Your organization’s leadership is 12 times more likely to be the target of a security incident and nine times more likely to be the target of a data breach than they were last year. Find out how they can be protected.
Read the Datasheet
Gift Cardsharks: The Massive Threat Campaigns Circling Beneath the Surface
Learn about the attack group primarily targeting gift card retailers and the monetization techniques they use.
Get the Report
Threat Hunting Workshop Series
Join one of our security threat hunting workshops to get hands-on experience investigating and remediating threats.
Attend an Upcoming Workshop
Inside Magecart: New RiskIQ & Flashpoint Research Report
Learn about the groups and criminal underworld behind the front-page breaches.
Threat Hunting Guide: 3 Must-Haves for the Effective Modern Threat Hunter
The threat hunting landscape is constantly evolving. Learn the techniques, tactics, and tools needed to become a highly-effective threat hunter.
September 18, 2018
SAN FRANCISCO – September 18, 2018 – RiskIQ, the global leader in digital risk management, today released its Mobile Threat Landscape Q2 2018 Report, which analyzed 120 mobile app stores and more than two billion daily scanned resources. The findings show a spike in blacklisted apps headlined by Trojans and Adware, as well as a fascinating shift in tactics by mobile threat actors.
For the second year in a row, RiskIQ observed a sharp increase in blacklisted apps between May and June. Although this spike was less dramatic in 2018 than in 2017—an increase of nearly 30,000 apps in 2017 versus 12,000 in 2018—it continues a trend of accelerated Q2 blacklistings following lows in January and February.
In total, RiskIQ observed 52,885 Blacklisted apps in Q2, which was 4% of all apps seen by the company and a 2% increase over Q1. The Google Play store made up a large chunk of this number, hosting 28,533 blacklisted apps, which is over 20,000 more blacklisted apps than Q1 2018 and 10,000 more than what RiskIQ observed in any quarter since Q1 2017.
RiskIQ also observed 11,288 blacklisted Feral apps (apps seen outside of any app store), 4,750 blacklistings in the 9Apps third-party store, and 2,985 blacklistings in the AndroidAPKDescargar third-party store.
Q2 marked a shift in tactics for threat actors using the mobile vector including:
Attacks on myetherwallet.net: By copying the MyEtherWallet website and adding malicious scripts, threat actors spun up a phishing page that looked and acted like the official MyEtherWallet site, but sent authentication data to C2 servers when the victim enters their password to access/decrypt their wallet. This attack highlighted the trend of threat actors targeting the cryptocurrency landscape.
Run for your (Battery) life: RiskIQ spotted a mobile scam page claiming to detect and resolve battery life issues that directed the victim to a malicious “battery life” app hosted in the Google Play store under the name ‘Advanced Battery Saver.’ The app claimed very excessive permissions including the ability to read sensitive log data, receive text messages (SMS), receive data from Internet, and modify system settings. It also stole IMEI data, phone numbers, location data, and included an ad-clicker as a revenue generator for the app author.
For specific metrics and more on mobile vulnerabilities and attacker tactics, download the RiskIQ Mobile Threat Landscape Q1 2018 Report here: https://www.riskiq.com/research/2018-q2-mobile-threat-landscape-report/
RiskIQ is the leader in digital risk management, providing the most comprehensive discovery, intelligence and mitigation of threats associated with an organization’s digital presence. With more than 75 percent of attacks originating outside the firewall, RiskIQ allows enterprises to gain unified insight and control over web, social and mobile exposures. Trusted by thousands of security analysts, RiskIQ’s platform combines advanced internet data reconnaissance and analytics to expedite investigations, understand digital attack surfaces, assess risk and take action to protect the business, brand and customers. Based in San Francisco, the company is backed by Summit Partners, Battery Ventures, Georgian Partners and MassMutual Ventures.
Visit https://www.riskiq.com or follow us on Twitter. Try RiskIQ Community Edition for free by visiting https://www.riskiq.com/community/.
© 2018 RiskIQ, Inc. All rights reserved. RiskIQ is a registered trademark of RiskIQ, Inc. in the United States and other countries. All other trademarks contained herein are the property of their respective owners.
Front Lines Media