Netskope Threat Labs publishes a monthly summary blog post of the top threats we are tracking on the Netskope platform. The purpose of this post is to provide strategic, actionable intelligence on active threats against enterprise users worldwide.

Summary

• A high number of Sliver framework payloads were found in the month of December. Sliver is a highly customizable C2 Framework used by red teamers, pen testers, and threat actors. The payload is usually used as a post-exploitation tool and gives full control of the machine to the attacker.
• Attackers continue to attempt to fly under the radar by using cloud apps to deliver malware, with 46% of all malware downloads in December originating from 164 cloud apps.
• A big variety of malwares were among the top malware families detected on the Netskope platform in December. Malware families such as the Infostealer AgentTesla, the AdWind RAT and also AvosLocker and Clop Ransomware were among the list.

Cloud Malware Delivery

Attackers attempt to fly under the radar by delivering malicious content via popular cloud apps. Abusing cloud apps for malware delivery enables attackers to evade security controls that rely primarily on domain block lists and URL filtering, or that don’t inspect cloud traffic. In December 2023, 46% of all HTTP/HTTPS malware downloads originated from popular cloud apps, the lowest value of the past six months.

The total number of cloud apps from which malware downloads originated in the month of December was 164 distinct cloud apps. Although this number is slightly smaller than the previous month, it is still the third-highest value we have observed in the past six months. 

Attackers achieve the most success reaching enterprise users when they abuse cloud apps that are already popular in the enterprise. Microsoft OneDrive, the most popular enterprise cloud app, has again held the top spot for the most cloud malware downloads, which it has for more than six months. 

The top ten apps remained largely unchanged including hosting apps like Sharepoint, free software hosting sites (GitHub), cloud storage apps (Google Drive) and email services like Microsoft Live Outlook. The top ten list is a reflection of attacker tactics, user behavior, and company policy.

Top Malware Families

Attackers are constantly creating new malware families and new variants of existing families, either as an attempt to bypass security solutions or to update their malware’s capabilities. In December 2023, 57% of all malware downloads detected by Netskope were either new families or new variants that had not been observed in the preceding six months. The other 43% were samples that had been previously observed during the preceding six months and are still circulating in the wild.

The following list contains the top malware and ransomware families blocked by Netskope in December 2023:

• Backdoor.Sliver is an open source Command and Control (C2) framework written in Golang. Similar to Cobalt Strike, the Sliver C2 framework is a useful tool to be used in post-exploitation activities due to the high number of features it contains. Once a machine is infected with Sliver the attacker would have full control of the system. The framework payloads support actions like information gathering, file download and upload, shell commands execution, payload encryption and obfuscation, persistence, and more. If this threat is found in an environment there’s a high chance of further malicious activities such as ransomware infections. Details
• Backdoor.Zusy (a.k.a. TinyBanker) is a banking Trojan based on the source code of Zeus, aiming to steal personal information via code injection into websites. Details
• Downloader.BanLoad is a Java-based downloader widely used to deliver a variety of malware payloads, especially banking Trojans. Details
• Infostealer.AgentTesla is a .NET-based remote access Trojan with many capabilities, such as stealing browsers’ passwords, capturing keystrokes, clipboard, etc. Details
• Phishing.PhishingX is a malicious PDF file used as part of a phishing campaign to redirect victims to a phishing page.
• RAT.AdWind is a RAT that can perform actions such as log keystrokes, collect sensitive information, download and run other payloads, and more. Details
• Ransomware.Clop is a Ransomware that is reportedly associated with malware like Raspberry Robin and groups like TA505. Details
• Ransomware.AvosLocker is a ransomware-as-a-service (RaaS) gang that first appeared in mid-2021. It has since become notorious for its attacks targeting critical infrastructure in the United States, including the sectors of financial services, critical manufacturing, and government facilities. Details
• Trojan.Razy is a Trojan typically distributed via malicious ads disguised as legitimate software, often used to steal cryptocurrency data. Details
• Trojan.Valyria (a.k.a. POWERSTATS) is a family of malicious Microsoft Office Documents that contain embedded malicious VBScripts, usually to deliver other malicious payloads. Details

Recommendations

Attackers have always sought to evade detection and avoid suspicion in delivering malware. Two strategies that attackers have been using increasingly in the past six months are to deliver malware by abusing cloud apps and to package malware in PDF files. Netskope Threat Labs recommends that you review your security posture to ensure that you are adequately protected against both of these trends:

• Inspect all HTTP and HTTPS downloads, including all web and cloud traffic, to prevent malware from infiltrating your network. Netskope customers can configure their Netskope NG-SWG with a Threat Protection policy that applies to downloads from all categories and applies to all file types.
• Ensure that your security controls recursively inspect the content of popular archive files such as ZIP files for malicious content. Netskope Advanced Threat Protection recursively inspects the content of archives, including ISO, TAR, RAR, 7Z, and ZIP.
• Ensure that high-risk file types like executables and archives are thoroughly inspected using a combination of static and dynamic analysis before being downloaded. Netskope Advanced Threat Protection customers can use a Patient Zero Prevention Policy to hold downloads until they have been fully inspected.
• Configure policies to block downloads from apps that are not used in your organization to reduce your risk surface to only those apps and instances that are necessary for the business.
• Block downloads of all risky file types from newly registered domains and newly observed domains.

In addition to the recommendations above, Remote Browser Isolation (RBI) technology can provide additional protection when there is a need to visit websites that fall in categories that present higher risk, like Newly Observed and Newly Registered Domains.

About This Report

Netskope provides threat and data protection to millions of users worldwide. Information presented in this report is based on anonymized usage data collected by the Netskope Security Cloud platform relating to a subset of Netskope customers with prior authorization. This report contains information about detections raised by Netskope’s Next Generation Secure Web Gateway (SWG), not considering the significance of the impact of each individual threat. Stats in this report are based on the period starting June 1, 2022 through December 31, 2023. Stats are a reflection of attacker tactics, user behavior, and organization policy.