2014 statistics: business and financial cyberthreats

As this tumultuous year is wrapping up, Kaspersky Lab lists the year’s cyberthreats. The numbers are appalling: 6.2 billon malicious attacks on computers and mobile devices were blocked by Kaspersky Lab antivirus products in 2014, which is 1 billion more than in 2013. This number is not surprising given the context and statistics from previous years. It doesn’t spell out doom and gloom, but it does point to something interesting about awareness.

The entire year was dominated by the “ultimate demise” of Windows XP (which is actually pen-ultimate at best), two major bugs codenamed Heartbleed and Shellshock, and a recently revealed critical flaw in Internet Explorer that was apparently there since Windows 95. The nearly two decades old bug received its own codename – WinShock. (If you haven’t noticed by now, naming the bugs became a trend.) All of these bugs affected businesses in different ways. Heartbleed and Shellshock led to a widespread panic globally, prompting IT staffs around the world to apply a series of patches immediately.

2014 statistics: business and financial #cyberthreats

Tweet

Also, this year was marked with loads of APT campaign disclosures, targeting all kinds of businesses, industries, and government organizations – Epic Turla, Energetic Bear/Crouching Yeti, Sandworm/BlackEnergy, Darkhotel, and Regin to name just a few. This kind of threat has gone “industrial”, and there are many reasons to assume APT tactics will become commonplace among cybercriminals soon. Yet to be affected business IT staff should pay attention to this kind of threat, as it’s likely they may encounter it in a matter of months.

Let’s look at other parts of the data:

Attempts to steal money via online access to bank accounts were blocked on almost 2,000,000 computers. Some attempts to access individuals’ computers are really attempts targeting the user’s company.

• 12,100 mobile banking Trojans were discovered this year. Nine times as many as in 2013. That’s alarming. Not just because there are so many of them (actually, this number itself is quite small compared to other threats), but because of the growth rate. This rate shows that banking Trojans are a very lucrative – even if expensive – criminal tool. This is due to insufficient security on the victim’s end – both corporate and individual end-users.
• Zeus remains the most widespread banking Trojan with ChePro and Lohmys coming in second and third. Three quarters of the attacks targeting users’ money were carried out using banking malware, although it’s not the only threat of financial nature: Bitcoin wallets are also in the criminals’ sights.
• 295,500 new mobile malicious programs, almost three times as many as in 2013. No surprises here either: Their numbers grew due to extremely high profit-to-effort rate for the criminals, who don’t even need any real hacking skills. Sometimes they only need to buy a piece of malware and pay a spammer to distribute it. Eventually their “investments” return twenty-fold.
• 53% of attacks involved mobile Trojans targeting users’ money (SMS-Trojans, banking Trojans).
• 19% of Android users (one in five) encountered a mobile threat at least once during the year.

Yes, Android. 98% of mobile threats are targeting this OS. It’s less than pleasant for the users, but it also holds the key to the malware authors’ undoing. The latest versions of Android, 4.4 and 5.0, appear to be much more secure than the older ones, so as soon as they take hold of the market, the number of security issues will most likely diminish.

Number of #cyberthreats grow, but it’s #awareness that will help to beat them

Tweet

All in all, the weakest point in security of both PCs and mobile devices remains the human factor. It can also be the strongest once we get into the habit of watching our backs.

The full statistics on 2014 cyberthreats gathered by Kaspersky Lab’s experts is available here.