Avast looks back at the prevalent cyber threats of 2021. Cybercriminals continued to take advantage of the Covid-19 pandemic, exploiting people’s habits formed during lockdown to spread scams. Ransomware and cryptocurrency malware and scams continued to prevail, and on the mobile side, adware and fleeceware were among the top threats.
“The pandemic has changed nearly every aspect of everyone’s lives, and that includes the cyber world too,” said, Michal Salat, Director of threat intelligence at Avast. “Attackers’ methods are becoming more sophisticated. Cybercriminals are using techniques that make them harder to spot and carrying out more personalised cyber attacks. They are also adding new spins on tried and tested techniques, especially in social engineering type of attacks like scams.”
Indian Businesses and Consumers heavily targeted by Ransomware attacks
Ransomware attacks persisted in 2021, with businesses like Kia Motors, Acer, Colonial Pipeline Company, and Managed Service Provider, Kaseya, being infected. Avast observed a 38% increase in ransomware attacks targeting consumers globally, when comparing the last five months of 2021 (June-October) to the first five months of the year (January-May) whereas for India, that number stands at 65%.
Businesses globally also experienced an increased number of attacks during the past five months of the year (June-October) to the tune of 32%. However, for India, this number was less than the global average and stood at 19%.
Sextortion, Parcel Delivery and Tech Support scams
Cybercriminals persisted to use the pandemic to their advantage, spreading scams and phishing attacks to exploit people’s new habits, like online communications and shopping.
Earlier this year, Avast researchers saw a flood in sextortion scams with over 500,000 sextortion scams blocked. This campaign takes advantage of the increased use of video conferencing services during the Covid-19 pandemic, falsely claiming to have accessed a user’s device and camera. Users in several countries have also been receiving SMS messages linking to a banking Trojan called “FluBot”, which impersonates parcel delivery companies in order to steal credentials and other personal data, and being targeted by tech support scams. These trick victims into believing their computer has been infected by malware and that their only recourse is to call a phone hotline for technical support, which in reality is unnecessary.
In general, phishing attacks continued to increase during 2021. The chances of businesses encountering phishing scams has increased globally by 40% in the last five months (June-October) but was much lower in India with 13%. Consumers, too, continue to be targeted by phishing scams with the increase in global (24%) and India (23%) figures being nearly the same.
Cryptocurrency-focused Scams and Malware
This year, our Threat Labs team identified a wide variety of new threats aimed at profiting from or mining cryptocurrencies at users’ expenses. Some of the main ones that impacted many countries around the world were Crackonosh, and BluStealer. The former was included in cracked versions of major games, and is a cryptocurrency mining malware. The latter, BluStealer is a keylogger, document uploader and cryptocurrency thief in a single malware that, like FluBot, took advantage of people ordering online during the pandemic and spread through a malicious spam campaign (malspam).
In addition to Crackonosh and BlueStealer, Avast researchers also found cryptocurrency-stealing malware that was distributed through HackBoss, a Telegram channel which, at the time of discovery, had stolen over $560,000 USD from victims.
Mobile Threats continued to spread and diversify with lockdown restrictions
Adware still is the most significant threat on Android phones and tablets in the world. Globally, 54.7% of mobile threats detected from January to September were adware. Fake apps came in second at 10%, banking Trojans in third with 9.6%, followed by downloaders with 7.5% and spyware with 2.3%.
Fleeceware apps also proved to be a serious concern to users in 2021. Avast discovered more than 200 new fleeceware applications on the Apple App Store and the Google PlayStore. These apps promised free trials but ended up extracting hundreds of dollars from their users through subscription services. Most recently, Avast discovered fraudulent sites masquerading as national postal services from various countries in Europe, including retail shops from the Czech Republic, Russia, Sweden and the Ukraine.
Risks to users were not only originated by bad actors in 2021. Early September, Avast researchers found more than 19,300 Android apps that potentially exposed user data due to an incorrect configuration of the Firebase database – an Android tool that developers can use with the purpose of storing user data. This affected a wide range of different apps, including lifestyle, fitness, gaming, food delivery and mailing apps in regions around the world and exposed Personally Identifiable Information (PII) such as names, addresses, location data and, in some cases, even passwords.
“Cybercriminals kept up many of their tricks this year, using social engineering to spread malware to get their hands on people’s money, abusing technology such as stalkerware to violate people’s privacy or deceiving vulnerable audiences into paying for fleeceware apps or unneeded tech support,” concludes Michal Salat. “We are seeing increasing online harms that affect how people experience the digital world. Everyone is being targeted, from everyday users to hospitals and oil pipelines to food companies globally. We hope by raising awareness around what we observed this year, we can help prevent people from falling victim in 2022.”