The Rise of Sophisticated Browser-Based Social Engineering Tactics: Insights from WatchGuard Threat Lab

New Internet Security Report Reveals Alarming Trends in Malware and Cyber Threats

Browser-Based Social Engineering Strategies

The latest Internet Security Report from WatchGuard Technologies highlights a concerning trend in phishing attacks, with threat actors leveraging browser-based social engineering strategies. As web browsers have become more adept at preventing pop-up abuse, attackers have shifted their tactics to exploit browser notification features. This enables them to force users into engaging with malicious content. Additionally, the report identifies a new malicious domain involving SEO-poisoning activity, highlighting the evolving techniques employed by cybercriminals.

Nation-State Ties to New Malware

Another significant finding from the report is the strong ties between new malware threats and nation states. WatchGuard’s Threat Lab researchers discovered that three out of the four new threats on the top ten malware list in Q1 2023 were linked to nation-state actors from China and Russia. However, it is important to note that this does not necessarily imply state sponsorship of these malicious activities. One example highlighted in the report is the Zusy malware family, which targets China’s population with adware that compromises browsers and hijacks Windows settings. This demonstrates the increasing sophistication and geopolitical implications of malware attacks.

Persistent Attacks on Office Products and End-of-Life Firewall

The report also reveals a concerning persistence of attacks on Office products, with document-based threats continuing to feature prominently in the most widespread malware list. Additionally, WatchGuard’s Threat Lab observed a relatively high number of exploits targeting Microsoft’s now-discontinued firewall, the Internet Security and Acceleration (ISA) Server. The fact that attackers continue to target an outdated and unsupported security product underscores the importance of comprehensive and up-to-date endpoint protection.

Living-Off-The-Land Attacks on the Rise

Living-off-the-land (LOTL) attacks, which involve leveraging legitimate tools and processes to carry out malicious activities, are on the rise. The report highlights the ViperSoftX malware as a prime example of malware that uses built-in tools from operating systems to achieve its objectives. Microsoft Office- and PowerShell-based malware also continue to be prevalent, emphasizing the need for endpoint protection that can distinguish between legitimate and malicious use of popular tools like PowerShell.

Targeting Non-Windows Systems

While Windows remains the dominant operating system in the enterprise space, the report warns against overlooking the security of non-Windows systems such as Linux and macOS. One notable finding is the detection of a malware dropper specifically targeting Linux-based systems. Organizations must ensure that their security measures, including Endpoint Detection and Response (EDR) solutions, cover all types of operating systems to maintain comprehensive protection.

Zero-Day Malware and Ransomware Threats

Zero-day malware, which exploits vulnerabilities unknown to the developers or users, accounted for the majority of detections in Q1 2023. Alarmingly, a significant portion of these zero-day malware detections occurred over encrypted web traffic. This highlights the increasing sophistication of cyber threats and the need for robust host-based defenses like WatchGuard’s Endpoint Protection Detection and Response (EPDR) solution.

The report also provides insights into ransomware tracking data, revealing that the Threat Lab identified 852 victims published to extortion sites and discovered 51 new ransomware variants in Q1 2023. Some of the victims targeted by these ransomware groups are well-known organizations and companies in the Fortune 500. Ransomware continues to pose a significant threat to businesses of all sizes, necessitating comprehensive security strategies.

Protecting Against Evolving Cyber Threats

Corey Nachreiner, Chief Security Officer at WatchGuard Technologies, emphasizes the importance of continuously evaluating and strengthening security solutions and strategies. In an era of increasingly sophisticated threats, organizations must adopt layered malware defenses to combat living-off-the-land attacks.

Layered Malware Defenses

To effectively mitigate the risks posed by evolving cyber threats, organizations should implement layered malware defenses. This approach combines multiple security measures, such as network security appliances, endpoint protection, and advanced threat intelligence, to create a comprehensive security posture.

Unified Security Platform and Managed Service Providers

WatchGuard Technologies advocates for a unified security platform approach, which is particularly beneficial for managed service providers (MSPs). By leveraging a unified security platform, MSPs can deliver world-class security to their customers while enhancing operational efficiency. The platform should encompass network security and intelligence, advanced endpoint protection, multi-factor authentication, and secure Wi-Fi. Partnering with dedicated managed service providers can simplify security management and ensure round-the-clock protection.

Endpoint Protection and Detection

Given the persistence of attacks on Office products and the rise of living-off-the-land attacks, investing in robust endpoint protection and endpoint detection and response (EDR) solutions is crucial. These solutions can differentiate between legitimate and malicious use of popular tools like PowerShell, providing effective defense against file-based and document-based threats.

Inclusive Security Coverage

Organizations must avoid neglecting non-Windows systems when deploying security measures. The report’s identification of a Linux-based malware dropper serves as a reminder that all operating systems can be targeted. Therefore, organizations should ensure endpoint protection and detection solutions provide comprehensive coverage across different operating systems.

Regular Updates and Patching

To mitigate the risks associated with known vulnerabilities, organizations must prioritize regular software updates and patching. Staying up-to-date with security patches and firmware updates ensures that potential entry points for cybercriminals are minimized.

User Education and Awareness

Improving user education and awareness is another essential aspect of effective cybersecurity. Employees must be trained to recognize and report potential threats, such as phishing attempts. Establishing a culture of cybersecurity within an organization can significantly enhance its resilience against cyber attacks.

Conclusion

The latest Internet Security Report from WatchGuard Technologies sheds light on the rapidly evolving cyber threat landscape. The findings underscore the need for proactive and robust cybersecurity measures, including layered malware defenses, comprehensive endpoint protection and detection, inclusive security coverage, regular updates and patching, and user education and awareness. As cyber threats continue to evolve, organizations must remain vigilant and adapt their security strategies to effectively combat emerging risks.