Vulnerabilities / Threats

07:25 PM
Connect Directly

Malware Leveraging PowerShell Grew 432% in 2017

Cryptocurrency mining and ransomware were other major threats.


McAfee previously incorrectly reported total Mac OS malware grew 243% in 2017. The correct percentage increase is 58%. The story has been updated to reflect the correct percentage increase
PowerShell malware clearly appears to be working very well for cybercriminals, judging by the huge spike in the use of such malware last year.

In a new report this week, security vendor McAfee says it observed a 267% increase in fileless malware samples leveraging PowerShell just in the fourth quarter of 2017, compared to the same period a year ago. The total number of PowerShell malware samples that McAfee observed in 2017 was a massive 432% higher than the number observed in 2016.

The scripting language proved irresistible for attackers who used it extensively within Microsoft Office files, typically to execute the initial stages of broader attacks, McAfee said.  

The vendor pointed to the Golden Dragon operation that targeted the Winter Olympics in PyeongChang as a particularly well-executed example of an attack involving PowerShell malware. In that campaign, the attackers used a PowerShell implant to establish an encrypted communication channel with a remote server for sending system information.

Among the most prevalent scripting malware families that used PowerShell for propagation in 2017 were W97/Downloader; Kovter, a click-fraud malware that went fileless last year; and the Nemucod Trojan, McAfee said in a previous report last September.

PowerShell malware takes advantage of the legitimate functionality of the scripting tool to carry out malicious activity. Administrators use PowerShell to automate repetitive tasks to identify and terminate processes, to check services running on a system, and other tasks.

PowerShell is a popular target because it gives attackers a way to conceal malicious activities. PowerShell's ability to run in system memory gives attackers a way to run malicious code without actually having to install malware on a system, thereby making such malware extremely hard to detect.

As long as two years ago, security vendors like Carbon Black had reported a sharp increase in the use of PowerShell malware, especially to carry out command and control communications and for concealing lateral movement on breached networks. Other malicious activity involving PowerShell malware includes credential theft and privilege escalation.

Unsurprisingly, 2017 witnessed a surge in other kinds of malicious activity as well. Cryptocurrency hijacking, for instance, emerged as a major threat category for both individuals and businesses, especially in the fourth quarter of last year. Malware targeting the Mac OS also registered a substantial increase in 2017, growing 24% in the fourth quarter of 2017 and recording a 58% growth over 2016.

Ransomware continued to grow and evolve as a threat though at a somewhat less hectic pace than previously. McAfee says it observed a 59% increase in ransomware samples in 2017 compared with the year before. Among the new twists was the emergence of what McAfee described as pseudo-ransomware tools like NotPetya that were designed to distract defenders from other attacks.

Healthcare emerged as the sector that was hit hardest by malware and malicious activities in 2017. The sector recorded an ominous 211% increase in disclosed security incidents compared to 2016, indicating that attackers increasingly see it as a high-value, relatively easy target. Many of the incidents, according to McAfee, resulted from a failure by healthcare organizations to address known vulnerabilities in medical software and from a failure to follow security best practices.

Related content:


Black Hat Asia returns to Singapore with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier solutions and service providers in the Business Hall. Click for information on the conference and to register.

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
The Case for Integrating Physical Security & Cybersecurity
Paul Kurtz, CEO & Cofounder, TruSTAR Technology,  3/20/2018
A Look at Cybercrime's Banal Nature
Curtis Franklin Jr., Senior Editor at Dark Reading,  3/20/2018
City of Atlanta Hit with Ransomware Attack
Dark Reading Staff 3/23/2018
Register for Dark Reading Newsletters
White Papers
Current Issue
How to Cope with the IT Security Skills Shortage
Most enterprises don't have all the in-house skills they need to meet the rising threat from online attackers. Here are some tips on ways to beat the shortage.
Flash Poll
[Strategic Security Report] Navigating the Threat Intelligence Maze
[Strategic Security Report] Navigating the Threat Intelligence Maze
Most enterprises are using threat intel services, but many are still figuring out how to use the data they're collecting. In this Dark Reading survey we give you a look at what they're doing today - and where they hope to go.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.