A noticeable shift in the methodology for developing malware is taking place, and it can't go unaddressed. A few years ago, attackers' primary objective was to avoid detection — second only to making a profit. But recently, these criminals have realized a critical truth: the longer they hold an infected endpoint, the more their profit increases.
Enter fileless malware, a new approach to cyber attacks that allows invaders to evade detection far longer than traditional methods, giving them an upper hand against enterprise security defenses. These attacks are proving to be particularly useful against businesses because the majority of outdated enterprise security solutions are designed to detect file-based malware that resided on the disk, not in memory. Small to midsize businesses (SMBs) have become particularly vulnerable since some lack adequate security and IT staff to understand and protect against these threats.
Research from the Ponemon Institute found that fileless malware attacks accounted for about 35% of all attacks in 2018, and are almost 10 times more likely to succeed than file-based attacks. My company's own internal research has also shown a surge in these types of attacks, pointing specifically to an increase in malware threats including Emotet, TrickBot, Sorebrect, SamSam and exploits on Microsoft's PowerShell.
As business leaders, the time has come to pivot our enterprise security strategies. Here’s a look at four of the top malware families affecting businesses around the world, and what I believe we can expect in 2019.
Emotet And Trickbot -- The Supervillain Of Malware And Its Nasty Accomplice
Banking trojans Emotet and TrickBot are part of the new wave of next-generation malware that distributes emails with malicious documents to initiate attacks. In fact, Emotet is so prevalent that it influenced an alert from the US-CERT about the threat and its capabilities last July. The Emotet threat is most active in the United States, with Texas as the biggest target. There have also been recent upticks in the Philippines, the U.K. and Canada, while TrickBot is active in Australia.
I expect that we'll see clones of this malware appear throughout 2019 that will affect entire networks by mutating every dropper to avoid detection.
Sorebrect -- Outdated Systems Leave Your Infrastructure Vulnerable
Sorebrect is a new, entirely fileless ransomware threat that attacks network shares. By combining traditional ransomware functionality with fileless tactics, the attack becomes impossible to stop with common security solutions that watch process memory and use behavioral identification.
While Sorebrect has yet to become a significant threat across the United States and most of Europe, we found that businesses in APAC — especially Indonesia, Thailand and the Philippines — have seen their share of devastating attacks. Many businesses there use outdated operating systems and browsers, making them an easy target for old exploits. That said, Sorebrect was discovered in several states in the United States this year, including Missouri and Tennessee. Luckily, the threat hasn’t spread beyond these regions, and copycats of Sorebrect functionality have yet to appear. We urge businesses to keep a close eye on this infection method in 2019.
SamSam -- Manually-Deployed Malware That Packs A Punch
Many malware types act autonomously, but there are a handful that can be manually launched by the attacker, making the tool far more powerful. Manually controlled threat vectors are especially hard to detect because they don’t follow predictable patterns or leave the same signatures of automatic attacks. SamSam, a particularly common threat, works by breaking into a network and launching malware manually, an approach that makes the malware particularly difficult to remove because attackers also manually disable existing security software.
Research from Symantec found that the attackers behind SamSam went after 67 different targets in 2018, mostly in the United States. Attacks of this nature can be extremely costly and leave a lasting impact. The City of Atlanta, for example, spent $2.6 million on ransomware recovery following a SamSam hit which crippled a sizable part of the city's online service. SamSam, or a variant of it, will likely continue to pose a threat in 2019.
Microsoft PowerShell -- A Backdoor Entry For Attackers
Microsoft’s administrative scripting tool PowerShell can be abused to commit attacks. For example, attackers recently discovered a new method to leverage PowerShell to download and deliver malware. From there, attackers are able to launch fileless attacks directly into computer memory. This method allows the bad actors to avoid detection by security vendors.
Protecting Our Future from Fileless Malware
It's time to take a holistic look at your current security tools and evaluate any gaps using a layered security approach. You should be reviewing your specific organization's needs, considering things like endpoint security, firewall, email, identity access management (IAM) and security information event management (SIEM). Here are a few other steps you can take.
• Ensure that if there are any patch updates to your security tools, they’ve been deployed to catch the latest threats.
• Invest in regular, ongoing training for your employees to help them recognize the latest security threats, including phishing emails and other social engineering tactics. In addition, make sure your first responders or those with access to sensitive customer or proprietary data are well-versed in cybersecurity best practices.
• Develop a protocol for responding to attacks and practice “cyber fire drills.” Businesses need a plan that is practiced and understood by all stakeholders in case of a cyber attack. This plan should cover how to quickly identify what the attack is, what information has been breached and how to secure all adjacent systems so the infection or attack is unable to spread.
Our adversaries will always look where we are not looking, finding a window whenever we close a door to a known threat. As an industry, we must continue to put ourselves in the mindset of these attackers, anticipating and developing solutions proactively, rather than reactively. If we want to protect every user’s right to a malware-free existence, we must become more agile in reducing the time it takes to identify threats and develop and bring to market new solutions that ensure our communities are protected.
