close
close
Your Network of Tomorrow
Your Network of Tomorrow
Plan your path toward a faster, more secure, and more resilient network designed for the applications and users that you support.
          Experience Netskope
          Get Hands-on With the Netskope Platform
          Here's your chance to experience the Netskope One single-cloud platform first-hand. Sign up for self-paced, hands-on labs, join us for monthly live product demos, take a free test drive of Netskope Private Access, or join us for a live, instructor-led workshops.
            A Leader in SSE. Now a Leader in Single-Vendor SASE.
            A Leader in SSE. Now a Leader in Single-Vendor SASE.
            Netskope debuts as a Leader in the Gartner® Magic Quadrant™ for Single-Vendor SASE
              Securing Generative AI for Dummies
              Securing Generative AI for Dummies
              Learn how your organization can balance the innovative potential of generative AI with robust data security practices.
                Modern data loss prevention (DLP) for Dummies eBook
                Modern Data Loss Prevention (DLP) for Dummies
                Get tips and tricks for transitioning to a cloud-delivered DLP.
                  Modern SD-WAN for SASE Dummies Book
                  Modern SD-WAN for SASE Dummies
                  Stop playing catch up with your networking architecture
                    Understanding where the risk lies
                    Advanced Analytics transforms the way security operations teams apply data-driven insights to implement better policies. With Advanced Analytics, you can identify trends, zero in on areas of concern and use the data to take action.
                        The 6 Most Compelling Use Cases for Complete Legacy VPN Replacement
                        The 6 Most Compelling Use Cases for Complete Legacy VPN Replacement
                        Netskope One Private Access is the only solution that allows you to retire your VPN for good.
                          Colgate-Palmolive Safeguards its "Intellectual Property” with Smart and Adaptable Data Protection
                          Colgate-Palmolive Safeguards its "Intellectual Property” with Smart and Adaptable Data Protection
                            Netskope GovCloud
                            Netskope achieves FedRAMP High Authorization
                            Choose Netskope GovCloud to accelerate your agency’s transformation.
                              Let's Do Great Things Together
                              Netskope’s partner-centric go-to-market strategy enables our partners to maximize their growth and profitability while transforming enterprise security.
                                Netskope solutions
                                Netskope Cloud Exchange
                                Netskope Cloud Exchange (CE) provides customers with powerful integration tools to leverage investments across their security posture.
                                  Netskope Technical Support
                                  Netskope Technical Support
                                  Our qualified support engineers are located worldwide and have diverse backgrounds in cloud security, networking, virtualization, content delivery, and software development, ensuring timely and quality technical assistance
                                    Netskope video
                                    Netskope Training
                                    Netskope training will help you become a cloud security expert. We are here to help you secure your digital transformation journey and make the most of your cloud, web, and private applications.

                                      Why Organisations Must Get to Grips With Cloud Delivered Malware

                                      Feb 28 2023

                                      Netskope has just published the Monthly Threat Report for February, with this month’s report focused on what is going on in  Europe. I don’t intend to summarise the report in this blog, instead I want to zoom in and  study a continuing trend that was highlighted in there; one that is unfortunately heading in the wrong direction. 

                                      The trend I am referring to is the shift from web hosting of malware (usually via compromised websites) to the hosting of malware in cloud apps (including popular collaboration and file sharing services). This approach has been a common method used for targeted attacks for some time. However, both globally and across Europe, we witnessed a milestone in December 2022. For the first time, cloud-hosted malware became the most prominent hosting method, overtaking general web-hosting.  In the past 12 months, the popularity of cloud malware delivery in Europe has risen from 33%of all malware in to 53%, a greater increase than that seen globally (a 20% hike in Europe, and a 12% hike globally).

                                      The reason? Attackers can stay somewhat under the radar by delivering malicious content via popular cloud apps and they have now learnt how to do this at scale. Abusing cloud apps for malware delivery enables attackers to evade security controls that rely primarily on domain block lists and URL filtering. Furthermore, many organisations whitelist common collaboration services, to avoid advanced detection tools slowing down access. . 

                                      Over the last 12 months, a third of cloud delivered malware detected by Netskope was hosted in Microsoft services, with Github, Amazon S3, and Sourceforge also being popular hosting locations–all services that most organisations would not block.

                                      Now, more so than ever before, organisations need to consider how to deal with this increasing risk exposure. Part of the answer is of course using best of breed endpoint detection, but we must look at this earlier in the attack chain if we want to reduce our risk exposure. 

                                      Organisations should make sure that they have a web and cloud filtering tool that:

                                      1. Offers instance awareness-a filter that can understand the difference between access to a corporate OneDrive instance, a business partner OneDrive instance or a personal or other third party instance. 
                                      1. Provides full SSL decryption and analysis of ALL SaaS app traffic.
                                      1. Can understand the language used by today’s SaaS apps and be able to identify the action being undertaken by a user (JSON and API)
                                      1. Provides a zero trust-based access policy, designed to allow the user to only complete actions needed to complete their task and nothing more. 
                                      1. Can undertake this deep analysis, including malware scanning and SSL decryption without impacting the user experience.  Ideally it offers processing latency SLAs encompassing all the aspects referenced above. 

                                      All too often organisations make life easy for the threat actors by allowing blanket access to SaaS apps, especially those that are officially selected and managed by the organisation. But why allow access to ALL OneDrive accounts, why allow users to download files from third-party stores, when they typically do not need this level of access to complete day to day tasks?

                                      It is time for organisations to take steps to block and detect such threats earlier in the attack chain, before it even hits the endpoint. Here at Netskope, we work with organisations to help them reduce risk, accelerate performance, and get unrivalled visibility into any cloud, web, and private application activity, day in and day out. It’s just one of the reasons why Netskope’s Security Service Edge platform is the choice of many of the world’s largest organisations. 

                                      Our February 2023 Threat Report is available here and or you can read a summary of the January threat landscape here

                                      author image
                                      Richard Davis
                                      Richard Davis is Director, Solution Strategy at Netskope. Davis is a seasoned cybersecurity professional with over 20 years’ experience.
                                      Richard Davis is Director, Solution Strategy at Netskope. Davis is a seasoned cybersecurity professional with over 20 years’ experience.

                                      Stay informed!

                                      Subscribe for the latest from the Netskope Blog