Darkreading.com reported that from the “CrowdStrike 2020 Global Threat Report” that “the first time in CrowdStrike's research and incident response engagement reporting, so-called "malware-free" attacks edged ahead of malware-based ones, at 51% to 49% in 2019. In 2018 and 2017, malware accounted for around 60% of all attacks globally, and malware-free attacks around 40%, according to CrowdStrike's data.” The March 4, 2020 report entitled “Most Cyberattacks in 2019 Were Waged Without Malware” included these comments:
Seasoned cybercriminals and nation-state attackers for some time now have been upping their game with new methods to mask their activities from security tools by blending in and posing as real users in the targeted organization's network - using stolen credentials and running legitimate tools to dig through victim systems and data, for instance.
A malware-free attack in CrowdStrike's parlance is one where the method to gain entry into a victim organization doesn't employ a malicious file or file fragment to a computer disk.
In addition to stolen credentials or legitimate tools, this type of attack also can execute code from memory and can only be detected with higher-level tools and techniques that spot unusual behavior, or via threat hunting.
Actually I’m not surprised, are you?
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
