Who needs malware? IBM says most hackers just PowerShell through boxes now, leaving little in the way of footprints
Direct-to-memory attacks now account for 57 per cent of hacks, apparently
38 
SHARE ▼
SHARE ▼
A company's internal network, once compromised, is now more likely to be
ransacked by automated scripts than a piece of malware.
This according to researchers with IBM's X-Force, who found that in 2018 just 43 per cent of the attacks it analyzed utilized any sort of locally installed files. Rather, the hackers utilized PowerShell scripts to execute their dirty deeds in memory without significantly touching file systems, if at all.
This finding is important because it is another reminder that admins can no longer solely rely on specific file signatures or similar as evidence of a cyber-intrusion. As with local malware infections, the attacker first needs to get the ability to run malicious commands. What differs is the next step, as the miscreant does not direct the infected Windows machine to download, save, and execute a trojan payload.
Rather, the attack runs entirely as commands using PowerShell, where Microsoft's powerful scripting language can be used to do anything from harvest and steal passwords to mine cryptocurrency.
"PowerShell is useful in data collection and analysis, but it is also favored by malicious actors who use it to forego the file system and inject malicious code directly into memory, thus enhancing obfuscation, and often evading security controls designed to detect malware deployments," the IBM report reads.
"Threat actors of all skill levels have expanded their capabilities using PowerShell over the last few years. IBM X-Force IRIS has seen cases wherein complete malicious toolkits were contained within PowerShell scripts."
In some cases, crooks wouldn't even need to run a super-leet exploit to steal corporate data. The X-Force report notes that misconfiguration incidents – instances where databases and storage buckets were left exposed to the public-facing internet – were also up 20 per cent from last year and accounted for 43 per cent of all of the exposed records X-Force tracked last year.
In addition to the exposed files and records themselves, misconfigurations could also indirectly lead to other attacks when things like passwords and email addresses are involved and used to login to other accounts on other services to carry out further mischief.
Finally, the report found, the tried and true social engineering attack remains as effective as it has ever been.
Last year, IBM found that 29 per cent of the attacks it analyzed were phishing attacks, and 45 per cent of those were targeted attacks on specific employees, something X-Force terms the business email compromise.
"When it comes to the most lucrative types of social engineering scams, BEC has been a growing tide for several years spanning all industries and geographies," notes X-Force.
It seems that, despite the various methods for sophisticated attacks, a bogus "CEO" email demanding a wire transfer is still a foolproof way to con a company out of cash. ®
This according to researchers with IBM's X-Force, who found that in 2018 just 43 per cent of the attacks it analyzed utilized any sort of locally installed files. Rather, the hackers utilized PowerShell scripts to execute their dirty deeds in memory without significantly touching file systems, if at all.
This finding is important because it is another reminder that admins can no longer solely rely on specific file signatures or similar as evidence of a cyber-intrusion. As with local malware infections, the attacker first needs to get the ability to run malicious commands. What differs is the next step, as the miscreant does not direct the infected Windows machine to download, save, and execute a trojan payload.
Rather, the attack runs entirely as commands using PowerShell, where Microsoft's powerful scripting language can be used to do anything from harvest and steal passwords to mine cryptocurrency.
"PowerShell is useful in data collection and analysis, but it is also favored by malicious actors who use it to forego the file system and inject malicious code directly into memory, thus enhancing obfuscation, and often evading security controls designed to detect malware deployments," the IBM report reads.
"Threat actors of all skill levels have expanded their capabilities using PowerShell over the last few years. IBM X-Force IRIS has seen cases wherein complete malicious toolkits were contained within PowerShell scripts."
In some cases, crooks wouldn't even need to run a super-leet exploit to steal corporate data. The X-Force report notes that misconfiguration incidents – instances where databases and storage buckets were left exposed to the public-facing internet – were also up 20 per cent from last year and accounted for 43 per cent of all of the exposed records X-Force tracked last year.
In addition to the exposed files and records themselves, misconfigurations could also indirectly lead to other attacks when things like passwords and email addresses are involved and used to login to other accounts on other services to carry out further mischief.
Finally, the report found, the tried and true social engineering attack remains as effective as it has ever been.
Last year, IBM found that 29 per cent of the attacks it analyzed were phishing attacks, and 45 per cent of those were targeted attacks on specific employees, something X-Force terms the business email compromise.
"When it comes to the most lucrative types of social engineering scams, BEC has been a growing tide for several years spanning all industries and geographies," notes X-Force.
It seems that, despite the various methods for sophisticated attacks, a bogus "CEO" email demanding a wire transfer is still a foolproof way to con a company out of cash. ®
