Cyber criminals targeting vulnerable Malaysian servers in their attacks

The number of malware attacks targeting vulnerable servers in Malaysia has significantly increased 150% in Q2 2021, said cybersecurity company Kaspersky.

In a statement today, it said fresh data from Kaspersky Security Network (KSN) indicated that in Q2 of 2021, cybercriminals utilized the servers located in Malaysia more to launch online threats. From just 204,313 attacks triggered by local servers from January to March, it ballooned to an alarming rate of 150% uptick with 512,014 incidents.

Yeo Siang Tiong, general manager for Southeast Asia at Kaspersky said with Malaysia’s digitalization drive to welcome investments in building more data center locally, it is important to include cybersecurity in the development of data centers.

“This will be beneficial for the country’s people and economy, but it is important to also include cybersecurity in this development. It is clear that cybercriminals are aware of the country’s move to be the next digital hub in the region, hence now is the best time to equip servers and systems with holistic cyber defenses,” Yeo said.

According to the statement, KSN also reported it has detected 28,931,223 unique internet-borne cyberthreats on computers in the second quarter of 2021. This is 10 million more compared with the attacks blocked during the first three months of 2021.

As most companies are closed at the moment due to the continuing pandemic situation in Malaysia, the local threats data from KSN showed a 36.5% reduction from 13,351,628 recorded in the first quarter to 8,475,567 in the second quarter of 2021.

In many cases, malware attempts through removable USB drives, CDs and DVDs and other ‘offline’ methods were observed between the first and the second quarter of 2021.

These infection attempts are often used by cybercriminals to penetrate systems. Such attacks usually take place when users visit infected websites.

The most dangerous is the fileless malware which can be extremely difficult to detect and remove, as its malicious code uses registry or Windows Management Instrumentation (WMI) subscriptions for persistence, leaving no single object for static analysis on the disk. 

To protect your organizations from advanced persistent threats (APTs) and other advanced attacks, Kaspersky recommends the following:

• Provide your Security Operation Centre (SOC) team with access to the latest threat intelligence and regularly upskill them with professional training.
  
• Provide your staff with basic cybersecurity hygiene training, as many targeted attacks start with phishing or other social engineering techniques.

• Install robust enterprise cybersecurity solutions which can help against high-profile threats such as Kaspersky Managed Detection and Response (MDR) and Kaspersky Optimum Framework.