Cyber crims just keep getting better, says EU infosec agency

Criminals upped the ante last year and beat down cyber defences with new, superior attack types, the European Union Agency for Network and Information Security (ENISA) says in its annual threat report, taking stock of 12 months worth of incidents.

Cyber defences matured and improved in 2016, but attackers remained one step ahead, ENISA said in the report, enjoying record turnovers for criminal activities. 

ENISA said attackers abused unsecured internet of things (IoT) devices for massive denial-of-service traffic floods last year. It observed large, malicious IT and network infrastructures that withstand takedown and which allow for quick development and multi-tenancy.

The ransomware business also boomed in 2016. Extortion attacks against commercial organisations achieved very high bounties, in addition to victims forced to pay up to restore access to their data, the agency said.

Multi-layered attacks that tilted the outcome of democratic elections, such as the United States presidential race, also demonstrated the superiority of attackers in 2016.

While the top three threats last year - malware, web-based and web application attacks - remained the same as in 2015, ENISA noted that denial-of-service, phishing and ransomware moved up the chart in 2016. 

The agency currrently collects over 600 million samples of malware per quarter. It said mobile malware grew by 150 percent last year, with the authors focusing on information stealing and ransomware to monetise their efforts.

Overall, ENISA assessed that most cyber threats increased in 2016 compared to the year before, with only identity theft, espionage and spam declining.

The agency suggested increased collaboration and liaison between stakeholders such as vendors, national security organisations, defence and businesses as the best overarching strategy to combat cyber crime.