FilelessMalwareAttacks
21
May

Fileless Malware Attacks: How to Identify and Defend Against Them

Reading Time: 4 minutes

An antivirus can serve as excellent protection against an outside bug disrupting your computer processes. However, there are some forms of digital threats that your antivirus can’t find, such as fileless malware.

Fileless malware is not some new alien technology. While you may not have heard the name, chances are that you may have one of these bugs sitting in your computer stealing your data, and your antivirus never detected it. When the topic of discussion is fileless malware, it is safe to say traditional antivirus software are not as effective as they used to be because digital threats have far evolved beyond “signatures.”

Trend Micro reported that 2019 saw a 256% growth in the rise of fileless events. Recent examples of this attack includes the hack of the Democratic National Committee and the Equifax breach. Fileless malware evade traditional means of attack, using your system software and applications to execute malicious activities.

At this point, you might be asking whether there are ways to be prepared against fileless malware, attacks. There are, and this blog will dive into just what defense measures you can undertake.

What Is Fileless Malware?

Fileless malware is a cyberattack that differs from all other malicious threats in that it’s a memory-based threat rather than a file-based threat. The malware hides in your computer and uses legitimate preinstalled software to run in your computer and infect it.

This way, you have no clue it is even there. Being a memory-based threat, it does not even leave any footprint or signature like other threats.

Antiviruses scan for the signature of the bugs in your computer to neutralize the threat. In the case of fileless malware, there is no footprint left on the disk. These digital threats go undetected as a result, leaving your system infected.

During the high-profile Code Red Worm attack in 2001, the head of the Kaspersky Antivirus research lab, Eugene Kaspersky, commented:

“We predict that in the very near future, such ‘fileless’ worms as Code Red will become one of the most widespread forms of malicious programs, and an antivirus’ ineffectiveness in the face of such a threat simply invites danger.”

What’s surprising is that the user does not need to download any malicious file or malware to infect the system with fileless malware. Hackers instead exploit known vulnerabilities in a preinstalled Windows program and insert their malicious code into the vulnerable program. The script then runs in the main memory, bypassing all firewalls and antivirus. It does not leave any trace, signature, or a “file” of its execution in the memory, giving rise to the name fileless malware. The antivirus software or security analysts are not able to detect what happened.

How Does Fileless Malware Work?

Fileless malware is a great danger to your organization as it does not need to copy bugs from outside into the system. It could already be hiding in vulnerabilities exploited by hackers in the old software, making it imperative to always keep your software up to date.

The malware’s mysterious nature is what makes it so challenging to detect. Interacting with a malicious link or malicious sites can leave your system infected. Some scenarios where a fileless malware could dupe you are:

  • Through Windows Management Instrumentation (WMI) and Microsoft PowerShell

While legitimate programs run normal processes, fileless malware piggybacks on the program remotely. Running along with a trusted program makes it challenging for security analysts to catch the malware. In the PowerShell attack, while the PowerShell runs normal processes, the fileless malware embeds malicious script into the PowerShell legitimate script.

  • Through Microsoft Word or JavaScript

Hackers inject malicious code into preinstalled, legitimate applications, and when these programs are run, the hacker hijacks the program and executes the malicious code, infecting your system.

  • Phishing emails, malicious downloads, and risky links

If you click on a suspicious link, it loads in your computer’s memory. Hackers use this to their advantage. By exploiting these vulnerabilities, they run and execute their malicious code directly in the memory of your system. These remotely managed codes capture and share your confidential data with the hacker.

  • Lateral infiltration

Hackers are not just motivated to gain access to PowerShell and Word. Once they compromise the system, they move on to the network to target other systems and compromise the whole network.

  • Malicious websites that look legitimate

Hackers create a legitimate-looking website so that victims think these websites are genuine business pages. These websites look for a vulnerability in your Flash plugin, which can be hijacked and will allow malicious code to run in the browser memory.

Ways to Protect Your Organization from Fileless Malware

When 93% of fileless malware is more threatening than other cyberattacks, it is necessary to take appropriate steps to catch this undetectable malware. Here are some precautions to take against fileless malware to provide a systematic security approach that should minimize your organization’s risk against fileless malware:

  • Disable PowerShell and WMI if you do not use them.
  • Install all the latest Windows updates, especially security updates.
  • Check if your installed software is patched and fixed to the latest updates.
  • Disable macros in MS Word and Excel if you are not using them.
  • It is advisable to monitor an unregulated amount of data leaving the network regularly. It could be a hacker stealing your system’s data.
  • Update your browser regularly.
  • Always be extra careful downloading malicious attachments from phishing emails. These could be hackers trying to dupe you.
  • Use an antivirus which can scan your computer’s memory and block malicious scripts and websites from hosting an attack.

To fight this attack, you need a computer forensic expert with the required industry expertise. With the proper training and experience, a forensic expert can identify and neutralize malicious scripts running in your system’s background. It would be wise for organizations and security enthusiasts alike to get a Computer Hacking Forensic Investigator Certification (CHFI) to save your system from malicious threats like fileless malware in the future.

 

References:

  1. https://www.trendmicro.com/en_ie/about/newsroom/press-releases/2019/trend-micro-report-reveals-265-growth-fileless-events.html
  2. https://web.archive.org/web/20010828141009/http://www.kaspersky.com/news.asp?tnews=0&nview=8&id=214&page=0
  3. https://blog.eccu.edu/most-common-malware-attacks-fileless-malware-part-2/
  4. https://twitter.com/ECCOUNCIL/status/1207592407132463104

FAQs

How does fileless malware work?
Unlike traditional malware, fileless malware works in memory. It does not create a file or leave behind any signature after the reboot. The malicious content never touches the disk, and the malware piggybacks on legitimate software and executes the malicious script directly in the memory.

Read more: Fileless Malware: Understanding the Invisible Cyberattack

What is a fileless attack?
A fileless malware attack is a type of attack in which hackers do not need to install malicious software in the system. The hacker can leverage preinstalled, trusted software to hijack and execute malicious code to compromise the system.
get certified from ec-council
Write for Us