Ransomware Up 627% in Latest Internet Security Report

Despite an observed decrease at the network level of detected malware last quarter, ransomware at the endpoint level surged 627%, according to the latest Internet Security Report from data security provider WatchGuard. What's the explanation?

According to WatchGuard, some 93% of malware is hiding behind encryption, and about 80% of the company's customers have not enabled https decryption in their firewalls, so the malware is going largely undetected until it reaches endpoints, where detections increased 22% overall.

"We continue to warn that most malware hides in the SSL/TLS encryption used by secured websites. Q4 continues that trend with a rise from 82% to 93%. If you don’t inspect this traffic, you are missing most malware — at least with your network security controls (endpoint security does still have a chance to catch it)."

The Internet Security Report is based on anonymized data collected from WatchGuard's Firebox appliances around the world. According to Watchguard: "Customer Fireboxes send a flurry of malware detections to our threat intelligence database, keeping us apprised of the latest trends. Network administrators who manage these Fireboxes have graciously allowed their devices to provide these anonymized detection reports to us. We analyze their details to understand what the malware landscape looked like last quarter and to investigate any trends or irregularities. With the data from this report, and previous ones, we can sometimes forecast what future malware trends might look like. We also make some conclusions and offer takeaways on defending against the current and future malware landscape."

The report also noted that overall network attacks were flat in the fourth quarter of 2022 compared with the previous quarter.

Among the other findings and recommendations:

  • Network-level detections of malware were down 9.2% for the quarter, despite endpoint detections being up. Recommendation: Inspect SSL/TLS traffic from secure websites before it reaches the endpoint.

  • Phishing attacks have increased. "Phishing and business email compromise (BEC) remains one of the top attack vectors, so make sure you have both the right preventative defenses and security awareness training programs to defend against it."

  • Lockbit continues to be a leading malware group for ransomware. "We continue to see Lockbit variants often, and they are definitely the group that seems to have the most success breaching companies (through their affiliates) with ransomware."

  • ProxyLogin exploits are growing. According to the report: "An exploit for this well-known, critical Exchange issue rose from eighth place in Q3 to fourth place last quarter. It should be long patched, but if not, you should know attackers are targeting it."

The complete report is freely available on WatchGuard's site. It includes an executive summary and further details and analysis of findings from the quarter.

About the Author

David Nagel is the former editorial director of 1105 Media's Education Group and editor-in-chief of THE Journal, STEAM Universe, and Spaces4Learning. A 30-year publishing veteran, Nagel has led or contributed to dozens of technology, art, marketing, media, and business publications.

He can be reached at [email protected]. You can also connect with him on LinkedIn at https://www.linkedin.com/in/davidrnagel/ .


Featured

  • cloud icon with a padlock overlay set against a digital background featuring binary code and network nodes

    Cloud Security Auditing Tool Uses AI to Validate Providers' Security Assessments

    The Cloud Security Alliance has unveiled a new artificial intelligence-powered system that automates the validation of cloud service providers' (CSPs) security assessments, aiming to improve transparency and trust across the cloud computing landscape.

  • robot brain with various technology and business icons

    Google Cloud Study: Early Agentic AI Adopters See Better ROI

    Google Cloud has released its second annual ROI of AI study, finding that 52% of enterprise organizations now deploy AI agents in production environments. The comprehensive survey of 3,466 senior leaders across 24 countries highlights the emergence of a distinct group of "agentic AI early adopters" who are achieving measurably higher returns on their AI investments.

  • laptop with a neural network image, surrounded by books, notebooks, a magnifying glass, a pencil cup, and a desk lamp

    D2L Updates Lumi with Personalized Study Supports

    Learning platform D2L has introduced new artificial intelligence features for D2L Lumi that help provide more personalized study supports for students.

  • cloud with binary code and technology imagery

    Hybrid and AI Expansion Outpacing Cloud Security

    A survey from the Cloud Security Alliance and Tenable finds that rapid adoption of hybrid, multi-cloud and AI systems is outpacing the security measures meant to protect them, leaving organizations exposed to preventable breaches and identity-related risks.