PowerShell threats increased over 200% last year

A new McAfee report finds PowerShell attacks driven largely by Donoff malware.

The number of threats leveraging PowerShell grew 208% in the last quarter of 2020, according to a new report by cybersecurity firm McAfee.

The  McAfee Threats Report of April 2021 found the Q4 2020 increase was driven largely by Donoff malware. It also observed numerous PowerShell attacks using process injection to insert code into legitimate running processes as a privilege escalation technique. 

Mobile malware grew 118% in Q4 due in part to a surge in SMS Reg samples, according to the report. Researchers said HiddenAds, Clicker, MoqHao, HiddenApp, Dropper, and FakeApp strains were the most detected mobile malware families.

Ransomware also grew in volume between Q3 and Q4 driven by Cryptodefense. Researchers said that REvil, Thanos, Ryuk, RansomeXX, and Maze groups topped the overall list of ransomware families.

MacOS malware exploded by 420% in Q3 due to EvilQuest ransomware but returned to normal levels in Q4. Office malware surged 199% from Q3 to Q4, and new Linux malware increased 6% at the same time.

Related Resource

Taking a proactive approach to cyber security

A complete guide to penetration testing

A complete guide to penetration testing - whitepaper from CyberCxDownload now

The number of overall threats grew too. In Q3 2020, McAfee Labs observed an average of 588 threats per minute, an increase of 169 threats per minute (40%). By the fourth quarter, this average rose to 648 threats per minute, an increase of 60 threats per minute (10%). The firm also observed nearly 3.1 million external attacks on cloud user accounts.

Adam Philpott, EMEA President at McAfee, said the continued increase in threats is a harsh reminder of how quickly and effectively cyber criminals have taken advantage of COVID-19.

“As we emerge from the pandemic and look to navigate the new normal, it’s important that businesses reconsider their approach to security to ensure business resilience and their ability to mitigate increased cyber risk,” Philpott said.

Philpott added that his company’s research also saw increases in ransomware, malware, and PowerShell attacks, highlighting the importance of IT teams being aware of the wide variety of threats that could target their organizations.

“It is now critical that organizations go beyond the basics to create and maintain a secure environment. By effectively using technology to prioritize threats, predict the types of campaigns that will be launched against them and pre-emptively improve their defensive countermeasures, organizations can rest assured that they’re doing everything they can to protect their business,” Philpott added.

Featured Resources

Preparing for AI-enabled cyber attacks

MIT technology review insights

Download now

Cloud storage performance analysis

Storage performance and value of the IONOS cloud Compute Engine

Download now

The Forrester Wave: Top security analytics platforms

The 11 providers that matter most and how they stack up

Download now

Harness data to reinvent your organisation

Build a data strategy for the next wave of cloud innovation

Download now

Recommended

NSA and CISA publish guidance on hardening Kubernetes following cloud infrastructure cyber attacks
Security

NSA and CISA publish guidance on hardening Kubernetes following cloud infrastructure cyber attacks

4 Aug 2021
McAfee’s zero trust solution strengthens private applications’ security
cyber security

McAfee’s zero trust solution strengthens private applications’ security

3 Aug 2021
Senate report slams agencies for poor cyber security
cyber security

Senate report slams agencies for poor cyber security

3 Aug 2021
Mastering endpoint security implementation
Security

Mastering endpoint security implementation

3 Aug 2021

Most Popular

RMIT to be first Australian university to implement AWS supercomputing facility
high-performance computing (HPC)

RMIT to be first Australian university to implement AWS supercomputing facility

28 Jul 2021
UK gov considers blocking Nvidia's takeover of Arm
Acquisition

UK gov considers blocking Nvidia's takeover of Arm

4 Aug 2021
Zyxel USG Flex 200 review: A timely and effective solution
Security

Zyxel USG Flex 200 review: A timely and effective solution

28 Jul 2021