Vulnerabilities / Threats

3/12/2018
07:25 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

Malware Leveraging PowerShell Grew 432% in 2017

Cryptocurrency mining and ransomware were other major threats.

Update:

McAfee previously incorrectly reported total Mac OS malware grew 243% in 2017. The correct percentage increase is 58%. The story has been updated to reflect the correct percentage increase
 
PowerShell malware clearly appears to be working very well for cybercriminals, judging by the huge spike in the use of such malware last year.

In a new report this week, security vendor McAfee says it observed a 267% increase in fileless malware samples leveraging PowerShell just in the fourth quarter of 2017, compared to the same period a year ago. The total number of PowerShell malware samples that McAfee observed in 2017 was a massive 432% higher than the number observed in 2016.

The scripting language proved irresistible for attackers who used it extensively within Microsoft Office files, typically to execute the initial stages of broader attacks, McAfee said.  

The vendor pointed to the Golden Dragon operation that targeted the Winter Olympics in PyeongChang as a particularly well-executed example of an attack involving PowerShell malware. In that campaign, the attackers used a PowerShell implant to establish an encrypted communication channel with a remote server for sending system information.

Among the most prevalent scripting malware families that used PowerShell for propagation in 2017 were W97/Downloader; Kovter, a click-fraud malware that went fileless last year; and the Nemucod Trojan, McAfee said in a previous report last September.

PowerShell malware takes advantage of the legitimate functionality of the scripting tool to carry out malicious activity. Administrators use PowerShell to automate repetitive tasks to identify and terminate processes, to check services running on a system, and other tasks.

PowerShell is a popular target because it gives attackers a way to conceal malicious activities. PowerShell's ability to run in system memory gives attackers a way to run malicious code without actually having to install malware on a system, thereby making such malware extremely hard to detect.

As long as two years ago, security vendors like Carbon Black had reported a sharp increase in the use of PowerShell malware, especially to carry out command and control communications and for concealing lateral movement on breached networks. Other malicious activity involving PowerShell malware includes credential theft and privilege escalation.

Unsurprisingly, 2017 witnessed a surge in other kinds of malicious activity as well. Cryptocurrency hijacking, for instance, emerged as a major threat category for both individuals and businesses, especially in the fourth quarter of last year. Malware targeting the Mac OS also registered a substantial increase in 2017, growing 24% in the fourth quarter of 2017 and recording a 58% growth over 2016.

Ransomware continued to grow and evolve as a threat though at a somewhat less hectic pace than previously. McAfee says it observed a 59% increase in ransomware samples in 2017 compared with the year before. Among the new twists was the emergence of what McAfee described as pseudo-ransomware tools like NotPetya that were designed to distract defenders from other attacks.

Healthcare emerged as the sector that was hit hardest by malware and malicious activities in 2017. The sector recorded an ominous 211% increase in disclosed security incidents compared to 2016, indicating that attackers increasingly see it as a high-value, relatively easy target. Many of the incidents, according to McAfee, resulted from a failure by healthcare organizations to address known vulnerabilities in medical software and from a failure to follow security best practices.

Related content:

 

Black Hat Asia returns to Singapore with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier solutions and service providers in the Business Hall. Click for information on the conference and to register.

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
'PowerSnitch' Hacks Androids via Power Banks
Kelly Jackson Higgins, Executive Editor at Dark Reading,  12/8/2018
The Case for a Human Security Officer
Ira Winkler, CISSP, President, Secure Mentem,  12/5/2018
Windows 10 Security Questions Prove Easy for Attackers to Exploit
Kelly Sheridan, Staff Editor, Dark Reading,  12/5/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
10 Best Practices That Could Reshape Your IT Security Department
This Dark Reading Tech Digest, explores ten best practices that could reshape IT security departments.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-8651
PUBLISHED: 2018-12-12
A cross site scripting vulnerability exists when Microsoft Dynamics NAV does not properly sanitize a specially crafted web request to an affected Dynamics NAV server, aka "Microsoft Dynamics NAV Cross Site Scripting Vulnerability." This affects Microsoft Dynamics NAV.
CVE-2018-8652
PUBLISHED: 2018-12-12
A Cross-site Scripting (XSS) vulnerability exists when Windows Azure Pack does not properly sanitize user-provided input, aka "Windows Azure Pack Cross Site Scripting Vulnerability." This affects Windows Azure Pack Rollup 13.1.
CVE-2018-8617
PUBLISHED: 2018-12-12
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Engine Memory Corruption Vulnerability." This affects Microsoft Edge, ChakraCore. This CVE ID is unique from CVE-2018-8583, CVE-2018-8...
CVE-2018-8618
PUBLISHED: 2018-12-12
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Engine Memory Corruption Vulnerability." This affects Microsoft Edge, ChakraCore. This CVE ID is unique from CVE-2018-8583, CVE-2018-8...
CVE-2018-8619
PUBLISHED: 2018-12-12
A remote code execution vulnerability exists when the Internet Explorer VBScript execution policy does not properly restrict VBScript under specific conditions, aka "Internet Explorer Remote Code Execution Vulnerability." This affects Internet Explorer 9, Internet Explorer 11, Internet Exp...