Malware

WatchGuard study advises security teams to focus on examining encrypted traffic at the perimeter.

Morphisec researchers noted that the new delivery chain uses the Nitro Pro PDF application, commencing with the distribution of a more than 100 MB MSI installer payload, which uses the Advanced Installer app for obfuscation and enables threat actors to evade anti-malware engines.

WSL created an attack surface that has allowed adversaries to introduce malware with little chance of AV detection.

Infosec teams struggle to detect Linux-based threats such as Vermillion Strike due to an overemphasis on Windows malware, a lack of effective solutions for protecting data centers, and the immaturity of sandboxes.

In separate reports Thursday, Akamai detailed two threats: One new, complex miner targeting WordPress, and a Linux miner that just learned to speak Windows.

Adversaries use the storage mechanism as a way to hide second-stage malware payloads, knowing that "no one in security really knows the exact structure of these files except Microsoft, said one security expert.