Why Organisations Must Get to Grips With Cloud Delivered Malware

Netskope has just published the Monthly Threat Report for February, with this month’s report focused on what is going on in  Europe. I don’t intend to summarise the report in this blog, instead I want to zoom in and  study a continuing trend that was highlighted in there; one that is unfortunately heading in the wrong direction. 

The trend I am referring to is the shift from web hosting of malware (usually via compromised websites) to the hosting of malware in cloud apps (including popular collaboration and file sharing services). This approach has been a common method used for targeted attacks for some time. However, both globally and across Europe, we witnessed a milestone in December 2022. For the first time, cloud-hosted malware became the most prominent hosting method, overtaking general web-hosting.  In the past 12 months, the popularity of cloud malware delivery in Europe has risen from 33%of all malware in to 53%, a greater increase than that seen globally (a 20% hike in Europe, and a 12% hike globally).

The reason? Attackers can stay somewhat under the radar by delivering malicious content via popular cloud apps and they have now learnt how to do this at scale. Abusing cloud apps for malware delivery enables attackers to evade security controls that rely primarily on domain block lists and URL filtering. Furthermore, many organisations whitelist common collaboration services, to avoid advanced detection tools slowing down access. . 

Over the last 12 months, a third of cloud delivered malware detected by Netskope was hosted in Microsoft services, with Github, Amazon S3, and Sourceforge also being popular hosting locations–all services that most organisations would not block.

Now, more so than ever before, organisations need to consider how to deal with this increasing risk exposure. Part of the answer is of course using best of breed endpoint detection, but we must look at this earlier in the attack chain if we want to reduce our risk exposure. 

Organisations should make sure that they have a web and cloud filtering tool that:

1. Offers instance awareness-a filter that can understand the difference between access to a corporate OneDrive instance, a business partner OneDrive instance or a personal or other third party instance. 

2. Provides full SSL decryption and analysis of ALL SaaS app traffic.

3. Can understand the language used by today’s SaaS apps and be able to identify the action being undertaken by a user (JSON and API)

4. Provides a zero trust-based access policy, designed to allow the user to only complete actions needed to complete their task and nothing more. 

5. Can undertake this deep analysis, including malware scanning and SSL decryption without impacting the user experience.  Ideally it offers processing latency SLAs encompassing all the aspects referenced above. 

All too often organisations make life easy for the threat actors by allowing blanket access to SaaS apps, especially those that are officially selected and managed by the organisation. But why allow access to ALL OneDrive accounts, why allow users to download files from third-party stores, when they typically do not need this level of access to complete day to day tasks?

It is time for organisations to take steps to block and detect such threats earlier in the attack chain, before it even hits the endpoint. Here at Netskope, we work with organisations to help them reduce risk, accelerate performance, and get unrivalled visibility into any cloud, web, and private application activity, day in and day out. It’s just one of the reasons why Netskope’s Security Service Edge platform is the choice of many of the world’s largest organisations. 

Our February 2023 Threat Report is available here and or you can read a summary of the January threat landscape here.