More and more malware is now attacking virtual infrastructure

Data Breach
(Image credit: Shutterstock)

More cybercriminals are customizing their malware to attack virtual machines and other virtualized resources, new research has found.

The Cybersecurity Threatscape Q1 2021 report from Positive Technologies revealed that the number of cyberattacks increased by 17% compared to Q1 2020.

Interestingly, it added that 77% of the total incidents in Q1 2021 were targeted attacks and involved malware geared for attacking virtual infrastructure.

TechRadar needs yo...

We're looking at how our readers use VPNs with streaming sites like Netflix so we can improve our content and offer better advice. This survey won't take more than 60 seconds of your time, and you can also choose to enter the prize draw to win a $100 Amazon voucher or one of five 1-year ExpressVPN subscriptions.

>> Click here to start the survey in a new window <<

“Attackers carefully monitor information about new vulnerabilities and try to find a use for these in their attacks as soon as possible. In early 2021, Positive Technologies researchers helped eliminate several critical vulnerabilities in VMware products, including in vCenter Server, which allowed remote code execution,” said Dmitry Serebryannikov, Director of Security Analysis, Positive Technologies.

Serebryannikov adds that even after the vulnerability was patched, security researchers noticed threat actors were continuing to scan the Internet for vulnerable hosts. 

The rise of ransomware

Perhaps unsurprisingly, ransomware emerged as the malware that is most often used by attackers, accounting for nearly two-thirds (63%) of all malware attacks.

The report notes that in addition to demanding “astronomical” ransoms in Q1 2021, the ransomware operators also refined the tools in their arsenal, most notably coding in new ways to veil them from security tools.

The number of attacks towards IT companies remained consistently high for the second quarter in a row, the report finds, in order to steal customer data or launch further attacks on their customers.

However, it was Governmental institutions that once again topped the rankings for being the most popular target.

The widely reported ProxyLogin vulnerabilities in Microsoft Exchange emerged as the most popular vulnerability this quarter. Also noteworthy was the use of a zero-day vulnerability in SonicWall’s VPN solutions that threat actors used not just to break into the company, but also to launch attacks on its customers. 

Mayank Sharma

With almost two decades of writing and reporting on Linux, Mayank Sharma would like everyone to think he’s TechRadar Pro’s expert on the topic. Of course, he’s just as interested in other computing topics, particularly cybersecurity, cloud, containers, and coding.