Malware Leveraging PowerShell Grew 432% in 2017

Update:

McAfee previously incorrectly reported total Mac OS malware grew 243% in 2017. The correct percentage increase is 58%. The story has been updated to reflect the correct percentage increase

PowerShell malware clearly appears to be working very well for cybercriminals, judging by the huge spike in the use of such malware last year.

In a new report this week, security vendor McAfee says it observed a 267% increase in fileless malware samples leveraging PowerShell just in the fourth quarter of 2017, compared to the same period a year ago. The total number of PowerShell malware samples that McAfee observed in 2017 was a massive 432% higher than the number observed in 2016.

The scripting language proved irresistible for attackers who used it extensively within Microsoft Office files, typically to execute the initial stages of broader attacks, McAfee said.  

The vendor pointed to the Golden Dragon operation that targeted the Winter Olympics in PyeongChang as a particularly well-executed example of an attack involving PowerShell malware. In that campaign, the attackers used a PowerShell implant to establish an encrypted communication channel with a remote server for sending system information.

Among the most prevalent scripting malware families that used PowerShell for propagation in 2017 were W97/Downloader; Kovter, a click-fraud malware that went fileless last year; and the Nemucod Trojan, McAfee said in a previous report last September.

PowerShell malware takes advantage of the legitimate functionality of the scripting tool to carry out malicious activity. Administrators use PowerShell to automate repetitive tasks to identify and terminate processes, to check services running on a system, and other tasks.

PowerShell is a popular target because it gives attackers a way to conceal malicious activities. PowerShell's ability to run in system memory gives attackers a way to run malicious code without actually having to install malware on a system, thereby making such malware extremely hard to detect.

As long as two years ago, security vendors like Carbon Black had reported a sharp increase in the use of PowerShell malware, especially to carry out command and control communications and for concealing lateral movement on breached networks. Other malicious activity involving PowerShell malware includes credential theft and privilege escalation.

Unsurprisingly, 2017 witnessed a surge in other kinds of malicious activity as well. Cryptocurrency hijacking, for instance, emerged as a major threat category for both individuals and businesses, especially in the fourth quarter of last year. Malware targeting the Mac OS also registered a substantial increase in 2017, growing 24% in the fourth quarter of 2017 and recording a 58% growth over 2016.

Ransomware continued to grow and evolve as a threat though at a somewhat less hectic pace than previously. McAfee says it observed a 59% increase in ransomware samples in 2017 compared with the year before. Among the new twists was the emergence of what McAfee described as pseudo-ransomware tools like NotPetya that were designed to distract defenders from other attacks.

Healthcare emerged as the sector that was hit hardest by malware and malicious activities in 2017. The sector recorded an ominous 211% increase in disclosed security incidents compared to 2016, indicating that attackers increasingly see it as a high-value, relatively easy target. Many of the incidents, according to McAfee, resulted from a failure by healthcare organizations to address known vulnerabilities in medical software and from a failure to follow security best practices.

Related content:

Black Hat Asia returns to Singapore with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier solutions and service providers in the Business Hall. Click for information on the conference and to register.