Netskope Threat Labs publishes a monthly summary blog post of the top threats we are tracking on the Netskope platform. The purpose of this post is to provide strategic, actionable intelligence on active threats against enterprise users worldwide.
Summary
- Attackers continue to attempt to fly under the radar by using cloud apps to deliver malware, with 61% of all malware downloads in February originating from 161 cloud apps, both six-month highs.
- Malicious plain text files, especially malicious LNK and PowerShell files, are on the rise and accounted for 12% of malware downloads in February, a six-month high.
- Trojans continue to represent the majority of malware downloads, used to deliver payloads such as the infostealers AgentTesla and ClipBanker, and the backdoors Zusy and Farfli.
Cloud Malware Delivery
Attackers attempt to fly under the radar by delivering malicious content via popular cloud apps. Abusing cloud apps for malware delivery enables attackers to evade security controls that rely primarily on domain block lists and URL filtering, or that do not inspect cloud traffic. In February 2023, 61% of all HTTP/HTTPS malware downloads originated from popular cloud apps, increasing for the fourth consecutive month.
The increase in cloud malware downloads is driven partially by an increase in the number of distinct cloud apps from which malware are being downloaded. In February 2023, Netskope detected malware downloads from 161 distinct cloud apps, increasing for the second consecutive month.
Attackers achieve the most success reaching enterprise users when they abuse cloud apps that are already popular in the enterprise. Microsoft OneDrive, the most popular enterprise clo