What is Malware?

Malware is a malicious software designed by a cyber criminal attempting to infiltrate a device and disrupt, steal, or exploit sensitive information. There are many types of malware and each involve a different method of exploitation. However, in most cases the cyber criminal wants to gain access to information that could harm the user to either financially benefit themselves through the form of a ransom or identity theft.

Malware works by exploiting vulnerabilities in computer systems or software to gain unauthorized access and perform malicious actions. Once a system is infected with malware, it can spread to other systems and networks, making it difficult to detect and remove. Usually, threat actors are attempting to steal sensitive information, install ransomware, or send spam.

Malware can be installed into your systems in several ways including:

• Phishing attacks
• Social engineering
• Exploiting software vulnerabilities

Malware is a malicious software designed by a cyber criminal attempting to infiltrate a device and disrupt, steal, or exploit sensitive information. There are many types of malware and each involve a different method of exploitation. However, in most cases the cyber criminal wants to gain access to information that could harm the user to either financially benefit themselves through the form of a ransom or identity theft.

Viruses

Common types of malware include viruses, which attach to legitimate programs and execute their malicious code when the host program runs. These can spread quickly, corrupting files, damaging system functionality, and locking users out of their computers. Viruses often spread through email attachments, infected downloads, and compromised websites.

Trojans

Another common type of malware is Trojans. These deceptive programs masquerade as legitimate software but deliver harmful payloads once installed. Trojans can steal personal data, install additional malware, or create backdoors for cybercriminals to access the system later. They often spread through fake software downloads and phishing emails.  

Ransomware

Among the most common types of malware is ransomware, which encrypts victims' files and demands payment for their release. This type of malware is highly profitable for cybercriminals and can cause significant disruption to individuals and organizations. Ransomware typically spreads through phishing emails, malicious attachments, and compromised websites.

Adware

Adware is another common type of malware that pushes unwanted advertisements on users. Among the common types of malware, adware can severely disrupt user experience and compromise security by redirecting browsers, displaying intrusive ads, and collecting personal data without consent. This common type of malware often comes bundled with free software downloads. Adware is one of the common types of malware that can affect any device connected to the internet.

Spyware

Spyware, a common type of malware, secretly monitors user activity and collects sensitive information without consent. As a common type of malware, spyware can be misused for identity theft, financial fraud, or other malicious purposes. Spyware can track keystrokes, capture screenshots, and monitor browsing habits. This common type of malware typically spreads through software vulnerabilities, malicious downloads, and email attachments. Spyware is one of the common types of malware that poses a significant threat to personal privacy.

Botnets

Botnets are networks of infected devices controlled remotely by cybercriminals. As a common type of malware, botnets are often used to launch large-scale attacks like DDoS (Distributed Denial of Service), send spam emails, and distribute additional malware. Botnets, another common type of malware, spread by exploiting software vulnerabilities and infecting multiple devices across a network. Botnets are among the common types of malware that can cause widespread disruption and damage.

Malvertising

Malvertising, or malicious advertising, is a common type of malware that embeds harmful code into legitimate ads. When users interact with these ads, their devices can become infected, leading to data theft, system compromise, and other security issues. This common type of malware spreads through online ad networks and can affect even reputable websites. Malvertising is one of the common types of malware that leverages the reach of online advertising to spread widely.

To prevent malware, you should use antivirus software, keep your operating system and software up to date, avoid clicking on suspicious links or downloading files from untrusted sources, and use strong passwords and multi-factor authentication. 

Malware can enter your systems in various ways. However, Email is the main attack vector for businesses and organizations because of the frequency and quantity of communication that is hosted on email platforms. Security professionals can take several advanced measures to better protect against malware in end user’s inboxes including:

• ‍Staying up to date on the latest trends in email security‍
• Implementing AI powered security solutions to protect against AI powered attacks‍
• Identifying and prioritizing highly vulnerable employees and improving employee training programs

Further, malware attack prevention tips include:

• Using next-generation firewalls, content filtering, and data leak prevention systems
• Strong passwords and multi-factor authentication are crucial for malware attack prevention
• Always use official apps and websites to avoid malware risks.
• Delete programs you don’t use to minimize potential vulnerabilities.
• Regularly back up your data to protect against data loss from malware attacks.

By following these guidelines and remaining vigilant, you can significantly reduce the risk of malware compromising your systems and personal information.  

Identifying Malware Attacks on Different Devices

Understanding how to identify malware attacks on various devices is crucial for effective malware attack prevention. Different devices may exhibit unique signs of infection. Below, we explore common indicators and methods for identifying malware attacks on computers, smartphones, tablets, and other connected devices.

Malware on Mobile Devices

Android

On Android devices, signs of malware include a rapidly draining battery, unexpected charges on bills, sudden increases in data usage, and the appearance of apps that the user didn’t download. These indicators suggest that malicious software may be running in the background, consuming resources, and sending data without your knowledge. Android malware can spread through various means, including malicious apps, phishing emails, and compromised websites. Regularly updating your phone’s software and using security apps from reputable sources can help mitigate these risks.

iPhone

For iPhones, a common indicator of malware is an unintentionally jailbroken device. In more covert cases, look for anything unfamiliar that you wouldn’t normally have on your iPhone, such as unknown apps, strange messages, or random events in your calendar. Unusually high data and power usage can also signal malware. iPhone attacks often occur on jailbroken or outdated phones, where security vulnerabilities are more prevalent. The App Store contains antivirus applications that allow you to reset your iPhone and remove any malicious materials. However, be careful of trojans posing as antivirus software and ensure your security tools are from reputable and verified sources.

Malware on a Mac or PC

Macs

Macs have built-in protection features that help safeguard against malware, but they are not invulnerable. Recently, there has been an increase in Mac-related attacks due to Apple’s growing popularity. You can check for malware on a Mac desktop or laptop by using antivirus software or running a malware scan using the built-in protection feature that comes with macOS. For more covert cases, look for unfamiliar apps, strange messages, or unusual events in your calendar. High data and power usage can also indicate malware. Updating your software to the latest macOS version is crucial, as updates often include patches that improve security. If necessary, manually delete malicious files or reset your Mac to its original factory settings. Always ensure that your security tools are from reputable and verified sources to avoid trojans posing as antivirus software.

PCs

PCs can experience attacks from various sources, including downloaded files, malicious hidden codes in software or videos, malicious websites, and email attachments. Common signs of malware infection on a PC include slow performance, unexpected crashes, frequent pop-up ads, and changes to browser settings or the appearance of unfamiliar programs. Malware can also cause a sudden increase in internet activity, consume system resources, and disable antivirus products. To prevent these issues, use reputable antivirus software, keep your operating system and applications up to date, and avoid clicking on suspicious links or downloading files from untrusted sources. Regularly backing up your data and performing system scans can also help detect and remove malware. For more information on Apple’s response to malware, visit their official support page.

A top indicator of malware is an unintentionally jailbroken iPhone. For more covert cases, check for anything unfamiliar that you wouldn’t normally have on your iPhone: apps, strange messages, or random events in your calendar. Other ways to check for malware is to be observant about power and data usage. Unusually high usage of both data and energy is a sign of malware.

The App Store contains antivirus applications that allow you to reset your iPhone and remove any malicious materials.

Be careful of trojans posing as AVs on the App Store, ensure your security is from a reputable and verified source.

You can check for malware on a Mac desktop or laptop by using an antivirus software or running a malware scan using the built-in protection feature that comes with macOS or you can manually delete malicious files or reset your Mac to its original factory settings.

You also want to update your software to the latest macOS software. Updated software usually includes patches that improve your security posture, making it very important to keep your Mac up to date.

For more information on Apple’s response to malware visit here.

If malware is downloaded onto your device you should:

1. Disconnect from the internet and restart your device. 
2. You should also scan and remove any malicious programs with a virus scanner. 
3. Check to see if you have any anti-malware or other security solutions on your device. If not, download it.
4. Make sure all software and applications are up to date.
5. Contact the manufacturer of your device for additional tech support.

Manually deleting suspicious files and restoring your device to its previous state is also possible but is not a foolproof process.

Malware is a serious security risk and can have devastating consequences to organizations that fall victim to an attack. Darktrace provides cybersecurity that defends against never before seen malware strains and can help security teams prevent, detect, respond to, and recover from a malware infection.

Raccoon Stealer is a MaaS (Malware-as-a-Service) that was first publicized in 2019. It grants its customers, which it calls “affiliates,” access to info-stealer software, which is an easy-to-use automated backend panel hosting C2 infrastructure, with 24/7 customer support. Raccoon Stealer’s end goal is to access sensitive data saved in targets’ browsers and crypto-currency wallets, such as cookies, saved login details, saved credit card details, and crypto-currency keys and seed phrases. Losing this information to a cyber-criminal can have detrimental effects to an organization or individual, including account takeovers, financial losses, and greater compromises.  

In March 2022, Racoon Stealer’s operators announced the end of the project. A few months later, Racoon stealer v2 was unleashed, continuing the same means and ends as Raccoon Stealer v1.

Raccoon Stealer communicates with a remote server controlled by the attackers, sending the stolen data for storage or sale on the dark web. The malware is designed to avoid detection by security software by using anti-debugging and anti-virtualization techniques.

Darktrace has consistently picked up on several instances of Raccoon. In particular, in the below examples the affected device’s downloads of library files from the C2 server caused an alarm in the system and a quick response by Darktrace’s 24/7 SOC team.

Learn more about the Raccoon Stealer v1

Learn more about the Raccoon Stealer v2

Laplas Clipper is a MaaS (Malware-as-a-Service) offering a variant of info-stealing malware that targets crypto-currency platforms. This malware has the capability to hijack in-progress transactions of certain crypto-currencies and send the funds to the attacker’s crypto-wallet instead.

In late 2022, Darktrace observed several threat actors employing a novel attack method to target crypto-currency users across its customer base, specifically with the latest version of Laplas Clipper. Darktrace was able to uncover and mitigate the activity and intervene to prevent the theft of large sums of digital currency.

Learn more about the Laplas Clipper