2018 IBM X-Force Report: Shellshock Fades, Gozi Rises and Insider Threats Soar

The IBM X-Force team examined numerous cyberthreats that shaped the threat landscape in 2017 and will continue to have an impact in 2018. The IBM X-Force Threat Intelligence Index 2018 delved into some of the biggest issues the research team uncovered in the past year.

Cloud Misconfiguration Incidents Take Center Stage

Inadvertent insiders — employees who unwittingly caused security incidents through negligent actions — took center stage in 2017. According to the latest X-Force report, they were responsible for more than two-thirds of total records compromised last year. Misconfigured cloud servers and networked backup incidents unintentionally exposed more than 2 billion records, making confidential data ripe for picking.

Read the complete 2018 IBM X-Force Threat Intelligence Index Now

More Highlights From the 2018 IBM X-Force Report

To uncover key trends in the 2017 cybersecurity threat landscape, such as the threat from inadvertent insiders, IBM X-Force research teams combed through and analyzed hundreds of millions of data points.

Below are a few important findings from the IBM X-Force Threat Intelligence Index 2018.

Diminishing Shellshock attacks lead to a decline in network attacks and security incidents. Top targeted industries experienced a decline in attacks and security incidents — down 18 percent and 22 percent, respectively — in 2017 over the previous year. This decline is largely attributed to a reduction in Shellshock attacks, which is a result of the diminishing available attack surface due to patching. There were 71 percent fewer Shellshock attacks in 2017 than 2016.
Gozi undergoes the most notable financial malware shift. The most active financial malware in 2017, Gozi (Ursnif), toppled Zeus from its No. 1 position. Gozi activity made up nearly one-fourth of the activity X-Force tracked, proving that organized crime is overtaking all other classes of threat actor in the financial malware-facilitated fraud scene.
Destructive ransomworm attacks WannaCry, Not Petya and Bad Rabbit cost enterprises millions. Although many chief information security officers (CISOs) were already aware and concerned about crypto-ransomware, organizations faced a new breed of this threat in 2017. The X-Force report projects that this is likely to happen again in 2018.

Read the Report to Learn More

Read the full IBM X-Force Threat Intelligence Index 2018 to discover how to keep pace with the changing threat landscape so you can make strategic decisions about cybersecurity and safeguard your business from costly cyberattacks.

Read the complete IBM X-Force Threat Intelligence Index Now

Michelle Alvarez

Manager, X-Force Strategic Threat Analysis, IBM

GootBot – Gootloader’s new approach to post-exploitation

8 min read - IBM X-Force discovered a new variant of Gootloader — the "GootBot" implant — which facilitates stealthy lateral movement and makes detection and blocking of Gootloader campaigns more difficult within enterprise environments. X-Force observed these campaigns leveraging SEO poisoning, wagering on unsuspecting victims' search activity, which we analyze further in the blog. The Gootloader group’s introduction of their own custom bot into the late stages of their attack chain is an attempt to avoid detections when using off-the-shelf tools for C2…

Hive0051’s large scale malicious operations enabled by synchronized multi-channel DNS fluxing

12 min read - For the last year and a half, IBM X-Force has actively monitored the evolution of Hive0051’s malware capabilities. This Russian threat actor has accelerated its development efforts to support expanding operations since the onset of the Ukraine conflict. Recent analysis identified three key changes to capabilities: an improved multi-channel approach to DNS fluxing, obfuscated multi-stage scripts, and the use of fileless PowerShell variants of the Gamma malware. As of October 2023, IBM X-Force has also observed a significant increase in…

“Authorized” to break in: Adversaries use valid credentials to compromise cloud environments

4 min read - Overprivileged plaintext credentials left on display in 33% of X-Force adversary simulations Adversaries are constantly seeking to improve their productivity margins, but new data from IBM X-Force suggests they aren’t exclusively leaning on sophistication to do so. Simple yet reliable tactics that offer ease of use and often direct access to privileged environments are still heavily relied upon. Today X-Force released the 2023 Cloud Threat Landscape Report, detailing common trends and top threats observed against cloud environments over the past…

Security Intelligence

{{title}}

{{title}}

{{title}}

Topics

Cloud Misconfiguration Incidents Take Center Stage

More Highlights From the 2018 IBM X-Force Report

Read the Report to Learn More

More from Threat Intelligence

GootBot – Gootloader’s new approach to post-exploitation

Hive0051’s large scale malicious operations enabled by synchronized multi-channel DNS fluxing

“Authorized” to break in: Adversaries use valid credentials to compromise cloud environments

Topic updates