The biggest threats to Windows and Mac in 2020 🔐

Although we are only in the seventh week of 2020, there is already enough data to put together an almost complete cybersecurity report. This year, we can expect major threats carried over from 2019, as well as new ones.

Originating mainly in China, Russia, Iran and North Korea, these attacks will continue to test networks and security systems around the world. We will also see the rise of increasingly sophisticated malware that can target individuals or businesses, all fuelled by social engineering to make malicious campaigns even more dangerous and effective.

This BlackBerry Cylance report explores the blurred lines between attackers and criminal networks that develop their own ways to exploit security flaws or distribute malware as a service, sending threats through email or messaging campaigns that target industries or territories.

This year will be decisive for improving defences against these attacks and reporting them worldwide. The accelerating Internet of Things is a real turning point for cybersecurity, with more endpoints, faster networks and the adoption of "always-connected" services.

The big challenge with the Internet of Things is the limited control over the security of these endpoints, which now include connected light bulbs, toys and even fridges, all described as smart.

But if all the technology and connectivity we bring into our homes has access to our Wi-Fi password and an internet connection, it will be virtually impossible to guarantee the security of our devices. Currently, the best practice, although it may seem difficult to implement, is to air gap home networks. In other words, physically separate secure devices and networks from insecure networks, such as those on the street and in public spaces. Yes, that includes mobile phones, computers and tablets, and then everything else.

This leaves users much better protected against attackers who might exploit any vulnerability, even an accidental one.

According to the same report, the geopolitical climate will also influence this year's attacks. There will even be large-scale campaigns sponsored by governments or organised groups, as well as criminal networks using the same techniques.

The actual threats have not changed much: phishing attacks ranging from basic attempts to sophisticated, highly targeted campaigns; ransomware and virus outbreaks; and the grey area between governments and criminal organisations. Then, of course, there are digital versions of crimes that would otherwise take place in the physical world: non-payment, failure to deliver products, fraudulent schemes based on promises of romance, extortion, harassment, identity theft and, as always, banking, investment and financial fraud.

There are two aspects of malware that continue to grow: its prevalence and the sophistication of its development and deployment. We are also seeing fully fledged criminal business models in which malware is bought and sold, or even rented, on dark web markets.

The report also offers a useful summary of the main threats facing Windows and Mac users. Cylance says this is one of the most dangerous collections ever compiled, using monitoring tools for different operating systems.

For cybersecurity expert Ian Thornton-Trump, the main concern for individuals and businesses worldwide should be email, particularly Business Email Compromise. "This is the fastest-growing and most profitable online criminal business." The expert also says that even basic security practices are far from perfect, with widespread "password reuse" and "poor configuration of cloud platforms" leading to huge data security gaps.

So, let us look at the 15 most significant growing threats, which include ransom demands and blackmail. Remember these names!

Note that ten of these attacks target Windows and five target Mac. Risks are greater for users of the former because they still make up the vast majority, especially in business.

Windows threats

• Emotet: the leading threat. This is a banking Trojan that has plagued users since 2014. The malware has served as both a credential thief and a delivery mechanism for other attacks. It spreads rapidly: once it takes over your system, it will infect your data using every possible trick.

• Kovter: without even using a file, this malware targets the computer's registry, making it even harder to detect. It began by hiding behind warnings about illegal downloads or file sharing, then moved into large-scale advertising fraud, generating fraudulent clicks that earn money for its operators. Who has not clicked, even accidentally, on an advert that quickly opens countless pages and can even freeze the browser?

• Poison Ivy: do not be fooled by its comic-book name, because this malware is anything but harmless. It is a malicious remote-access Trojan hidden in software installers. The virus infects computers with various tools for spying and stealing data and credentials. It is usually distributed by email through Microsoft Office attachments.

• Qakbot: more than a decade old, it has evolved to become increasingly dangerous. The latest variants are better at evading detection systems and spreading across infected computers. Qakbot can lock user and administrator accounts, making it even harder to remove.

• Ramnit: a parasitic virus that can move easily through the places it aims to infect. It was designed to attack removable data storage devices, replicating itself and increasing its capacity to attack. It also infects HTML files and the machines hosting them, steals credentials and can even allow third parties to take full remote control of a system.

• Sakurel (also known as Sakula and VIPER): another remote-access Trojan, typically used in coordinated, planned attacks. Its delivery mechanism is relatively simple: malicious URLs drop code onto a machine when someone visits them. This malware can also disguise itself while similar threats are placed on the target computer.

• Upatre: although a niche piece of malware, it remains a very real threat. Infection comes from email attachments, usually disguised as invoices or other apparently legitimate documents, but it also spreads through visits to malicious websites. Increasingly common, this virus acts as a delivery mechanism, or dropper, for other threats.

• Ursnif: an advanced banking Trojan that infects computers when users visit malicious websites, planting code in the process. The malware can adapt to digital content, increasing its chances of infection. Like Upatre, it is also a dropper, opening the door to other threats, and it can even take screenshots of infected computers.

• Vercuse: it can arrive through ordinary downloads or infected storage devices, such as a USB stick. This malware has been adapted to evade modern detection methods, including terminating its processes if it is detected. Like others, it is also a dropper.

• Zegost: this malware was designed to identify and extract useful information from infected computers using sophisticated techniques. That information can include login details and stolen credentials. Zegost can also be used to attack servers.

Mac threats

• CallMe: a long-standing piece of Mac malware that opens a backdoor for further exploitation of infected systems and control of the server. It spreads through Microsoft Office attachments, usually Word documents. More recent versions of MacOS and Office have addressed the vulnerability, improving user protection.

• KeRanger: one of the first examples of ransomware on Mac, this malware encrypts multiple files and includes a process for adding the README ransom file. To avoid it, keep your system updated and maintain offline backups.

• LaoShu: a remote-access Trojan that spreads through infected PDF files. This malware can search for specific files and compress them into a ZIP folder that can be removed from the machine. Keeping your system up to date and learning not to open unknown email attachments are the first steps towards avoiding it.

• NetWiredRC: a favourite for Iranian government-sponsored attacks, this malware acts as a remote-access Trojan on both Mac and Windows. The attack focuses on extracting sensitive information and credentials, providing reliable routes for further attacks. Cylance advises blocking "212[.]7[.]208[.]6" in the firewall and monitoring "%home%/WIFIADAPT.app" on the system.

• XcodeGhost: targeting both Mac and iOS, this malware has been described as the first large-scale attack on Apple's App Store. Using espionage and extensive attacks, XcodeGhost identifies its targets, captures strategic information and extracts it from an infected machine. It works by infiltrating devices through apparently safe apps. Always pay attention to the sources of the apps you download on your iPhone or Mac.

In practice, this list is largely informative, and the ways to limit the damage caused by these viruses and malware remain much the same: antivirus software, digital awareness, email filters, checks on incoming attachments and some network monitoring.

Using trustworthy VPNs, avoiding public Wi-Fi networks and making regular backups are also important.

Cylance urges Windows users to watch for unusual activity or processes running on their systems. Thornton-Trump warns that we all need constant reminders about cybersecurity, which centres on people, processes and technology. The expert believes too much attention goes to technical malware defences rather than other forms of protection, such as digital training and vulnerability management.

Ultimately, educating users of computers and internet-connected devices, and keeping everything up to date, already helps contain many of these threats. At the same time, taking some basic precautions and using common sense can prevent cyberattacks on any platform.