Virtual Event: Threat Detection and Incident Response Summit - Watch Sessions
Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Malware & Threats

VirusTotal Data Shows How Malware Distribution Leverages Legitimate Sites, Apps

Google-owned malware analysis service VirusTotal has published a report showing how threat actors abuse trust to bypass defenses and deliver their malware.

According to data collected by VirusTotal, legitimate websites and applications are often leveraged for malware delivery.

Google-owned malware analysis service VirusTotal has published a report showing how threat actors abuse trust to bypass defenses and deliver their malware.

According to data collected by VirusTotal, legitimate websites and applications are often leveraged for malware delivery.

In some cases, legitimate applications and websites are directly abused. For instance, the company found that 0.1% of legitimate hosts for popular apps have distributed malware. In addition, 10% of the top 1,000 Alexa domains have been observed delivering suspicious files.

The apps themselves are also abused, with 4,000 samples analyzed by VirusTotal executing or packing legitimate application installers. Moreover, 98% of the samples that included legitimate installers in their PE resources were malicious.

“One of the most effective social engineering techniques consists of hiding malware by packaging it into installation packages with legitimate software. This becomes a supply chain attack when attackers get access to the official distribution server, source code, or certificates,” VirusTotal said.

While this technique is not as common as others, the company says it seems to be a ‘constant and slightly growing trend’.

Since 2021, the company has identified more than one million malicious samples that were signed, with 87% of them having a valid signature. Malware signed with stolen keys is likely more common than many expect.

Advertisement. Scroll to continue reading.

VirusTotal has also reported seeing an increase in attackers mimicking legitimate applications, with Skype, Adobe Acrobat and VLC being the most targeted. When it comes to mimicking legitimate websites, attackers have most commonly targeted WhatsApp, Instagram and Amazon.

“When thinking about these techniques as a whole, one could conclude that there are both opportunistic factors for the attackers to abuse (like stolen certificates) in the short and mid term, and routinely (most likely) automated procedures where attackers aim to visually replicate applications in different ways,” VirusTotal noted.

It added, “Although less sophisticated, the aggregate effect of these techniques could lead to a bigger combined impact than more complex but less voluminous attacks. That’s why it seems there are good candidates to monitor at a global level how malware attackers abuse them, which can also help automatically detect suspicious samples before they hit the victim.”

Related: VirusTotal Shares Analysis of 80 Million Ransomware Samples

Related: VirusTotal Hacking Offers a Supercharged Version of Google Hacking

Related: VirusTotal Introduces ‘Collections’ to Simplify IoC Sharing

Written By

Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Click to comment

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

SecurityWeek’s Threat Detection and Incident Response Summit brings together security practitioners from around the world to share war stories on breaches, APT attacks and threat intelligence.

Register

Securityweek’s CISO Forum will address issues and challenges that are top of mind for today’s security leaders and what the future looks like as chief defenders of the enterprise.

Register

Expert Insights

Related Content

Cybercrime

The changing nature of what we still generally call ransomware will continue through 2023, driven by three primary conditions.

Cybercrime

A recently disclosed vBulletin vulnerability, which had a zero-day status for roughly two days last week, was exploited in a hacker attack targeting the...

Risk Management

The supply chain threat is directly linked to attack surface management, but the supply chain must be known and understood before it can be...

Cybercrime

No one combatting cybercrime knows everything, but everyone in the battle has some intelligence to contribute to the larger knowledge base.

ICS/OT

The overall effect of current global geopolitical conditions is that nation states have a greater incentive to target the ICS/OT of critical industries, while...

Malware & Threats

Threat actors are increasingly abusing Microsoft OneNote documents to deliver malware in both targeted and spray-and-pray campaigns.

Cybersecurity Funding

2022 Cybersecurity Year in Review: Top news headlines and trends that impacted the security ecosystem

Malware & Threats

Unpatched and unprotected VMware ESXi servers worldwide have been targeted in a ransomware attack exploiting a vulnerability patched in 2021.