TrendMicro says major cyber-storm set to hit
TrendMicro is a leading cyber security player and its quarterly report is seen as a key publication in the industry; so when its banner headline reads "Hazards Ahead: Current Vulnerabilities Prelude Impending Attacks", it is worth paying attention. Its argument is that the attacks of the past couple of quarters are like seismic tremors ahead of a big shock; events over the past few months should be seen as the building of momentum. The breach and dumping of Hacking Team's secure data in July was a seminal event, but might be an early warning of larger, deeper breaches down the road as punitive attacks grow in scale and ferocity.

Overall malware detections, unknown malware detections spike

We detected and blocked 4,263,650 malware files in 2022, for a 29% increase from 2021’s numbers. The number of unknown malware files also surged to 3,757,812, for a 46% increase. However, it should be noted that the number of known malware files dropped to 505,838, a 32% decrease in detections.

Our security solution can catch, analyze, and block new and unknown malicious content (such as zero hour malware or URLs) used by threat actors. Unknown or newly created malware could be used by actors to evade detection or in customized attacks tailored to each victim. In fact, threat actors have been increasingly using custom malware in their attacks to target specific industries and sectors, such as government and military groups. We detected more than 3.7 million such threats in 2022, a leap from the 2.5 million detected in 2021.

Figure 1. Known and unknown malware detections in 2021 and 2022

This decline can be attributed to a move made by Microsoft in mid-2022, where they blocked the execution of macro programs in Office documents, ones that have been downloaded from the internet, and those that are sent as email attachments. For the past seven years, the most popular initial access vector has been Microsoft Office documents laced with malicious macros, which are typically distributed to victims via email.

Malicious actors use HTML smuggling, fake Google accounts as macro alternatives

Because of this defensive move, cybercriminals resorted to finding malicious alternatives, such as HTML smuggling, an attack that is usually sent through email and uses a malicious HTML file to slip in a Zip file that contains an ISO file. The ISO file contains an LNK file that loads the malware.

Malicious actors had to evolve their social engineering tactics to successfully steal victims’ personal information. In December, we published a report on a social engineering scheme that made use of Trend Micro’s name in a legitimate PayPal payment request invoice (wherein the requestor was a random person’s name) and a prompt for victims to call a phone number to dispute the charges, only to be directed to scammers who will attempt to steal personal information.

Last year, we also reported on a large-scale cyberespionage campaign by an advanced persistent threat (APT) group called Earth Preta, which targeted different countries, including Japan and Australia. This campaign used spear-phishing emails with fake Google accounts and Google Drive links to distribute TONEINS, TONESHELL, and PUBLOAD.

Meanwhile, ransomware detections continued to plummet for the third consecutive year. In 2022, we detected 58,416 ransomware files, a decrease of 42% compared to the previous year’s numbers.

Figure 2. Ransomware detections in 2021 and 2022

There was a notable decrease in victim payouts last year. Ransomware actors countered this by adopting sophisticated business practices, including offering technical support to victims who opt to negotiate ransom amounts, to keep their businesses thriving.

Last year, we saw ransomware actors updating their payloads to have multiple capabilities. In June 2022, we reported on CMD-based ransomware variants, such as YourCyanide ransomware, that use heavily obfuscated scripts for detection evasion. These ransomware variants steal user information, bypass remote desktop connections, and propagate via email, Discord, Pastebin, Microsoft document links, and physical drives.

Toward the latter part of 2022, a new ransomware family dubbed Royal rose to infamy. Though relatively new to the ransomware scene, its operators are former members of Conti Team One, which are established ransomware actors. We found that it used intermittent encryption tactics and callback phishing techniques to lure victim corporations into installing remote desktop malware.