Cyber Defense eMagazine March Edition for 2022

• Nearly half of zero-day malware is now delivered via encrypted connections – While the
total amount of zero-day malware increased by a modest 3% to 67.2% in Q3, the percentage of
malware that arrived via Transport Layer Security (TLS) jumped from 31.6% to 47%. A lower
percentage of encrypted zero-days are considered advanced, but it is still concerning given that
WatchGuard’s data shows that many organizations are not decrypting these connections and
therefore have poor visibility into the amount of malware hitting their networks.
• As users upgrade to more recent versions of Microsoft Windows and Office, attackers are
focusing on newer vulnerabilities – While unpatched vulnerabilities in older software continue
to provide a rich hunting ground for attackers, they are also looking to exploit weaknesses in the
latest versions of Microsoft’s widely used products. In Q3, CVE-2018-0802 – which exploits a
vulnerability in the Equation Editor in Microsoft Office – cracked WatchGuard’s top 10 gateway
antivirus malware by volume list, hitting number 6, after showing up in the most-widespread
malware list in the previous quarter. In addition, two Windows code injectors (Win32/Heim.D and
Win32/Heri) came in at number 1 and 6 on the most detected list respectively.
• Attackers disproportionately targeted the Americas – The overwhelming majority of network
attacks targeted the Americas in Q3 (64.5%) compared to Europe (15.5%) and APAC (20%).
• Overall network attack detections resumed a more normal trajectory but still pose
significant risks – After consecutive quarters of more than 20% growth, WatchGuard’s Intrusion
Prevention Service (IPS) detected roughly 4.1 million unique network exploits in Q3. The drop of
21% brought volumes down to Q1 levels, which were still high compared to the previous year.
The shift doesn’t necessarily mean adversaries are letting up as they are possibly shifting their
focus towards more targeted attacks.
• The top 10 network attack signatures account for the vast majority of attacks – Of the
4,095,320 hits detected by IPS in Q3, 81% were attributed to the top 10 signatures. In fact, there
was just one new signature in the top 10 in Q3, ‘WEB Remote File Inclusion /etc/passwd’
(1054837), which targets older, but still widely used Microsoft Internet Information Services (IIS)
web servers. One signature (1059160), a SQL injection, has continued to maintain the position it
has held atop the list since Q2, 2019.
• Scripting attacks on endpoints continue at record pace – By the end of Q3, WatchGuard’s
AD360 threat intelligence and WatchGuard Endpoint Protection, Detection and Response
(EPDR) had already seen 10% more attack scripts than in all of 2020 (which, in turn, saw a 666%
increase over the prior year). As hybrid workforces start to look like the rule rather than the
exception, a strong perimeter is no longer enough to stop threats. While there are several ways
for cybercriminals to attack endpoints – from application exploits to script-based living-off-the-land
attacks – even those with limited skills can often fully execute a malware payload with scripting
tools like PowerSploit, PowerWare and Cobalt Strike, while evading basic endpoint detection.
• Even normally safe domains can be compromised – A protocol flaw in Microsoft’s Exchange
Server Autodiscover system allowed attackers to collect domain credentials and compromise
several normally trustworthy domains. Overall, in Q3 WatchGuard Fireboxes blocked 5.6 million
malicious domains, including several new malware domains that attempt to install software for
cryptomining, key loggers and remote access trojans (RATs), as well as phishing domains
masquerading as SharePoint sites to harvest Office365 login credentials. While down 23% from
the previous quarter, the number of blocked domains is still several times higher than the level
seen in Q4 2020 (1.3 million). This highlights the critical need for organizations to focus on keeping
Cyber Defense eMagazine – March 2022 Edition 37
Copyright © 2022, Cyber Defense Magazine. All rights reserved worldwide.