Fileless malware refer to a type of malicious software that uses trusted applications to carry out attacks instead of storing malicious files in a target system’s hard drive.
Traditionally, a piece of malware is delivered as a digital file, which must be downloaded, stored on a computer hard drive, and then executed. Fileless malware, however, run directly within a system’s memory and does not need a digital file or an installation process.
Read More about Fileless Malware
This type of malware may sound new to some, but it has been around for decades. The first recorded attack occurred in 2001 when a computer worm called “Code Red” infected more than 350,000 computers by exploiting a vulnerability in the Microsoft IIS web server.
Learn more about this stealthy type of malware here.
How Do Fileless Malware Work?
Threat actors use several sneaky methods to infiltrate a system using fileless malware. We’ll talk about them in greater detail below.
Living Off the Land
The most common technique attackers use is “living off the land,” where they leverage legitimate tools to perform malicious activities, removing the need to introduce new files to a system.
An example of this is PowerShell, a scripting language built into Windows. Attackers can use PowerShell commands to manipulate system settings, execute malicious codes, and interact with other applications. Other legitimate processes running within an operating system (OS) may also be used.
Embedding Malicious Code into Documents
In some cases, the attacks involve embedding malicious code within a seemingly harmless document, such as Microsoft Word, Excel, and PowerPoint files. This code often takes the form of macros or small programs that automate tasks within the file.
When a user downloads the document, opens it, and enables the macros, the malicious macros are automatically executed using PowerShell.
Exploiting Software Vulnerabilities
Attackers may also exploit known vulnerabilities to inject malicious code directly into the memory of vulnerable applications. These vulnerabilities are often related to Remote Code Execution (RCE) flaws, allowing attackers to execute arbitrary code on a target system. They include:
- Buffer overflows: Overwriting memory buffers with malicious code.
- Command injection: Injecting malicious commands into legitimate applications.
- Deserialization vulnerabilities: Exploiting flaws in how applications handle serialized data.
Process Hijacking
There are instances when attackers target legitimate processes running on a system, such as the Windows Explorer process explorer.exe. They would inject their malicious code into the memory of these processes. The infected processes then execute the malicious code as if it were part of their own functionality.
What Happens During a Fileless Malware Attack?
Fileless malware make it to a target system through common techniques like phishing and vulnerability exploitation. After the initial access, the malicious code will be executed using any of the methods discussed in the previous section.
Once executed, the malware can then access the target system and remain undetected while it performs the tasks it was designed to do. These tasks could involve encrypting files, stealing sensitive information, or downloading other malware.
Why Are Fileless Malware More Dangerous Than Traditional Malware?
Fileless malware are considered more dangerous, as they can successfully evade traditional security measures. Most antivirus software, for example, rely on signature-based detection and scans for known malicious files. Since the malware doesn’t create files on a hard drive, it can effectively bypass this threat detection method.
Additionally, the malware uses legitimate applications and processes to make its payload appear like a normal system activity. This method can fool security systems that primarily focus on detecting malicious files and suspicious behaviors.
Aside from being difficult to detect, these types of malware are also harder to remove since they reside in a system’s memory. They can also quickly adapt and constantly change their appearance and behavior to make them hard to track.
—
Fileless malware can be a challenge to traditional security solutions because of their stealthy, evasive, and persistent nature. Organizations would have to implement advanced security techniques that can identify and address these threats.
Key Takeaways
- Fileless malware refer to malicious software that run in memory and leverage trusted applications for attacks, unlike traditional file-based malware.
- They have been around for decades, with the first recorded attack in 2001.
- They bypass traditional security by not needing to be downloaded or stored on a hard drive.
- Their common techniques include living off the land (using legitimate tools), embedding malicious code into documents, and exploiting software vulnerabilities.
- They can steal data, encrypt files, download more malware, and remain undetected for long periods.
- They are more dangerous than traditional malware due to evasion tactics and difficulty in detection and removal.
Sources
- https://www.fortinet.com/resources/cyberglossary/fileless-malware
- https://www.cybereason.com/blog/fileless-malware
- https://arcticwolf.com/resources/blog-uk/the-risks-of-fileless-malware/
- https://www.trendmicro.com/vinfo/ph/security/news/security-technology/security-101-defending-against-fileless-malware
