Malicious Code: Real Life Examples and 14 Protective Measures

What Is Malicious Code?

A malicious code attack refers to the deployment of harmful software or scripts designed to cause unwanted outcomes, compromise security, or inflict damage on a system. This broad category encompasses various cyber threats such as viruses, worms, Trojans, backdoors, and malicious active content.

Malicious code attacks can involve known strains of malware that can be detected and blocked by traditional antivirus software. However, there are advanced malware techniques such as permutation, encryption, rootkits, and antimalware evasion methods, which require advanced anti-malware protection based on behavioral analysis. Once infiltrated, malicious code can spread throughout network drives and propagate.

This is part of a series of articles about vulnerability management

In this article:

Types of Malicious Code Attacks
Examples of Malicious Code Attacks
WannaCry Ransomware
Stuxnet Worm
NotPetya
Mirai Botnet
SolarWinds Attack
Microsoft Exchange Vulnerability
Kaseya Ransomware Attack
NVIDIA Attack
Costa Rica Ransomware
14 Tips for Protecting Against Malicious Code Attacks

How Can Malicious Code Cause Damage?

Malicious code can cause damage in various ways, depending on the type and purpose of the code. It can compromise data, steal sensitive information, disrupt system operations, and spread to other devices or networks. Here are some ways malicious code can cause damage:

Unauthorized access: Malware can exploit vulnerabilities in software or operating systems to gain unauthorized access to a system. This allows attackers to control the infected device, steal sensitive information, or use it as a launchpad for further attacks.
Data theft: Malware can be designed to steal sensitive data, such as login credentials, financial information, personal identification data, or intellectual property, which can be used for identity theft, financial fraud, or corporate espionage.
Data corruption or deletion: Some types of malware can alter, corrupt, or delete data on the infected system, leading to data loss, system instability, or application failures.
System disruption: Malware can consume system resources, cause crashes, or create performance issues, disrupting the normal operation of a device or network. For example, ransomware can encrypt files and demand payment for their release, rendering the system unusable until the ransom is paid or the files are restored.
Network propagation: Many types of malware are designed to spread across networks or to other devices, either directly or through social engineering tactics like phishing emails. This can lead to widespread infections, network congestion, or the spread of malware to other organizations.
Espionage and surveillance: Some malware is designed to secretly monitor user activities, record keystrokes, capture screenshots, or access the device’s microphone or camera for eavesdropping or surveillance purposes.
Sabotage and destruction: In some cases, malware can be designed to cause physical damage to hardware or infrastructure. For example, the Stuxnet worm targeted industrial control systems and caused physical damage to Iranian nuclear centrifuges.
Reputation damage: Businesses and organizations affected by a malware attack can suffer significant reputational damage, resulting in a loss of trust, decreased customer confidence, and potential legal consequences.

Types of Malicious Code Attacks

Here are some common types of malicious code attacks:

Social engineering

Social engineering involves manipulating individuals into divulging sensitive information or performing actions that compromise security. Attackers may use psychological tactics, such as posing as trusted entities, to trick users into revealing passwords, clicking on malicious links, or downloading harmful files.

Spyware

Spyware is a type of malicious software designed to secretly monitor and collect information about a user or an organization. It often operates covertly, recording keystrokes, browsing history, and personal data to transmit back to the attacker.

Trojan horse

A Trojan horse is a malicious program disguised as legitimate software. Once installed, it grants unauthorized access to the attacker, enabling them to steal data, install other malware, or control the system remotely.

Malicious scripts

Malicious scripts are pieces of code embedded in websites, emails, or files that execute harmful actions when triggered. These scripts can be used to exploit vulnerabilities, spread malware, or perform unauthorized actions on a user’s device.

Vulnerability exploitation

This type of attack occurs when an attacker exploits weaknesses in software or hardware to gain unauthorized access, execute malicious code, or compromise system integrity. Vulnerability exploitation often relies on unpatched systems or software flaws that have not been addressed by the vendor.

Supply chain exploits

Supply chain exploits involve compromising a product or service at some point during its development, distribution, or installation process. Attackers may insert malicious code into software, tamper with hardware components, or compromise third-party providers to gain access to the target environment.

Compromised accounts

Compromised accounts result from unauthorized access to user credentials, usually through phishing, social engineering, or weak passwords. Attackers can use these credentials to infiltrate systems, steal sensitive information, or launch further attacks.

Logic bombs

Logic bombs are malicious code segments embedded within legitimate software that activate under specific conditions, such as a certain date or event. Once triggered, logic bombs can cause significant damage, including data corruption, system crashes, or the deletion of crucial files.

These are some of the most common types of malicious code attacks, and new types of malware are constantly being developed. It is important for individuals and organizations to take steps to protect against these attacks, such as keeping software up to date, using anti-malware software, and being cautious when opening emails or attachments from unknown or untrusted sources.

Examples of Malicious Code Attacks

Here are a few high profile examples of malicious code that caused widespread damage.

WannaCry Ransomware

Initially discovered in May 2017, the WannaCry ransomware exploited a vulnerability in Microsoft Windows that allowed it to spread from one infected system to others on the same network. Once a system was infected, WannaCry encrypted the victim’s files and demanded a ransom payment. It spread globally, infecting hundreds of thousands of computers in over 150 countries, including hospitals, universities, and businesses. In some cases, the attack disrupted entire organizations, preventing them from accessing important data and files.

Stuxnet Worm

The Stuxnet computer worm was discovered in 2010. It was designed to target industrial control systems (ICS) used in critical infrastructure, such as nuclear power plants and manufacturing facilities. It is believed Stuxnet was used to attack Iran’s nuclear power program. Once Stuxnet infects a system, it can take control of the ICS and manipulate the operations of the associated machinery, such as the centrifuges used in uranium enrichment.

NotPetya

NotPetya was a destructive malware attack that began in Ukraine in June 2017 and quickly spread to other countries. The malware was initially spread through a software update of an accounting program used in Ukraine. Once a system was infected, the malware began to spread through the network and destroy data. NotPetya caused significant damage to businesses and critical infrastructure, including the shipping and logistics industries.

Mirai Botnet

Mirai is a malware that turns networked devices into remotely controlled “bots” that can be used as part of a botnet in large-scale network attacks. The malware targets devices such as Internet of Things (IoT) devices, which often have weak security, and turns them into bots that can be used to launch Distributed Denial of Service (DDoS) attacks.

The Mirai botnet was responsible for several high-profile DDoS attacks, including one in 2016 that temporarily disabled the domain name system (DNS) provider Dyn, resulting in widespread internet disruption.

SolarWinds Attack

In December 2020, it was revealed that the software company SolarWinds had been the target of a supply chain attack, in which attackers implanted malicious code into an update of the company’s network management software. The attack affected several US government agencies and a large number of private companies.

Microsoft Exchange Vulnerability

In March 2021, Microsoft announced that a Chinese state-sponsored hacking group had exploited vulnerabilities in its Exchange Server software to steal data from organizations in the US and other countries. The attack affected thousands of organizations, including government agencies, businesses, and nonprofits. Microsoft released patches to address the vulnerabilities, but it is believed that many organizations were still affected for months after the attack.

Kaseya Ransomware Attack

In July 2021, a supply chain attack targeting the software company Kaseya affected up to 1,500 of its customers, many of which were managed service providers. The attack involved the distribution of ransomware through Kaseya’s VSA software, which is used to remotely manage and monitor customer endpoints. The attack is believed to have been carried out by the Russian-affiliated group REvil.

NVIDIA Attack

In February 2022, NVIDIA disclosed it fell victim to a ransomware attack, which compromised NVIDIA’s internal systems and caused disruption to email and developer tools. It took the chip company two days to get these systems partially running. Leaked messages between the ransomware group and NVIDIA show that the group stole over 1TB of sensitive data, customer information, employee login credentials, and source code. It is unclear if NVIDIA paid the ransom, but some data was leaked online during the week of the attack.

Costa Rica Ransomware

In April 2022, the Costa Rican government declared a national emergency after ransomware attacks struck 30 government institutions over several weeks. A Russian ransomware group called Conti claimed to have launched the attack, which encrypted sensitive information and threatened to leak the data. It disrupted the country’s tax and customs systems, civil servant payroll, foreign trade, and healthcare. However, the Costa Rican government refused to pay the ransom, and the group publicly released 50% of the encrypted data.

14 Tips for Protecting Against Malicious Code Attacks

Here are some steps individuals and organizations can take to protect against malicious code attacks:

Keep software up to date: Regularly update all software and operating systems to ensure that vulnerabilities are patched and security measures are up-to-date.
Use anti-malware software: Install and regularly update anti-malware software, such as antivirus or anti-spyware programs, to help detect and remove malicious code.
Be cautious with emails and attachments: Be cautious when opening emails or attachments from unknown or untrusted sources, as they may contain malicious code.
Use strong passwords: Use strong, unique passwords for all online accounts, and use multi-factor authentication whenever possible.
Back up data: Regularly back up important data to a secure location, such as an external hard drive or cloud storage service, in case a malicious code attack results in data loss.
Use a firewall: Use a firewall to help prevent unauthorized access to a computer or network and to control the flow of incoming and outgoing network traffic.
Monitor network activity: Regularly monitor network activity for unusual or suspicious behavior, such as unexpected traffic or new devices connecting to the network.
Endpoint protection: Deploying endpoint protection software on all endpoints, such as laptops, desktops, and servers, to detect and prevent malware from spreading.
Network segmentation: Segmenting the network into smaller segments to limit the spread of malware and prevent unauthorized access to critical systems.
Sandboxing: Isolating applications and processes in a virtual environment, such as a sandbox, to prevent malware from spreading or causing harm.
Multi-factor authentication: Requiring multiple forms of authentication, such as a password and a security token, to access critical systems and data, which can prevent unauthorized access.
Email security: Implementing email security measures, such as spam filters and content filtering, to prevent malicious emails from reaching end-users.
Patch management: Regularly applying security patches and updates to software applications and systems to address vulnerabilities and prevent exploitation.
User education and awareness: Educating employees on safe computing practices, such as avoiding suspicious emails and links, and maintaining strong passwords, to reduce the risk of malware infections.

By implementing these measures and staying vigilant, individuals and organizations can help protect themselves against malicious code attacks.

Learn More About Vulnerability Management

Open Source Vulnerability Scanning: Methods and Top 5 Tools

Open source vulnerability scanners, often used as part of Software Composition Analysis (SCA) tools, are used to detect open source components used in software projects, and check if they contain unpatched security vulnerabilities, and help organizations remediate them. These tools scan complex dependency trees, because vulnerabilities can be found in a dependent library used by the main component or brought into an application during the build phase. Learn how open source vulnerability scanning works and discover tools that can help you identify and remediate vulnerabilities in OSS components and containers.

Trivy Vulnerability Scanner Adopted by Leading Cloud Native Platforms

Trivy is a comprehensive and easy-to-use open source vulnerability scanner for container images. Unlike other open source scanners, Trivy covers both OS packages and language-specific dependencies and is extremely easy to integrate into organizations’ software development pipelines. Trivy vulnerability scanner is being added as an integrated option in the CNCF’s Harbor registry, in GitLab, and in Mirantis Docker Enterprise.
Read more: Trivy Vulnerability Scanner Adopted by Leading Cloud Native Platforms