Cyberattack: Windows automation tool spreads ransomware and infostealers

The latest Advanced Threat Protection (ATP) test conducted by AV-TEST has highlighted the effectiveness of security products in defending against new types of cyber threats. The test specifically focused on scenarios where attackers exploit legitimate Windows automation tools, such as AutoIt, to distribute ransomware and infostealers.

A total of 17 different security packages, aimed at both consumers and businesses, were evaluated. These products faced ten distinct attack scenarios within Windows 11 environments. Particular attention was paid to the use of AutoIt scripts, which can be employed to create and distribute malicious programs. As AutoIt is a legitimate tool, its use does not necessarily raise immediate suspicion.

The results indicate that most of the tested protection solutions performed excellently. Out of the eight consumer-oriented products, seven achieved a flawless result, repelling all attacks and securing a perfect 35 points in protection scores. The nine enterprise solutions also demonstrated strong defensive capabilities, with almost all achieving full marks.

AV-TEST's ATP test simulates realistic attack methods, including the latest techniques used by various hacker groups like Qilin, Play, and Akira. The ability of the tested products to identify and halt such complex threats is critical, as modern malware constantly evolves, often with the aid of artificial intelligence. The test is regularly updated to address emerging threats.