{"id":32163,"date":"2023-10-25T08:59:44","date_gmt":"2023-10-25T14:59:44","guid":{"rendered":"https://www.webroot.com/blog/?p=32163"},"modified":"2023-10-25T09:01:29","modified_gmt":"2023-10-25T15:01:29","slug":"uncover-the-nastiest-malware-of-2023","status":"publish","type":"post","link":"https://www.webroot.com/blog/2023\/10\/25\/uncover-the-nastiest-malware-of-2023\/","title":{"rendered":"Uncover the nastiest malware of 2023"},"content":{"rendered":"\n<p>Our annual analysis of the most notorious malware has arrived. As always, it covers the trends, malware groups, and tips for how to protect yourself and your organization.<\/p>\n\n\n\n<p>This post covers highlights of our analysis, including the rise of ransomware as a service (RaaS), the six nastiest malware groups, and the role of artificial intelligence in both cybersecurity and cyberthreats.<\/p>\n\n\n\n<h2>Malware shifts to RaaS<\/h2>\n\n\n\n<p>To say cybercriminals have come a long way since their humble beginnings\u2014when floppy disks were used to spread malware infections\u2014is an understatement. Their tactics have evolved significantly over the years, with ransomware now the malware of choice for cybercriminals.<\/p>\n\n\n\n<p>The allure of ransomware is not surprising given the combination of financial gains and potential for anonymity. Never satisfied in their quest to scale operations and increase revenue potential, criminal actors have shifted their focus to a relatively new \u201cbusiness model\u201d that is proving very successful\u2014ransomware-as-a-service (RaaS). By removing the technical barriers for prospective affiliates, RaaS makes it easy for big players to grow their \u201centerprise.\u201d<\/p>\n\n\n\n<h2>Who made this year\u2019s malware list?<\/h2>\n\n\n\n<p>Topping this year\u2019s nastiest malware is CI0p. This ransomware group made a name for itself with the MOVEit campaign, which drove up the average ransom payment to nearly three-quarters of a million dollars. To date, this campaign is&nbsp;known to have impacted&nbsp;more than 1,150 organizations and over 60 million individuals, <a rel=\"noreferrer noopener\" href=\"https:\/\/www.wired.com\/story\/moveit-breach-victims\/\" data-type=\"URL\" data-id=\"https:\/\/www.wired.com\/story\/moveit-breach-victims\/\" target=\"_blank\">putting its global cost at close to $11 billion<\/a>.<\/p>\n\n\n\n<p>Also on the list are four new ransomware gangs\u2014Black Cat, Akira, Royal, and Black Basta\u2014believed to be the next generations of previous big players. They join a familiar name on the list, Lockbit.<\/p>\n\n\n\n<p>We ranked these six malware groups accordingly:<\/p>\n\n\n\n<ol>\n<li>Cl0p, a RaaS platform, became famous following a series of cyberattacks that exploited a zero-day vulnerability in the MOVEit file transfer software developed by Progress Software.&nbsp;&nbsp;<\/li>\n\n\n\n<li>Black Cat, believed to be the successor to the REvil ransomware group, built its RaaS platform on the Rust programming language. Black Cat made headlines for taking down MGM Casino Resorts.&nbsp;<\/li>\n\n\n\n<li>Akira, presumed to be a descendant of Conti, primarily targets small- to medium-sized businesses. Most notably, Akira ransomware targeted Cisco virtual private network (VPN) products to breach corporate networks, steal data, and encrypt it.&nbsp;<\/li>\n\n\n\n<li>Royal, suspected heir to Ryuk, uses whitehat penetration testing tools to move laterally in an environment and gain control of the entire network. A unique partial encryption approach allows the threat actor to choose a specific percentage of data in a file to encrypt.<\/li>\n\n\n\n<li>Lockbit 3.0, a main stain on the list and last year\u2019s winner, continues to wreak havoc. Now in its third epoch, Lockbit 3.0 is more modular and evasive than its predecessors. &nbsp;<\/li>\n\n\n\n<li>Black Basta, one of the most active RaaS threat actors, is considered to be yet another descendant of the Conti ransomware group. It has gained a reputation for targeting all types of industries.&nbsp;<\/li>\n<\/ol>\n\n\n\n<h2>An intelligent future: artificial intelligence and machine learning<\/h2>\n\n\n\n<p>For six years, the OpenText\u2122 Cybersecurity threat intelligence team has witnessed a steady increase in the number and sophistication of malware attacks\u2014which show no signs of slowing down. Threat actors are creative and resourceful in their attempts to trick users and exploit software and computer vulnerabilities. And while the use of artificial intelligence (AI) and machine learning (ML) in cybersecurity is still in its early stages, it is rapidly evolving. This is good and bad news.<\/p>\n\n\n\n<p>AI and ML have the potential to make the world a safer place, but they could also be used for malicious purposes. Rather than taking a wait-and-see approach, businesses of every size must take steps to protect themselves and mitigate the risks.<\/p>\n\n\n\n<p>For a more detailed analysis of the 2023 malware landscape and tips from OpenText Cybersecurity threat experts on how to protect against ransomware attacks, visit: <a href=\"https:\/\/community.webroot.com\/preview\/article\/1442?t=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ0b3BpY0lkIjoiMTQ0MiIsImNvbnRlbnRUeXBlIjoiYXJ0aWNsZSJ9.uj4ntz0MEXT27vicd9YSUBskiZx8zRkJB9nQ2ilFSWE\" target=\"_blank\" rel=\"noreferrer noopener\">Ask your question | Webroot Community<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Our annual analysis of the most notorious malware has arrived. As always, it covers the trends, malware groups, and tips for how to protect yourself and your organization. This post covers highlights of our analysis, including the rise of ransomware as a service (RaaS), the six nastiest malware groups, and the role of artificial intelligence [&hellip;]<\/p>\n","protected":false},"author":21,"featured_media":32161,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[3005],"tags":[],"yst_prominent_words":[24549,6391,5859,3631,3817,4401,3787,3477,18753,3937,3569,19433],"acf":[],"_links":{"self":[{"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/posts\/32163"}],"collection":[{"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/users\/21"}],"replies":[{"embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/comments?post=32163"}],"version-history":[{"count":2,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/posts\/32163\/revisions"}],"predecessor-version":[{"id":32167,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/posts\/32163\/revisions\/32167"}],"wp:featuredmedia":[{"embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/media\/32161"}],"wp:attachment":[{"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/media?parent=32163"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/categories?post=32163"},{"taxonomy":"post_tag","embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/tags?post=32163"},{"taxonomy":"yst_prominent_words","embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/yst_prominent_words?post=32163"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}