Crimeware trends: self-propagation and driver exploitation

Crimeware trends: self-propagation and driver exploitation

Introduction


If one sheep leaps over the ditch, the rest will follow. This is an old saying, found in various languages, and it can be applied to ransomware developers. In previous blog posts, we highlighted an increase in the popularity of platform-independent languages and ESXi support, and recently, we wrote about ransomware borrowing these propagation methods.


Last month, we wrote in our crimeware reporting service about further ransomware variants that now had their own methods for copying and executing malware on other machines within the network. We also wrote about a case of abusing vulnerable drivers, something that might become popular in the future as well. In this blog post, we provide excerpts from these reports.


For questions or more information on our crimeware reporting service, please contact [email protected].


Some ransomware statistics


During the first ten months of 2022, the share of users affected by targeted ransomware among all users affected by all types of malware almost doubled year-on-year, reaching 0.026%.



Share of users attacked by targeted ransomware, January–October 2021 and January–October, 2022 (download)


LockBit


LockBit is one of the most popular, innovative and rapidly developing current ransomware families. Recently, we noticed that a new option was added to the LockBit builder site, as can be seen below:



Support the originator by clicking the read the rest link below.