SEATTLE – April 5, 2022 – WatchGuard® Technologies, a global leader in network security and intelligence, advanced endpoint protection, multi-factor authentication (MFA) and secure Wi-Fi, announced today findings from its most recent quarterly Internet Security Report, detailing the top malware trends and network security threats analyzed by WatchGuard Threat Lab researchers. Of note, researchers found a record number of evasive malware detections. Advanced threats increased by 33% indicating a higher level of zero day threats than ever before. Network detections also continued an upward trajectory, with the Americas receiving the majority of attacks.
“The continued shift to a hybrid workforce is making attack surfaces larger and creating more potential security holes for organizations to plug,” says Corey Nachreiner, chief security officer at WatchGuard. “With the highest level of zero-day threats we’ve ever recorded and an attack surface that extends well beyond the network perimeter to IoT, home networks and mobile devices, companies need to adopt a true unified security approach that can adapt quickly and efficiently to the growing threat landscape. Organizations should make a commitment to implementing simple but critically important measures like updating and patching systems on a regular basis so they’re not enabling hackers.”
Other key findings from this Internet Security Report, which analyzes data from Q4 2021, include:
- Total network attack detections continue to climb, highlighting the complexity of network security – The trajectory of network intrusion detections continued its upward climb with the largest total detections of any quarter in the last three years. This also represented a 39% increase quarter over quarter. This may be due to the continued targeting of old vulnerabilities as well as the growth in organizations’ networks; as new devices come online and old vulnerabilities remain unpatched, network security is becoming more complex.
- Malware threats were detected in EMEA at a much higher rate than other regions in the world – Europe, the Middle East and Africa were also the regions most targeted by malware threats in Q4. In fact, EMEA saw malware detections per Firebox (49%) at near or above double the rate as other regions of the world (AMER 23% and APAC 29%).
- 78% of malware delivered via encrypted connections is evasive – Overall, 67% of malware detections arrived over an encrypted connection, and within those malware detections, 78% were evasive zero-day malware threats that evade basic detections. This continues a trend seen in previous quarters. These threats can often be stopped at the perimeter by setting firewalls to decrypt and scan incoming traffic – a step that, unfortunately, many organizations fail to take.
- A new leader in Office exploit malware emerges – Q4 saw a significant incidence of malware targeting Office documents, similar to findings from Q3. CVE-2018-0802 remains on the top 10 malware list, landing at number 5 this quarter, up one spot from last quarter, and remains on the most widespread malware list. Researchers suspect this may have replaced CVE-2017-11882 as the top Office exploit.
- Emotet comes back with a vengeance - Two new malware domains were added this quarter to the list of top malware domains detected by WatchGuard. One of these domains, Skyprobar[.]info, has been linked to Emotet, the banking trojan that has evolved into a C2 and distribution infrastructure malware for other payloads. After diminishing due in part to direct disruption by US law enforcement, the Emotet malware saw a resurgence in Q4 2021.
WatchGuard’s quarterly research reports are based on anonymized Firebox Feed data from active WatchGuard Fireboxes whose owners have opted to share data in direct support of the Threat Lab’s research efforts. In Q4, WatchGuard blocked a total of more than 23.9 million malware variants (313 per device) and nearly 5.9 million network threats (75 per device). The full report includes details on additional malware and network trends from Q4 2021, a detailed analysis of the Log4Shell vulnerability, recommended security strategies and critical defense tips for businesses of all sizes and in any sector, and more.
For a detailed view of WatchGuard’s research, read the complete Q4 2021 Internet Security Report here.