2016-2018勒索软件和恶意矿工的威胁景观（英文版）

KSN Report: Ransomware and Malicious Cryptominers 2016-2018 Summary

Core Content

This report examines the decline of ransomware and the rise of cryptocurrency mining as a dominant cyber threat from April 2017 to March 2018, comparing it with the previous year (April 2016 to March 2017). It highlights the shift in cybercriminal focus from ransomware to cryptominers due to the latter's more sustainable and less risky financial model.

Main Findings

• Ransomware Decline:

  • The total number of users encountering ransomware dropped by 30%, from 2,581,026 in 2016-2017 to 1,811,937 in 2017-2018.
  • The proportion of users encountering ransomware out of all malware users fell by 1 percentage point, from 3.88% to 2.80%.
  • The share of users encountering cryptors (a type of ransomware) decreased by 3 percentage points, from 44.6% to 41.5%.
  • The number of users attacked with cryptors almost halved, from 1,152,299 to 751,606.
  • Mobile ransomware attacks fell by 22.5%, from 130,232 to 100,868.

• Cryptominers Rise:

  • The total number of users encountering miners increased by 44.5%, from 1,899,236 to 2,735,611.
  • The share of miners in overall threats grew from 3% to 4%.
  • The share of miners in risk tool detections increased from 5% to 8%.
  • The number of users encountering mobile miners also increased, but at a steadier pace (9.5% increase, from 4,505 to 4,931).

Ransomware Trends

• Ransomware attacks were initially focused on financial institutions in 2017, but this trend was short-lived.
• The WannaCry and BadRabbit outbreaks caused significant peaks in ransomware attacks, but the overall trend was a decline.
• The top ransomware families in 2016-2017 included Locky, CryptXXX, Zerber, Shade, Crusis, Cryrar, Snocry, Cryakl, Cryptodef, Onion, and Spora.
• In 2017-2018, WannaCry dominated, with Locky, Zerber, and Shade maintaining similar victim shares.
• The share of victims affected by top ransomware actors increased from 33% to 50%, indicating a more centralized and less competitive landscape.

Geographic Distribution

• Top countries for ransomware attacks (2016-2017):
  • Turkey (7.93%), Vietnam (7.52%), India (7.06%), Italy (6.62%), Bangladesh (6.25%), Japan (5.98%), Iran (5.86%), Spain (5.81%), Algeria (3.84%), China (3.78%).
• Top countries for ransomware attacks (2017-2018):
  • Thailand (9.57%), UAE (8.67%), Iran (8.47%), Bangladesh (7.62%), Vietnam (6.17%), Saudi Arabia (5.45%), China (5.36%), India (4.28%), Algeria (3.59%), Turkey (3.22%).
• Absolute attack numbers: Vietnam, India, and Algeria had the highest number of ransomware attacks, though their percentages were lower due to higher malware detection rates.

Mobile Ransomware Trends

• Mobile ransomware attacks declined from 130,232 in 2016-2017 to 100,868 in 2017-2018, following a similar pattern to PC ransomware.
• Despite the decline, mobile ransomware remains a serious threat due to its technical sophistication and the fact that it often targets users in developed or large developing markets.
• Top countries for mobile ransomware (2016-2017): United States (18.65%), Canada (17.97%), Germany (15.46%), UK (13.37%), Italy (11.87%), Kazakhstan (6.78%), Spain (6.35%), Mexico (5.85%), Ukraine (1.96%), Russian Federation (0.88%).
• Top countries for mobile ransomware (2017-2018): United States (1.64%), Kazakhstan (1.60%), Belgium (1.16%), Italy (1.10%), Poland (1.03%), Romania (0.78%), Mexico (0.70%), Ireland (0.68%), Germany (0.66%), China (0.66%).
• The main mobile ransomware families in 2016-2017 were Fusob, Svpeng, and SMALL, with Fusob increasing from 47% to 65% of attacks.
• In 2017-2018, SMALL and Svpeng continued to dominate, with Zebt entering the top three as a new threat.

Cryptominers as a Game Changer

• Cryptominers are becoming a preferred alternative to ransomware due to their lower risk, steady income, and sustainability.
• Bitcoin and Monero prices influenced mining activities, with peaks in 2017 leading to increased mining attacks.
• The number of users attacked by miners increased from 1.87 million in 2016 to 2.7 million in 2017.
• Top countries for miners (2016-2017): Afghanistan (27.28%), Ethiopia (25.29%), Uzbekistan (24.57%), Tajikistan (22.34%), Zambia (20.79%), Turkmenistan (19.71%), Kazakhstan (16.36%), Mozambique (15.05%), Tanzania (12.21%), Kyrgyzstan (9.77%).
• Top countries for miners (2017-2018): Ethiopia (31%), Afghanistan (29%), Turkmenistan (24%), Tajikistan (21%), Mozambique (19%), Uzbekistan (18%), Zambia (18%), Kazakhstan (17%), Tanzania (15%), Kyrgyzstan (12%).
• The decline in ransomware attacks was not uniform across all families, with Zerber and Shade maintaining similar victim numbers.

Conclusions

• Ransomware is declining as a primary threat, with cybercriminals shifting to cryptocurrency mining.
• The geographic distribution of both ransomware and cryptominers is changing, with cryptominers increasingly targeting developing markets.
• Mobile ransomware remains a concern, but its decline indicates a shift in the overall threat landscape.
• The rise of cryptominers is expected to continue, given their lower risk and more stable income model.

Fighting Back

• Users should remain vigilant and cautious when using the internet, especially in regions with high ransomware and miner activity.
• Cybersecurity measures, including updated software and anti-malware tools, are essential to combat these threats.
• The report underscores the importance of understanding the evolving nature of cyber threats and adapting defenses accordingly.