McAfee Report Finds New Malware Evolving to Evade ‘Sandboxes’

The anti-malware business has long been a ‘cat-and-mouse’ game with hackers increasingly trying to outmaneuver security vendor technologies. According to the McAfee Labs June 2017 Threat report, the most common evasion technique now used by malware to avoid being detected is anti-sandboxing. Sandboxes are commonly used by security researchers and technologies to isolate running processes and limit risks. Overall, McAfee Labs reported that in the first quarter of 2017 the volume of new malware variants it detected grew on a quarterly basis. New ransomware variant detection also grew in the first quarter, according to McAfee Labs. In this slideshow, eWEEK takes a look at some of the highlights of the 83-page June 2017 McAfee Labs Threat Report.

According to McAfee Labs, the most common evasion technique in use by malware is anti-sandboxing at 23.3 percent.

The Fareit password stealing malware was first reported back in 2011 by Microsoft. Even though it’s not a new threat, McAfee Labs is still detecting Fareit attacks against its customers.

In the first quarter of 2017, McAfee Labs reported that the volume of new malware variants it detected grew, after declining in the fourth quarter of 2016.

As the overall volume of malware is growing, so too is the total number mobile malware samples detected by McAfee Labs. At the end of the first quarter, the total volume of mobile malware surpassed 16 million samples.

While many forms of new malware are growing, that’s not the case with macOS malware. After spiking higher in the fourth quarter of 2016, the volume of new macOS malware declined on a quarterly basis, at the beginning of 2017.

McAfee Labs detected more new ransomware variants in the first quarter of 2017 than in the fourth quarter of 2017.

A rare bright spot was McAfee Labs’ finding that the number of new phishing web addresses it detected in the first quarter of 2017 declined on a quarterly basis.

Spam is often propagated across the web via botnets. According to McAfee Labs, the most prevalent spam botnet in the first quarter is Gamut representing 54 percent of spam botnet volume.

While botnets can reside anywhere in the world, more botnet command and control servers are located in the U.S. than anywhere else in the world.