More and more malware is now attacking virtual infrastructure

Data Breach
(Image credit: Shutterstock)

More cybercriminals are customizing their malware to attack virtual machines and other virtualized resources, new research has found.

The Cybersecurity Threatscape Q1 2021 report from Positive Technologies revealed that the number of cyberattacks increased by 17% compared to Q1 2020.

Interestingly, it added that 77% of the total incidents in Q1 2021 were targeted attacks and involved malware geared for attacking virtual infrastructure.

TechRadar needs you!

We're looking at how our readers use VPNs with streaming sites like Netflix so we can improve our content and offer better advice. This survey won't take more than 60 seconds of your time, and you can also choose to enter the prize draw to win a $100 Amazon voucher or one of five 1-year ExpressVPN subscriptions.

>> Click here to start the survey in a new window <<

“Attackers carefully monitor information about new vulnerabilities and try to find a use for these in their attacks as soon as possible. In early 2021, Positive Technologies researchers helped eliminate several critical vulnerabilities in VMware products, including in vCenter Server, which allowed remote code execution,” said Dmitry Serebryannikov, Director of Security Analysis, Positive Technologies.

Serebryannikov adds that even after the vulnerability was patched, security researchers noticed threat actors were continuing to scan the Internet for vulnerable hosts. 

The rise of ransomware

Perhaps unsurprisingly, ransomware emerged as the malware that is most often used by attackers, accounting for nearly two-thirds (63%) of all malware attacks.

The report notes that in addition to demanding “astronomical” ransoms in Q1 2021, the ransomware operators also refined the tools in their arsenal, most notably coding in new ways to veil them from security tools.

The number of attacks towards IT companies remained consistently high for the second quarter in a row, the report finds, in order to steal customer data or launch further attacks on their customers.

However, it was Governmental institutions that once again topped the rankings for being the most popular target.

The widely reported ProxyLogin vulnerabilities in Microsoft Exchange emerged as the most popular vulnerability this quarter. Also noteworthy was the use of a zero-day vulnerability in SonicWall’s VPN solutions that threat actors used not just to break into the company, but also to launch attacks on its customers. 

TOPICS
Mayank Sharma

With almost two decades of writing and reporting on Linux, Mayank Sharma would like everyone to think he’s TechRadar Pro’s expert on the topic. Of course, he’s just as interested in other computing topics, particularly cybersecurity, cloud, containers, and coding.

Read more
Android phone malware
Over 25 new malware variants created every single hour as smart device cyberattacks more than double in 2024
A person holding out their hand with a digital AI symbol.
This ransomware gang is using SSH tunnels to target VMware appliances
ransomware avast
“Every organization is vulnerable” - ransomware dominates security threats in 2024, so how can your business stay safe?
Best email services: image of email with one unread message alert
Over 400 million unwanted and malicious emails were received by businesses in 2024
Pirate skull cyber attack digital technology flag cyber on on computer CPU in background. Darknet and cybercrime banner cyberattack and espionage concept illustration.
Criminals are using a virtual hard disk image file to host and distribute dangerous malware
A laptop with a red screen with a white skull on it with the message: &quot;RANSOMWARE. All your files are encrypted.&quot;
More reports claim 2024 was the worst year for ransomware attacks yet
Latest in Security
Isometric demonstrating multi-factor authentication using a mobile device.
NCSC gets influencers to sing the praises of 2FA
Sam Altman and OpenAI
OpenAI is upping its bug bounty rewards as security worries rise
A stylized depiction of a padlocked WiFi symbol sitting in the centre of an interlocking vault.
Dangerous new CoffeeLoader malware executes on your GPU to get past security tools
China
Notorious Chinese hackers FamousSparrow allegedly target US financial firms
A digital representation of a lock
NYU website defaced as hacker leaks info on a million students
NHS
NHS IT supplier hit with major fine following ransomware attack
Latest in News
Google Pixel Watch 3 side dial and button
Google Gemini reportedly spotted on Wear OS – could a rollout be close at hand?
Nintendo Switch 2 Joy-Con up-close from app store
Nintendo's new app gave us another look at the Switch 2, and there's something different with the Joy-Con
cheap Nintendo Switch game deals sales
Nintendo didn't anticipate that Mario Kart 8 Deluxe was 'going to be the juggernaut' for the Nintendo Switch when it was ported to the console, according to former employees
Toni Collette in Hereditary
Everything leaving Netflix in April 2025 – from the scariest movie ever made to a beloved DreamWorks animation with 99% on Rotten Tomatoes
Three angles of the Apple MacBook Air 15-inch M4 laptop above a desk
Apple MacBook Air 15-inch (M4) review roundup – should you buy Apple's new lightweight laptop?
Witchbrook
Witchbrook, the life-sim I've been waiting years for, finally has a release window and it's sooner than you think