Network attacks at highest point in the last three years
A WatchGuard Threat Lab report shows network attacks at the highest point over the past three years.
WatchGuard Technologies has announced findings from its latest quarterly Internet Security Report, detailing the top malware trends and network security threats analysed by WatchGuard Threat Lab researchers.
Researchers found a record number of evasive malware detections. They say the advanced threats have increased by 33%, indicating a higher level of zero-day threats than ever before. Network detections also continued an upward trajectory, with the Americas receiving the majority of attacks.
"The continued shift to a hybrid workforce is making attack surfaces larger and creating more potential security holes for organisations to plug," says WatchGuard chief security officer, Corey Nachreiner.
"With the highest level of zero-day threats we've ever recorded and an attack surface that extends well beyond the network perimeter to IoT, home networks and mobile devices, companies need to adopt a true unified security approach that can adapt quickly and efficiently to the growing threat landscape."
He says organisations should commit to implementing simple but critically important measures like updating and patching systems regularly, so they're not enabling hackers.
Some key findings from this Internet Security Report, which analyses data from Q4 2021, include:
Total network attack detections continue to climb: Highlighting the complexity of network security, The trajectory of network intrusion detections continued its upward climb, with the largest total detections of any quarter in the last three years. This also represented a 39% increase quarter over quarter. This may be due to the continued targeting of old vulnerabilities and the growth in an organisation's networks; as new devices come online and old vulnerabilities remain unpatched, network security is becoming more complex.
Malware threats were detected in EMEA at a much higher rate than in other regions: Europe, the Middle East, and Africa (EMEA) were also the most targeted by malware threats in Q4. The EMEA saw malware detections per Firebox (49%) at nearly or above double the rate of other world regions (AMER 23% and APAC 29%).
78% of malware delivered via encrypted connections is evasive: Overall, 67% of malware detections arrived over an encrypted connection, and within those malware detections, 78% were evasive zero-day malware threats that evade basic detections. This continues a trend seen in previous quarters. These threats can often be stopped at the perimeter by setting firewalls to decrypt and scan incoming traffic, a step that many organisations fail to take.
A new leader in Office exploit malware emerges: Q4 saw a significant incidence of malware targeting Office documents, similar to findings from Q3. CVE-2018-0802 remains on the top 10 malware list, landing at number 5 this quarter, up one spot from last quarter, and remains on the most widespread malware list.
Emotet comes back with a vengeance: Two new malware domains were added this quarter to the top malware domains detected by WatchGuard. One of these domains, Skyprobar, has been linked to Emotet, the banking trojan that has evolved into a C2 and distribution infrastructure malware for other payloads. After diminishing due in part to direct disruption by US law enforcement, the Emotet malware saw a resurgence in Q4 2021.
WatchGuard's quarterly research reports are based on anonymised Firebox Feed data from active WatchGuard Fireboxes whose owners have opted to share data directly supporting the Threat Labs research efforts. In Q4, WatchGuard says it blocked more than 23.9 million malware variants (313 per device) and nearly 5.9 million network threats (75 per device).
