The Central Texas IT Guy

Gone are the days when the only way to inject a malware was through malicious files sent in emails. Nowadays, fileless attacks are taking over the toll and are becoming more common. According to The State of Endpoint Security Risk Report by Ponemon Institute, 77% of the total compromised attacks in 2017 were fileless.

Fileless malware attack as the name suggests do not need installation of a malicious software to infect the victim’s machine. It is also known as zero-footprint, non-malware, macro attack etc. as unlike traditional malware it takes advantage of the vulnerabilities existing on the user’s device. It usually exists in the computer’s RAM and uses common system tools such as Windows Management Instrumentation, PowerShell etc. to inject the malware.

Since they are not injected through a file, it is often very difficult to prevent, detect & remove the malware. However, the loss can be minimized to a great extent if you reboot your device as RAM can be exploited only if the device is on.

Features Of Fileless Malware

• It is difficult for antivirus software’s to detect the malware as it is not based on an identifiable code or signature.
• It is a memory based malware.
• It can be paired with other types of malwares as well.
• Fileless attacks evade whitelisting (the practice by which only approved applications are allowed to be installed on a system).
• Processes that are native to the operating system are generally used in order to initiate an attack.
• It generally takes advantage of approved applications that are there on your system.

How Does It Work?
Such an attack maybe launched through a variety of ways. You might mistakenly click on a banner ad that shall redirect you to a legitimate looking malicious site which may load Flash on your system. Flash in turn will compromise the Windows PowerShell. This in turn might download a malicious code from a botnet and send the data to hackers.

How To Detect?

It is usually difficult to detect a fileless malware attack since it is not launched through files. However, there are certain warning signs that one needs to take a note of.

• Unusual network patterns
• Compromised memory
• Unusual snags

Ways To Protect Yourself From Fileless Malware Attack

• Updating your current software on a regular basis.
• Keeping a tab on your network traffic.
• Disabling PDF readers from activating JavaScript
• Uninstalling or disabling features that you do not use.
• By enhancing your end point security.
• Adopting safe practices to use PowerShell.
• Disabling Flash
• Employing password vaults & strengthening user authentication.
• Cognizing employees about the attack in order to combat the threat.

For more information about IT Security, call Centex Technologies at (254) 213-4740.