G DATA threat report: Attacks without malware on the increase

The number of averted cyber attacks has fallen by more than 40 percent compared to the first half of 2020. This is documented in the latest threat report from G DATA for the first half of 2021 compared to the same period last year. The sharp decline also reflects the extremely high numbers in 2020. In the second quarter of 2020 especially, cyber criminals were concentrating on exploiting people's uncertainty that resulted from the effects of the pandemic. This led to a massive increase in averted attacks during that period (up 156 percent). The decrease from the first to the second quarter of 2021 is 15.6 percent. However, the current figures also confirm the growing trend for businesses to be the focus of attacks.  While the number of averted attacks on private customers has fallen by almost 20 percent, the decline in the corporate environment is just some three percent.

Cyber criminals continue to exploit existing vulnerabilities for targeted attacks. In the first six months of the year especially, various criminal groups actively exploited a number of major security vulnerabilities in Microsoft Exchange servers and infiltrated corporate networks.

Another example of cyber criminal activity is what is known as the AMSI bypass. Attackers repeatedly try to bypass the Antimalware Scan Interface (AMSI) developed by Microsoft. Security solutions actually scan applications for malicious activity using AMSI. However, malware authors try to use automated tools to switch off this interface or find a way around it - especially when using fileless malware.

QBot continues to be not only one of the most active malware programs, but also one of the most dangerous. This successor to Emotet was used in the majority of the latest attacks during the first half of the year. Originally a banking Trojan, the malware has also been gradually developed into an all-purpose weapon for cyber criminals by the attackers. Numerous Remote Access Trojans (RATs) continue to be active. Seven of the ten most active malware programs belong to this group. RATs enable remote control and administrative monitoring of a third-party computer without the user noticing. Among other things, attackers can view the victim's desktop, log keystrokes, access the camera, steal the login information stored in browsers or upload and download files.

A look at the current wave of attacks from the Gootkit malware family illustrates just how devious cyber criminals have been in developing their attack efforts. The malware authors have developed Gootloader in such a way that it can reload and install various malware. In the process, the attackers push up their own pages with search engine poisoning. These look like legitimate pages, so that even technically savvy users fall victim to such deception.