WatchGuard Technologies last week announced findings from its most recent quarterly Internet Security Report, detailing the top malware trends and network security threats analyzed by WatchGuard Threat Lab researchers.
Of note, researchers found a record number of evasive malware detections. Advanced threats increased by 33% indicating a higher level of zero day threats than ever before. Network detections also continued an upward trajectory, with the Americas receiving the majority of attacks.
Other key findings from this Internet Security Report, which analyzes data from Q4 2021, include:
- – Total network attack detections continue to climb, highlighting the complexity of network security – The trajectory of network intrusion detections continued its upward climb with the largest total detections of any quarter in the last three years. This also represented a 39% increase quarter over quarter. This may be due to the continued targeting of old vulnerabilities as well as the growth in organizations’ networks; as new devices come online and old vulnerabilities remain unpatched, network security is becoming more complex.
- Malware threats were detected in EMEA at a much higher rate than other regions in the world – Europe, the Middle East and Africa were also the regions most targeted by malware threats in Q4. In fact, EMEA saw malware detections per Firebox (49%) at near or above double the rate as other regions of the world (AMER 23% and APAC 29%).
- – 78% of malware delivered via encrypted connections is evasive – Overall, 67% of malware detections arrived over an encrypted connection, and within those malware detections, 78% were evasive zero-day malware threats that evade basic detections. This continues a trend seen in previous quarters. These threats can often be stopped at the perimeter by setting firewalls to decrypt and scan incoming traffic – a step that, unfortunately, many organizations fail to take.
- – A new leader in Office exploit malware emerges – Q4 saw a significant incidence of malware targeting Office documents, similar to findings from Q3. CVE-2018-0802 remains on the top 10 malware list, landing at number 5 this quarter, up one spot from last quarter, and remains on the most widespread malware list. Researchers suspect this may have replaced CVE-2017-11882 as the top Office exploit.
- Emotet comes back with a vengeance – Two new malware domains were added this quarter to the list of top malware domains detected by WatchGuard. One of these domains, Skyprobar[.]info, has been linked to Emotet, the banking trojan that has evolved into a C2 and distribution infrastructure malware for other payloads. After diminishing due in part to direct disruption by US law enforcement, the Emotet malware saw a resurgence in Q4 2021.
WatchGuard’s quarterly research reports are based on anonymized Firebox Feed data from active WatchGuard Fireboxes whose owners have opted to share data in direct support of the Threat Lab’s research efforts.