4 Cyber Threats that Frequently Evade Detection and How to Address Them

Some cyberattacks are just more evasive than others. While many attacks can be identified and blocked through a system that relies on threat signatures, many cannot and easily breeze through at least the initial layers of defense organizations usually have in place. And, with the rapidly growing availability of AI, threat actors have even more ways to adapt to detection mechanisms quickly.

That said, here’s a look at four cyberattacks notorious for their ability to bypass detection and prevention systems.

These threats may appear standard and less sophisticated than other, more advanced techniques, but because they are so good at evading detection, they are a significant cause for concern for organizations and consumers alike.

Website Cloning

Website clones are spoofed copies of a brand’s website that trick unsuspecting users into submitting their login credentials or private data, which malicious actors harvest.

These attacks often fly under the radar by posing as a legitimate brand’s website and using phishing tactics to lure in customers.

Sometimes, scammers even use a redirect back to the authentic website after the user inputs their information on the fraudulent site to evade any suspicion, making detection even more difficult.

Despite the gravity of website cloning and its potential repercussions, organizations often overlook the importance of website security, prioritizing their internal networks instead. They usually only learn about cloned versions of their site through customer reports or post-facto threat intelligence solutions. This should not be the case, given how cloned websites can lead to data theft, reputational damage, and a mass exodus of customers.

To mitigate damages arising from this problem, organizations can set up Google Alerts to see if anything has been published online recently that appears to impersonate their website or brand. Also, organizations can invest in website spoofing protection software that can detect similar suspicious domains.

These solutions alert brands but do not necessarily protect their customers from the potential damages of the cloned websites while they remain active. The takedown process for cloned websites can take days, weeks, or even months for them to be fully delisted from search engines or taken offline by hosting providers. 

Organizations should consider real-time detection and protection tools to combat this issue more effectively. Memcyco is a real-time platform that detects website cloning, immediately alerts organizations, provides full details of the attack, and prevents customers from falling into the trap by issuing Red Alert pop-ups on the cloned site until it is taken down.

While there are currently no solutions that can prevent the cloning of a website, the best thing organizations can do is try to mitigate the damage as soon as possible.

Fileless Malware 

Also known as memory-based malware, fileless malware is anomalous software that does not even need to be written to the storage device of a target device. It only needs to infect a device’s random access memory (RAM) or manipulate the Windows registry, which makes its detection extremely challenging. It operates discreetly by concealing itself under legitimate processes and tools already in a system.

Cybersecurity provider Morphiesec admits that fileless malware can easily evade existing detection systems, including static and dynamic analyses.

Whitelisting can reduce opportunities for fileless malware infections, but it is far from foolproof as perpetrators can find ways to bypass whitelists. Also, liberal whitelisting can impair an organization’s operational flexibility.

To counter fileless malware, organizations must employ a combination of strategies. These include the analysis of file or app behaviors, advanced EDR, network traffic analysis, privilege management, isolation and segmentation, and memory analysis.

Also, it is crucial to implement a zero-trust strategy to ensure that every action, file, or application is presumed dangerous and scrutinized before granting access or privileges.

Preventive cybersecurity technologies like Automated Moving Target Defense (AMTD) are also helpful, as they block attack pathways at the application level before threat actors manage to exploit them.

Stolen Credentials

Often, it takes weeks or months for organizations to discover that they have suffered a data breach, including the theft of their usernames and passwords. The detection of stolen credentials usually happens only once there are attempts to use the stolen credentials to log in to the account. 

It is very possible to prevent and remedy this problem. Security mechanisms such as regular password changes and multi-factor authentication are effective ways to prevent cybercriminals from using stolen login details.

Also, using services like “Have I been Pwned,” which is reliable enough, helps determine if a breach has affected an account.

However, the problem with most organizations and individuals is that they tend to downplay the threat of stolen credentials.

Many do not bother checking if their accounts have already been compromised, even when government institutions or private institutions such as banks release advisories to change passwords due to specific security incidents that have recently occurred.

Therefore, the prevalence of this threat could be mitigated if organizations better observe cybersecurity best practices as far as their accounts are concerned. 

Polymorphic Malware

Polymorphic malware, as the phrase suggests, is malicious software that constantly changes its code and appearance to prevent signature-based as well as pattern-based solutions from detecting it. Each instance of the malware looks different, making it difficult to identify through traditional methods. In other words, it’s malware that evolves or mutates every so often, which makes signature-based detection and even behavioral analysis, to some extent, ineffective against it.

Aggravating the polymorphic malware problem is the rise of generative AI. As reported recently, ChatGPT is capable of generating polymorphic malware that can evade most EDR solutions.

Cybersecurity firm Hyas demonstrated this possibility by creating BlackMamba, a simple proof of concept that showed it’s possible to leverage large language models to produce polymorphic malware that can dynamically and autonomously change its code at runtime.

It works without the need for any command-and-control infrastructure.

The solutions against polymorphic malware include behavioral analysis, heuristic analysis, sandboxing, memory analysis, network traffic analysis, and AI-assisted detection.

To emphasize, it is essential to take advantage of AI to combat adversarial utilization of AI. As Jeff Sims of Hyas asserts in a blog post, “It is crucial for organizations to remain vigilant, keep their security measures up to date, and adapt to new threats that emerge by operationalizing cutting-edge research being conducted in this space.”

In summary

There is no doubt that cybersecurity technologies and strategies have evolved. However, threats and attacks have also advanced, and even detecting them can be highly challenging in the context of traditional cybersecurity practices. It’s reassuring to know that solutions to many problems already exist.

It’s just a matter of making sure that these solutions are implemented. Best practices, especially cybersecurity education, should be compulsory. Also, modern security technologies designed to counter new and emerging threats should be maximized and instilled as a vital part of every organization’s security posture.

Source: https://cybersecuritynews.com/cyber-attacks-that-frequently-evade-detection/