Many malware strains have become cross-functionally adaptive, as noted in the 2023 End of Year Threat Report. This comprises the combination of information-stealing malware with malware loaders like remote access trojans (RATs).
The menace of malware-as-a-service
Researchers at Darktrace discovered that "malware strains are progressively developed with a minimum of two functions and are interoperable with a greater number of existing tools" through reverse engineering and detection analysis.
Because these malicious tools may gather passwords and data without compromising files, which makes detection more difficult, they pose a special risk to enterprises.
One well-known instance of this was the information-stealing and remote access Trojan (RAT) called ViperSoftX, which was designed to obtain sensitive data such as Bitcoin wallet addresses and passwords kept in password managers or browsers.
2020 saw the first recorded sighting of ViperSoftX in the wild, however, strains discovered in 2022 and 2023 have more advanced detection evasion strategies and capabilities.
Another instance is the ransomware known as Black Basta, which spreads the Qbot banking virus to steal credentials.
Additional Transition to Ransomware-as-a-Service (RaaS)
The research also noted a move away from traditional ransomware in 2023 with an increase in RaaS assaults.
It was reported that the ransomware market expanded after law enforcement dismantled the Hive ransomware gang in January 2023. Among these was the emergence of ScamClub, a malvertising actor that sends false virus alerts to well-known news websites, and AsyncRAT, which has been targeting US infrastructure workers lately.
According to Darktrace's prediction, an increasing number of ransomware attackers are expected to utilize multi-functional malware and double and triple extortion tactics in the upcoming year.
According to the company, in 2024 the MaaS and RaaS ecosystems should continue to flourish, hence reducing the entry barrier for cybercriminals.
Attackers Incorporating AI into Phishing Schemes
According to Darktrace, last year it saw threat actors use additional creative strategies to get beyond an organization's security measures.
This includes phishing and other increasingly successful email attacks that try to trick users into downloading dangerous payloads or divulging private information.
For instance, 58% of phishing emails that Darktrace saw last year were able to get past all security measures in place, while 65% of the emails were able to effectively evade Domain-based Message Authentication (DMARC) verification checks.
According to the researchers, a lot of attackers are using generative AI technologies to automate the creation of more realistic phishing operations.