{"id":30558,"date":"2017-12-20T12:44:22","date_gmt":"2017-12-20T04:44:22","guid":{"rendered":"http:\/\/www.upgrademag.com\/web\/?p=30558"},"modified":"2017-12-20T12:44:22","modified_gmt":"2017-12-20T04:44:22","slug":"mcafee-labs-report-sees-known-exploits-and-fileless-malware-drive-record-new-malware-surge","status":"publish","type":"post","link":"http:\/\/www.upgrademag.com\/web\/2017\/12\/20\/mcafee-labs-report-sees-known-exploits-and-fileless-malware-drive-record-new-malware-surge\/","title":{"rendered":"McAfee Labs report sees known exploits and fileless malware drive record new malware surge"},"content":{"rendered":"

McAfee released its\u00a0McAfee Labs Threat Report: December 2017<\/em>, examining the growth and trends of new malware, ransomware, and other threats in Q3 2017. McAfee Labs saw malware reach an all-time high of 57.6 million new samples\u2014four new samples per second\u2014featuring developments such as new fileless malware using malicious macros, a new version of Locky ransomware dubbed Lukitus, and new variations of the banking Trojans Trickbot and Emotet.<\/strong><\/p>\n

\"\"<\/a><\/p>\n

Threats attempting to exploit Microsoft technology vulnerabilities were very prominent despite the fact that the platform vendor addressed these issues with patches as early as the first quarter of 2017.<\/p>\n

\u201cThe third quarter revealed that attackers\u2019 threat designs continue to benefit from the dynamic, benign capabilities of platform technologies like PowerShell, a reliable recklessness on the part of individual phishing victims, and what seems to be an equally reliable failure of organizations to patch known vulnerabilities with available security updates,\u201d said Raj Samani, McAfee\u2019s chief scientist. \u201cAlthough attackers will always seek ways to use newly developed innovations and established platforms against us, our industry perhaps faces a greater challenge in the effort to influence individuals and organizations away from becoming their own worst enemies.\u201d<\/p>\n

Each quarter, McAfee Labs assesses the state of the cyber threat landscape based on threat data gathered by the McAfee Global Threat Intelligence cloud from hundreds of millions of sensors across multiple threat vectors around the world. McAfee Advanced Threat Intelligence complements McAfee Labs by providing in-depth investigative analysis of cyberattacks from around the globe.<\/p>\n

Known Vulnerabilities Exploited<\/strong><\/p>\n

The third quarter of 2017 saw cybercriminals continue to take advantage of Microsoft Office vulnerabilities such as CVE-2017-0199, which took advantage of a vulnerability within both Microsoft Office and WordPad to allow remote code execution through specially crafted files. To execute this attack, many took advantage of a tool available via GitHub offering an easy route to creating a backdoor attack without complex configuration.<\/p>\n

New variations of the Trickbot banking Trojan featured code that embedded the EternalBlue exploit responsible for the massive WannaCry and NotPetya ransomware outbreaks in Q2. Despite Microsoft\u2019s continued efforts to counter EternalBlue with security patches, the new Trickbot authors still found the proven technique to be effective. They combined it with new features such as cryptocurrency theft and new delivery methods, and made these new Trickbot versions the most active banking Trojans in Q3.<\/p>\n

\u201cOnce vulnerabilities are discovered and disclosed \u2018into the wild,\u2019 or the hacker community, they present a blueprint for malicious parties seeking to develop sophisticated threats that exploit them,\u201d said Steve Grobman, CTO at McAfee. \u201cThe year 2017 will be remembered as the time when such vulnerabilities were exploited to orchestrate large-scale cyber events, including the WannaCry and NotPetya ransomware outbreaks, and high-profile breaches such as at Equifax. Only by investing more in the discovery and remediation of cyber vulnerabilities can technology vendors, governments, and business enterprises hope to gain a step on the cybercriminals working furiously to uncover and take advantage of them.\u201d<\/p>\n

Fileless Threats<\/strong><\/p>\n

Fileless threats continued to be a growing concern in Q3, with PowerShell malware growing by 119%. Very prominent in this category was the Emotet banking Trojan, which spread around the world through large spamming campaigns, and lured users into downloading Microsoft Word documents. This act inadvertently activates a PowerShell macro that downloads and installs the malware on their systems.<\/p>\n

\u201cAlthough many cyberattacks continue to rely on the exploitation of basic security vulnerabilities, exposures, and user behaviors, fileless threats leverage the utility of our own system capabilities,\u201d said Vincent Weafer, Vice President for McAfee Labs. \u201cBy leveraging trusted applications or gaining access to native system operating tools such as PowerShell or JavaScript, attackers have made the development leap forward to take control of computers without downloading any executable files, at least in the initial stages of the attack.<\/p>\n

Lukitus Ransomware<\/strong><\/p>\n

One of the key developments in the ransomware space was the emergence of Lukitus, a new version of Locky ransomware. The ransomware was distributed by more than 23 million spam emails within the first 24 hours of the attack. Overall in the category,\u00a0new ransomware samples increased by 36%. The number of total ransomware samples has grown 44% in the past four quarters to 12.3 million samples.<\/p>\n

DragonFly: New Industries, New Objectives<\/strong><\/p>\n

The McAfee Advanced Threat Research team found that DragonFly 2.0, the malware discovered earlier in 2017 in the energy sector, has targeted organizations beyond original discoveries, including the pharmaceutical, financial services, and accounting industries. These attacks were initiated through spear-phishing emails, luring recipients to click on links that download the Trojan and provide attackers with network access.<\/p>\n

\u201cThe actors involved in the DragonFly 2.0 attacks have a reputation for initiating attacks for the purpose of conducting reconnaissance on the inner workings of targeted sectors\u2014with energy and pharmaceutical confirmed as top priorities,\u201d said Christiaan Beek, McAfee Lead Scientist and Principal Engineer. \u201cThe intellectual property and insider insights they obtain upon gaining access to targeted sectors is of tremendous economic value.\u201d<\/p>\n

Q3 2017 Threat Activity<\/strong><\/p>\n

Security incidents.\u00a0McAfee Labs counted 263 publicly disclosed security incidents in Q3, a decrease of 15% from Q2. More than 60% of all publicly disclosed security incidents in Q3 took place in the Americas.<\/p>\n

Vertical industry targets.\u00a0The health and public sectors accounted for more than 40% of total incidents in Q3.<\/p>\n