Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

3/12/2018
07:25 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

Malware Leveraging PowerShell Grew 432% in 2017

Cryptocurrency mining and ransomware were other major threats.

Update:

McAfee previously incorrectly reported total Mac OS malware grew 243% in 2017. The correct percentage increase is 58%. The story has been updated to reflect the correct percentage increase
 
PowerShell malware clearly appears to be working very well for cybercriminals, judging by the huge spike in the use of such malware last year.

In a new report this week, security vendor McAfee says it observed a 267% increase in fileless malware samples leveraging PowerShell just in the fourth quarter of 2017, compared to the same period a year ago. The total number of PowerShell malware samples that McAfee observed in 2017 was a massive 432% higher than the number observed in 2016.

The scripting language proved irresistible for attackers who used it extensively within Microsoft Office files, typically to execute the initial stages of broader attacks, McAfee said.  

The vendor pointed to the Golden Dragon operation that targeted the Winter Olympics in PyeongChang as a particularly well-executed example of an attack involving PowerShell malware. In that campaign, the attackers used a PowerShell implant to establish an encrypted communication channel with a remote server for sending system information.

Among the most prevalent scripting malware families that used PowerShell for propagation in 2017 were W97/Downloader; Kovter, a click-fraud malware that went fileless last year; and the Nemucod Trojan, McAfee said in a previous report last September.

PowerShell malware takes advantage of the legitimate functionality of the scripting tool to carry out malicious activity. Administrators use PowerShell to automate repetitive tasks to identify and terminate processes, to check services running on a system, and other tasks.

PowerShell is a popular target because it gives attackers a way to conceal malicious activities. PowerShell's ability to run in system memory gives attackers a way to run malicious code without actually having to install malware on a system, thereby making such malware extremely hard to detect.

As long as two years ago, security vendors like Carbon Black had reported a sharp increase in the use of PowerShell malware, especially to carry out command and control communications and for concealing lateral movement on breached networks. Other malicious activity involving PowerShell malware includes credential theft and privilege escalation.

Unsurprisingly, 2017 witnessed a surge in other kinds of malicious activity as well. Cryptocurrency hijacking, for instance, emerged as a major threat category for both individuals and businesses, especially in the fourth quarter of last year. Malware targeting the Mac OS also registered a substantial increase in 2017, growing 24% in the fourth quarter of 2017 and recording a 58% growth over 2016.

Ransomware continued to grow and evolve as a threat though at a somewhat less hectic pace than previously. McAfee says it observed a 59% increase in ransomware samples in 2017 compared with the year before. Among the new twists was the emergence of what McAfee described as pseudo-ransomware tools like NotPetya that were designed to distract defenders from other attacks.

Healthcare emerged as the sector that was hit hardest by malware and malicious activities in 2017. The sector recorded an ominous 211% increase in disclosed security incidents compared to 2016, indicating that attackers increasingly see it as a high-value, relatively easy target. Many of the incidents, according to McAfee, resulted from a failure by healthcare organizations to address known vulnerabilities in medical software and from a failure to follow security best practices.

Related content:

 

Black Hat Asia returns to Singapore with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier solutions and service providers in the Business Hall. Click for information on the conference and to register.

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
10 Ways to Keep a Rogue RasPi From Wrecking Your Network
Curtis Franklin Jr., Senior Editor at Dark Reading,  7/10/2019
The Security of Cloud Applications
Hillel Solow, CTO and Co-founder, Protego,  7/11/2019
Where Businesses Waste Endpoint Security Budgets
Kelly Sheridan, Staff Editor, Dark Reading,  7/15/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: "Jim, stop pretending you're drowning in tickets."
Current Issue
Building and Managing an IT Security Operations Program
As cyber threats grow, many organizations are building security operations centers (SOCs) to improve their defenses. In this Tech Digest you will learn tips on how to get the most out of a SOC in your organization - and what to do if you can't afford to build one.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-13623
PUBLISHED: 2019-07-17
In NSA Ghidra through 9.0.4, path traversal can occur in RestoreTask.java (from the package ghidra.app.plugin.core.archive) via an archive with an executable file that has an initial ../ in its filename. This allows attackers to overwrite arbitrary files in scenarios where an intermediate analysis r...
CVE-2019-13624
PUBLISHED: 2019-07-17
In ONOS 1.15.0, apps/yang/web/src/main/java/org/onosproject/yang/web/YangWebResource.java mishandles backquote characters within strings that can be used in a shell command.
CVE-2019-13625
PUBLISHED: 2019-07-17
NSA Ghidra before 9.0.1 allows XXE when a project is opened or restored, or a tool is imported, as demonstrated by a project.prp file.
CVE-2019-3571
PUBLISHED: 2019-07-16
An input validation issue affected WhatsApp Desktop versions prior to 0.3.3793 which allows malicious clients to send files to users that would be displayed with a wrong extension.
CVE-2019-6160
PUBLISHED: 2019-07-16
A vulnerability in various versions of Iomega and LenovoEMC NAS products could allow an unauthenticated user to access files on NAS shares via the API.