As companies grapple with the security implications of hybrid work, malware continues to evolve and increase in sophistication. In fact, malware is no longer limited to traditional web risk categories; now it’s lurking everywhere, from cloud apps to search engines.
To avoid falling victim to malware, security leaders must understand how these threats are evolving, regularly review their malware protection strategy, and consider all possible entry points. To do this effectively, we must first think like an attacker to better understand how malware is penetrating organizations around the world.
SEO as the primary attack method
Attackers are getting smarter and use search engine optimization (SEO) techniques to upload malicious links and files to the top of users’ search engine results. This tactic is directly related to increases in malicious PDF downloads, with recent research found that malicious PDF downloads increased by 450% over the past 12 months. By improving the ranking of malicious PDF files in popular search engines such as Google and Bing, these attackers are able to quickly spread malware to often unknowing users.
Understand the origins of malware and targeted techniques
SEO is just a technique used by attackers to lure victims into downloading malware hosted on the web or in the cloud. Email, SMS, messaging apps and social media are also commonly used to engage users. Web malware downloads come from many different website categories, led by technology sites and content servers, while cloud malware downloads come from hundreds of different applications, led by popular cloud storage applications. cloud
In particular, web and cloud malware downloads often originate from servers located in the same regions as their victims. This is a growing trend that points to the growing sophistication of cybercriminals, who often install malware on content servers and cloud applications to bypass geofencing filters and other traditional prevention measures.
When attackers are designing decoys to spread malware, they typically try to take advantage of major social events, such as COVID-19. They also tend to design lures that create a sense of urgency, such as a shipping bill that needs to be paid or confirmation of personal information on a health care form. These decoys account for the majority of malware downloads. Attackers can also use more technical approaches, such as software exploits, drive-by downloads, or HTML smuggling to download malware onto a victim’s device. So what can be done to help strengthen protection?
How to stop malware downloads
Scan All: Organizations often allow sanctioned cloud applications to bypass content inspection, and attackers exploit the bypass by abusing the applications themselves. Instead, organizations should scan all traffic, including popular cloud applications. They should also scan all file types. Although PDF files are currently very popular among threat actors, we continue to see a wide variety of files being misused to deliver malware.Add layers: Don’t rely on a single security solution to protect your data. Make sure you can detect post-compromise behaviors such as command and control and data exfiltration that can occur after an attacker gains access to an endpoint.Reduce the risk surface: Reduce the risk surface by restricting downloads and uploads to unauthorized apps and sites. Use technologies such as Remote Browser Isolation (RBI) to isolate endpoints from web-based threats.
The immediate first step to building a stronger security architecture is to recognize that these threat trends occur in today’s digital environment. Regularly reviewing an organization’s malware protection strategy and verifying that all possible entry points are considered is one way for security teams to stay one step ahead of cybercriminals. Subsequently, by understanding the contemporary methods used by these malicious actors across today’s highly dispersed business operations, security leaders can ensure efficient and effective protection against data theft, costly breaches and unnecessary disruptions to productivity on an ongoing basis .
[ad_2]
Source link
