New attack vectors make securing virtual companies even more challenging

As organizations are settling into long-term remote working, new attack vectors for opportunistic cyberattackers—and new challenges for network administrators have been introduced, Nuspire reveals.

Now six months into the pandemic, attackers pivoted away from COVID-19 themes, instead utilizing other prominent media themes like the upcoming U.S. election to wreak havoc.

Increase in both botnet and exploit activity

There was an increase in both botnet and exploit activity over the course of Q2 2020 by 29% and 13% respectively—that’s more than 17,000 botnet and 187,000 exploit attacks a day.

While attackers targeted remote work technology at the source to obtain access to the enterprise in Q1 2020, there was a shift in tactics to leverage botnets to obtain a foothold in the network. Home routers typically are not monitored by IT teams therefore have become a viable attack method that avoids detection while infiltrating corporate networks.

“Today, the pandemic has complicated an already complex threat landscape. CISOs are under great pressure to ensure their virtual organizations are secure,” said Lewie Dunsworth, CEO of Nuspire.

“Threat vectors will continue to evolve as the uncertainty of our world continues to play out. That’s why our team analyzes the latest threat intelligence daily and uses this data to engage in proactive threat hunting and response to ensure our clients have the upper hand.”

Additional findings

• The ZeroAccess botnet made a resurgence in Q2, coming in second for most used botnet. ZeroAccess was originally terminated in 2013 but has made rare resurgences over the last seven years.
• There was a significant spike (1,310% peak mid-quarter) in exploit attempts against Shellshock, an exploit discovered in 2014, demonstrating that attackers attempt to exploit old vulnerabilities to catch old operating systems and unpatched systems.
• A new signature, dubbed MSOffice Sneaky that was released during Q2 has been identified. Documents containing malicious macros that reach out to command and control servers to download a malware of the attackers choosing. This attack vector is increasingly dangerous, especially when remote employees disconnect from their VPN.
• DoublePulsar, the exploit developed by the NSA, continues to dominate the exploit chart, consisting of 72% of all exploit attempts witnessed at Nuspire.