Cloud Hosting

WatchGuard Technologies has released its Internet Security Report for Q4 2020, including new endpoint protection threat insights based on their product and a recent acquisition.

The report reveals that fileless malware and cryptominer attack rates grew by nearly 900% and 25% respectively, while unique ransomware payloads plummeted by 48% in 2020 compared to 2019.

Additionally, the WatchGuard Threat Lab found that Q4 2020 brought a 41% increase in encrypted malware detections over the previous quarter and network attacks hit their highest levels since 2018.

Here are some of the trends Corey Nachreiner, CTO of WatchGuard, says IT departments should watch out for in 2021.

Youve likely heard of malware before, but with most strains, the goal is to be persistent and live on a victim for a long time to maximize the return on investment for the bad guy.

Fileless malware rates in 2020 increased by 888% over 2019. These threats can be particularly dangerous due to their ability to evade detection by traditional endpoint protection clients and because they can succeed without victims doing anything beyond clicking a malicious link or visiting a compromised website.

The good part about traditional filed malware is a lot of the security mechanisms you rely on whether you call it anti virus Endpoint Protection, anti malware, those protections in the past traditionally have been very geared to looking for those files, Nachreiner says.

This malware is different in that attackers are using different attack techniques to run code on your computer to get something to run as code without necessarily using a file persistently.

Toolkits like PowerSploit and CobaltStrike allow endpoint protection threat actors to easily inject malicious code into other running processes and remain operational even if the victims defenses identify and remove the original script. Deploying endpoint detection and response solutions alongside preventative anti-malware can help identify these threats.

Related:Tips for Buying Cybersecurity Technology

Maybe theres a malicious email that has a Word document with a lot of people think is a benign file. But Word documents can contain things like active content, scripts, or macros, he explains.

If you get a Word document and you allow that content to run, that script can be the entry point for an attacker to actually run something like PowerShell. If youre a Windows IT person, PowerShell is a very legitimate Windows application used to do lots of administrative tasks. But if me as an attacker, if I can run PowerShell with your privilege, theres a lot of evil things I can do on your computer.

Fileless malware typically starts with some sort of script and its a way of of using programs that come with operating systems typically windows but other operating systems to administrative software thats on a Windows operating system to do bad stuff.

Because old school antivirus doesnt detect this, it wriggles a way around security controls.

Nachreiner says IT departments to consider Endpoint Detection and Response, making sure your EDR suite includes post execution and file list detection capabilities.

For the second year in a row, the number of unique ransomware payloads trended downward in 2020, falling to 2,152 unique payloads from 4,131 in 2019 and the all-time-high of 5,489 in 2018.

These figures in the report represent individual variants of ransomware that may have infected hundreds or thousands of endpoints worldwide. The majority of these detections resulted from signatures originally implemented in 2017 to detect WannaCry and its related variants, showing that ransomworm tactics are still thriving over three years after WannaCry burst onto the scene.

Between 2013 through 2016, or 17, bad guys were using what we call crypto ransomware, the kind that actually encrypts your files, and thats how they extorted, Nachreiner says.

It was new, and it was very effective. As a result, the extortionists had a kind of shotgun approach, where they would blast ransomware emails to everybody.

But what happened between 2017 and now is the industry as a whole got better at detecting this kind of shotgun blast ransomware, so the reason you see the volume in the variants decline but not the victims necessarily decline is these bad guys have switched to a very targeted method where now they are targeting and only sending ransomware to very specific people, he explains.

The report details how the Linux.Generic virus (a.k.a. The Moon) directly targets IoT devices and network devices to exploit vulnerabilities. WatchGuards investigation uncovered Linux-specific malware designed for ARM processors and another payload designed for MIPS processors within the attackers infrastructure, indicating a clear focus on evasive attacks against IoT devices.

The reason its Linux-based is a lot of these IoT devices run a Linux subsystem, Nachreiner says.

The Moon is an IoT threat that specifically targets consumer routers, consumer network access storage devices, and even in some cases, other consumer IoT devices. We saw this target use a very specific version of the NASA network access storage operating system that many use.

One of the interesting things about all these devices is your normal computer is probably an x86 computer, and most of them have an x86 processor. The issue there is a lot of these kind of embedded low cost devices are using these arm and MIPS processors, so the malware you need to create for these IoT devices is pretty specific.

The main takeaway is to to make sure to have a layered security strategy where its not just endpoint protection on your desktops.

The Trojan.Script.1026663 made its way onto WatchGuards top five most widespread malware detections list in Q4.

The attack begins with an email asking victims to review an order list attachment. The document triggers a series of payloads and malicious code that ultimately lead the victim machine to load the final attack: the Agent Tesla remote access trojan (RAT) and keylogger.

Its not until the script downloads that you would actually have something really bad. So you really need to pay attention to these multi staged approaches to to running malware. The reason they have these stages of starting with a document then script to finally downloading the payload, is to try to evade your security. So make sure you have those layers that can catch these different types of attacks, including the EDR.

See the original post here:
The State of Endpoint Threats and Internet Security in 2021 - TechDecisions

The Internet Security Audit market report provides information about the companys product, sales in terms of volume and revenue, technologies utilized, and innovations carried out in recent years. Additionally, it provides details on the challenges faced by them in the market. Also, the global Internet Security Audit report gives in detailed insights on the regional landscape, which involves determining the potential of the worth of investment in the region/country.

Objectives of the Report

Get a Sample Copy of the Internet Security Audit Market Report 2021-2026 Including TOC, Figures, and [emailprotected]https://www.inforgrowth.com/sample-request/6671309/Internet Security Audit-market

A Brief Outlook of the Leading Organizations in the Internet Security Audit market, Focusing on Companies such as

Internet Security Audit Market: Product Type Segment Analysis:

Internet Security Audit Market: Application Segment Analysis:

Leading regions covered in this research report:

North America (United States, Canada, and Mexico), Europe (Germany, France, UK, Russia, and Italy), Asia-Pacific (China, Japan, Korea, India and Southeast Asia), South America (Brazil, Argentina, Colombia, etc.), Middle East & Africa (Saudi Arabia, UAE, Egypt, Nigeria, and South Africa).

Also, the Internet Security Audit Market report provides a Detailed Analysis of Market-Definitions, Classifications, Applications, and Market Overview;product specifications; manufacturing processes; cost structures, raw materials, and so on. The report considers theimpact of the novel COVID-19 pandemic on the Internet Security Audit marketwith Competitive Intensity and How the Competition Will Take Shape in Coming Years. The report also covers the trade scenario, Porters Analysis, PESTLE analysis, value chain analysis, and company market share.

For more Customization, Connect with us athttps://www.inforgrowth.com/enquiry/6671309/Internet Security Audit-market

Key Attributes of Market Report:

Internet Security Audit market along with Report Research Design:

Internet Security Audit Market Historic Data (2015-2020):

Internet Security Audit Market Influencing Factors:

Internet Security Audit Market Forecast (2021-2026):

If you are an investor/shareholder in the Internet Security Audit Market, the provided study will help you to understand the growth model of the Internet Security Audit Industry after the impact of COVID-19. Request for sample reporthttps://www.inforgrowth.com/CovidImpact-Request/6671309/Internet Security Audit-market

For all your Research needs, reach out to us at:

Contact Person:Rohan

Email:[emailprotected]

US:+1-909-329-2808

See original here:
Glonal Internet Security Audit Market 2021 Industry Outlook, Research, Key Trends and Forecast to 2026 SoccerNurds - SoccerNurds

Security vendor WatchGuard Technologies' Internet Security Report for Q4 2020 shows fileless malware attack rates grew by nearly 900% while unique ransomware payloads plummeted by 48%.

Fileless malware rates in 2020 increased by 888% over 2019, according to WatchGuard.

One problem with fileless attacks is that they can evade detection by traditional endpoint protection products. Another is that all it takes to become a victim is visiting a malicious or compromised web page.

Once the malware is delivered, toolkits such as PowerSploit and CobaltStrike can be used to inject malicious code into legitimate processes, which will continue to run even if the script that delivered the code is detected and removed.

Applying endpoint detection and response alongside regular anti-malware products can help identify these threats.

Cryptocurrency prices have trended upwards, and cryptominer malware detections climbed more than 25% in 2020. 850 unique variants were detected during the year.

Double-digit growth was also seen in encrypted malware attacks. In the fourth quarter of 2020, 47% of all attacks detected by WatchGuard at the network perimeter were encrypted.

A new trojan Trojan.Script.1026663 found its way around email scanners and entered WatchGuard's list of the top five most-widespread malware detections in the same period. An email asking victims to review an order list attachment, but the malicious document triggers a series of payloads and malicious code that ultimately installs the Agent Tesla remote access trojan (RAT) and keylogger.

Botnet malware targeting IoT devices and routers is a growing issue. The Linux.Generic virus (aka The Moon) entered WatchGuard's list of top 10 malware detections. Linux-specific malware designed for ARM processors and another payload designed for MIPS processors shows a clear attack on IoT devices.

Despite some well-publicised cases, ransomware attack volumes shrank for the second year running. The number of unique ransomware payloads also continued to fall, from a record 5,489 in 2018 to 4,131 in 2019 and 2,152 in 2020. Each variant may have infected hundreds or thousands of endpoints worldwide.

Most ransomware detections were against signatures implemented in 2017 to detect WannaCry and related variants.

The decline in volume reflects a shift from scattergun campaigns to highly targeted attacks against targets that are particularly sensitive to downtime, including healthcare organisations and manufacturing firms.

In 4Q20, WatchGuard appliances blocked more than 20.6 million malware variants (456 per device) and nearly 3.5 million network threats (77 detections per appliance).

"The rise in sophisticated, evasive threat tactics last quarter and throughout 2020 showcases how vital it is to implement layered, end-to-end security protections," said WatchGuard CTO Corey Nachreiner.

"The attacks are coming on all fronts, as cyber criminals increasingly leverage fileless malware, cryptominers, encrypted attacks and more, and target users both at remote locations as well as corporate assets behind the traditional network perimeter. Effective security today means prioritising endpoint detection and response, network defences and foundational precautions such as security awareness training and strict patch management."

WatchGuard's Q4 2020 Internet Security Report is available here.

Visit the iTWire Shop, a leading destination for stylish accessories, gear & gadgets, lifestyle products and everyday portable office essentials, drones, zoom lenses for smartphones, software and online training.

PLUS Big Brands include: Apple, Lenovo, LG, Samsung, Sennheiser and many more.

Products available for any country.

We hope you enjoy and find value in the much anticipated iTWire Shop.

ENTER THE SHOP NOW!

We work with you to develop the message and conduct the interview or product review in a safe and collaborative way. Unlike other Tech YouTube channels, we create a story around your message and post that on the homepage of ITWire, linking to your message.

In addition, your interview post message can be displayed in up to 7 different post displays on our the iTWire.com site to drive traffic and readers to your video content and downloads. This can be a significant Lead Generation opportunity for your business.

We also provide 3 videos in one recording/sitting if you require so that you have a series of videos to promote to your customers. Your sales team can add your emails to sales collateral and to the footer of their sales and marketing emails.

See the latest in Tech News, Views, Interviews, Reviews, Product Promos and Events. Plus funny videos from our readers and customers.

SEE WHAT'S ON ITWIRE TV NOW!

See the rest here:
WatchGuard reports the ups and downs of malware - iTWire