Menlo Security has discovered an increase in cyber threats defined as Highly Evasive Adaptive Threats (HEAT), that bypass traditional security defenses.

HEAT attacks are a type of cyberattack that uses strategies to evade detection by several layers in today’s security stacks, including firewalls, Secure Web Gateways, sandbox analysis, URL reputation, and phishing detection. HEAT threats are used to transfer malware or compromised credentials, leading to ransomware attacks in many circumstances.

The research team concluded that 69 % of malicious domains used HEAT methods to deliver malware after analyzing over 500,000 of them. By adapting to the intended environment, these attacks allow bad actors to transmit malicious content to the endpoint. HEAT attacks have increased by 224 % since July 2021.

CEO of Menlo Security, Amir Ben-Efraim said, “With the abrupt move to remote working in 2020, every organization had to pivot to work from an anywhere model and accelerate their migration to cloud-based applications. An industry report found that 75% of the working day is spent in a web browser, which has quickly become the primary attack surface for threat actors, ransomware, and other attacks. The industry has seen an explosion in the number and sophistication of these highly evasive attacks and most businesses are unprepared and lack the resources to prevent them. Cyber threats are a mainstream problem and a boardroom issue that should be on everyone’s agenda. The threat landscape is constantly evolving, ransomware is more persistent than ever before, and HEAT attacks have rendered traditional security solutions ineffective.”

ESG Senior Analyst, John Grady said, “Highly Evasive Adaptive Threat (HEAT) attacks evade existing security defenses by understanding all the technology integrated into the existing security stack and building delivery mechanisms to evade detection. Organizations should focus on three key tenets to limit their susceptibility to these types of attacks: shifting from detection to a prevention mindset, stopping threats before they hit the endpoint, and incorporating advanced anti-phishing and isolation capabilities.”