Malware Has Increased By 64%

The most common domains that attackers use to host malware and launch phishing attacks include several subdomains of legitimate sites and content delivery networks. 

These sites include CloudFlare.net which belongs to Amazon, SharePoint and Amazonaws.com, along with a number of legitimate file-sharing websites, according to WatchGuard who have completed a report on these problems. 

The research shows that year-on-year malware volume has increased by 64% and that it is increasingly targeting Europe and APAC

The report highlights that modules from the popular Kali Linux penetration testing tool made the top ten malware list for the first time in Q2 2019.

WatchGuard 2019 Internet Security Report highlights:

  • Zero-day malware accounted for 38% of all malware detections, within a few percentage points of the previous two quarters.
  • Overall    malware detections trended down around 5% this quarter compared to Q1 2019. 
  • Malware is still up 64% compared to Q2 2018.
  • DNSWatch blocked multiple campaigns that used 
  • Content Delivery Networks (CDNs) to host browser-hijacking malware. 
  • In Q2 2019, there was an increased overlap between the most-widespread malware detection affecting individual networks and the most prolific malware by volume, with three threats found in both lists.
  • The EMEA region saw the most malware detections per Firebox, with APAC in a close second and AMER bringing up the rear. This is almost the perfect opposite to the previous quarter.
  • Multiple popular backdoor shell scripts, used by both penetration testers and cyber criminals, showed up in top malware attacks. 
  • 11% of the sextortion (sexual extortion) phishing emails associated with Trojan.Phishing.MH targeted Japan
  • Network attacks more than doubled from Q1 to Q2. This was the largest percent increase we’ve seen since 2017.
  • In Q2 2019, WatchGuard Fireboxes blocked 22,619,836 malware variants (549 per device) across all three anti-malware engines and 2,265,425 network attacks (60 per device).
  • 4 Trojan.GenericKD, which covers a family of malware that creates a backdoor to a command-and-control server, and backdoor.Small.DT, a web shell script used to create backdoors on web servers, were sixth and seventh on the list. 

The research shows that malware volume increased by 64% annually and that it is increasingly targeting Europe and the APAC region.

According to WatchGuard ,  nearly 37% of malware targeted the EMEA region, with several individual attacks focusing on the UK, Italy and Germany in Q2 2019. APAC came in second, targeted by 36% of overall malware attacks. In particular, the Razy and Trojan.Phishing. MH malware variants primarily targeted the APAC region, with 11% of Trojan.Phishing.MH detections found in Japan.

“This edition of the Internet Security Report exposes the gritty details of the methods hackers use to sneak malware or phishing emails onto networks by hiding them on legitimate content hosting domains,” said Corey Nachreiner, CTO at WatchGuard Technologies. 

“Luckily there are several ways to defend against this, including DNS-level filtering to block connections to known malicious websites, advanced anti-malware services, multi-factor authentication to prevent attacks leveraging compromised credentials, and training to help employees recognise phishing emails......No one defence will prevent every attack, so the best way for organisations to protect themselves is with a unified security platform that offers multiple layered security services.”

Widespread Phishing and Office Exploit Malware Increases
Two pieces of malware, a phishing attack that threatens to release fake compromising information on the victim and a Microsoft Office exploit, that appeared on the most widespread malware list in Q1 2019 and Q4 2018 have graduated to the top ten list by volume. This illustrates that these campaigns are on the rise and are sending a high volume of attacks at a wide range of targets. Users should update Office regularly and invest in anti-phishing and DNS filtering security solutions.

SQL injection dominates Network Attacks
SQL injection attacks made up 34% of all network attacks detected in Q2 2019 and have increased significantly in volume year-over-year. One specific attack increased over 29,000% from Q2 2018 to Q2 2019.

Anyone who maintains a SQL database, or a web server with access to one, should patch systems regularly and invest in a web application firewall.

The Report also contains a detailed analysis of the actual malware used in the Sodinokibi MSP ransomware attacks. 
 WatchGuard’s research shows that the attackers leveraged weak, stolen, or leaked credentials to gain administrative access to legitimate management tools that these MSPs used to monitor and manage their clients’ networks, then used these tools to disable security controls and stage and deliver the Sodinokibi ransomware via PowerShell.

Help Net Security:         WatchGuard

You Might Also Read:

A New Era Of Malware:

 

 

 

 


 

 

« UK Announces Plans For A Workforce Cyber Security Audit
USA and Britain Agree To Share Crime Data »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

CYRIN

CYRIN

CYRIN® Cyber Range. Real Tools, Real Attacks, Real Scenarios. See why leading educational institutions and companies in the U.S. have begun to adopt the CYRIN® system.

NordLayer

NordLayer

NordLayer is an adaptive network access security solution for modern businesses — from the world’s most trusted cybersecurity brand, Nord Security. 

LockLizard

LockLizard

Locklizard provides PDF DRM software that protects PDF documents from unauthorized access and misuse. Share and sell documents securely - prevent document leakage, sharing and piracy.

Alvacomm

Alvacomm

Alvacomm offers holistic VIP cybersecurity services, providing comprehensive protection against cyber threats. Our solutions include risk assessment, threat detection, incident response.

Clayden Law

Clayden Law

Clayden Law advise global businesses that buy and sell technology products and services. We are experts in information technology, data privacy and cybersecurity law.

Centre for Cyber Security (CFCS) - Denmark

Centre for Cyber Security (CFCS) - Denmark

The Centre for Cyber Security is the Danish national IT security authority, Network Security Service and Centre for Excellence within cyber security.

Intezer Labs

Intezer Labs

The only solution replicating the concepts of the biological immune system into cyber-security. Intezer provides enterprises with unparalleled Threat Detection and accelerates Incident Response.

Tempered Networks

Tempered Networks

Tempered Networks delivers the first purpose-built platform for IIoT cybersecurity that allows customers to connect and secure devices in minutes without the need for specialized skills.

Private Internet Access

Private Internet Access

Private Internet Access is a Virtual Private Network services provider offering secure encrypted access to the internet.

US Secret Service

US Secret Service

The US Secret Service has a pivotal role in securing the nation’s critical infrastructures, specifically in the areas of cyber, banking and finance.

CyberSecJobs.com

CyberSecJobs.com

CyberSecJobs.com is a career site and job fair company providing services and resources to the cyber security community.

Open Raven

Open Raven

Open Raven is the cloud native data security platform that prevents breaches driven by modern speed and sprawl. Restore full visibility and regain control within minutes, without agents.

StartupXseed Ventures

StartupXseed Ventures

StartupXseed Ventures is a smart capital provider for Deep Tech, B2B, Early Stage Startups. We support, NextGen Tech Entrepreneurs, who have potential to deliver the outsized growth.

OSIbeyond

OSIbeyond

OSIbeyond provides comprehensive Managed IT Services to organizations in the Washington D.C., MD, and VA area including IT Help Desk Support, Cloud Solutions, Cybersecurity, and Technology Strategy.

Clear Skye

Clear Skye

Clear Skye, an Identity Access and Management (IAM) software company, reimagines enterprise identity access and risk management software to make a complicated problem easier to manage.

Gomboc.ai

Gomboc.ai

Gomboc solve cloud infrastructure security policy deviations by providing tailored remediations to the IaC (Infrastructure as Code).

Prescott

Prescott

Prescott acts as your guiding light in the preparation for your CMMC assessment and long after by governing your cybersecurity practice.

BreakPoint Labs

BreakPoint Labs

BreakPoint Labs is dedicated to providing the methods and means for sustainable, measurable, and effective cybersecurity operations.

WeVerify

WeVerify

WeVerify is a platform for collaborative, decentralised content verification, tracking, and debunking.

Computer Futures

Computer Futures

Computer Futures are a global specialist IT recruitment partner, matching candidates with roles across niche IT markets and core technologies.

Blue Goat Cyber

Blue Goat Cyber

Blue Goat stands at the forefront of cybersecurity, particularly in medical device security and penetration testing.