www.helpnetsecurity.com Open in urlscan Pro
52.36.176.186  Public Scan

Form analysis
1 forms found in the DOM

POST

<form id="mc4wp-form-1" class="mc4wp-form mc4wp-form-244483 mc4wp-ajax" method="post" data-id="244483" data-name="Footer newsletter form">
  <div class="mc4wp-form-fields">
    <div class="hns-newsletter">
      <div class="hns-newsletter__top">
        <div class="container">
          <div class="hns-newsletter__wrapper">
            <div class="hns-newsletter__title">
              <i>
                        <svg class="hic">
                            <use xlink:href="#hic-plus"></use>
                        </svg>
                    </i>
              <span>Cybersecurity news</span>
            </div>
          </div>
        </div>
      </div>
      <div class="hns-newsletter__bottom">
        <div class="container">
          <div class="hns-newsletter__wrapper">
            <div class="hns-newsletter__body">
              <div class="row">
                <div class="col">
                  <div class="form-check form-control-lg">
                    <input class="form-check-input" type="checkbox" name="_mc4wp_lists[]" value="520ac2f639" id="mcs1">
                    <label class="form-check-label text-nowrap" for="mcs1">Daily Newsletter</label>
                  </div>
                </div>
                <div class="col">
                  <div class="form-check form-control-lg">
                    <input class="form-check-input" type="checkbox" name="_mc4wp_lists[]" value="d2d471aafa" id="mcs2">
                    <label class="form-check-label text-nowrap" for="mcs2">Weekly Newsletter</label>
                  </div>
                </div>
              </div>
            </div>
            <div class="form-check form-control-lg mb-3">
              <input class="form-check-input" type="checkbox" name="_mc4wp_lists[]" value="28abe5d9ef" id="mcs3">
              <label class="form-check-label" for="mcs3">(IN)SECURE - monthly newsletter with top articles</label>
            </div>
            <div class="input-group mb-3">
              <input type="email" name="email" id="email" class="form-control border-dark" placeholder="Please enter your e-mail address" aria-label="Please enter your e-mail address" aria-describedby="hns-newsletter-submit-btn" required="">
              <button class="btn btn-dark rounded-0" type="submit" id="hns-newsletter-submit-btn">Subscribe</button>
            </div>
            <div class="form-check">
              <input class="form-check-input" type="checkbox" name="AGREE_TO_TERMS" value="1" id="mcs4" required="">
              <label class="form-check-label" for="mcs4">
                <span>I have read and agree to the <a href="https://www.helpnetsecurity.com/newsletter/" target="_blank" rel="noopener" class="d-inline-block">terms &amp; conditions</a>
                </span>
              </label>
            </div>
          </div>
        </div>
      </div>
    </div>
  </div><label style="display: none !important;">Leave this field empty if you're human: <input type="text" name="_mc4wp_honeypot" value="" tabindex="-1" autocomplete="off"></label><input type="hidden" name="_mc4wp_timestamp"
    value="1683121596"><input type="hidden" name="_mc4wp_form_id" value="244483"><input type="hidden" name="_mc4wp_form_element_id" value="mc4wp-form-1">
  <div class="mc4wp-response"></div>
</form>

Text Content

searchtwitterarrow rightmail strokearrow leftmail solidfacebooklinkedinplusangle
upmagazine plus
 * News
 * Features
 * Expert analysis
 * Videos
 * Reviews
 * Events
 * Whitepapers
 * Industry news
 * Product showcase
 * Newsletters

 * 
 * 
 * 


Help Net Security
May 3, 2023
Share


MALICIOUS CONTENT LURKS ALL OVER THE WEB



Attackers are finding new ways to evade detection and blend in with normal
network traffic using HTTP and HTTPS to deliver malware, according to Netskope.



On average, five out of every 1,000 enterprise users attempted to download
malware in Q1 2023, and new malware families and variants represented 72% of
those malware downloads.


SOCIAL ENGINEERING AND SEARCH ENGINE DATA VOIDS ON THE RISE

Netskope uncovered that nearly 10% of all malware downloads in Q1 were referred
from search engines. These downloads mostly resulted from weaponized data voids,
or combinations of search terms that have very few results, which means that any
content matching those terms is likely to appear very high in the search
results. This represents just one of many social engineering techniques that
attackers are accelerating.

Social engineering as a whole continues to dominate as a leading malware
infiltration technique with attackers abusing not only search engines, but
email, collaboration apps, and chat apps to trick their victims. As the top two
malware types, Trojans accounted for 60% of malware downloads in Q1 and phishing
downloads accounted for 13%.


EVALUATION OF PRIMARY COMMUNICATION CHANNELS FOR ATTACKERS

Netskope researchers found that attackers, in order to consistently evade
detection, have used HTTP and HTTPS over ports 80 and 443 as their primary
communication channel. In fact, of the new malware executables analyzed by
Netskope that communicated with external hosts, 85% did so over port 80 (HTTP)
and 67% did so over port 443 (HTTPS). This approach enables attackers to easily
go unnoticed and blend in with the abundance of HTTP and HTTPS traffic already
on the network.

Additionally, to evade DNS-based security controls, some malware samples
sidestep DNS lookups, instead reaching out directly to remote hosts using their
IP addresses. In Q1 2023, most malware samples that initiated external
communications did so using a combination of IP addresses and hostnames, with
61% communicating directly with at least one IP address and 91% communicating
with at least one host via a DNS lookup.

“Job number one for attackers is finding new ways to cover their tracks as
enterprises put more resources into threat detection, but these findings
indicate just how easy it still is for attackers to do so in plain sight,” said
Ray Canzanese, Threat Research Director, Netskope Threat Labs.

“As attackers gravitate towards cloud services that are widely used in the
enterprise and leverage popular channels to communicate, cross-functional risk
mitigation is more necessary than ever,” Canzanese continued.


CLOUD AND WEB MALWARE TRENDS

 * 55% of HTTP/HTTPS malware downloads came from cloud apps, up from 35% for the
   same period one year earlier. The primary driver of the increase is an
   increase in malware downloads from the most popular enterprise cloud
   applications, with Microsoft OneDrive tracked as the most popular enterprise
   app by a wide margin.
 * The number of applications with malware downloads also continued to increase,
   reaching a high of 261 distinct apps in Q1 2023.
 * Only a small fraction of total web malware downloads were delivered over web
   categories traditionally considered risky. Instead, downloads are spread out
   among a wide variety of sites, with content servers (CDNs) responsible for
   the largest slice, at 7.7%.

As enterprises work to defend against the onslaught of malware, cross-functional
collaboration across multiple teams is required, including network, security
operations, incident response, leadership, and even individual contributors.

Some of the additional steps organizations can take to reduce risks include:

 * Inspect all HTTP and HTTPS downloads, including all web and cloud traffic, to
   prevent malware from infiltrating your network
 * Ensure that security controls recursively inspect the content of popular
   archive files and that high-risk file types are thoroughly inspected
 * Configure policies to block downloads from apps that are not used in your
   organization to reduce risk surface.




More about
 * cloud
 * malware
 * Netskope
 * phishing
 * report
 * social engineering

Share this

FEATURED NEWS

 * Attackers are trying to exploit old DVR vulnerabilities (CVE-2018-9995,
   CVE-2016-20016)
 * Google Chrome will lose the “lock” icon for HTTPS-secured sites
 * T-Mobile suffers second data breach this year

eBook: Security Compliance for CISOs


SPONSORED


THE BEST DEFENSE AGAINST CYBER THREATS FOR LEAN SECURITY TEAMS


WEBINAR: TIPS FROM MSSPS TO MSSPS – STARTING A VCISO PRACTICE


SECURITY IN THE CLOUD WITH MORE AUTOMATION


CISOS STRUGGLE WITH STRESS AND LIMITED RESOURCES




DON'T MISS


ATTACKERS ARE TRYING TO EXPLOIT OLD DVR VULNERABILITIES (CVE-2018-9995,
CVE-2016-20016)


GOOGLE CHROME WILL LOSE THE “LOCK” ICON FOR HTTPS-SECURED SITES


T-MOBILE SUFFERS SECOND DATA BREACH THIS YEAR


5 API SECURITY BEST PRACTICES YOU MUST IMPLEMENT


EASILY EXPLOITABLE FLAW IN ORACLE OPERA COULD SPELL TROUBLE FOR HOTEL CHAINS
(CVE-2023-21932)




Cybersecurity news
Daily Newsletter
Weekly Newsletter
(IN)SECURE - monthly newsletter with top articles
Subscribe
I have read and agree to the terms & conditions
Leave this field empty if you're human:

© Copyright 1998-2023 by Help Net Security
Read our privacy policy | About us | Advertise
Follow us
×