Cybercrime tactics and techniques: Q2 2018
A generally slow quarter reflects an overall lullin cybercrime, picking up where Q1 left off with cryptominers continuing to dominate, ransomware continuing to evolve through experimentation, and exploits making a small but significant comeback.
New developments in ransomware and cryptomining drove the market, as Q2 attacks generally showed more sophistication than their Q1 counterparts. The introduction of complex VPNFilter malware, which dropped multi-stage attacks on hundreds of thousands of unsuspecting small office and consumer users, shook the sleepy cybersecurity industry awake. While 2017 outbreaks such as WannaCry and NotPetya have been as yet unmatched in terms of distribution volume and impact, VPNFilter, SamSam, and other such complicated campaigns show that 2018 may just be the year of higher-level, targeted attacks.
So how did we draw these conclusions? As we’ve done for the last several quarterly reports, we combined intel and statistics gathered from April through June 2018 from our Intelligence, Research, and Data Science teams with telemetry from both our consumer and business products, which are deployed on millions of machines. Here’s what we learned about cybercrime in the second quarter of 2018.