How Are Advanced Malware Attacks Evolving?

TL;DR

Cybercriminal groups reinvest profits into research and development, creating malware that changes dynamically, hides inside trusted processes, targets valuable data, and uses cloud infrastructure for flexible command and control. Defenders must account for malicious search optimization, short-lived attack sites, custom malware, process injection, and code that may not appear in ordinary process or module listings.

Transcript

Wonderful. So I'm gonna start out, uh, talking about some top new attack vectors and threats and things to be aware of and some defenses associated with each of those. Then I'm gonna turn it over to some of my co-panelists, Johannes Ullrich and, uh, Rohit Dhamankar. Um, I wanna keep the remarks very brief here. I'm gonna be going over a lot of stuf... Read More

Key Insights

• Cybercrime profits are reinvested into malware research and development, creating a feedback loop in which reliable criminal business models finance increasingly capable malicious code. Organized groups can therefore improve attack tools while continuing to sell exploits, attack packages, stolen identities, and resilient hosting services.
• The Russian Business Network is described as an integrated malware operation with groups providing exploits, criminal attack packages, stolen identities, and globally distributed hosting. Reports cited in the talk also connected it with remaining parts of the Storm botnet and the Zeus botnet.
• Cloud computing is used by attackers to improve their own operations, not merely treated as a target. Reported uses include temporary command-and-control hosts on Amazon EC2 and access to economies of scale for computational work such as password cracking.
• Malicious search engine optimization draws victims toward attack sites by exploiting interest in major news stories or celebrity events. Attackers create pages, insert popular keywords, and use link bombing so their malicious sites appear higher in search results crawled by services such as Google and Bing.
• Search-engine malware warnings reduce risk but face rapidly changing infrastructure. Google and Bing attempt to identify harmful sites, while attackers dynamically move malware-hosting locations and use cloud resources to stay ahead. The talk notes only anecdotal, not statistical, evidence about differences between their filtering effectiveness.
• Remote-control Trojans provide extensive control over compromised computers and are moving deeper into operating-system kernels. Their expanding feature sets make an older malware category increasingly powerful rather than obsolete, allowing attackers to maintain broad control over targeted machines.
• Extreme polymorphism helps malware evade signature-based detection by dynamically recoding itself whenever it runs. Observed specimens changed their code, filenames, and even file-system icons, modifying small visual details so icon hashes would also differ between executions.
• Process migration conceals malware inside common, essential Windows processes such as winlogon.exe or the Local Security Authority Subsystem service. Attackers may inject code as a DLL or place machine instructions directly into a process, preventing that code from appearing in standard tasklist module output.

Questions & Answers

Q: How do cybercriminal business models improve malware?

Cybercriminal groups can use income from established operations to finance research and development. This creates a feedback loop in which profitable malware services generate money that supports better malicious code. Integrated operations may sell exploits, attack packages, stolen identities, and resilient distributed hosting, allowing both the tools and the supporting criminal infrastructure to become more capable over time.

Q: How do attackers use cloud computing for cybercrime?

Attackers use cloud computing to gain operational efficiencies similar to those pursued by legitimate organizations. The talk cites reports of the Russian Business Network using Amazon EC2 hosts as command-and-control channels. Criminals can start a host for a short period, remove it when needed, and obtain economies of scale for demanding activities such as password cracking.

Q: How does malicious search engine optimization spread malware?

Malicious search optimization attempts to place attack sites near the top of search results for popular subjects. Criminals create websites around major news stories or celebrity events, add relevant keywords, and build other pages containing links back to the malicious destination. When search engines crawl those links, the attack page may gain visibility and attract unsuspecting visitors.

Q: Why are search-engine malware warnings not sufficient protection?

Google, Bing, and other search engines attempt to identify dangerous sites and display warnings before users visit them. However, attackers continually change the locations hosting their malware and can use temporary cloud resources to support that movement. The talk emphasizes that search providers are working to keep pace, but rapidly changing malicious infrastructure makes comprehensive detection difficult.

Q: What makes polymorphic malware difficult to detect?

Polymorphic malware changes its observable characteristics to stay ahead of signatures used by antivirus products. The described specimens dynamically recoded themselves each time they ran and altered filenames that might otherwise trigger detection. Some even changed small details in their file-system icons, producing different icon hashes and expanding the number of characteristics defenders would need to track.

Q: How do modern keystroke loggers target valuable information?

Modern keystroke loggers are designed to capture selected information rather than indiscriminately recording every key. They may focus on credit card numbers, account numbers, and other valuable data by monitoring which graphical application currently has focus. They can also operate inside specific applications, including browsers, placing the collection mechanism close to where sensitive information is entered.

Q: How does process migration help malware remain hidden?

Process migration allows malicious code to leave the original process that a user, administrator, or antivirus tool might notice and terminate. The malware injects itself into a common process expected to remain active, including vital Windows components such as winlogon.exe or the Local Security Authority Subsystem service. Living inside a trusted process makes simple process-name inspection less useful.

Q: Why can tasklist fail to reveal injected malware?

The tasklist command can display running processes, while tasklist /m can show the DLL modules loaded into them. However, ordinary systems may contain hundreds of DLLs across dozens of processes, making unusual modules difficult to identify manually. Attackers can also inject machine-language code directly into a running process without registering it as a DLL, so it will not appear in tasklist /m output.

Summary & Key Takeaways

• Organized crime groups have developed reliable malware businesses that sell exploits, attack packages, stolen identities, and distributed hosting. Revenue funds further research and development, creating a feedback loop that steadily improves malicious software. The Russian Business Network is presented as an example of an integrated operation connected to multiple criminal services and botnets.

• Attackers use cloud computing for the same operational efficiencies sought by legitimate organizations. Cloud hosts can support temporary command-and-control infrastructure and disappear when no longer needed, while cloud scale can assist activities such as password cracking. This illustrates that criminals can exploit cloud services operationally without directly attacking the cloud platform itself.

• Modern malware combines targeted data theft, evasive execution, and deep system control. Remote-control Trojans offer broad access, polymorphic code changes repeatedly, and custom malware avoids widely deployed signatures. Malicious code can migrate into trusted Windows processes or inject machine instructions without registering as a DLL, making ordinary process inspection increasingly unreliable.