Advanced Malware

So what is advanced malware and how does it work?

As the name suggests, malware is software designed to infect a computer to perform a variety of malicious actions. After exploiting technical or human vulnerabilities in your environment, an attacker will deliver malware to compromise your users’ computers for the purpose of stealing or denying access to information and systems. Antivirus (AV) solutions were introduced to combat known malware files by identifying them using distinct patterns we call signatures. While these solutions are still useful for quickly preventing a certain threshold of basic malware, they’re insufficient at detecting the more common evasive and advanced malware samples seen today, as they rely on human or automated systems to find, analyze, and update a database of malware signatures.

What’s more, modern malware is more adaptive than ever and able to change the way it looks to evade signature-based detection. Using methods the criminals call “packing and crypting,” attackers can repeatedly change a malware file on a binary level, making it look different to antivirus software. Even though the malicious executable still does the exact same thing, it looks like a new file, resulting in AV products missing a piece of malware that they previously knew about. With hundreds of millions of new malware variants discovered each year, signature-based antivirus simply cannot keep up.

How can you defend against advanced malware?

The ever-evolving nature of malware necessitates a new approach to prevention. Advanced malware detection solutions that can identify new malware as early as possible, like Threat Detection and Response (TDR) and APT Blocker from WatchGuard, are essential to defending your organizations against these threats. Both solutions are designed to identify unknown and evasive malware by looking at how the malware behaves, instead of relying on a database of known malware signatures. APT Blocker emulates a host computer in a next-generation sandbox to proactively catch new malware variants. Using a lightweight Host Sensor, TDR provides visibility into potentially malicious behaviors occurring on an endpoint and correlates this information with event data from the network to deliver a comprehensive threat score to guide remediation. What happens when a threat is scored as suspicious? Now, thanks to a tight integration with TDR, you can triage threats buy sending suspicious files directly from the Host Sensor to APT Blocker for deep analysis and re-scoring.