This article originally appeared in SiliconANGLE on March 5, 2019.
Phishing attacks were up in 2018 while ransomware attack were down are two keys findings from a new report from Microsoft Corp. detailing security trends.
Microsoft’s annual Microsoft Security Intelligence Report Volume 24 analyzed data from 6.5 trillion security signals that go through the Microsoft cloud as well as gathered insights from thousands of security researchers.
Leading the pack, the report noted a change in the types of attacks, both attempted and successful, as the security community has pushed back at bad actors.
Ransomware attacks, long a popular form of cyberattack, along with general attacks using malware, were found to have declined 34 percent in 2018 as attackers shifted from highly visible attacks to more stealth attacks.
On the flip side, phishing attacks jumped 250 percent in 2018. The report suggested that bad actors have shifted tactics in response to the more sophisticated tools and techniques that have been deployed to protect users.
Cryptocurrency mining, also known as cryptojacking, is described as still being prevalent but surprisingly, given the ongoing attention it receives, was also found to have declined over the year. The report also noted that software supply chain attacks are presenting increased risks as hackers leverage the trust users have in their software vendors to gain access to enterprise networks.
Usman Rahim, digital threat analyst at The Media Trust, told SiliconANGLE that malicious actors are always on the lookout for new ways to hack devices.
“Phishing, whether through email, malvertising, or any other channel, takes advantage of the fact that most consumers pay little attention to details and are likely to click on an email link, an ad, and enter sensitive information when prompted,” Rahim said. “What’s worrisome is that as threat actors innovate, they are finding new ways to escape detection by checking for known anti-malware solutions, persist despite a browser reboot, steal device information like IPs, and switch infection tactics when they’ve been discovered.”
Rahim said the best defense for organizations is to take a layered approach to security that involves employee training and collaboration with digital supply chain partners. “The former addresses internal threats; the latter will address the risks that reside within the supply chain, most of which fall under the radar of most organizations,” he said.
