What are the 10 common types of malware-based attacks?
Here are the 10 most common types of malware-based attacks:
1. Ransomware
2. Adware
3. Trojan
4. Residential proxy
5. Worm
6. Spyware/keylogger
7. Process injection/fileless malware
8. Remote access trojan (RAT)
9. Cryptojacking
10. Mobile malware
1. Ransomware
Ransomware is malware that uses encryption to prevent companies from accessing their data and other business-critical systems until a ransom is paid. In May 2021, Colonial Pipeline was the victim of a ransomware attack and had to pay 75 bitcoin — $4.4 million — to restore operations.
While the FBI was able to help the oil company reclaim a big chunk of that ransom, these attacks are quite common due to lucrative potential payouts. In an era of remote and hybrid workforces, hackers have more remote worker endpoints to exploit.
2. Adware
Adware is software that displays advertising and other sales materials in your browser as popup ads or applications. Generally speaking, adware commandeers end users’ browsers and tricks them into clicking on fraudulent ads.
Attackers also use a version of this technique called scareware to trick users into believing their systems are hacked and that the only way to fix it is by buying more software, which often contains malware.
3. Trojan
A banking trojan is malware that gives malicious actors access to important data. Typically, trojans — which spread through environments like worms — can harvest all network passwords from a system, capturing passwords stored in web browsers, and intercepting network traffic. They also are used to steal banking credentials entered by an end user and capture credentials and data from email clients.
Another common example of a trojan malware attack is Emotet, an advanced modular banking trojan that primarily functions as a downloader of other banking trojans.
4. Residential proxy
A residential proxy is an intermediary network that enables threat actors to use what appear to be real residential IP addresses in specific geographic areas while launching attacks from elsewhere. For example, a hacker in Eastern Europe can use a residential proxy network to appear to be an internet user in Oklahoma.
Recently, the FBI warned that hackers are increasingly using residential proxy networks and malware to launch credential-stuffing attacks, where bad actors use previously exposed login credentials en masse in hopes of gaining access to sensitive accounts.
5. Worm
A worm is malicious software that spreads across networks and has self-replicating capabilities. All it takes is one employee to download an infected file or a bad actor to exploit a remote vulnerability to wreak havoc on an organization’s network. Famous examples of worms include Stuxnet, which targeted industrial control systems, and the Morris worm, which impacted organizations like Harvard, Princeton, Stanford, Johns Hopkins, and NASA.
6. Spyware/keylogger
As the name suggests, spyware is a type of keylogging software that records user behavior and is primarily used to collect usernames and login credentials. For example, after a keylogger is installed on an employee’s computer, a bad actor can access to all mission-critical systems that the user accesses, and even their own financial and social media accounts.
Recently, hackers used RedLine Stealer to steal usernames and passwords stored in web browsers like Chrome and Edge. Once those credentials were stolen, hackers could use them to commit additional crimes or sell them on the dark web. This attack illustrates the importance of using encrypted password managers and practicing good password hygiene.
7. Process injection/fileless malware
Unlike more common malware attacks, fileless malware isn’t file-based; instead, malicious scripts are memory-based, which makes them much harder to identify and easier to execute in the background. For example, an employee might click on a link in a phishing email that loads a script into their computer’s memory. Once that happens, hackers can capture and share confidential credentials and sensitive information.
According to Norton, there are three primary types of fileless malware attacks:
Windows registry manipulation, which uses normal Windows processes to implement fieless code into a machine’s registry. An example of this is Kovter, which captures and takes control of unsuspecting user’s machines and uses them to commit click fraud.
Memory code injection, which occurs when bad actors hide malicious scripts in a normal application’s memory, like PowerShell and WMI. Since these programs are supposed to be running on an employee’s machine, they’re often able to elude malware detectors.
Script-based techniques, including Operation Cobalt Kitty, where a group of hackers targets a select group of employees with spear-phishing emails containing Word documents with malicious scripts.
8. Remote access trojan (RAT)
A remote access trojan is software that enables bad actors to control someone else’s device or computer from another location. In most cases, hackers dupe employees into downloading RATs alongside business applications or files or get them to click on duplicitous links in phishing emails. Once a hacker has control of an individual’s computer, they can steal all important data and use that device to launch any number of additional attacks.
9. Cryptojacking
One of the latest malware trends is cryptojacking, which occurs when bad actors commandeer computers and use them to mine cryptocurrency without the end user knowing. Since mining for cryptocurrency is resource-intensive and requires a lot of electricity, this is an easy way for bad actors to force companies to pay for the energy needed to mine cryptocurrency while they collect the rewards (e.g., bitcoin or ethereum).
Good news: Coalition insures against this.
10. Mobile malware
Mobile malware is malware that — you guessed it — targets mobile devices. These days, with so many employees working on the go or working remotely, hackers are increasingly exploiting this attack vector to gain access to sensitive business information and user credentials. In addition to ensuring business devices are protected against malware, it’s also important that your employees know their personal devices can be targeted, particularly if they’re being used for work purposes.
