Story image

Script-based cyber attacks rise as threat actors choose stealth

14 Dec 2017

WatchGuard Technologies’ latest quarterly Internet Security report has revealed a massive increase in scripting attacks and malware against both SMBs and enterprises.

Asia Pacific was targeted in 6.65% of all malware attacks while EMEA took the brunt (71.62%) and the Americas (21.73%).

Of all malware detected, 76% was known malware and 24% was classified as zero day. However, the quantity of malware reached 19 million in Q3 – apparently an 81% increase since Q2.

Scripting attacks now account for 68% of all known malware, according to data from WatchGuard’s Gateway AntiVirus solution. Those attacks include JavaScript and Visual Basic Script threats such as downloaders.

Cross-site Scripting attacks (XSS) attacks enable cybercriminals to inject malicious script into victims’ websites. They infect users’ web browsers and have been spreading internationally.

Two vulnerabilities include a 1.x signature that capitalises on SharePoint Foundation 2010. The 36 signature exploits a vulnerability in Adobe RoboHelp.

“This quarter, we found that script-based attacks – like the fake Python library packages discovered in September – appeared 20 times more than in Q2, while overall malware attacks shot through the roof,” comments WatchGuard CTO Corey Nachreiner.

Whether it’s due to a lack of new malware or an improvement in legacy AV products, they only missed 24% of new malware this quarter – a marked drop from 47% in Q2. WatchGuard warns that it doesn’t mean legacy AV is any more trustworthy than it used to be and advanced protection is recommended.

HTML iframes are still causing headaches for websites everywhere as attackers use iframes to force visitors to suspicious and malicious websites.

Meanwhile, attacks that go after authentication and credentials are still creating havoc. Brute force web login attempts were highly visible and the Mimikatz credential stealer also played a part.

“ Don’t forget that your credentials are your weakest link. You need to protect them,” WatchGuard says.

“Threat actors are constantly adjusting their techniques, always looking for new ways of exploiting vulnerabilities to steal valuable data,” Nachreiner continues.

The report points out that most network exploits still find web servers, browsers and applications. They feature heavily in WatchGuard’s IPS top ten.

Macro-related malware in Microsoft Word has also dropped in Q3, however other malware seems to have taken its place.

 “Staying vigilant regarding these developments is half the battle. Every business can better protect themselves and their stakeholders by employing multiple layers of protection, enabling advanced security services and monitoring network logs for traffic related to the top threats mentioned in this report,” Nachreiner continues.

In total, 29,934 WatchGuard Firebox appliances blocked 2.9 million network attacks and 22.9 million malware variants in Q3.

Cloud application attacks in Q1 up by 65% - Proofpoint
Proofpoint found that the education sector was the most targeted of both brute-force and sophisticated phishing attempts.
Huawei to deploy Open Rack in all its public cloud data centres
Tech giant Huawei has unveiled plans to adopt Open Rack proposed by the Open Compute Project in its new public cloud data centres across the globe.
Beyond renewables: Emerging technologies for “greening” the data centre
Park Place Technologies’ CEO shares his views on innovations aside from renewable energy that can slim a data centre’s footprint.
Interxion’s David Ruberg wins Europe’s best data centre industry CEO
The European CEO Awards took place this week to celebrate the key figures at the helm of corporations that are driving innovation.
Opinion: 5G’s imminent impact on data centre infrastructure
Digital Realty’s Joseph Badaoui shares his thoughts on how 5G will transform data centre infrastructure now and beyond.
EMEA external storage market hits record high, Dell EMC on top
IDC's recent analysis on the external storage market in EMEA has shown healthy results - with some countries performing better than others - largely fuelled by all-flash arrays.
SolarWinds extends database anomaly detection
As organisations continue their transition from purely on-premises operations into both private and public cloud infrastructures, adapting their IT monitoring and management capabilities can pose a significant challenge.
Was Citrix unaware of its own data breach until the FBI got involved?
According to a blog post from Citrix’s CSIO Stan Black, the FBI contacted Citrix on March 6 and advised that international cybercriminals had allegedly gained access to Citrix’s internal network.