WatchGuard Technologies on Wednesday announced the findings of its latest Internet Security Report, detailing the top malware trends and network and endpoint security threats analyzed by WatchGuard Threat Lab researchers. Key findings from the data show a dramatic surge in evasive malware that fueled a large increase of total malware, threat actors targeting on-premises email servers as prime targets to exploit, and ransomware detections continuing to decline, potentially as a result of law enforcement’s international takedown efforts of ransomware extortion groups.
Among the key findings, the latest Internet Security Report featuring data from Q4 2023 showed:
- Evasive, basic, and encrypted malware all increased in Q4, fueling a rise in total malware. The average malware detections per Firebox rose 80% from the previous quarter, illustrating a substantial volume of malware threats arriving at the network perimeter. Geographically, most of the increased malware instances affected the Americas and Asia-Pacific.
- TLS and zero-day malware instances also rise. Approximately 55% of malware arrived over encrypted connections, which was a 7% increase from Q3. Zero-day malware detections jumped to 60% of all malware detections, up from 22% the previous quarter. However, zero-day malware detections with TLS fell to 61%, which was a 10% decrease from Q3, showing the unpredictability of malware in the wild.
- Two top 5 malware variants redirect to DarkGate network. Among the top 5 most-widespread malware detections were JS.Agent.USF and Trojan.GenericKD.67408266. Both variants redirect users to malicious links, and both malware loaders attempt to load DarkGate malware on the victim’s computer.
- A surge in living-off-the-land techniques. Q4 showed a resurgence in script-based threats, as scripts rose the most as an endpoint attack vector, with threats detected increasing 77% from Q3. PowerShell was the top attack vector that the Threat Lab saw hackers use on endpoints. Browser-based exploits also rose significantly, increasing 56%.
- Four of the top 5 most-widespread network attacks were Exchange server attacks. These attacks are specifically associated with one of the ProxyLogon, ProxyShell, and ProxyNotShell exploits. A ProxyLogon signature that first appeared in the top 5 most-widespread network attacks in Q4 2022 at number 4 and rose to number 2 in Q4 2023. These attacks illustrate the need to reduce reliance on on-premises email servers to mitigate security threats.
- Cyberattack commoditization continues, trending toward “victim-as-a-service” offerings. Glupteba and GuLoader were once again counted among the top 10 most prevalent endpoint malware in Q4, making a return as two of the most prolific variants analyzed during the quarter. Glupteba is worth noting as a particularly formidable and sophisticated adversary, due in part to its prevalence targeting victims on a global scale. A multi-faceted malware-as-a-service (MaaS), Glupteba’s malicious capabilities include downloading additional malware, masquerading as a botnet, stealing sensitive information, and mining cryptocurrency with tremendous stealth.
- Takedown efforts stifling ransomware extortion groups. Once again in Q4, the Threat Lab reported a decline in ransomware detections compared to the previous quarter – observing a 20% decrease in overall volume for the last three months of 2023. WatchGuard’s threat analysts also noted a decline in public ransomware breaches and attribute this trend to law enforcement’s ongoing takedown efforts of ransomware extortion groups.
Consistent with WatchGuard’s Unified Security Platform® approach and the WatchGuard Threat Lab’s previous quarterly research updates, the data analyzed in this quarterly report is based on anonymized, aggregated threat intelligence from active WatchGuard network and endpoint products whose owners have opted to share in direct support of WatchGuard’s research efforts.
For a more in-depth view of WatchGuard’s research, download the complete Q4 2023 Internet Security Report here: https://www.watchguard.com/wgrd-resource-center/security-report-q4-2023
Corey Nachreiner, chief security officer at WatchGuard
The Threat Lab’s latest research shows threat actors are employing various techniques as they look for vulnerabilities to target, including in older software and systems, which is why organizations must adopt a defense-in-depth approach to protect against such threats. Updating the systems and software on which organizations rely is a vital step toward addressing these vulnerabilities. Additionally, modern security platforms that are operated by managed service providers can deliver the comprehensive, unified security that organizations need and enable them to combat the latest threats.
