Tag Archives: WatchGuard

Cybersecurity, News

Ransomware volume already doubled 2021 total by end of Q1 2022 says WatchGuard Threat Lab Report

New research shows Log4Shell detections tripled, PowerShell scripts heavily influenced a surge in endpoint attacks, the Emotet botnet came back in a big way and malicious cryptomining activity increased

28 June 2022 – Ransomware detections in the first quarter of this year doubled the total volume reported for 2021, according to the latest quarterly Internet Security Report from the WatchGuard Threat Lab. Researchers also found that the Emotet botnet came back in a big way, the infamous Log4Shell vulnerability tripled its attack efforts and malicious cryptomining activity increased.

Although findings from the Threat Lab’s Q4 2021 report showed ransomware attacks trending down year over year, that all changed in Q1 2022 with a massive explosion in ransomware detections. While Q4 2021 saw the downfall of the infamous REvil cybergang, WatchGuard analysis suggests that this opened the door for the LAPSUS$ extortion group to emerge, which along with many new ransomware variants such as BlackCat – the first known ransomware written in the Rust programming language – could be contributing factors to an ever-increasing ransomware and cyber-extortion threat landscape.

The report also shows that EMEA continues to be a hotspot for malware threats. Overall regional detections of basic and evasive malware show WatchGuard Fireboxes in EMEA were hit harder than those in North, Central and South America (AMER) at 57% and 22%, respectively, followed by Asia-Pacific (APAC) at 21%.

“Based on the early spike in ransomware this year and data from previous quarters, we predict 2022 will break our record for annual ransomware detections,” said Corey Nachreiner, chief security officer at WatchGuard. “We continue to urge companies to not only commit to implementing simple but critically important measures but also to adopt a true unified security approach that can adapt quickly and efficiently to growing and evolving threats.”

Other key findings from this Internet Security Report include:

  • Log4Shell makes its debut on the top 10 network attacks list – Publicly disclosed in early December 2021, the Apache Log4j2 vulnerability, also known as Log4Shell, debuted on the top 10 network attack list fashionably late this quarter. Compared to aggregate IPS detections in Q4 2021, the Log4Shell signature nearly tripled in the first quarter of this year. Highlighted as the top security incident in WatchGuard’s previous Internet Security Report, Log4Shell garnered attention for scoring a perfect 10.0 on CVSS, the maximum possible criticality for a vulnerability, and because of its widespread use in Java programs and the level of ease in arbitrary code execution.

 

  • Emotet’s comeback tour continues – Despite law enforcement disruption efforts in early 2021, Emotet accounts for three of the top 10 detections and the top widespread malware this quarter following its resurgence in Q4 2021. Detections of Trojan.Vita, which heavily targeted Japan and appeared in the top five encrypted malware list, and Trojan.Valyria both use exploits in Microsoft Office to download the botnet Emotet. The third malware sample related to Emotet, MSIL.Mensa.4, can spread over connected storage devices and mostly targeted networks in the US. Threat Lab data indicates Emotet acts as the dropper, downloading and installing the file from a malware delivery server.

 

  • PowerShell scripts lead the charge in surging endpoint attacks – Overall endpoint detections for Q1 were up about 38% from the previous quarter. Scripts, specifically PowerShell scripts, were the dominating attack vector. Accounting for 88% of all detections, scripts single-handedly pushed the number of overall endpoint detections clear past the figure reported for the previous quarter. PowerShell scripts were responsible for 99.6% of script detections in Q1, showing how attackers are moving to fileless and living-off-the-land attacks using legitimate tools. Although these scripts are the clear choice for attackers, WatchGuard’s data shows that other malware origin sources shouldn’t be overlooked.

 

  • Legitimate cryptomining operations associated with malicious activity – All three new additions to the top malware domains list in Q1 were related to Nanopool. This popular platform aggregates cryptocurrency mining activity to enable steady returns. These domains are technically legitimate domains associated with a legitimate organization. However, connections to these mining pools almost always originate in a business or education network from malware infections versus legitimate mining operations.

 

  • Businesses still facing a wide range of unique network attacks – While the top 10 IPS signatures accounted for 87% of all network attacks; unique detections reached their highest count since Q1 2019. This increase indicates that automated attacks are focusing on a smaller subset of potential exploits rather than trying everything but the kitchen sink. However, businesses are still experiencing a wide range of detections.

WatchGuard’s quarterly research reports are based on anonymised Firebox Feed data from active WatchGuard Fireboxes whose owners have opted to share data in direct support of the Threat Lab’s research efforts. In Q1, WatchGuard blocked a total of more than 21.5 million malware variants (274 per device) and nearly 4.7 million network threats (60 per device). The full report includes details on additional malware and network trends from Q1 2022, recommended security strategies and critical defence tips for businesses of all sizes and in any sector, and more.

For a detailed view of WatchGuard’s research, read the complete Q1 2022 Internet Security Report here, or visit: https://www.watchguard.com/wgrd-resource-center/security-report-q1-2022

Cybersecurity, News

Leading Managed Service Provider recognised by cybersecurity vendor for continued growth and commitment to deliver the full portfolio of WatchGuard’s products and services

London – 20 June 2022 – Redinet is pleased to announce the company has been recognised by leading cybersecurity vendor WatchGuard Technologies as a new Platinum Partner in the WatchGuardONE partner program. As a long-standing partner, Redinet has been promoted to Platinum due to its many years of dedication to the WatchGuard business as well as the company’s continued efforts in driving WatchGuard’s product adoption across the full portfolio. To achieve Platinum status, companies must be nominated and invited by the WatchGuard executive team.

“Over the years, we have worked to build a great relationship with WatchGuard which has helped us and our customers continue to grow and stay ahead of the increasing threat landscape. Dedicated access to product and technical teams within WatchGuard means we are always up-to-date and ready to introduce new technologies as they become available,” said James McMillan, CTO at Redinet Limited.

“We are delighted to recognise Redinet for their continued growth and commitment to delivering WatchGuard products and services to their customers. For over two decades we have worked collaboratively with Redinet and with this close working relationship, Redinet offers the entire WatchGuard portfolio of products and services that make up WatchGuard’s Unified Security Platform,” said Jon-Marc Wilkinson, Sales Director UK & Ireland at WatchGuard.

“Redinet continually works with our own internal teams to provide valuable insight into the requirements from their customers to assist our go-to-market strategy. Their knowledge and technical expertise of the WatchGuard portfolio ensures they are perfectly positioned to continue to deliver service excellence to their growing number of customers throughout the UK. Redinet’s loyalty and dedication to WatchGuard has helped to deliver continued growth and we are proud to promote Redinet to Platinum Partner status.”

To learn more about WatchGuard’s Unified Security Platform, visit: https://www.watchguard.com/wgrd-solutions/unified-security-platform.

To learn more about WatchGuardONE, visit: https://www.watchguard.com/wgrd-partners.

News, Security

New WatchGuard Threat Lab Report Shows Network Attacks at Highest Point Over Last Three Years

Network detections in EMEA quadrupled, with malware detections occurring at nearly twice the rate as the rest of the world.

5 April 2022 – WatchGuard® Technologies’ latest quarterly Internet Security Report shows a record number of evasive malware detections with advanced threats increasing by 33%, indicating a higher level of zero day threats than ever before.

Researchers at the WatchGuard Threat Lab detected malware threats in EMEA at a much higher rate than other regions of the world in Q4 2021, with malware detections per Firebox at 49%, compared to Americas at 23% and APAC at 29%. The trajectory of network intrusion detections also continued its upward climb with the largest total detections of any quarter in the last three years and a 39% increase quarter over quarter. Researchers suggest that this may be due to the continued targeting of old vulnerabilities as well as the growth in organisations’ networks. As new devices come online and old vulnerabilities remain unpatched, network security is becoming more complex

“The continued shift to a hybrid workforce is making attack surfaces larger and creating more potential security holes for organisations to plug,” says Corey Nachreiner, chief security officer at WatchGuard. “With the highest level of zero-day threats we’ve ever recorded and an attack surface that extends well beyond the network perimeter to IoT, home networks and mobile devices, companies need to adopt a true unified security approach that can adapt quickly and efficiently to the growing threat landscape. Organisations should make a commitment to implementing simple but critically important measures like updating and patching systems on a regular basis so they’re not enabling hackers.”

Other key findings from this Internet Security Report include:

  • 78% of malware delivered via encrypted connections is evasive – Overall, 67% of malware detections arrived over an encrypted connection, and within those malware detections, 78% were evasive zero-day malware threats that evade basic detections. This continues a trend seen in previous quarters. These threats can often be stopped at the perimeter by setting firewalls to decrypt and scan incoming traffic – a step that, unfortunately, many organisations fail to take.
  • A new leader in Office exploit malware emerges – Q4 2021 saw a significant incidence of malware targeting Office documents, similar to findings from Q3. CVE-2018-0802 remains on the top 10 malware list, landing at number 5 this quarter, up one spot from last quarter, and remains on the most widespread malware list. Researchers suspect this may have replaced CVE-2017-11882 as the top Office exploit.
  • Emotet comes back with a vengeance – Two new malware domains were added this quarter to the list of top malware domains detected by WatchGuard. One of these domains, Skyprobar[.]info, has been linked to Emotet, the banking trojan that has evolved into a C2 and distribution infrastructure malware for other payloads. After diminishing due in part to direct disruption by US law enforcement, the Emotet malware saw a resurgence in Q4 2021.

WatchGuard’s quarterly research reports are based on anonymized Firebox Feed data from active WatchGuard Fireboxes whose owners have opted to share data in direct support of the Threat Lab’s research efforts. In Q4, WatchGuard blocked a total of more than 23.9 million malware variants (313 per device) and nearly 5.9 million network threats (75 per device). The full report includes details on additional malware and network trends from Q4 2021, a detailed analysis of the Log4Shell vulnerability, recommended security strategies and critical defence tips for businesses of all sizes and in any sector, and more.

For a detailed view of WatchGuard’s research, read the complete Q4 2021 Internet Security