Cyberattacks have become so rampant these days that they are now considered a worldwide concern. Collectively, hacking activities will put at risk a total value of $5.2 trillion worth of data and infrastructure globally over the next five years.
Just about anyone with malicious intentions can become a threat. Hacking malware such as remote access tools and spyware can be easily purchased on the dark web. Other malware makers have even made their creations’ source code available for download and modification for anyone to use. Those with some computing experience can simply use these do-it-yourself (DIY) hacking kits and readily carry out data breaches, scams, and ransomware attacks. What’s more worrisome is that newer and more complex malware have even become more evasive, rendering conventional solutions such as run-of-the-mill antivirus and antimalware solutions simply inadequate.
To deal with these threats, organizations should consider protecting the different potential attack vectors that hackers can use. Companies should protect common entry points such as web applications and email servers using web application firewalls (WAFs) and spam filters. They should also look to implement browsing protection to prevent users from inadvertently downloading and running infected files and programs. They can also adapt new malware disarm solutions that can deal with newer variants. For instance, the use of content disarm and reconstruction (CDR) as an approach to combat malware is rapidly emerging.
With evasive malware posing an immediate threat, it’s high time that organizations revisit their security measures and include more capable solutions.
Where conventional measures fall short
To prevent malware attacks, users often rely on antivirus and antimalware solutions. These applications are often installed on workstations and run silently in the background, checking for malicious files and processes that are found on a particular device. They can also be integrated to email and file servers to check the legitimacy of documents and attachments.
Organizations can also deal with malware through the use of sandboxes. IT teams use virtualized environments to examine suspicious files that enter their networks. Should a file actually be malware, its effects are contained within the sandbox’s secure environment and away from the rest of the network.
However, more advanced malware are designed to circumvent these measures. Newer variants may use polymorphic code which allows the malware to change its own file signature, rendering conventional antiviruses that rely on signature-based detection ineffective. The Emotet malware strain, which has been used to steal banking credentials, has recently been observed to now feature improved evasion capabilities using polymorphism. Hackers can also disguise malware as legitimate work documents by embedding malicious code deep within common work documents.
Other malware strains can also detect if they are located or are ran within a virtualized environment. If they detect that they are within sandboxes, these strains will avoid deploying their payloads in order to avoid detection. If they bypass these security measures, these malware can eventually find their way into the network and do their damage then.
How to plug the gaps
Because of this rising complexity of malware, IT teams should be looking to institute more comprehensive measures to mitigate such threats.
A key step in dealing with evasive malware is by limiting the ways they can get into a network. Many such malware are delivered as attachments through phishing attempts and fake emails. Putting up solutions such as WAFs that prevent malicious traffic from interacting with email and messaging applications can help prevent automated malware campaigns from spamming these channels. Anti-phishing solutions such as email filters and browsing protection can also help users avoid downloading and running potentially malicious attachments.
Malware disarm solutions that use CDR have also become an emerging option for companies to use against malware threats. CDR works by deconstructing files and conducting advanced scans to identify any traces of malicious code they may contain. Files are scanned at a binary level so that even files embedded with polymorphic code or heavily disguised malware will be sanitized. Once the malicious code is removed, the file is then reconstructed. The sanitization process effectively disarms malware.
Unlike most anti-malware solutions that use signature detection, CDR does not rely on definitions databases to identify malware. Even if the solution encounters a new and previously unreported malware strain, it will still be able to scan its code and detect any malicious instructions it contains. Because of this mechanism, CDR also takes away the need for virtualized environments or sandboxes.
When combined, these measures can help cover the possible vectors of attack that evasive malware take.
A stronger posture against malware
Newer variants of malware are now sophisticated enough to circumvent security tools that are traditionally used to combat cybersecurity threats. Companies should know that they just cannot solely rely on these measures, especially when they’ve proven to fall short and fail often. They must now turn to more capable solutions to beef up their defenses and improve their security posture. If they don’t, they may suffer from an attack and risk ruin.
