Information Security

Ransomware Up 627% in Latest Internet Security Report

• By David Nagel
• 03/30/23

Despite an observed decrease at the network level of detected malware last quarter, ransomware at the endpoint level surged 627%, according to the latest Internet Security Report from data security provider WatchGuard. What's the explanation?

According to WatchGuard, some 93% of malware is hiding behind encryption, and about 80% of the company's customers have not enabled https decryption in their firewalls, so the malware is going largely undetected until it reaches endpoints, where detections increased 22% overall.

"We continue to warn that most malware hides in the SSL/TLS encryption used by secured websites. Q4 continues that trend with a rise from 82% to 93%. If you don’t inspect this traffic, you are missing most malware — at least with your network security controls (endpoint security does still have a chance to catch it)."

The Internet Security Report is based on anonymized data collected from WatchGuard's Firebox appliances around the world. According to Watchguard: "Customer Fireboxes send a flurry of malware detections to our threat intelligence database, keeping us apprised of the latest trends. Network administrators who manage these Fireboxes have graciously allowed their devices to provide these anonymized detection reports to us. We analyze their details to understand what the malware landscape looked like last quarter and to investigate any trends or irregularities. With the data from this report, and previous ones, we can sometimes forecast what future malware trends might look like. We also make some conclusions and offer takeaways on defending against the current and future malware landscape."

The report also noted that overall network attacks were flat in the fourth quarter of 2022 compared with the previous quarter.

Among the other findings and recommendations:

• Network-level detections of malware were down 9.2% for the quarter, despite endpoint detections being up. Recommendation: Inspect SSL/TLS traffic from secure websites before it reaches the endpoint.

• Phishing attacks have increased. "Phishing and business email compromise (BEC) remains one of the top attack vectors, so make sure you have both the right preventative defenses and security awareness training programs to defend against it."

• Lockbit continues to be a leading malware group for ransomware. "We continue to see Lockbit variants often, and they are definitely the group that seems to have the most success breaching companies (through their affiliates) with ransomware."

• ProxyLogin exploits are growing. According to the report: "An exploit for this well-known, critical Exchange issue rose from eighth place in Q3 to fourth place last quarter. It should be long patched, but if not, you should know attackers are targeting it."

The complete report is freely available on WatchGuard's site. It includes an executive summary and further details and analysis of findings from the quarter.