information from and conduct surveillance on their targets’ systems. One VPN vulnerability, CVE-2019-11510, accounted for nearly 800,000 detections in 2020 alone and was involved in attacks in 2020 where it was exploited to deliver ransomware. Malicious actors also found other ways to incorporate VPNs in their attacks: In September, we discovered an instance where an attacker bundled a VPN installer with the Bladabindi backdoor, which could be used to gather information from infected machines.

The rise in remote work also meant an increase in the use of communication tools such as Zoom, Slack, and Discord. This, in turn, led to an increase in attacks that abused these applications: from “Zoombombing” pranks and malicious Zoom installers to a ransomware variant that used Slack webhooks and a spam email campaign that used Discord to deliver malware.

The detection counts of notable VPN vulnerabilities in 2020

Cloud threats

In 2020, the cloud became an even more integral component of the operations of many organizations. But the proper configuration of cloud assets and services continued to be a challenge. In April, for example, it was reported that attackers had dropped cryptocurrency miners on misconfigured Docker daemon API ports via the Kinsing malware. And in October, we reported on an attack on exposed Docker APIs that involved the use of the Metasploit Framework (MSF) shellcode as a payload — the first time we observed the use of such a technique.

In 2020, we also published our findings on how malicious actors take advantage of the underground cloud infrastructure. In the underground, cybercriminals regularly interact and transact with one another. On occasion, they delegate tasks for common jobs, thereby commodifying underground services. Some underground participants also sell access to troves of stolen data advertised as “clouds of logs.”

The infection chain of the Kinsing malware

How the MSF shellcode was used to attack misconfigured container APIs

IoT attacks

Cybercriminals also took notice of the increased reliance of organizations and employees on the internet of things (IoT). This should be a major concern since home networks and devices could be abused by attackers to gain access to the corporate networks they’re connected to. Routers are particularly vulnerable, especially since security at an employee’s home is not as tight as at an enterprise workplace.

In 2020, we saw an uptick in the total number of inbound attack events, which was more than triple the 2019 tally, and in the total number of outbound attack events, which nearly doubled from 2019.