Fileless Attacks Jump 94% in First Half of 2018

While ransomware is still popular, fileless and PowerShell attacks are the threats to watch this year.

A snapshot of the threat landscape from the first half of 2018 shows fileless and PowerShell attacks are the ones to worry about this year, security analysts report.
Endpoint security firm SentinelOne today published its H1 2018 Enterprise Risk Index Report, which shows fileless-based attacks rose by 94% between January and June. PowerShell attacks spiked from 2.5 attacks per 1,000 endpoints in May 2018 to 5.2 attacks per 1,000 endpoints in June. Ransomware remains popular, ranging from 5.6 to 14.4 attacks per 1,000 endpoints.
The rise of fileless and PowerShell attacks wasnt a major surprise to Aviram Shmueli, SentinelOnes director of product management and leader of this report, who says the two are especially appealing to threat actors who want to fly under their targets radar.
Fileless attacks are more sophisticated; they dont leave any trace, he explains, adding that these types of threats are increasingly common in user data. The PowerShell spike tells us PowerShell [attacks] are here to stay, Shmueli says. Fileless, lateral movement, and document attacks made up 20% of all attacks analyzed in the report.
Fileless and PowerShell attacks are powerful, and attackers can leverage either to do significant damage, he says. Its worth noting the two can overlap: PowerShell lets actors access internal components and can be fileless in nature, enabling them to evade detection.
This report
isnt the only one pointing to the popularity of PowerShell among cyberattackers. Earlier this year, McAfee
published
findings indicating a 267% spike in fileless malware samples spreading PowerShell in the fourth quarter of 2017 alone, compared with the same time period one year prior.
When it comes to which threat is easier to execute, Shmueli says PowerShell might be the more accessible option. PowerShell is already installed on Windows systems, so attackers can rely on the fact that its already there without installing anything else, he adds. This is why we believe attackers choose to use this vector so frequently.
However, the simultaneous increase in fileless attacks indicates threat actors are becoming more sophisticated and turning toward advanced forms of cybercrime. Its becoming less difficult for them to create payloads that wont get caught, complicating defense for targets.
Researchers investigated the drivers behind the recent spikes in fileless and PowerShell attacks but couldnt point to a specific reason driving the increase. This seems to be more of an overall growing trend than a spike related to a particular campaign.
While all three threat vectors are popular, Shmueli says companies should be most cautious about fileless campaigns. The 2018 spike was preceded by an incremental rise in fileless malware that is likely to continue.
I believe that we will see a growing number of fileless attacks and PowerShell attacks, he adds. As for ransomware, hes not so sure. The trend is not so constant, he admits. SentinelOne will continue to release these types of reports on a quarterly basis.
Related Content:
Why Security Needs a Software-Defined Perimeter
7 Serious IoT Vulnerabilities
WhatsApp: Mobile Phishings Newest Attack Target
Iranian Hackers Target Universities in Global Cyberattack Campaign

Black Hat Europe returns to London Dec 3-6 2018 with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions and service providers in the Business Hall. Click for information on the
conference
and
to register.

Last News
▸ ArcSight prepares for future at user conference post HP acquisition. ◂ Discovered: 07/01/2025 Category: security	▸ Samsung Epic 4G: First To Use Media Hub ◂ Discovered: 07/01/2025 Category: security	▸ Many third-party software fails security tests ◂ Discovered: 07/01/2025 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Fileless Attacks Jump 94% in First Half of 2018