Woburn, MA – November 3, 2016 – Kaspersky Lab today announced the results of its quarterly IT threat evolution report, which found the number of Internet users that encountered encrypting ransomware more than doubled in Q3 2016, reaching 821,865 people. As a result, the number of people attacked by ransomware has now risen for the third quarter in the row in 2016.

Besides increasing their number of victims, cybercriminals are also exploring new geographies. In Q3 the top five countries with the highest percentage of users attacked with encrypting ransomware were: Japan (4.83%), Croatia (3.71%), South Korea (3.36%), Tunisia (3.22%) and Bulgaria (3.2%). In the previous quarter, first place was held by Japan, while the second, third and fourth were held by Italy, Djibouti and Luxembourg. These three countries left the top five in Q3 to give way to others.

The main driver of growth in the number of attacked users was Trojan-Downloader.JS.Cryptoload – a family of downloaders written in the JavaScript language and capable of downloading different families of crypto ransomware. The most widespread of these in Q3 included CTB-Locker (28.34% of attacked users), Locky (9.6%) and CryptXXX (8.95%).

“Crypto ransomware continues to be one of the most dangerous threats, both to private users and to businesses,” said Fedor Sinitsyn, ransomware expert at Kaspersky Lab. “The recent jump in the number of attacked users may have been provoked by the fact that the number of modifications of ransomware we detected in Q3 – more than 32,000 modifications – was 3.5 times more than in Q2. This may be due to the fact that security companies nowadays invest a lot of resources into being able to detect new samples of ransomware as fast as possible. Criminals must therefore avoid detection by creating more new modifications of their malware,” he added.

The other key findings of the ‘IT Threat Evolution in Q3 Report’ include:

• According to KSN data, in Q3 Kaspersky Lab solutions detected and repelled a total of 171,802,109 malicious attacks from online resources located all over the world. This is slightly fewer than in the previous quarter, when 171,895,830 attacks were blocked.
• Of these, 45,169,524 were malicious URLs hosting 12,657,673 malicious objects like scripts, exploits, executable files etc.
• The number of users attacked with banking malware grew by 5.8% and reached 1,198,264.
• Browsers and Android OS remain the most frequently attacked software when it comes to exploits. 45% of exploits detected by Kaspersky Lab were aimed at browsers, and 19% of these malicious programs were built to exploit weaknesses in the popular Android mobile operating system.

To learn more about the most significant changes in the cyber threat landscape from July to September 2016, see the full ‘IT Threat Evolution in Q3 2016 Report’ on Securelist.com