Are you ready for state-sponsored zombie malware attacks?

On January 4, 2017 CTO Vision published a blog post titled “Are you ready for a state-sponsored cyber attack?” In hindsight, the blog post should have been titled “Are you ready for state-sponsored zombie malware attacks?”

Zombie malware combines the most deadly aspects of malware and zombie computers into one horrible mess. Typically malware gets into a compute device via phishing or email attachment which limits the scale of the attack. In contrast, zombie malware autonomously hunts for vulnerable systems across LAN, WiFi and VPN connections. Once zombie malware finds a system to infect, it utilizes the new host to scan for other systems which can be anywhere on the globe.

Another key aspect of zombie malware is the lack of a control channel to manage its destructive path (unlike zombie computers used in DDoS attack). Subsequently zombie malware just destroys anything it can connect to.  For example, the NotPetya started on Ukraine government systems but then quickly spread around the globe.

Given the last three zombie malware attacks were outside the USA on older Windows XP systems one might be led to believe the American companies are safe. Unfortunately the combination of global supply chains and BYOD make American companies highly vulnerable to zombie malware. More important, the posting of CIA’s Vault 7 files on Wikileaks was designed to escalate the number of zombie malware attacks by broadcasting vulnerability information to cyber combatants. In short, America’s enemies are attempting to launch a zombie apocalypse by increasing number and lethality of malware attacks.

Countermeasure against autonomously hunting malware (or how to stop zombie apocalypse)

Building on the five countermeasures from the original January 2017 blog post, here some additional items you should be implementing to avoid the zombie apocalypse.

Deploy endpoint protection. There is a new generation of endpoint protection systems that is not reliant on signatures (and thanks to the Wikileaks the new attacks won’t have any). While you can’t do anything about BYOD or supply chain partners devices, at least the devices that manage your critical assets will be safe.

Lock down LAN, WiFi and VPN networks. A key feature of zombie malware is its lateral movement capability that allows it to autonomously traverse LAN, WiFi and VPN networks. Enabling “port isolation” which is a standard features on enterprise switches is recommended. Additionally VPN connections should be filtered so that only authorized applications can utilize them.

Limit access privileges. If you allow a user access to everything, any zombie malware on their device will also get to everything. Implement role-based access control on your data center and cloud systems. Ensure you have solid east-west partitioning in place.

Allow only application layer access. Only authorized applications from a user’s device should have access to network and application resources.  Consider moving away from the older network access VPN model to newer application layer access solutions like software defined perimeter.

Backup data to offline stores. Backing up to the cloud is easy and inexpensive. But as more American assets migrate to the cloud, the bigger the target it becomes for a malware attack. You must have an offline data backup so that you can re-start your organization if there’s a catastrophic failure. And hopefully you’ve remembered to store away a few servers and laptops to do this.

Winter is here.



Junaid Islam

CTO at Vidder
Junaid Islam has over 25 years of experience in network and security protocol design. In the early 90's Junaid developed the queing algorithms for Frame Relay at StrataCom which was used by the US military for multilevel precedence and preemption (MLPP). He later developed the first Frame-ATM integration protocol at Cisco which became the foundation for MPLS. After Cisco Junaid worked on a number of US Government research programs.

Currently Junaid is leading the development of the Secure Enclave solutions using the Software Defined Perimeter architecture at Vidder. Junaid is a well respected security expert and has been interviewed by publications such as the Wall Street Journal and Newsweek.

Leave a Reply