Virus replacement

[НСК-СБ]

Virus replacement

Every year before the New Year holidays, Kaspersky Lab summarizes the viral results of the year. By tradition, this event is held in the form of a thematic show: in 2012 it was a fairy tale ( ammo1.livejournal.com/332978.html ), in 2014 - the morning TV show ( ammo1.livejournal.com/460694.html ), in the 2015 show on the radio ( ammo1.livejournal.com/679787.html ), in the 2016 circus show ( ammo1.livejournal.com/757075.html ), in the 2017 air show ( ammo1.livejournal.com/899236.html ) This year, an event called Kaspersky SLAM was held in the form of a stand-up show.

Perhaps the main trend of this year is that cybercriminals increasingly do not try to run malicious code remotely on computers or devices of the victim, but go the other way.

In attacks on banks of Eastern Europe, which was called DarkVishnya, attackers physically carried devices for attack into banks and connected them to the banking network. It could be a simple laptop, a Raspberry Pi board or even a device in the format of a USB flash drive.

Thanks to the 4G modem, these devices were remotely controlled and gained access to shared network folders, servers, and workstations intended for payments. The damage from these attacks amounted to several tens of millions of dollars.

Similar attacks were recorded on ATMs. Instead of pulling out a cassette of money from an ATM, the attackers connected a laptop to it and the ATM itself gave out all the money.

As for attacks on ordinary users' computers, this year almost harmless miners came out on top.

They do not encrypt user data, do not require money, do not steal passwords, but simply use the power of the user's computer to mine cryptocurrencies. The user hardly suffers (unless the computer slows down a lot), and attackers get very good incomes if they manage to infect a large number of computers with miners.

Often miners embed in websites. In this case, there is not even any infection. Just while the user is on such a site, his computer is mining in favor of the creators of the site. This activity cannot be unambiguously considered illegal. Just such a new reality.

Of course, ordinary computer crooks have not gone anywhere. The share of spam in Russian mail in 2018 amounted to 53% of all forwarded emails. In 2018, Kaspersky Anti-Virus recorded and stopped 89 million attempts to go to phishing sites.

The most notable mobile “malware” for Android in 2018 was the Asacub banking Trojan, which was distributed via phishing SMS messages offering to see the photo via the link. 98% of infections occurred in Russia; up to 40 thousand people came across this Trojan per day. Its main dirty trick is the method of distribution. As soon as the Trojan launches, it sends out all the contacts from the SMS address book using the name of the subscriber from the contacts and writes something like "Alexey, see what pictures: link". Curiosities also happened when people received messages like “Ivan repair the refrigerator, see what pictures” when they turned out to be written in the victim's address book in this way.

Security recommendations are traditional and very simple: never follow links from SMS and MMS, never follow links from letters that cause any suspicions, regularly make backup copies, use different passwords on different sites, use anti-virus.


© 2018, Alexey Nadezhin
Virus replacement