Evasive malware grew to record high levels in 2019; over two-thirds of malware detected by WatchGuard in Q4 2019 evaded signature-based antivirus solutions, says a new report. 

Obfuscated or evasive malware is becoming the rule, not the exception, and companies of all sizes desperately need to deploy advanced anti-malware solutions that can detect and block these attacks, says WatchGuard in its new Internet Security Report for Q4 2019. 

In addition, WatchGuard found widespread phishing campaigns exploiting a Microsoft Excel vulnerability from 2017. This ‘dropper’ malware downloads several other types of malware onto victims’ systems, including a keylogger named Agent Tesla that was also used in phishing attacks in February 2020 that preyed on fears of a coronavirus outbreak.

“Our findings from Q4 show that threat actors are always evolving their attack methods,” said Corey Nachreiner, chief technology officer at WatchGuard. “With over two-thirds of malware in the wild obfuscated to sneak past signature-based defenses, and innovations like Mac adware on the rise, businesses of all sizes need to invest in multiple layers of security. Advanced AI or behavioral-based anti-malware technology and robust phishing protection like DNS filtering will be especially crucial.”

Here are the key findings from the Q4 2019 report:

  • Evasive malware made up 68% of total malware in Q4 2019 – This is a dramatic increase from the year-long average of 35% for 2019. WatchGuard UTM appliances have three anti-malware services; a signature-based antivirus, a machine-learning detection engine called IntelligentAV and a behavioral-based solution called APT Blocker. Malware is considered to be evasive when it makes it through the signature-based AV but is caught by one of the other two.  
  • Microsoft Excel exploit still being heavily used – A vulnerability from 2017, this exploit was number seven on WatchGuard’s top ten malware list, and targeted Great Britain, Germany and New Zealand heavily. It is delivered via a phishing attack and exploits macros to download and install other types of malware including keyloggers like Agent Tesla and trojans like Razy.
  • Analysis of the Agent Tesla keylogger used in coronavirus phishing attacks – WatchGuard’s report includes an analysis of the Agent Tesla keylogger used in phishing attacks in February 2020 that aimed to manipulate fears around the coronavirus. Agent Tesla is one of several pieces of malware delivered via the aforementioned Microsoft Excel dropper malware.
  • Mac adware jumps in popularity in Q4 – One of the top compromised websites WatchGuard detected in Q4 2019 hosts a macOS adware called Bundlore that masquerades as an Adobe Flash update. This lines up with a MalwareBytes report from February 2020 that showed a rise in Mac malware, particularly adware.
  • SQL injection attacks became the top network attack in 2019 – SQL injection attacks rose an enormous 8000% in total between 2018 and 2019, becoming the most common network attack of the year by a significant margin.
  • Hackers increasingly using automated malware distribution – Many attacks hit 70 to 80 percent of all Fireboxes in a single country, suggesting attackers are automating their attacks more frequently.

The findings included in WatchGuard’s Internet Security Report are drawn from anonymized Firebox Feed data from active WatchGuard UTM appliances whose owners have opted in to share data to support the Threat Lab’s research efforts. Today, over 40,000 appliances worldwide contribute threat intelligence data to the report. In Q4 2019, they blocked over 34,500,000 malware variants in total (859.5 samples per device) and approximately 1,879,000 network attacks (47 attacks per device).