Fileless malware is a malicious activity that infects a system using built-in legitimate and native programs. In contrast to other malware programs like ransomware, attackers don’t need to install a malicious program in the system to execute an attack, which makes it hard to detect and prevent. A traditional antimalware solution detects malware by matching files against a database of known malicious programs. However, fileless malware payloads reside in the memory only and do not write any files to the hard drive making it difficult for signature-based security solutions to detect it. Thus, cybersecurity experts agree that attackers are ten times more likely to succeed when executing fileless malware attacks than file-based attacks.

The Rising Threats of Fileless Malware

An analysis by Cyber Threat Intelligence (CTI) team at the Multi-State Information Sharing and Analysis Center (MS-ISAC) indicates that fileless malware will cause 50% of cyberattacks targeting complex enterprise IT environments in 2022. The ability of fileless malware to evade detection by traditional security tools has caused it to be a favorite for hackers, with reports showing that fileless-based attacks tripled between February and March 2022.

Moreover, attackers have increased the use of fileless malware attack techniques, also known as living off the land (LotL) techniques, since the malicious scripts hide in computer memory to utilize the installed librari4es, binaries, and legitimate programs to spread infections across the system.

How Fileless Malware Works

Fileless malware provides attackers with two main benefits; it does not write or leave files on the computer memory making it nearly impossible to detect using traditional antivirus programs. The absence of files means nothing for forensics investigators to discover. But how is it delivered to the target computer system?

Since attackers must inject the malware directly into the memory, they first gain access to the target environment using the known methods. For example, they can exploit unpatched vulnerabilities in installed programs or operating systems, and once they have access, they inject the malware directly into the memory of legitimate applications. Also, using stolen credentials gives hackers an easy way of gaining access and injecting malware.

In addition, attackers can inject fileless malware into the target computer’s systems, files, protocols, and applications under the following scenarios:

• Phishing emails: Attackers craft phishing emails to trick employees into visiting malicious sites or downloading harmful software. Although the websites may appear legitimate, clicking a malicious one loads the fileless malware in the computer memory, permitting hackers to load additional harmful codes remotely and exfiltrating sensitive information.
• Native applications: Hackers target native applications, such as Microsoft PowerShell, and inject malicious code remotely. Legitimate programs running malicious scripts are hard to detect using normal antivirus solutions. For example, injecting the malicious code in Microsoft PowerShell permits attackers to run remote malicious scripts as legitimate PowerShell scripts without detection.
• Websites that appear legitimate: Hackers can create websites that seem legitimate but execute malicious scripts once you visit them. For instance, they may exploit vulnerable Flash plugins and inject malicious code into the browser’s memory.

In other words, fileless malware is designed not to write any files to the disk, as is the case with traditional file-based malware. Instead, attackers write fileless malware directly to the random access memory of trusted applications, such that the application is legitimate to a traditional anti-malware program, whereas the malware runs in the background. It also complicates the work of a forensics examiner since it does not leave traces.

Recommended Prevention Measures

The traditional antivirus solutions relied upon by millions of users cannot detect or prevent fileless malware attacks. Therefore, organizations should implement next-generation endpoint detection and response (EDR) solutions. EDR systems rely on continuous, real-time, and AI-based monitoring to detect unusual patterns, such as sudden changes in outgoing/incoming network traffic, unwanted operations in native applications like PowerShell and Windows Management Infrastructure, and phishing emails, among others.

Additionally, fileless malware attacks seek to exploit human vulnerabilities to be successful. Therefore, organizations should analyze and monitor human and system behaviors to ensure a proactive security approach. For example, a managed service provider leverages cutting-edge tools and solutions to monitor your systems 24/7 to detect behaviors that may enable attackers to inject malicious code into the random access memory of installed software programs. Employees and other end-users should also adhere to the following practices:

• Avoid installing or downloading applications from unknown sources
• Ensure all applications have the latest updates and security patches
• Update the web browsers regularly and avoid clicking on malicious sites
• Be on the lookout for phishing emails

Also, identifying and analyzing attack indicators can enable a proactive method for detecting and stopping fileless malware attacks. Indicators of attack don’t focus on the phases of an attack but instead on identifying signs of an attack in progress. In the case of fileless malware attacks, the indicators of attack include signs of lateral movement and local or remote code execution. In addition, since fileless attacks evade detection by traditional antivirus software, indicators of attack examine the sequences, intent, and context to identify and block malicious actions. Lastly, managed threat hunting services enable round-the-clock proactive intrusion detection, IT environment monitoring, and other subtle incidents that go undetected by conventional security tools.

Sentia Can Help Protect Your Organization From Fileless Malware

While traditional firewalls typically provide stateful inspection of incoming and outgoing network traffic, Sentia’s next-generation firewall includes additional features like application awareness and control, integrated intrusion prevention, and cloud-delivered threat intelligence. These are important attributes for flagging unusual traffic resulting from fileless malware attacks. We will design, procure, manage and monitor your entire network, so you can focus on driving business growth and new initiatives. At the same time, our experts leverage advanced monitoring solutions to detect and mitigate fileless malware in your systems. Our enterprise network security offerings include modern enterprise network management for on-premise, cloud, and hybrid environments. Sentia will work with you to design the optimal services to keep your IT infrastructure safe and operational. Contact Sentia today for a free consultation.