Netskope Threat Labs publishes a monthly summary blog post of the top threats we are tracking on the Netskope platform. The purpose of this post is to provide strategic, actionable intelligence on active threats against enterprise users worldwide.
Summary
- Attackers continue to attempt to fly under the radar by using cloud apps to deliver malware, with 60% of all malware downloads in May originating from a record 177 cloud apps.
- While malicious PE (EXE/DLL) files are still the most common malware file type, malicious PDF files rose to become the second most common, with a rise in malicious PDFs downloaded from free hosting services Squarespace and Weebly and document sharing service DocPlayer, among other sources.
- The Rhysida ransomware emerged in May, claiming to be doing their victims a favor by compromising their systems and demanding a ransom payment.
Cloud Malware Delivery
Attackers attempt to fly under the radar by delivering malicious content via popular cloud apps. Abusing cloud apps for malware delivery enables attackers to evade security controls that rely primarily on domain block lists and URL filtering, or that do not inspect cloud traffic. In May 2023, 60% of all HTTP/HTTPS malware downloads originated from popular cloud apps, nearing the all-time high we saw in February.
The number of cloud apps from which the downloads originated also increased, reaching a new monthly record of 177 apps, beating the February record by more than 20 apps.