Netskope
Threat Labs Report:
Asia 2024

Each month, 2.3% of users in Asia attempt to access malicious content on the web or in the cloud and are blocked from doing so by Netskope Advanced Threat Protection engines. This is roughly twice the rate of other regions, including nearby Australia. The malicious content takes multiple forms, including malicious JavaScript content that the browser executes and malware downloads that infect the host OS. The following is a list of the top four malware families detected in Asia over the past year. Dominated by JavaScript-based downloaders and traffic direction systems.

• Downloader.Nemucod is a JavaScript downloader that has previously delivered Teslacrypt.
• Downloader.SLoad (a.k.a Starslord) is a downloader often used to deliver Ramnit.
• Trojan.FakeUpdater (a.k.a. SocGholish) is a JavaScript downloader that delivers various payloads, including Dridex and Azorult.
• Trojan.Parrottds is a JavaScript-based traffic direction system that has been used to redirect traffic to various malicious locations since 2019.

Delivering malware using popular cloud apps is a technique adversaries use to fly under the radar. Each month, 86% of organizations have users attempting to download malware from cloud apps. While the downloads come from hundreds of apps, the chart below presents the top five apps in terms of the percentage of organizations that see malware downloaded from the app monthly. GitHub is at the top because it is used to host a variety of hacktools. Google Drive and OneDrive follow closely behind because they are ubiquitous cloud storage apps widely used in the enterprise. Adversaries attempt to exploit the familiarity end users have with these apps to deliver malware. Other top apps include Amazon S3 and Box for similar reasons: attackers can easily host files there and hope to exploit the familiarity factor. The numbers indicate that this familiarity effect is real, as the apps leading the pack are those with which users are most familiar.

Netskope Threat Labs tracks adversaries actively targeting Netskope customers to understand their motivations, tactics, and techniques, so that we can build better defenses against them. We generally categorize adversary motivations as either criminal or geopolitical. The three top adversary groups targeting organizations in Asia over the past year were criminal groups based in China and Russia.