Woburn, MA – May 22, 2017 - The global nightmare of ransomware shows no sign of slowing down, with the volume of mobile ransomware rising over three-fold (3.5 times) during the first few months of the year, according to the Kaspersky Lab Malware Report for Q1, 2017. Ransomware targeting all devices, systems and networks also continued to grow, with 11 new cryptor families and 55,679 new modifications making their appearance in the first quarter. In addition, the United States became the country hardest hit by mobile ransomware in Q1, with Svpeng ransomware the most widespread threat.
The number of mobile ransomware files detected reached 218,625 during the quarter, compared to 61,832 in the previous quarter, with the Congur family accounting for more than 86 percent. Congur ransomware is primarily a blocker, which sets or resets the device PIN (passcode) giving the attackers administrator rights on the device. Some variants of the malware take further advantage of these rights in order to install their module into the system folder from where it is almost impossible to remove.
Despite the popularity of Congur, Trojan-Ransom.AndroidOS.Fusob.h remained the most widely used mobile ransomware, accounting for nearly 45 percent of all users attacked by this threat during the quester. Once run, the Trojan requests administrator privileges, collects information about the device, including GPS coordinates and call history, and uploads the data to a malicious server. Based on what it receives, the server may send back a command to block the device.
Geography of mobile Trojan-Ransomware in Q1 2017 (percentage of all users attacked)
“The mobile threat landscape for ransomware was far from calm in Q1,” said Roman Unuchek, Senior Malware Analyst at Kaspersky Lab. “Ransomware targeting mobile devices soared, with new ransomware families and modifications continuing to proliferate. People need to bear in mind that attackers can – and increasingly will - try to block access to their data not only on a PC but also on their mobile device.”
In all, 55,679 new Windows ransomware modifications were detected during the quarter, representing a near two-fold increase on Q4, 2016 (29,450). Most of these new modifications belonged to the Cerber family.
o 1,333,605 malicious installation packages;
o 32,038 mobile banking Trojans (installation packages).
For help and advice on dealing with ransomware visit No More Ransom
Read the full version of the Kaspersky Lab’s Malware Report on Securelist.com.
About Kaspersky Lab
Kaspersky Lab is a global cybersecurity company celebrating its 20 year anniversary in 2017. Kaspersky Lab’s deep threat intelligence and security expertise is constantly transforming into security solutions and services to protect businesses, critical infrastructure, governments and consumers around the globe. The company’s comprehensive security portfolio includes leading endpoint protection and a number of specialized security solutions and services to fight sophisticated and evolving digital threats. Over 400 million users are protected by Kaspersky Lab technologies and we help 270,000 corporate clients protect what matters most to them.
Learn more at www.kaspersky.com.
For the latest in-depth information on security threat issues and trends, please visit:
Follow @Securelist on Twitter
Follow @Threatpost on Twitter