Highlights of eSentire's 2018 Annual Threat Report

eSentire’s 2018 Year End Threat Report offers an expansive overview of the threat landscape in 2018. The content and analysis for this report is built off of intelligence gathered from 2,000+ proprietary network and host-based detection sensors. This blog post is presented to highlight some of the most interesting and important findings; to learn more, you can read the full report.

In 2018, the use of botnets increased 500 percent over 2017, with Mirai and its variants continuing to be the most observed threat. This surge in botnet activity led to a 250 percent increase in overall intrusion attempts when compared to 2017. As IoT devices continue to increase in numbers, they continue to be a significant contributor to a rapidly growing threat surface which increases with each newly published exploit.

Throughout 2018, coinmining emerged in two forms: malware on compromised assets and in-browser mining that persists only through the browsing session. Once infected, the coinmining malware silently mines cryptocurrency while consuming a significant amount of CPU cycles resulting in compromised devices with sluggish performance and reduced battery life. Numerous financially-motivated incentives have led threat actors to prefer coinmining over alternative methods such as ransomware, and these incentives drove a fifteenfold year-over-year increase in the amount of coinmining observed by eSentire.

Multiple Maldocs downloaders continued to propagate during 2018. Marap emerged as a new threat, while Emotet’s increased its pervasiveness by adding enhancements. This allowed it to evade detection, spread internally on a network, and deliver modular packages. Maldocs downloaders typically enter organizations embedded within Office and PDF documents delivered through email, however, 2018 also saw the addition of seasonally-themed (Winter holiday, Independence Day) lures disguised as greeting cards.

The Top 10 affected industries in 2018 remained the same as in 2017. For many industries, however, their placement within the Top 10 shifted. Most shifts were small (one or two rankings), but the education industry climbed to first place from 10th place. This change for the education industry is likely a result of the combination of a highly exposed threat surface with an increased volume in botnet activity. DocuSign continues to dominate phishing lures in the corporate environment, followed by Office365 and OneDrive.

With the exponential growth of cybersecurity threats being a common theme in 2018, 2019 will present significant challenges for organizations looking to stay ahead of threats. For even the best-prepared organizations, the increase in threats will present considerable operational and financial challenges as sophisticated tools make it easier and more economical than ever for threat actors to execute attacks. In order to stay ahead, it will be crucial for both organizations and security vendors to turn to emerging technologies such as artificial intelligence (AI) to help take on a proactive approach to protecting their most valuable assets.