What is a Fileless Cyberattack?
The Threat that Directly Loads Malicious Code into Memory
Cyber threat actors are constantly developing more and more sophisticated techniques to infect systems. The best-known method is using files that contain and inject malware, sent through systems such as email or via web downloads. However, in recent years the industry has seen a sharp rise in a much more complex form of attack – fileless malware. But what exactly is it?
Instead of installing a malicious application on the victim's hard drive like traditional malware, fileless malware is a threat that directly loads malicious code into memory. It tends to use two entry vectors: either it exploits an existing vulnerability in a program the victim uses or it gets in through a file that’s not installed as such, like a script. Fileless malware often injects its code into the memory of existing programs, which makes it very difficult for conventional antivirus solutions to detect.
If this malware has already managed to get in, EDR solutions enable organizations to reduce detection and response time and therefore recovery time thanks to the post-execution functionalities.
Although these techniques are not that new, there has been exponential growth in cases since 2016 (in fact, the first memory-resident viruses emerged in the 80s). At WatchGuard, we have registered more than 200,000 different malwares originating from scripts since 2020 (compared to less than 50,000 from browsers, which comes second in the entry point ranking). This is an increase of 888% compared to 2019.
These threats include Word DDE (Dynamic Data Execution), which abuses a functionality in Microsoft Office documents to run code on the computer without using macros. But the most prominent fileless cyberattacks are living-off-the-land attacks, such as the famous Astaroth case.
Another example of a LotL attack we investigated recently involved obtaining the victim's SQL Server credentials, triggering a procedure that allows hackers to launch Windows utility PowerShell to then download and execute the malware. These attacks often go undetected, even if you have cybersecurity tools in place. So, how can organizations protect themselves from fileless malware?
Traditional cybersecurity solutions primarily base analysis on signatures of known malware and malware that uses files. Today, they can also detect some anomalous patterns in code structures that may indicate script-based attacks that vary in terms of sophistication.
However, although these tools are constantly updated, they are insufficient when it comes to dealing with the most dangerous and advanced threats such as fileless cyberattacks, or those coming from APT groups that can even take advantage of zero day vulnerabilities that have not yet been discovered.
This is where advanced Endpoint Detection and Response (EDR) solutions come in. In addition to preventing intrusions and detecting advanced malware, they focus on post-execution detection of malware. For this purpose, they start from contextual detections under the zero-trust premise of a proactive search for threats. They also use Threat Hunting services to search for them by correlating and identifying suspicious activities.
Moreover, these solutions perform a thorough inspection of the systems' memory to detect potential code injections and exploits.
This enables the most sophisticated threats, such as fileless attacks, to be detected more easily. But if this malware has already managed to get in, EDR solutions enable organizations to reduce detection and response time and therefore recovery time thanks to the post-execution functionalities. And this is ultimately a key factor in mitigating any damage that malware may have caused to organizations.
If you are looking for more information about what fileless malware is, please contact your AaSys Account Manager today!
|
|
|
|
What Is Endpoint Detection and Response (EDR)? |
Endpoint detection and response (EDR), also known as endpoint threat detection and response (ETDR), is an integrated endpoint security solution that combines real-time continuous monitoring and collection of endpoint data with rules-based automated response and analysis capabilities. The term was suggested by Anton Chuvakin at Gartner to describe emerging security systems that detect and investigate suspicious activities on hosts and endpoints, employing a high degree of automation to enable security teams to quickly identify and respond to threats.
The primary functions of an EDR security system are to:
- Monitor and collect activity data from endpoints that could indicate a threat
- Analyze this data to identify threat patterns
- Automatically respond to identified threats to remove or contain them, and notify security personnel
- Forensics and analysis tools to research identified threats and search for suspicious activities
Adoption of EDR solutions
Adoption of EDR is projected to increase significantly over the next few years. According to Stratistics MRC's Endpoint Detection and Response - Global Market Outlook (2017-2026), sales of EDR solutions—both on-premises and cloud-based—are expected to reach $7.27 billion by 2026, with an annual growth rate of nearly 26%.
One of the factors driving the rise in EDR adoption is the rise in the number of endpoints attached to networks. Another major driver is the increased sophistication of cyberattacks, which often focus on endpoints as easier targets for infiltrating a network.
New types of endpoints and endpoint attacks
An average IT department manages thousands of endpoints across its network. These endpoints include not only desktops and servers, but laptops, tablets, smartphones, internet of things (IoT) devices, and even smart watches and digital assistants. The SANS Endpoint Protection and Response Survey reports that 44% of IT teams manage between 5,000 and 500,000 endpoints. Each of these endpoints can become an open door for cyberattacks; therefore, endpoint visibility is critical.
While today's antivirus solutions can identify and block many new types of malware, hackers are constantly creating more. Many types of malware are difficult to detect using standard methods. For example, fileless malware—a recent development—operates in the computer's memory, thus avoiding malware signature scanners.
Key components of EDR security
EDR security provides an integrated hub for the collection, correlation, and analysis of endpoint data, as well as for coordinating alerts and responses to immediate threats. EDR tools have three basic components:
Endpoint data collection agents. Software agents conduct endpoint monitoring and collect data—such as processes, connections, volume of activity, and data transfers—into a central database.
Automated response. Pre-configured rules in an EDR solution can recognize when incoming data indicates a known type of security breach and triggers an automatic response, such as to log off the end user or send an alert to a staff member.
Analysis and forensics. An endpoint detection and response system may incorporate both real-time analytics, for rapid diagnosis of threats that do not quite fit the pre-configured rules, and forensics tools for threat hunting or conducting a post-mortem analysis of an attack.
- A real-time analytics engine uses algorithms to evaluate and correlate large volumes of data, searching for patterns.
- Forensics tools enable IT security professionals to investigate past breaches to better understand how an exploit works and how it penetrated security. IT security professionals also use forensics tools to hunt for threats in the system, such as malware or other exploits that might lurk undetected on an endpoint.
|
|
|
 |
CFPB Issues Libor Transition Final Rule
On December 7, 2021, the Consumer financial Protection Bureau (“CFPB”) issued a Final Rule to facilitate LIBOR transition via amendments to Regulation Z. The amendments take effect April 1, 2022 and compliance becomes mandatory on October 1, 2022.
The Final Rule makes numerous related amendments to Regulation Z. Broadly speaking, while it does not require covered entities to adopt particular replacement indices for LIBOR, the Final Rule outlines the standards that replacement indices should meet and provides examples to help ensure creditors meet those standards. The CFPB also updated its sample forms and LIBOR Transition FAQs.
With respect to closed-end credit, the rule identifies SOFR-based spread-adjusted indices recommended by the Alternative Reference Rates Committee (“ARRC”) as an example of a “comparable index” for the LIBOR indices that they are intended to replace. The commentary lists factors—such as whether identified aspects of the two indices are comparable and whether the new index is publicly available—to assist creditors in determining whether a replacement index meets Regulation Z standards.
With respect to open-end credit, the Final Rule provides guidance on transitioning away from a LIBOR index on a home equity line of credit (“HELOC”). It identifies examples of replacement indices, such as the Prime Rate published by the Wall Street Journal and the SOFR-based spread-adjusted indices recommended by the ARRC. The rule further includes factors creditors should consider in determining whether a replacement index has historical fluctuations substantially similar to the LIBOR tenor it replaces, as required by Regulation Z. As amended by the Final Rule, Regulation Z also contains revised standards for when credit card issuers may change the index and margin on an existing contract. As with HELOC accounts, a replacement index for a credit card account must meet the historical fluctuation standard. Additionally, a replacement index and margin must result in an annual percentage rate (“APR”) substantially similar to that existing under the replaced index. The rule identifies examples of indices that meet Regulation Z’s standards and provides guidance to assess whether alternate indices are appropriate. It also includes updated guidance on credit card rate reevaluation requirements. Finally, the Final Rule revises disclosure requirements for change-in-terms notices for HELOCs and credit card accounts, now requiring creditors to disclose adjusted margins used to calculate consumers’ rates after LIBOR transition.
What the Final Rule does not do is include references to a 1-year USD LIBOR index and its replacement. The CFPB reserves judgment on that issue until it reviews the index recommended by the ARRC and measures it against the “APR comparison” requirement.
However, on December 7, 2021, the Adjustable Interest Rate (LIBOR) Act of 2021 was introduced into the House of Representatives. The proposed LIBOR Act would mandate a statutory benchmark replacement, spread adjustment, and one-year transition period for “consumer loans” (as defined in the Truth in Lending Act/Regulation Z) that mirror the ARRC recommendations and are incorporated into the Final Rule.
|
|
|
|
A new year is upon us and with it comes many exciting changes. AaSys is pleased to announce that we have made a few internal changes that aim to keep AaSys on the trajectory it has been on: one of success and innovation.
Tony Coleman, who has been AaSys’ President and CEO since it’s inception, has passed on the reins to Cheryl Buntin. Although Tony will no longer be overseeing the everyday workings of the company, we know he will always be close by. Tony will now be AaSys CEO. Cheryl Buntin, who has led the Sales Team for over 20 years is the new AaSys President. With her direction, AaSys is guaranteed to succeed.
In addition, we are also happy to announce that Stuart Wells, whose technical ideas and guidance have been irreplaceable, will now be Executive Vice President.
Congratulations to all and we look forward to an exciting and productive 2022!
|
|
Spot and Stop Messaging Attacks |
What are messaging attacks?
Smishing (a portmanteau word combining SMS and phishing) are attacks that occur when cyber attackers use SMS, texting, or similar messaging technologies to trick you into taking an action you should not take. Perhaps they fool you into providing your credit card details, get you to call a phone number to get your banking information, or convince you to fill out an online survey to harvest your personal information. Just like in email phishing attacks, cyber criminals often play on your emotions to get you to act by creating a sense of urgency or curiosity, for example. However, what makes messaging attacks so dangerous is there is far less information and fewer clues in a text than there is in an email, making it much harder for you to detect that something is wrong.
A common scam is a message telling you that you won an iPhone, and you only need to click on a link and fill out a survey to claim it. In reality, there is no phone and the survey is designed to harvest your personal information. Another example would be a message stating that a package could not be delivered with a link to a website where you are asked to provide information needed to complete delivery, including your credit card details to cover “service charges.” In some cases, these sites may even ask you to install an unauthorized mobile app that infects and takes over your device.
Sometimes cyber criminals will even combine phone and messaging attacks. For example, you may get an urgent text message from your bank asking if you authorized an odd payment. The message asks you to reply YES or NO to confirm the payment. If you respond, the cybercriminal now knows you are willing to engage and will call you pretending to be the bank’s fraud department. They will then try to talk you out of your financial and credit card information, or even your bank account’s login and password.
Spotting and Stopping Messaging Attacks
Here are some questions to ask yourself to spot the most common clues of a messaging attack:
- Does the message create a tremendous sense of urgency attempting to rush or pressure you into taking an action?
- Is the message taking you to websites that ask for your personal information, credit card, passwords, or other sensitive information they should not have access to?
- Does the message sound too good to be true? No, you did not really win a new iPhone for free.
- Does the linked website or service force you to pay using non-standard methods such as Bitcoin, gift cards or Western Union transfers
- Does the message ask you for the multi-factor authentication code that was sent to your phone or generated by your banking app?
- Does the message look like the equivalent of a “wrong number?” If so, do not respond to it or attempt to contact the sender; just delete it.
If you get a message from an official organization that alarms you, call the organization back directly. Don’t use the phone number included in the message, use a trusted phone number instead. For example, if you get a text message from your bank saying there is a problem with your account or credit card, get a trusted phone number on your bank’s website, a billing statement, or from the back of your bank or credit card. Also remember that most government agencies, such as tax or law enforcement agencies, will never contact you via text message, they will only contact you by old fashioned mail.
When it comes to messaging attacks, you are your own best defense.
|
|
2022 Company Holidays
Monday, January 17, 2022 - Dr. Martin Luther King Jr. Day
Monday, February 21, 2022 - President's Day
Monday, May 30, 2022 - Memorial Day
Monday, June 20, 2022 - Juneteenth National Independence Day
Monday, July 4, 2022 - Independence Day
Monday, September 5, 2022 - Labor Day
Monday, October 10, 2022 - Columbus Day
Friday, November 11, 2022 - Veterans Day
Thursday, November 24, 2022 - Thanksgiving Day
Saturday, December 24, 2022 - Christmas Eve Day
Monday, December 26, 2022 - Christmas Day (Observed)
Monday, January 2, 2023 - New Year's Day (Observed)
|
|
AaSys Group, Inc.
11301 North US Highway 301
Suite 106
Thonotosassa, FL 33592
(813) 246-4757 Phone
(813) 246-4576 Fax
|
|
|
|
|
|
|
