McAfee Corp, the device-to-cloud cybersecurity company, today released its McAfee Threats Report: November 2020, examining cybercriminal activity related to malware and the evolution of cyber threats in Q2 2020. During this period, McAfee saw an average of 419 new threats per minute as overall new malware samples grew by 11.5 per cent. A significant proliferation in malicious Donoff Microsoft Office documents attacks propelled new PowerShell malware up 117 per cent, and the global impact of Covid-19 prompted cybercriminals to adjust their cybercrime campaigns to lure victims with pandemic themes and exploit the realities of a workforce working from home.
“The second quarter of 2020 saw continued developments in innovative threat categories such as PowerShell malware and the quick adaptation by cybercriminals to target organizations through employees working from remote environments,” said Raj Samani, McAfee fellow and chief scientist. “What began as a trickle of phishing campaigns and the occasional malicious app quickly turned into a deluge of malicious URLs, attacks on cloud users and capable threat actors leveraging the world’s thirst for more information on Covid-19 as an entry mechanism into systems across the globe.”
Each quarter, McAfee assesses the state of the cyber threat landscape based on in-depth research, investigative analysis, and threat data gathered by the McAfee Global Threat Intelligence cloud from over a billion sensors across multiple threat vectors around the world.
Covid-19-themed threat campaigns
After a first quarter that saw the world plunge into pandemic, the second quarter saw enterprises continue to adapt to unprecedented numbers of employees working from home and the cybersecurity challenges this new normal demands. In response, McAfee launched the McAfee Covid-19 Threats Dashboard to help CISOs and security teams understand how bad actors have retargeted increasingly sophisticated techniques toward businesses, governments, schools, and a workforce coping with Covid-19 restrictions and the potential vulnerabilities of remote device and bandwidth security. Over the course of Q2, McAfee’s global network of over a billion sensors observed a 605 per cent increase in Covid-19-related attack detections compared to Q1.
Donoff & PowerShell Malware
Donoff Microsoft Office documents act as TrojanDownloaders by leveraging the Windows Command shell to launch PowerShell and proceed to download and execute malicious files. Donoff played a critical role in driving the 689% surge in PowerShell malware in Q1 2020. In Q2, the acceleration of Donoff-related malware growth slowed but remained robust, driving up PowerShell malware by 117 per cent and helping to drive a 103 per cent increase in overall new Microsoft Office malware. This activity should be viewed within the context of the overall continued growth trend in PowerShell threats. In 2019, total samples of PowerShell malware grew 1,902 per cent.
Attacks on cloud users
McAfee observed nearly 7.5 million external attacks on cloud user accounts. This is based on the aggregation and anonymization of cloud usage data from more than 30 million McAfee MVISION cloud users worldwide during the second quarter of 2020. This data set represents companies in all major industries across the globe, including financial services, healthcare, public sector, education, retail, technology, manufacturing, energy, utilities, legal, real estate, transportation, and business services.