Network Security
Vulnerability Management
Privileged Access Management
Endpoint Security
Threat Hunting
Unified Endpoint Management
Email & Collaboration Security
Contents:
Many of the most widely encountered types of cyberattacks are fuelled by malicious code. But what can malicious code do? What makes it so dangerous?
In the following article, I will briefly go over the broad definition of malicious code, then single in on the three most common types of malicious code attacks. Stay tuned until the end for infection indicators and actionable advice that will help you both react and defend your network properly.
Before diving into what malicious code can do, let’s first briefly recap what malicious code is. In my previous article on the topic, I outlined seven common examples of malicious code:
- computer viruses,
- computer worms,
- Trojan horses
- Internet bots
- spyware,
- ransomware,
- and logic bombs.
What all of these have in common is their ability to execute themselves once injected into the target system. What is more, they are usually delivered through recognizable computer programs such as scripting languages, plug-ins, ActiveX controls, and Java Applets.
Types of Malicious Code Attacks
Malicious code attacks come in all shapes and sizes, as do the cybercriminal groups behind them. In the following sections, I will discuss the top three most widespread types.
#1 Social Engineering Attacks
Malspam emails have become part and parcel of our everyday lives. If you have an active Internet connection and an email address, you most likely know what I’m talking about. At an enterprise level, things are the same. According to statistics cited by Security Boulevard, 85% of all organizations have been the victim of a phishing campaign at least once.
But while phishing might be a common occurrence these days, not everyone knows how to spot a fraudulent message when they see it. We have social engineering to blame for that. In cybersecurity, the term social engineering refers to an attack that requires human interaction and manipulation to access confidential data or even entire networks. So, what can malicious code do in relation to social engineering?
Phishing is the traditional type of social engineering attack. Attackers impersonate trusted brands or companies over email messages, forging their tone, language, and imagery to build trust. Netflix, Facebook, or PayPal are just a few common examples. These emails come with malicious macro attachments that contain viruses, worms, Trojans, or even ransomware. Alternatively, they might also contain falsified forms that require filling in credentials, which hackers then proceed to steal.
Spear phishing, or whaling, is a targeted type of phishing attack that has specific organizations or people in view. It involves copious amounts of research and a tailored approach that either makes use of a similar approach to that of phishing or goes as far as to impersonate authority figures in the company such as the CEO.
#2 Bot Attacks
A bot attack is a type of cyberattack where hackers make use of Internet bots to unlawfully enter a system and steal private data from it or further infect it with viruses, Trojans, or ransomware. The bots are usually part of an interconnected network of compromised zombie computers known as a botnet.
Botnets are created through a process known as botnet recruitment, which targets any type of device that can go online. This includes both desktop and mobile devices, as well as IoT devices and Internet infrastructure hardware. Therefore, a botnet isn’t solely formed of computers and smartphones, but smartwatches, surveillance cameras, TVs, Wi-Fi routers, and even servers. But what can malicious code do when it comes to bot attacks?
Distributed denial of service (DDoS) is a common type of bot attack. It consists of flooding servers with zombie computer traffic in an attempt to overload them and cause a shutdown. Simply put, malicious bots flock onto the targeted website and cause it to crash, which takes connected services offline as well.
Brute force attacks are another popular example of a bot attack. Through the dictionary method and credential stuffing, hackers exploit accounts with weak passwords. Bots are used to try thousands of variants at a time, eventually cracking vulnerable credentials and gaining access to confidential data.
#3 Ransomware Attacks
Ransomware attacks usually occur after phishing campaigns and bot attacks breach the security of a system. What can malicious code do in this case? Well, operators exploit these vulnerabilities and deploy a strain of encryption malware, taking sensitive files hostage in the process and rendering them inaccessible.
A decryption key is promised in exchange for a ransom payment, which is specified in the note that comes with the attack. However, there is no real guarantee that hackers will hold up their end of the bargain. There are two main types of ransomware attacks, namely commodity attacks and targeted attacks.
Commodity attacks set out to infect devices indiscriminately, focusing on quantity rather than quality. This generally results in multiple ransom payouts that consist of smaller sums. Operators who retort to this strategy generally also offer ransomware-as-a-service (RaaS) to create multiple avenues for profit.
Targeted attacks are focused, singling in on various industries or organizations that are particularly vulnerable. They commonly involve a lot more planning and research than commodity attacks do. As a result, larger ransom payments are also acquired if victims give into the group’s demands.
Ryuk ransomware, Sodinokibi ransomware, and Netwalker ransomware are just a few infamous examples of encryption malware strains that are out there and that we’ve also covered on our blog. If you are interested in specific tactics and prevention strategies, I recommend having a look.
Indicators of Malicious Code Injection
Malicious code attacks might slip past the untrained eye with ease depending on how well-planned they are, but a quick response is crucial to the process of mitigation. There are a few telltale signs that your network has been infected with malicious code:
- decreased machine performance,
- high resource usage on your machine (CPU, Memory, Disk, Network)
- seemingly random system crashes,
- unfamiliar programs in the taskbar,
- strange applications on startup,
- browser redirects or lagging,
- changed login credentials on accounts,
- strange emails sent in your name,
- arbitrarily deleted files,
- unexpected pop-up windows.
- strange extensions appended to your files
If you start noticing any of these indicators within your network, my advice is to take the affected device(s) offline as quickly as possible. What is more, you should also log out of the cloud and disconnect any external storage devices immediately to not compromise data backups.
Heimdal Security’s suite of Email Protection solutions has been specifically designed to prevent phishing attempts on your organization. Consisting of the Heimdal™ Email Security and the Heimdal™ Fraud Prevention modules, it not only filters spam and defends your network against malware infiltration, but also detects fraud attempts early on.
For complete protection against malicious code attacks, I recommend pairing Email Protection with Heimdal™ Threat Prevention, our revolutionary DNS filtering tool. It is effective against ransomware attacks, data leaks, and advanced persistent threats, nipping infiltration attempts in the bud.
So, What Can Malicious Code Do?
The short answer would be that it can inoculate itself into networks, damaging files and stealing confidential data in the process. In a nutshell, it has the ability to not only steal your private data but also damage your assets and organization as a whole in the process. Fortunately, there are quite a few ways to prevent this from happening to you.
Interested in boosting your company’s digital defenses? Contact us at sales.inquiries@heimdalsecurity.com for a complete cybersecurity assessment that will help you determine which of our solutions is the right fit for you.
Heimdal® DNS Security Solution
Alina Georgiana Petcu is a Product Marketing Manager within Heimdal™ Security and her main interest lies in institutional cybersecurity. In her spare time, Alina is also an avid malware historian who loves nothing more than to untangle the intricate narratives behind the world's most infamous cyberattacks.
