With increased cyber threats, there is great awareness of malware that comes attached in files.  Individuals and businesses invest in security solutions to protect against malware. In fact, there are often company policies regarding opening attachments on emails; yet there is an increase in a type of threat (though not new), known as the fileless malware.

What is Fileless Malware?

A fileless malware attack is a type of threat that doesn’t involve executable files. Instead, these attacks include scripts that run on browsers, command prompts, Windows PowerShell, Windows Management Instrumentation, VBScripts, or Linux (Python, PERL).

In other words, fileless malware is a form of cyberattack carried out through software that already exists on your device, in your authorized protocols and in applications that you have allowed on your device.

As such, fileless malware is becoming a favorite of cybercriminals because they don’t have to look for ways to install malicious files in your device – they only need to take advantage of built-in tools.

Reported examples of fileless malware include PowerGhost, which has been used in crypto-mining and DDoS attacks.

How It Works

First, note that these attacks are termed fileless because they are not file-based; instead, they hide in computer memory.

The malware launches an attack in various ways. For instance, a malicious code is injected in an application already installed or a user clicks on a legitimate-looking link that loads a remote script.

Another scenario exists within a legitimate-looking website that a user visits; the attackers exploit vulnerabilities in the Flash plugin; and a malicious code runs in the browser memory of the user’s computer.

While file-based malware uses executable files, the fileless type hides in areas where it can’t easily be detected, such as the memory. It is then written directly to the RAM (and not the disk), where it carries out a series of events.

Once in your system, the malware piggybacks on legitimate scripts and executes malicious activities while the legitimate program runs. At this point, it performs malicious activities such as payload delivery, escalating admin privileges, and reconnaissance, among others.

Since it works in-memory (RAM), its operations end when you reboot your system. This makes it more challenging to trace attacks. The fileless malware also may work in cohorts with other attack vectors, such as ransomware.

Detection and prevention

Various security vendors claim to have products that can detect fileless threats, as well as protect endpoint systems.

Successful security solutions need to be able to put in place technologies that enable them to inspect different kinds of operating systems storage, as well as analyze in real-time the execution of patterns of processes in a system.

But even so, one thing is certain: traditional anti-malware software will not detect fileless malware because they are not file-based and they do not they leave footprints. Here are some tips that will help mitigate against fileless attacks:

• Regularly update the software on your devices (especially Microsoft applications) to protect against attacks propagated through PowerShell.
• Apply an integrated approach that addresses the entire full threat lifecycle. This is possible when you use a multilayered defense mechanism.  
• Use security solutions that can detect malicious attacks against command prompt (CMD), PowerShell, and whitelisted application scripts.
• Use anti-malware tools that include machine learning, as this will limit scripts from creating new polymorphic malware within your environment.
• Practice behavior monitoring to help lookout for unusual patterns.
• Use memory scanning to help detect patterns of known threats.
• Be on the lookout for high CPU usage by legitimate processes and suspicious error messages that appear for no clear reason.
• Disable PowerShell and Windows Management Instrumentation (WMI) if you are not utilizing them.
• Avoid using macros that have no digital signatures or turn off macros if not being used.
• Use endpoint detection and response tools.

Final Thoughts

The cyber threat landscape keeps evolving. Every day, there are more sophisticated threats as criminals keep advancing to take on countermeasures that have been implemented.

Invest in security solutions that mitigate varying classes of threats, especially machine learning technologies. This will help protect against the latest and emerging threats. Also, keep your Windows OS and other installed software up-to-date to reduce the chances of fileless malware attacks.

Despite taking the mentioned measures, it’s important to stay informed of the latest threats and take necessary precautions.

Most states are starting to relax stay-at-home restrictions. As such, businesses are developing plans for bringing employees back to work. Many businesses are already affected by the pandemic and their future looks grim. Specifically, we are going to look at the IT sector and examine what spending might look like in a post-lockdown economy.

Disruption

The COVID-19 pandemic has resulted in an unprecedented disruption in businesses. As a result, management has tried to reduce costs to survive or risk shutting down. IT departments have suffered the most with major budget cuts due to a reduction in revenue. As a result, non-urgent purchases have been eliminated; initiatives have been suspended; and employees have been terminated.

Of course, technology also has been playing a great role in supporting businesses during the pandemic, especially by enabling work at home and keeping in touch with clients. But there are expectations for major challenges when businesses get back to normal. For instance, the post-coronavirus business world expects travel restrictions, office distancing, business continuity, and pandemic regulations. As for onsite work in the office, challenges will include distributed collaboration, endpoint data protection, scalable administration, and secure access to corporate data.

It also appears that the impact will vary from industry to industry. Companies that depend on face-to-face contact are in danger of lost income and bankruptcy. At the same time, other businesses are thriving.

Consider digital marketing industries. With more businesses moving online, there will be a rise in the purchase of IT-related expenditures such as software. The entertainment sector has found solace in digital platforms, while there is an increase in the work-at-home trend.

The Future

Despite the uncertainties, some predictions can be made.

One thing that is certain is that the impact on IT spending will vary depending on the IT stack. While the infrastructure, branch networking, middleware, and enterprise apps might see a drop, areas such as communication/collaboration, cloud storage, security, and compliance will likely see an increase in spending as more people work remotely.

While the impact on the IT industry will definitely vary, we could see a lot of new innovations. Such innovations might include customer-facing and worker productivity apps. Some companies may increase spending on new innovations to help outperform their competition.

Another factor affecting IT spending is the size of a business. While big businesses may get back to normal after a few months, small businesses have to tread carefully. As such, IT spending for different-sized businesses will not be similar.

A decision to have employees continue working at home means that IT expenditures will take a different shape. While there will be less need for office equipment, there will be an increase in spending to enable offsite work.

There could also be more spending by businesses investing in continuity strategies such as more remote locations, new training in information and communications technology (ICT) and automation of processes.

This also will depend on business operations. Consider a business that had already migrated to the cloud before the COVID-19 pandemic. Such businesses did not suffer much disruption compared to those still using on-premise applications and proprietary data centers. Thus, IT spending for both types of businesses will vary in the future.

Lastly, businesses will want to invest in projects that are likely to provide a return on investment faster.

Conclusion

The disruption to businesses by the COVID-19 pandemic is like none previously encountered. One thing is certain: Things will not bounce back to the known normal. Rather, we should expect a new normal. And, as we have seen through the examination of certain IT expenditures, the success of each industry is dependent on various factors.