Surprisingly Useful AI Article Enhancements
WatchGuard Technologies has released its latest Internet Security Report, which covers key cyber threats observed during the second quarter of 2024. The report highlights how threat actors are now attempting to use blockchains as hosts for malicious content, a method that could create long-term challenges for cybersecurity.
According to the WatchGuard Threat Lab, seven of the top ten malware threats identified in the quarter were new, with attackers increasingly turning to more evasive techniques. Among the new threats were Lumma Stealer, designed to extract sensitive data from systems, and a variant of the Mirai Botnet, which infects smart devices, turning them into remotely controlled bots. LokiBot, malware that targets both Windows and Android devices, was also among the top threats identified.
One of the most concerning trends was the use of “EtherHiding,” a technique where malicious PowerShell scripts are embedded in blockchains like Binance Smart Contracts. Victims are tricked by fake error messages on compromised websites, which prompt them to “update their browser,” leading them to the malicious code hidden in the blockchain. Since blockchains are designed to be immutable, this technique poses a long-term risk, as the malicious code could remain hosted in the blockchain indefinitely.
Shift Towards Evasive Malware
The report found that while overall malware detections were down by 24 per cent, there was a significant shift in the types of threats being detected. Signature-based malware detections dropped by 35 per cent, but there was a 168 per cent increase in evasive malware identified by WatchGuard’s advanced behavioural engine. This suggests that attackers are shifting their focus toward more sophisticated, harder-to-detect threats, including ransomware and zero-day exploits.
“The latest findings show that attackers tend to follow patterns, with certain attack techniques gaining popularity in waves,” said Corey Nachreiner, Chief Security Officer at WatchGuard Technologies. “These results also highlight the importance of regularly updating software and systems to address security vulnerabilities. A defence-in-depth approach, often delivered by a managed service provider, is crucial to combating these evolving security challenges.”
Network Attacks on the Rise
The report also pointed to a sharp rise in network attacks, which increased by 33 per cent compared to the first quarter of 2024. The Asia-Pacific region was particularly affected, accounting for 56 per cent of all network attack detections. This was a significant increase from the previous quarter, doubling in volume.
An NGINX vulnerability, first detected in 2019, was the most common network attack by volume during the quarter, responsible for 29 per cent of all network attack detections. This amounted to roughly 724,000 detections across the US, EMEA, and APAC regions.
Another significant development was the reappearance of the Fuzzbunch hacking toolkit, originally leaked by The Shadow Brokers in 2016. Fuzzbunch ranked as the second-highest endpoint malware threat, targeting Windows operating systems.
Targeting Chromium-Based Browsers
The report also found that 74 per cent of all browser-initiated malware attacks targeted Chromium-based browsers such as Google Chrome, Microsoft Edge, and Brave. Among the most common threats was a signature known as trojan.html.hidden.1.gen, which targets users through phishing campaigns aimed at collecting credentials via the browser.
One specific instance highlighted by the WatchGuard Threat Lab involved this signature being used to target students and faculty at Valdosta State University in Georgia. The attack involved the delivery of phishing campaigns to gather login credentials from users’ browsers.
Key Findings from the Report
In summary, the WatchGuard Q2 2024 Internet Security Report identified several key trends:
- A shift from signature-based malware detections to more evasive malware, with a 168 per cent increase in the latter.
- Network attacks increased by 33 per cent from the previous quarter, with the Asia-Pacific region seeing a large rise in attack volume.
- An old NGINX vulnerability, dating back to 2019, became the top network attack by volume during the quarter.
- The Fuzzbunch hacking toolkit, leaked in 2016, re-emerged as a prominent endpoint malware threat.
- Browser-initiated malware attacks primarily targeted Chromium-based browsers, with phishing campaigns being a common method of attack.
The findings underscore the evolving nature of cyber threats and the importance of staying vigilant. Regular updates and patches to software, along with a comprehensive defence-in-depth approach, remain critical in mitigating the risks posed by these attacks.
For a more detailed analysis, the full report is available for download at WatchGuard’s website.
Last Updated on October 18, 2024 by Nick Ross
