Surge in “Hunter-Killer” Malware

The SecOps experts at Picus Security have released their 2024 Red Report, which shares conclusions from an in-depth analysis of more than 600,000 real-world malware samples and identifies the most common techniques leveraged by attackers.

Picus has uncovered a surge of “Hunter-killer” malware from the research findings, demonstrating a drastic shift in adversaries’ ability to identify and neutralise advanced enterprise defenses such as next-gen firewalls, antivirus, and EDR.

According to the report, there was a 333% increase in malware that can actively target defensive systems in an attempt to disable them.

“We are witnessing a surge in ultra-evasive, highly aggressive malware which shares the characteristics of hunter-killer submarines,” said Dr. Suleyman Ozarslan, Picus Security Co-founder and VP of Picus Labs. “Just as these subs move silently through deep waters and launch devastating attacks to defeat their targets’ defenses, new malware is designed to not only evade security tools but actively bring them down.

“We believe cyber criminals are changing tact in response to the security of average businesses being much-improved, and widely used tools offering far more advanced capabilities to detect threats... A year ago, it was relatively rare for adversaries to disable security controls. Now, this behavior is seen in a quarter of malware samples and is used by virtually every ransomware group and APT group.”

The Red Report helps security teams better understand and battle cyber attacks by identifying the Top 10 most prevalent MITRE ATT&CK techniques exhibited by the latest malware. Its insights help prioritise defensive actions against commonly used techniques.

Additional key findings include:

  • Evolving tactics challenge detection and response:  70% of malware analysed now employ stealth-oriented techniques by attackers, particularly those that facilitate evading security measures and maintaining persistence in networks.
  • Invisibility at the forefront of evasion:   There was a 150% increase in the use of T1027 Obfuscated Files or Information. This highlights a trend toward hindering the effectiveness of security solutions and obfuscating malicious activities to complicate the detection of attacks, forensic analysis, and incident response efforts.
  • The ransomware saga continues:   There was a 176% increase in the use of T1071 Application Layer Protocol, which are being strategically deployed for data exfiltration as part of sophisticated double extortion schemes.

To combat Hunter-killer malware and stay ahead of 2024 malware trends, Picus is urging organisations to embrace machine learning, protect user credentials, and consistently validate their defenses against the latest tactics and techniques used by cyber criminals.

It is particularay difficult to detect a malware attack whch has disabled or reconfigured security tools, which alhough netralised, may appear to be working as expected.

Picus advise that preventing such under the radar attacks requires the use of multiple security controls, with security validation as the a starting point for organisations to better understand their readiness and identify gaps.

“Unless an organisation is proactively simulating attacks to assess the response of its EDR, XDR, SIEM, and other defensive systems that may be weakened or eliminated by Hunter-killer malware, they will not know they are down until it is too late.” commented Hüseyin Can Yüceel, Security Research Lead at Picus Security

Picus Security        Image: Slim3D

You Might Also Read: 

Rhysida Ransomware Cracked & Decrypted:

DIRECTORY OF SUPPLIERS - Threat Detection & Protection:

___________________________________________________________________________________________

If you like this website and use the comprehensive 6,500-plus service supplier Directory, you can get unrestricted access, including the exclusive in-depth Directors Report series, by signing up for a Premium Subscription.

  • Individual £5 per month or £50 per year. Sign Up
  • Multi-User, Corporate & Library Accounts Available on Request

Cyber Security Intelligence: Captured Organised & Accessible


 

« Data Breach - Bank of America Warns Clients & Customers
Deepfakes Complicate Election Security »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

XYPRO Technology

XYPRO Technology

XYPRO is the market leader in HPE Non-Stop Security, Risk Management and Compliance.

ZenGRC

ZenGRC

ZenGRC - the first, easy-to-use, enterprise-grade information security solution for compliance and risk management - offers businesses efficient control tracking, testing, and enforcement.

CSI Consulting Services

CSI Consulting Services

Get Advice From The Experts: * Training * Penetration Testing * Data Governance * GDPR Compliance. Connecting you to the best in the business.

Practice Labs

Practice Labs

Practice Labs is an IT competency hub, where live-lab environments give access to real equipment for hands-on practice of essential cybersecurity skills.

Alvacomm

Alvacomm

Alvacomm offers holistic VIP cybersecurity services, providing comprehensive protection against cyber threats. Our solutions include risk assessment, threat detection, incident response.

Security Weekly

Security Weekly

Security Weekly provides free content within the subject areas of IT security news, vulnerabilities, hacking, and research.

Lastline

Lastline

Lastline is the leader in advanced malware protection.

Cyber Risk Opportunities

Cyber Risk Opportunities

Cyber Risk Opportunities was formed to enable middle-market executives to become more proficient cyber risk managers so their organizations can thrive.

BlueKrypt

BlueKrypt

BlueKrypt is a consulting firm for the security of IT systems and their management.

Buglab

Buglab

The Buglab contest and Vigilante Protocol help companies all over the world to discover and fix vulnerabilities on their digital solutions or assets.

Bl4ckswan

Bl4ckswan

Bl4ckswan is a Management Consulting firm specialized in the delivery of information security and compliance services.

LSoft Technologies

LSoft Technologies

LSoft Technologies is a leader in data recovery software technologies.

Montreal International

Montreal International

You’re an entrepreneur planning to launch a company in an innovative sector such as AI, cybersecurity, 'deeptech' or fintech? You’ve found the right place!

Sparrow

Sparrow

Sparrow specializes in application security testing solutions to cope with new technology trends such as cloud, mobile, and DevSecOps.

US Digital Corps

US Digital Corps

The U.S. Digital Corps is a new two-year fellowship for early-career technologists where you will work every day to make a difference in critical impact areas including cybersecurity.

UK Cyber Security Association (UKCSA)

UK Cyber Security Association (UKCSA)

The UK Cyber Security Association (UKCSA) is a membership organisation for individuals and organisations who actively work in the cyber security industry.

Celcom

Celcom

Celcom is the oldest mobile telecommunications provider in Malaysia, providing solutions and services to consumers and businesses.

Cyware

Cyware

Cyware is the only company building Virtual Cyber Fusion Centers enabling end-to-end threat intelligence automation, sharing, and unprecedented threat response for organizations globally.

Bittnet Training

Bittnet Training

Bittnet Training is the leader in the IT Training market in Romania. We develop the IT skills of IT professionals as well as those who wish to start a career in IT.

OneZero Solutions

OneZero Solutions

OneZero specialize in cybersecurity operations, information assurance, computer network operations, solutions engineering, and project management.

Evervault

Evervault

Evervault provides engineers easy solutions to complex data security and compliance problems.