In cybersecurity, malware remains a persistent and growing concern. One of the most dangerous forms of malware is dormant malware, also known as sleeper malware.

This malicious software can remain inactive for extended periods within a system before being activated by cybercriminals, sometimes waiting for months or even years. While there is no precise data on how many systems are infected with dormant malware, certain statistics shed light on the prevalence and potential impact of this hidden threat.

Dormant Malware Prevalence

The term dormant malware refers to malicious programs that are intentionally left inactive, sometimes for months or even years, before being triggered by external, but mainly by internal, conditions – keywords, access to specific files, date events… This form of malware is challenging to detect because it does not show any obvious signs of compromise until activated. Some key data points provide insight into how dormant malware may be affecting systems worldwide:

• 560,000 new malware samples are detected DAILY, contributing to an already staggering total of over 1 billion known malware programs. Many of these could potentially remain dormant within infected systems, waiting for the right conditions to activate [1], with the staggering cost of an average of US$/EUR 4.5 million per incident.
  
• In 2023, the total number of malware attacks worldwide reached an alarming 6+ billion, marking a 10% increase from the previous year [2]. This increase in attacks raises concerns about the growing threat landscape, with dormant malware being a likely factor in many incidents.
  
• A particularly concerning statistic is that nearly every second computer in China is infected with malware, with a 47% infection rate that ranks as the highest globally. Many of these infections could involve dormant malware that is lying in wait for activation [1], and it can spill over into systems worldwide, including the West.

Malware knows no borders, much like influenza.

Factors Contributing to Dormant Malware

There are several reasons why malware might remain dormant in a system. Understanding these threats can help organizations strengthen their defenses and detect them more effectively:

1. Dependency on External Infrastructure: Dormant malware may not activate if it cannot communicate with its command-and-control (C&C) server, which is responsible for sending activation commands. Without this connection, the malware remains inert until the link is re-established [3]. This is my favorite method, ‘air-gapped systems’, but still not safe without certain precautions.
   
2. Internal Component Dependency: Many malware families consist of multiple components that must work together to execute their payload. If a critical component is missing, the malware may remain dormant until the necessary components are present or accessible [3], making it undetectable.
   
3. Missing/Expected Input: Some malware requires specific inputs or conditions to execute, as mentioned before. Without these triggers, such as certain user actions or system events, the malware stays inactive, posing a potential threat that could go undetected until activation [3].
   
4. Broken ‘Packer‘: Malware often uses packers (encryption tools) to evade antivirus detection. If the packer malfunctions or breaks, the malware may fail to unpack and remain dormant, as the broken payload can be replaced or reinitialized when a suitable trigger activates it. [3].

Impact and Detection Challenges

The threat posed by dormant malware is varied. On one hand, its ability to stay hidden for extended periods makes it difficult to detect. On the other hand, when activated, it can cause huge ravages, not only in terms of financial loss but also in exposing individuals’ private lives to the world. Major challenges include:

• Extended Dwell Times: Cybercriminals often rely on extended dwell times, using these inactive periods to plan their attacks carefully and maximize the damage once the malware is activated. The longer the malware stays dormant, the more time attackers have to refine their strategies [6].
  
• Traditional Security Gaps: Traditional perimeter security tools, such as firewalls and antivirus software, may fail to detect dormant malware, allowing it to sit undetected for weeks, months, or even longer. As cybersecurity tools become more sophisticated, so do the methods that malware uses to remain hidden [6].
  
• Case Studies of Detection: In Q3 2023, Kaspersky’s security solutions blocked banking malware on the computers of 76,551 unique users. While it’s unclear whether these infections were dormant before activation, this statistic highlights the scope of the problem and the challenges in detecting malware that lies in wait [4].

Why You Should Care About Dormant Malware

Dormant malware is particularly dangerous because systems may appear to be functioning normally while harboring malicious code that can be triggered at any time. Organizations and individuals alike must understand the threat and take proactive measures to protect their data and systems.

How to Defend Against Dormant Malware

To mitigate the risks, it’s critical to implement comprehensive cybersecurity strategies that go beyond traditional defenses:

• Advanced Detection Tools: Rely on more sophisticated security software that can detect and analyze suspicious activities over extended periods, looking beyond the immediate threat to uncover hidden dangers.
  
• Regular Security Audits: Conduct regular security audits to identify any signs of dormant malware and ensure that all components of your system are functioning properly.
  
• Employee Training: Educate employees on the risks of malware, including dormant threats. Awareness and vigilance can go a long way in preventing the initial infection that could lead to dormant malware. As I’ve written multiple times, don’t click on any suspicious links – the most prevalent cyberthreat ever, PHISHING.
  
• Network Segmentation: Segment networks to limit the spread of dormant malware. If malware does become active, limiting its ability to move through the system can contain the damage. Segment the data from the system !!!
  

While precise statistics on dormant malware infections are elusive, the data available paints a clear picture:

Dormant malware is a growing concern among all companies.

With increasing numbers of malware attacks and the sophistication of these threats, organizations must remain vigilant and employ advanced detection techniques to identify and mitigate dormant malware risks, without forgetting to train your employees. By focusing on both technological solutions and user education, we can reduce the chances of becoming the next victim of this hidden threat.

References:

[1] Astra Security, Malware Statistics – https://www.getastra.com/blog/security-audit/malware-statistics/
[2] Statista, Malware Attacks Per Year Worldwide – https://www.statista.com/statistics/873097/malware-attacks-per-year-worldwide/
[3] Tripwire, Four Common Scenarios for Dormant Functionality in Malware – https://www.tripwire.com/state-of-security/four-common-scenarios-for-dormant-functionality-in-malware
[4] Securelist, IT Threat Evolution Q3 2023 – https://securelist.com/it-threat-evolution-q3-2023-non-mobile-statistics/111228/
[5] Statista, Malware Overview – https://www.statista.com/topics/8338/malware/
[6] Node4, Why Ransomware Hides in Your Systems for Months – https://node4.co.uk/blog/why-ransomware-now-hides-in-your-systems-for-months/
[7] Gabsten, Dormant Malware: Beware the Lurking Threat to Your Data – https://www.gabsten.co.za/2024/01/19/dormant-malware-beware-the-lurking-threat-to-your-data/