Thursday, April 18, 2024
spot_img
spot_img

Email malware rate continues to increase and WannaCry, Petya inspire other threats to add self-spreading components: Symantec

spot_img
spot_img
- Advertisement -

Some of the key takeaways from July’s Latest Intelligence, and the threat landscape in general, include an increase in the email malware rate, several malware threats add self-spreading functionality, and Symantec looks at how attackers are increasingly using living off the land tactics.

The email malware rate in July increased to one in 359 emails, up from one in 451 the previous month. This marks the highest rate seen in the past seven months.

This trend in malware being distributed through email seems to be catching on, with several infamous malware families recently adding functionality that allows them to spread via spam email.

Following the success of WannaCry and Petya, the banking Trojans Emotet (Trojan.Emotet) and TrickBot (Trojan.Trickybot) have both added support for self-spreading components. Emotet now has the capability to steal email credentials from infected computers and then use them to send out spam in order to spread itself. TrickBot takes advantage of SMB to spread to computers on the same network as the original host and also spreads itself via spam posing as invoices from a financial organization. However, TrickBot’s new module doesn’t appear to be fully implemented yet, according to the researchers that discovered it.

It’s not just banking malware that are working to bring worm-like functionality back in vogue. The ransomware Reyptson was discovered in July using stolen Thunderbird email client credentials to send out spam containing malicious links that ultimately lead to Reyptson being downloaded onto the recipient’s computer.

July also saw Symantec comment on another trend in the world of malware, so-called “living off the land” tactics. Attackers are increasingly making use of tools already installed on targeted computers or are running simple scripts and shellcode directly in memory. This allows them to minimize the risk of their attacks being discovered and blocked by traditional security tools. June’s Petya outbreak is a good example of an attack using living off the land tactics, with its use of system commands and legitimate tools such as PsExec and wmic.exe.

- Advertisement -

97 COMMENTS

  1. The next time I read a blog, I hope that it won’t fail me as much as this particular one. I mean, Yes, it was my choice to read, nonetheless I really believed you would have something interesting to talk about. All I hear is a bunch of crying about something you can fix if you were not too busy looking for attention.

  2. Having read this I thought it was extremely informative. I appreciate you taking the time and energy to put this content together. I once again find myself personally spending a lot of time both reading and leaving comments. But so what, it was still worthwhile!

  3. I seriously love your website.. Pleasant colors & theme. Did you make this web site yourself? Please reply back as Iím hoping to create my own blog and would love to know where you got this from or just what the theme is named. Thank you!

  4. I have to thank you for the efforts you’ve put in writing this website. I am hoping to view the same high-grade content from you in the future as well. In truth, your creative writing abilities has inspired me to get my own, personal website now 😉

  5. Next time I read a blog, Hopefully it doesn’t fail me as much as this particular one. I mean, Yes, it was my choice to read through, however I genuinely thought you would probably have something helpful to talk about. All I hear is a bunch of moaning about something you could fix if you were not too busy looking for attention.

  6. Iím amazed, I must say. Rarely do I come across a blog thatís both educative and engaging, and without a doubt, you’ve hit the nail on the head. The problem is something that too few people are speaking intelligently about. Now i’m very happy that I came across this during my search for something regarding this.

  7. After I originally commented I seem to have clicked the -Notify me when new comments are added- checkbox and now every time a comment is added I recieve four emails with the same comment. Perhaps there is a way you can remove me from that service? Thank you!

LEAVE A REPLY

Please enter your comment!
Please enter your name here

spot_img
spot_img
spot_img
spot_img