The healthcare sector saw a 211% increase in publicized security incidents throughout 2017. The rise in Bitcoin value in Q4 also prompted hackers to use various methods of crypto-hijacking, including the use of malicious Android apps.

"Q4 was characterized by the rapid adoption of newer tools and attack methods - fileless malware, crypto mining and steganography. Even tried-and-true tactics like ransomware evolved to distract defenders from the attacks," said Raj Samani, Chief Scientist at McAfee. "Collaboration and better information sharing to improve cyber defenses remain critical for defenders in the fight against asymmetric cyber attacks."

Threat activity in the fourth quarter
- Fileless malware: New PowerShell malware tripled with 267 percent growth.
- Security incidents: There were 222 disclosed incidents in the fourth quarter, a 15 percent decrease from the third quarter.
- Vertical targets: In the public sector, incidents fell by 15 percent in 2017 compared to the previous year. The education sector, on the other hand, recorded an increase of 125 percent. In the financial sector, the number of incidents fell by 29% in the fourth quarter, but rose by 16% over the year as a whole.
- Ransomware: The total number of ransomware samples rose by 16% in the last quarter to 14.8 million samples. Over the year as a whole, growth amounted to 59 percent.
- Malware: The number of new malware samples rose by 32 percent from the third to the fourth quarter and by 10 percent for the year as a whole.
- Mobile malware: The number of new mobile malware fell by 35% compared to Q3. In 2017 as a whole, however, the number of mobile malware increased by 55%.
- Mac malware: In Q4, the number of new Mac OS malware increased by 24 percent, while there was a 58 percent increase in 2017 as a whole.
- Spam campaigns: 97% of spam botnet traffic in Q4 came from Necurs and Gamut. Necurs sent both "Lonely Girl" spam, pump-and-dump stock spam and Locky ransomware downloaders. Gamut, on the other hand, sends phishing emails with job offers and so-called "money mule" recruitment emails, which are used for money laundering.