Vulnerabilities / Threats

3/12/2018
07:25 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

Malware Leveraging PowerShell Grew 432% in 2017

Cryptocurrency mining and ransomware were other major threats.

Update:

McAfee previously incorrectly reported total Mac OS malware grew 243% in 2017. The correct percentage increase is 58%. The story has been updated to reflect the correct percentage increase
 
PowerShell malware clearly appears to be working very well for cybercriminals, judging by the huge spike in the use of such malware last year.

In a new report this week, security vendor McAfee says it observed a 267% increase in fileless malware samples leveraging PowerShell just in the fourth quarter of 2017, compared to the same period a year ago. The total number of PowerShell malware samples that McAfee observed in 2017 was a massive 432% higher than the number observed in 2016.

The scripting language proved irresistible for attackers who used it extensively within Microsoft Office files, typically to execute the initial stages of broader attacks, McAfee said.  

The vendor pointed to the Golden Dragon operation that targeted the Winter Olympics in PyeongChang as a particularly well-executed example of an attack involving PowerShell malware. In that campaign, the attackers used a PowerShell implant to establish an encrypted communication channel with a remote server for sending system information.

Among the most prevalent scripting malware families that used PowerShell for propagation in 2017 were W97/Downloader; Kovter, a click-fraud malware that went fileless last year; and the Nemucod Trojan, McAfee said in a previous report last September.

PowerShell malware takes advantage of the legitimate functionality of the scripting tool to carry out malicious activity. Administrators use PowerShell to automate repetitive tasks to identify and terminate processes, to check services running on a system, and other tasks.

PowerShell is a popular target because it gives attackers a way to conceal malicious activities. PowerShell's ability to run in system memory gives attackers a way to run malicious code without actually having to install malware on a system, thereby making such malware extremely hard to detect.

As long as two years ago, security vendors like Carbon Black had reported a sharp increase in the use of PowerShell malware, especially to carry out command and control communications and for concealing lateral movement on breached networks. Other malicious activity involving PowerShell malware includes credential theft and privilege escalation.

Unsurprisingly, 2017 witnessed a surge in other kinds of malicious activity as well. Cryptocurrency hijacking, for instance, emerged as a major threat category for both individuals and businesses, especially in the fourth quarter of last year. Malware targeting the Mac OS also registered a substantial increase in 2017, growing 24% in the fourth quarter of 2017 and recording a 58% growth over 2016.

Ransomware continued to grow and evolve as a threat though at a somewhat less hectic pace than previously. McAfee says it observed a 59% increase in ransomware samples in 2017 compared with the year before. Among the new twists was the emergence of what McAfee described as pseudo-ransomware tools like NotPetya that were designed to distract defenders from other attacks.

Healthcare emerged as the sector that was hit hardest by malware and malicious activities in 2017. The sector recorded an ominous 211% increase in disclosed security incidents compared to 2016, indicating that attackers increasingly see it as a high-value, relatively easy target. Many of the incidents, according to McAfee, resulted from a failure by healthcare organizations to address known vulnerabilities in medical software and from a failure to follow security best practices.

Related content:

 

Black Hat Asia returns to Singapore with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier solutions and service providers in the Business Hall. Click for information on the conference and to register.

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
12 Free, Ready-to-Use Security Tools
Steve Zurier, Freelance Writer,  10/12/2018
Most IT Security Pros Want to Change Jobs
Dark Reading Staff 10/12/2018
Most Malware Arrives Via Email
Dark Reading Staff 10/11/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
Flash Poll
The Risk Management Struggle
The Risk Management Struggle
The majority of organizations are struggling to implement a risk-based approach to security even though risk reduction has become the primary metric for measuring the effectiveness of enterprise security strategies. Read the report and get more details today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-17534
PUBLISHED: 2018-10-15
Teltonika RUT9XX routers with firmware before 00.04.233 provide a root terminal on a serial interface without proper access control. This allows attackers with physical access to execute arbitrary commands with root privileges.
CVE-2018-17980
PUBLISHED: 2018-10-15
NoMachine before 5.3.27 and 6.x before 6.3.6 allows attackers to gain privileges via a Trojan horse wintab32.dll file located in the same directory as a .nxs file, as demonstrated by a scenario where the .nxs file and the DLL are in the current working directory, and the Trojan horse code is execute...
CVE-2018-18259
PUBLISHED: 2018-10-15
Stored XSS has been discovered in version 1.0.12 of the LUYA CMS software via /admin/api-cms-nav/create-page.
CVE-2018-18260
PUBLISHED: 2018-10-15
In the 2.4 version of Camaleon CMS, Stored XSS has been discovered. The profile image in the User settings section can be run in the update / upload area via /admin/media/upload?actions=false.
CVE-2018-17532
PUBLISHED: 2018-10-15
Teltonika RUT9XX routers with firmware before 00.04.233 are prone to multiple unauthenticated OS command injection vulnerabilities in autologin.cgi and hotspotlogin.cgi due to insufficient user input sanitization. This allows remote attackers to execute arbitrary commands with root privileges.