Phishing & Email Spam

Phishing-as-a-Service Platforms Used to Bypass Multi-Factor Authentication Controls

by titanadmin | Aug 31, 2023 | Phishing & Email Spam |

Phishing attacks are often conducted to obtain credentials in order to gain initial access to business networks; however, many businesses have implemented multi-factor authentication which prevents stolen credentials from being used to access accounts. With multi-factor authentication implemented, credentials alone are not sufficient as access will only be granted if one or more additional authentication mechanisms are navigated. Multifactor authentication can significantly improve protection against phishing attacks, but it does not guarantee protection against unauthorized account access, and multi-factor authentication bypass attacks are increasing.

To bypass multifactor authentication, threat actors typically use adversary-in-the-middle (AitM) techniques using a phishing-as-a-service (PhaaS) platform. PhaaS platforms such as EvilGinx, Muraena, and Modlishka use reverse proxy servers to steal session cookies that allow multi-factor authentication to be bypassed. In these attacks, the user is directed to the phishing site hosting the phishing kit and when they enter their credentials the site proxies them to the actual website that is targeted in real time. The website returns the MFA screen, which is proxied to the user, and when the user enters the additional authentication, it is proxied to the actual website. The MFA is successfully completed and a session cookie is returned, which is used by the attacker to access the targeted account as the genuine user. The phishing site redirects the user to another page, unaware that their account has been compromised. The attacker will be able to access the account for as long as the session cookie is active.

An alternative method of bypassing MFA is to use synchronous relay servers. This method is used by the Storm-1295 threat group, which provides the Greatness PhaaS platform. This PhaaS platform presents the user with a copy of the sign-in page for the website, similar to standard phishing attacks that only steal credentials. This method uses a phishing kit server that dynamically loads the phishing page and MFA request page and communicates with the PhaaS platform relay server through an API. The PhaaS platform provides a synchronous relay server to relay captured credentials and MFA codes to the sign-in service but does not proxy network traffic.

According to Microsoft, there has been a marked increase in AitM attacks this year which are being conducted through already established MFA-bypassing PhaaS platforms and there has also been an increase in phishing services incorporating AitM capabilities. Businesses need to ensure that they are properly protected against these phishing attacks. The first line of defense is still a spam filter, which will block the majority of phishing emails to ensure they do not land in inboxes where they can be clicked. SpamTitan Plus provides the best protection against phishing attacks. SpamTitan Plus has 100% coverage of ALL current market-leading anti-phishing feeds, which ensures 1.6x faster detection of phishing than all current market leaders.

End-user training is also important for improving resilience against phishing attacks. By providing ongoing training and phishing simulations, employees will learn how to recognize and avoid phishing attempts that are able to circumvent spam filters. SafeTitan is a comprehensive security awareness training and phishing simulation platform that user data shows can improve resilience to phishing by up to 80%.

The increase in the use of MFA-bypassing PhaaS platforms means businesses can no longer rely on standard MFA controls to protect their accounts. While any form of MFA is better than none, businesses should transition to the most secure MFA methods that are resistant to these phishing attacks, such as FIDO2 security keys and certificate-based authentication.

Simple, Yet Effective Phishing Campaign Targets Zimbra Collaboration Credentials

by titanadmin | Aug 23, 2023 | Phishing & Email Spam |

Phishing campaigns do not need to be especially sophisticated to be effective, as a recently identified campaign that targets Zimbra Collaboration credentials clearly demonstrates. Zimbra Collaboration, previously known as Zimbra Collaboration Suite, is a software suite that includes an email server and web client. Zimbra Collaboration email servers are targeted by a range of different threat actors, including state-sponsored hackers and cybercriminals for espionage, conducting phishing attacks, and gaining a foothold that can be used for a more extensive compromise of an organization.

This global campaign targets users’ credentials and does not appear to be targeted on any specific sector and the threat actor behind the campaign and their motives are not known. The highest number of attacks have occurred in Poland, Ecuador, and Italy. Like many phishing campaigns, the emails warn users about a security update, security issue, or pending account deactivation, and the emails appear to have been sent from an email server administrator.

The emails include an HTML attachment, which is opened as a locally hosted page in the user’s browser. The HTML file displays a Zimbra login prompt that is tailored for each organization and includes their logo and name, and the targeted user’s username is prefilled. If the user enters their password, the credentials are transmitted to the attacker’s server via an HTTPS POST request.

The campaign was identified by security researchers at ESET, who observed waves of phishing emails being sent from companies that had previously been targeted, which suggests that some of the attacks have allowed the threat actor to compromise administrator credentials and set up new mailboxes to target other organizations.

Despite the simplicity of the campaign, it has proven to be very effective, even though the login prompt in the HTTP file differs considerably from the genuine Zimbra login prompt, and the page is opened locally, which suggests a lack of security awareness training due to the failure to identify the red flags in the emails. The emails are also likely to have a low detection rate by email security solutions, as the only malicious element is a single link to a malicious host, which is within the HTML file rather than the email body,

Phishing remains one of the most effective ways for hackers to gain initial access to networks. Combatting phishing attacks requires a combination of measures. A spam filter such as SpamTitan should be used to block the emails and prevent them from reaching their intended targets. SpamTitan incorporates signature-based and behavioral detection mechanisms for identifying malware, link scanning, and reputational checks to ensure a high catch rate and low false positive rate.

No spam filtering solution will be able to block all malicious emails without also having an unacceptably high false positive rate, so it is important to also provide regular security awareness training to employees to teach them how to recognize and avoid malicious emails. Security awareness training should also incorporate phishing simulations to give employees practice at identifying threats. If a threat is not detected, it can be turned into a training opportunity. TitanHQ’s security awareness training platform – SafeTitan – delivers instant training in response to a failed phishing simulation, and also delivers training in response to other security mistakes, ensuring training is provided when it has the greatest impact. Training data shows that SafeTitan reduces employee susceptibility to phishing attacks by up to 80%, and combined with SpamTitan email security, ensures that businesses are well protected from phishing attacks and other cyber threats.

SpamTitan and SafeTitan, like all TitanHQ solutions are available on a free trial and product demonstrations can be arranged on request.

LokiBot Malware Distributed Email Campaign Exploiting Known Vulnerabilities

by titanadmin | Jul 26, 2023 | Phishing & Email Spam |

Cybercriminals are exploiting unpatched remote code execution vulnerabilities to distribute an information-stealing malware called LokiBot. LokiBot, also known as LokiPWS, primarily targets Windows systems and collects sensitive information from infected devices including usernames and passwords. The malware can also log keystrokes, capture screenshots, steal information from web browsers, and empty cryptocurrency wallets. LokiBot was discovered in 2016 and has been active since at least 2015, and is primarily spread via email, most commonly through malicious email attachments.

One of the latest campaigns exploits the Microsoft Office vulnerability, CVE-2021-40444, and the Microsoft Windows Support Diagnostic Tool (MSDT) vulnerability, CVE-2022-30190, to embed malicious macros in Office documents that deliver LokiBot. The campaign was detected by security researchers at FortiGuard Labs in May 2023, and the campaign is still active.

The infection process is different depending on which vulnerability is exploited. The Word document that exploits the CVE-2021-40444 vulnerability includes a GoFile link embedded in an XML file, which will download an HTML file that exploits the CVE-2022-30190 vulnerability, which will deliver a Visual Basic payload that delivers LokiBot. Alternatively, a Word file is used that contains a VBA macro that drops an INF file, through which a connection will be made to the command-and-control server and LokiBot will be loaded.

LokiBot may be an old malware variant, but it is regularly updated, and the methods used to distribute the malware regularly change. This campaign takes advantage of businesses that are slow to implement patches. Ensuring patches for known vulnerabilities or workarounds are implemented quickly is vital. Email anti-spam services will also protect against attacks such as these. It is important to use an email security solution that does not rely on signature-based detection methods. Malware variants are constantly updated and changed to evade signature-based detection methods, so AI-based solutions should be used that can detect novel malware variants by their behavior.

SpamTitan includes both detection methods and will scan for known malware variants and subject attachments to in-depth analysis in a sandbox to identify malicious actions, such as command-and-control center callbacks. SpamTitan also performs a barrage of front-end and advanced checks on all emails, including machine-based detection methods that can identify emails that deviate from those typically received by a business, ensuring security teams are rapidly alerted about potential threats. Security awareness training is also strongly recommended to educate end users about email-based threats and teach security best practices, such as always exercising caution with emails, email attachments, and messages containing external links.

If you want to improve your defenses against malware and other cyber threats, give the TitanHQ team a call. SpamTitan, along with other TitanHQ cybersecurity solutions, is available on a free trial to allow you to test the product in your own environment before deciding if it is right for your business.

Free OnlyFans Content Used as a Lure in DcRAT Malware Campaign

by titanadmin | Jun 21, 2023 | Phishing & Email Spam |

Malicious actors are distributing malware under the guise of free access to paywall-protected OnlyFans content. OnlyFans is a popular Internet content subscription platform, where visitors can pay to receive premium content from a range of different content creators such as social media personalities, musicians, and celebrities, although the 18+ subscription platform is most commonly associated with X-rated content. The malware campaign targets individuals looking to access the latter for free.

The campaign uses fake OnlyFans content and X-rated lures promising access to private photos, videos, and posts without having to pay for the content. Users are tricked into downloading an executable file, that installs a remote access Trojan. A VBScript loader is contained in a ZIP file, and if executed, will deliver a variant of the AsynchRAT called DCRAT (aka DarkCrystal) -– a remote access Trojan that provides access to the user’s device. DcRAT allows remote access, but can also access the webcam, log keystrokes, manipulate files, steal credentials, cookies, and Discord tokens, and encrypt files for extortion.

Researchers at eSentire identified the campaign after a user attempted to execute the VBscript loader, although it is currently unclear how the ZIP file containing the VBScript loader is being distributed. As such, a defense-in-depth approach is recommended to block the most likely attack vectors. Phishing emails are commonly used for distributing malware. Any email that claims to offer free access to OnlyFans is a major red flag since the site requires paid subscriptions to access content. SEO poisoning may be used to get malicious websites to appear high in the search engine results for key search terms, and malvertising – malicious adverts – may be displayed on legitimate websites through third-party ad networks that direct users to URLs where free content is offered. Compromised social media accounts may be used to post offers of free access to OnlyFans content, and SMS and instant messaging service messages may advertise the offers and include links to malicious websites.

All of these ways of making contact with users can be combatted through phishing and security awareness training using the SafeTitan platform. SafeTitan includes an extensive library of training content for creating security awareness training programs to improve awareness of threats, teach security best practices, and train users how to identify phishing attempts. The platform also includes a phishing simulator for testing responses to phishing attacks, including phishing attempts with OnlyFans-related lures.

Email security solutions should be implemented to block any phishing attempts. SpamTitan incorporates signature and behavior-based detection mechanisms for identifying malicious attachments, link scanning, and machine learning capabilities to identify zero-day phishing attacks. WebTitan Cloud can be used to improve protection against web-based attacks, such as malicious file downloads from malicious and compromised websites and to prevent access to risky categories of websites and websites that serve no work purpose. IT admins should also consider implementing restrictions for script files, such as blocking VBScript and JavaScript from launching downloaded executable content or using Group Policy Management Console to create open with parameters for script files to ensure they are opened with notepad.exe. These measures will not only be effective at blocking this OnlyFans campaign but also for blocking attempts by other malicious actors to install malware and ransomware.

PDF File Attachments Used for Distributing QBot Malware

by titanadmin | Apr 30, 2023 | Phishing & Email Spam |

When Microsoft started blocking macros in Internet-delivered Office files, threat actors had to come up with new ways of distributing malware via email. Since then, there has been a rise in the use of OneNote files in phishing attacks. OneNote files allow scripts to be embedded and serve as an ideal replacement for Office files and macros; however, Microsoft has responded with security updates for OneNote to prevent this technique from being used for malware distribution. There has also been an increase in the use of container files to bypass protections, which include compressed files such as .rar and .zip, and .iso files.

Another method of bypassing these protections has been adopted to distribute QBot malware. QBot is used to gain initial access to business networks and is often used to drop malware payloads for other threat actors. QBot used to be delivered via phishing emails using malicious macros in Office file attachments, but that technique is no longer viable due to Microsoft’s updates. Instead, the threat actor is now using a combination of .pdf files and Windows Script Files. The phishing emails have a .pdf attachment, which downloads a .wsf file, which is used to deliver QBot.

The emails used in this campaign are reply chain emails, which makes it appear that the emails have been sent as a reply to a previous conversation. That increases the chances of the email being opened as employees are usually trained to be suspicious of unsolicited emails from unknown senders. If the attachment is opened, the PDF file states that the document is protected, and the user is required to click an ‘open’ link, which will trigger a download of a .zip file that includes a Windows Script file.

If the user double clicks that file, the script will be executed, which will run a PowerShell script that will deliver QBot from a hardcoded URL and execute the malware. QBot will be injected into the Windows Error Manager program and will run silently in the background. QBot will steal sensitive data and can move laterally and compromise other devices on the network. Once data has been stolen, access to QBot-infected devices is sold to ransomware gangs. A single device infected with QBot can easily end with large-scale data theft and a network-wide ransomware attack.

The latest campaign involves PDF file attachments, but the methods used for distributing malware such as QBot often change and will continue to do so. The key to improving security is to adopt a defense-in-depth approach, where there are multiple overlapping layers of security in place. If any one measure fails, others will be in place to continue to provide protection.

An email security solution such as SpamTitan is a good place to start. SpamTitan Email Security adds multiple layers of security to your defenses by performing extensive checks on all inbound and outbound emails. Message headers are checked, as is the reputation of the sender, and machine learning techniques are used to identify messages that deviate from the normal messages a user receives. Multiple scans are conducted on email attachments looking for malware and malicious scripts, including signature-based and behavior-based detection through dual antivirus engines and a Bitdefender-powered sandbox. Links are checked and followed to block phishing and malware downloads.

A web filtering solution is an important security measure for blocking the web-based component of these attacks. All attempts to connect with a URL – including automated attempts and clicks by users – will be assessed in real time and blocked if an attempt is made to connect to a known malicious URL. WebTitan can be configured to block downloads of executable files, such as .wsf files, and controls can be implemented to restrict access to websites to confirmed benign URLs.

Email-based attacks attempt to exploit human weaknesses so it is also important to improve your human defenses through security awareness training. The SafeTitan security awareness training platform can be used to automate workforce training and teach security best practices and eliminate risky behaviors, and make employees aware of the threats they are likely to encounter. The platform also includes a phishing simulator with hundreds of phishing templates to test employees to see how they respond to real-world threats, and automatically assigns further training modules if they fail a phishing simulation. These three solutions can be adopted by businesses to greatly improve their security posture against current and evolving threats. Speak with TitanHQ today to find out more.

Top Malware Threats and How to Prevent Infections

by titanadmin | Apr 25, 2023 | Phishing & Email Spam |

QBot, Emotet, and Formbook are currently the most prevalent malware threats according to new data from Check Point, all of which are mostly distributed using spam emails. Email is still one of the most common methods of malware distribution, and even Microsoft’s efforts to prevent the malicious use of macros have not changed that.

Last year, Microsoft disabled macros by default in Internet-delivered documents, and while this was a blow to cybercriminals who have relied on macros for their infection process, they simply changed tactics and used other methods for malware delivery. Macros were easy to abuse, as victims just needed to be tricked into enabling macros in documents and ignoring security warnings. Now that macros are disabled, cybercriminals have had to adopt new tactics for distributing malware via email, such as sending malicious links or using alternative attachments, such as OneNote files. The latter has been used to distribute Emotet, which has helped the malware return to the top of Check Point’s most wanted malware list.

OneNote files have proven popular for malware distribution as they allow scripts to be embedded and masked with overlays. The user is instructed to double-click a button in the OneNote file as they are told that the document is protected, when what they are actually doing is double-clicking an executable file embedded under the overlay, thus executing the script and triggering the downloading of a malicious payload. Microsoft has announced that this security issue will be tackled by May, but until then OneNote will continue to be used for malware delivery.

The top three malware variants share some of the same functionality but offer specialized features. QBot, also known as QakBot, was primarily a banking Trojan used to steal banking credentials but is now capable of stealing other credentials due to its keylogging capabilities. It has been in use since 2008 and is one of the oldest malware families currently in use.

Emotet has long been at the top of the most common malware variants and has survived a recent law enforcement takedown. Emotet started life as a banking Trojan but has evolved over the years and is now primarily used as a distributor of other malicious payloads under the malware-as-a-service model. Like QBot, Emotet is also extensively distributed via email, helped by its self-propagating capabilities, which allow it to hijack message threads and send copies of itself to the victims’ contacts.

FormBook has been used since at least 2016 and is an information stealer that is also marketed under the malware-as-a-service model. FormBook primarily harvests credentials from web browsers, but also logs keystrokes, collects screenshots, and can deliver additional files to infected devices. It is one of the most widely distributed malware due to its capabilities, relatively low cost, and strong evasion techniques.

These three malware variants have had a huge impact globally, with QBot infections detected at 10% of organizations worldwide and Emotet and FormBook each affecting 4% of organizations worldwide. Preventing infections requires a defense-in-depth approach involving multiple layers of protection, with one of the most important layers provided by a spam filter.

All three of these malware families are extensively spread via spam email, so blocking the initial attack vector is by far the best defense. SpamTitan incorporates several layers of protection against malicious emails, including emails with malicious attachments such as OneNote files and malicious links. SpamTitan performs a multitude of front-line checks including message headers and reputation checks and has dual anti-virus engines for detecting malware and sandboxing for behavioral analysis of email attachments. SpamTitan also scans links and uses machine learning algorithms to identify emails that deviate from the genuine emails typically received by businesses.

While a spam filter and endpoint protection solutions such as antivirus software were once sufficient, the speed at which new malware variants are being released and the evasion methods they use mean additional layers of protection are now required. TitanHQ recommends also deploying a web filter to block Internet-based threats. A web filter such as WebTitan augments the spam filter by blocking malware delivery via the Internet and improves protection against non-email-based threats, such as malicious links in text messages and instant messaging platforms.

Threats will occasionally bypass these protections, so it is important to provide security awareness training to the workforce. By educating the workforce on cyber threats, if one is encountered it can be recognized and avoided. Security awareness training allows businesses to train employees on security best practices and eradicate the risky behaviors that are often exploited by cybercriminals. SafeTitan is a comprehensive training platform covering all aspects of security and includes a phishing simulation platform for testing how employees respond to phishing threats and providing targeted training where it is needed.

For more information on these solutions and improving your security posture in the most cost-effective way, give the TitanHQ team a call today.

Smishing Campaign Targets Coinbase Users

by titanadmin | Feb 23, 2023 | Phishing & Email Spam |

SMS-based phishing attacks are becoming more common, and these attacks can be particularly effective. SMS phishing – commonly referred to as smishing – is the use of SMS messages for delivering malicious URLs. There are several advantages of smishing over phishing. Most companies have email security solutions in place such as spam filters that can easily detect malicious emails, so many phishing emails will not reach end users. Smartphones tend to have fewer cybersecurity controls than computers, so malicious SMS messages are more likely to be delivered. Another reason why smishing attacks have a high success rate is employees tend to be aware of the risk of email attacks but are more trusting about SMS messages as security awareness training tends to focus on email phishing. Further, since smartphones are often accessed on the go, people can be distracted and click links without stopping to think.

Businesses are often targeted with smishing attacks as it is an easy way of getting phishing URLs in front of employees. One recent attack targeted Coinbase employees. Coinbase is one of the world’s largest cryptocurrency exchanges with more than 1,200 employees and more than 103 million users, which makes the company a big target for cybercriminals (although smishing attacks are conducted on companies of all sizes!).

In this attack, SMS messages were sent to employees using a common ruse – They were told they needed to log in urgently about a security issue. Virtually all Coinbase employees ignored the message, but one employee responded and entered their username and password on the phishing page. Smishing campaigns do not need to fool a lot of employees. They only need to fool one person. Coinbase was protected against smishing attacks to a certain degree, as the company had implemented 2-factor authentication, so while the attackers obtained a username and password, those credentials alone would not allow access to be gained to the user’s account.

However, smishing can be combined with voice phishing to get around 2FA and MFA protections. The attackers then called the employee and pretended to be from the Coinbase IT department, and provided the employee with instructions, which were followed, allowing the attackers to bypass the 2FA protection and log in to the employee’s workstation. In this attack, unauthorized access was rapidly detected by the IT team, as the remote access generated a security alert. Fortunately, the attack was thwarted before the threat actor was able to achieve very much, although, in the short time that access was possible, the attacker was able to steal some employee data, including names, email addresses, and phone numbers. Similar attacks have been conducted on companies that did not have 2FA protection, and many attacks have not been detected rapidly by security teams, allowing much more damage to be caused.

With smishing attacks increasing, businesses need to prepare and ensure they have appropriate defenses in place, which should include 2FA or MFA protection on all accounts. As the Coinbase attack demonstrated, 2FA/MFA alone is not sufficient. Whitelisting IP addresses is recommended, and security alerts should be set up and immediately followed up on by security teams.

Web filtering can provide some protection by restricting access to the websites that employees can access, thus preventing them from accessing the phishing URLs where credentials are harvested. Another important measure is to provide security awareness training to the workforce to ensure that employees are aware of smishing and voice phishing attacks. By raising awareness, employers can greatly improve protection against these attacks.

Give TitanHQ a call today to find out how web filter and security awareness training can improve your defenses against smishing, vishing, and other types of cyberattacks targeting employees.

Namecheap Customers Targeted in Sophisticated Phishing Scam

by titanadmin | Feb 22, 2023 | Phishing & Email Spam |

Phishing emails often spoof a company and include its logos and branding, but one of the red flags that allow these emails to be identified by users is the email address used in the campaign is set up on a domain unrelated to the brand being spoofed. For instance, a phishing email spoofing FedEx is sent from a Gmail account. Oftentimes, a display name is created that makes the email appear to come from a genuine account used by the spoofed company – FedEx customer service for instance – but a quick check will reveal the actual email address used, allowing users to identify the phishing attack.

However, these checks sometimes fail, as highlighted by a recent phishing campaign that impersonated the logistics company DHL and the software cryptocurrency wallet provider, MetaMask that targeted customers of the domain registrar Namecheap. The emails originated from the legitimate customer communication platform SendGrid, which Namecheap uses for sending marketing communications and renewal notices to customers. Namecheap responded quickly when the attack was identified and disabled the accounts, but not in time to prevent many phishing emails from being sent.

The emails spoofing DHL included the DHL Express logo and warned recipients that their parcel was not able to be delivered because the sender did not pay the necessary delivery fees, as such, the parcel has been retained at the delivery depot and will not be released until the delivery fees are paid.

The MetaMask emails purported to be a Know Your Customer verification request, which required the recipient to verify their identity to prevent their account from being suspended. If the verification is not completed, the emails claimed, users would be unable to withdraw or transfer funds without interruption.

In both cases, the emails included a link that the users were required to click to complete the request – a Namecheap.com marketing link that redirected users to a phishing page on an unrelated domain. This was not a data breach at Namecheap, but at the third-party system the company uses for sending emails – SendGrid. It is currently unclear how SendGrid was hijacked to send the phishing emails.

Phishing emails may be sent from legitimate company email accounts, either an account at the actual company being spoofed or other well-known services such as SendGrid. In the summer of 2022, a phishing campaign was conducted targeting customers of the hardware cryptocurrency wallet Trezor, following a hack at the email marketing platform MailChimp.

Phishing attacks such as these can sneak past email defenses and are harder for employees to identify, which is why businesses need to adopt a defense-in-depth approach. Email security solutions will block the majority of spam and phishing emails, but no email security solution will block all malicious messages. In addition to an advanced email security solution such as SpamTitan – which incorporates multiple layers of protection and machine learning mechanisms to block novel phishing attacks – businesses should invest in security awareness training for employees and should provide the training continually throughout the year. Through comprehensive training, employees can be taught more than just the basics and can learn how to recognize and avoid sophisticated phishing attacks.

A web filter is also recommended for blocking access to the malicious URLs that are used to harvest sensitive information. A web filter augments the spam filter by providing time-of-click protection against malicious links in emails and also protects against non-email methods used to drive traffic to phishing sites, such as malvertising, smishing, and vishing attacks.

If you want to improve protection against phishing, call TitanHQ to find out more about improving the depth of your security protections through spam filtering, security awareness training, and web filtering.

OneNote Attachments and Blank Images Used in Phishing Attacks

by titanadmin | Jan 31, 2023 | Phishing & Email Spam |

Phishers are constantly coming up with new ways to evade security solutions, steal credentials, and distribute malware. In January, two new tactics were observed in separate phishing campaigns, one hides malicious URLs from security solutions in a credential-stealing campaign, and the other uses OneNote attachments for distributing malware.

Blank Image Phishing Attacks

The blank image phishing attack involves hiding a Scalable Vector Graphics (SVG) image file within an HTML document sent via email. In this campaign, the email claims to include a DocuSign document, which office workers are likely to be familiar with. The email claims the document includes remittance advice. The user is required to click to view the document and will be directed to the legitimate DocuSign webpage if they do.

However, the attack starts when the user clicks to view the HTML document. The document contains a Base64 blank image file, which has embedded JavaScript that will redirect the victim to a malicious URL. The image itself contains no graphics, so does not render anything on the screen. It is just used as a placeholder for the malicious script. The URL that the user is directed to will prompt them to enter sensitive information. A similar technique using SVG files has previously been used to distribute QBot malware. Many email security solutions ignore HTML files, which increases the chance of the malicious email landing in inboxes. Security teams should consider blocking or quarantining HTML emails to protect against these types of attacks.

OneNote Attachments Used to Distribute Malware

Another campaign has been detected that uses OneNote attachments in phishing emails for distributing remote access malware, which can provide initial access to a victim’s system allowing further malicious payloads to be delivered, such as information stealers and ransomware. For many years, Office documents were the preferred attachment for distributing malware. These files can include macros that download a malicious payload, but Microsoft now blocks macros by default in Office files delivered via the internet, which has forced hackers to look for new ways to distribute their malware.

One new tactic is the use of OneNote attachments. OneNote is installed by default with Microsoft Office and Microsoft 365, which means OneNote files can be opened on most devices even if the user does not use the OneNote application. The lures used in these emails vary, although some of the intercepted emails claimed to be shipping notifications, with the details of the shipment included in the OneNote file.

OneNote files cannot contain macros, but it is possible to insert VBS attachments into a NoteBook. When opening the file, the user is told they must double-click to view the file. Doing so will launch the VBS script, which will download and install malware from a remote site. If the user does click, they will be warned that opening attachments can harm their computer. If that warning is ignored and the user chooses to open the attachment, the script will download a decoy OneNote file – a genuine file – so the user is unlikely to realize that anything untoward has happened, but the script will execute a batch file in the background and will install the second downloaded file, which is malware.

How to Defend Against Phishing Attacks

Cybercriminals are constantly developing new methods for distributing malware and stealing credentials, and phishing is the most common way to do this. Defending against these attacks requires a defense-in-depth approach, involving multiple overlapping layers of protection. If anyone measure fails to detect a threat, others are in place to detect and block the threat.

In addition to a secure email gateway or spam filter, businesses should consider a web filter for blocking the web-based component of the attack, multifactor authentication for all accounts, antivirus software/endpoint security solutions, and security awareness training for employees to help them identify and avoid phishing threats. For assistance improving your defenses against phishing, contact TitanHQ.

ChatGPT Used to Create Convincing Phishing Lures and New Malware

by titanadmin | Jan 30, 2023 | Phishing & Email Spam |

Toward the end of 2022, a new AI-based chatbot was made available to the public which has proven popular for creating written content. Concern is now growing about the potential for the tool to be used by cybercriminals for creating new phishing lures and for rapidly coding new malware.

ChatGPT was developed by OpenAI and was released on 30 November 2022 to the public as part of the testing process. Just a few days after its release, the chatbot had reached a million users, who were using the tool to write emails, articles, essays, wedding speeches, poems, songs, and all manner of written content. The chatbot is based on the GPT-3 natural language model and can create human-like written content. The language model was trained using a massive dataset of written content from the Internet and can generate content in response to questions or prompts that users enter into the web-based interface.

While articles written using the chatbot would be unlikely to win any awards, the content is grammatically correct, contains no spelling mistakes, and in many cases is far better than you could expect from an average high school student. One of the problems is that while the content may superficially appear to be correct, it is biased by the data it was trained on and may include errors. That said, the generated content is reasonable and sufficiently accurate to pass the Bar exam for U.S. lawyers and the US Medical Licensing exam, although only just. It is no surprise that many school districts have already implemented bans on students using ChatGPT.

To get ChatGPT to generate content, you just need to tell it what you want to create. It is no surprise that it has proven to be so popular, considering it is capable of writing content better than many humans could. While there are many benefits from using AI for chatbots that can create human-like text, there is growing concern that these natural language AI tools could be used for malicious purposes, such as creating social engineering scams and phishing and business email compromise attacks.

The potential for misuse has prompted many security researchers to put ChatGPT to the test, to see whether it is capable of generating malicious emails. The developer has put certain controls in place to prevent misuse, but those controls can be bypassed. For instance, asking ChatGPT to write a phishing email will generate a message saying the request violates the terms and conditions, but by experimenting with the queries it is possible to get the chatbot to generate the required content.

Further, it is possible to write a phishing email and spin up many different combinations that are all unique, grammatically correct, and free from spelling errors. The text is human-like, and far better than many of the phishing emails that are used in real phishing campaigns. The rapid generation of content has allowed security researchers to spin up an entire email chain for a convincing spear phishing attack. It has also been demonstrated that the technology can be rapidly trained to mimic a specific style of writing, highlighting the potential for use in convincing BEC attacks. These tests were conducted by WithSecure prior to public release and before additional controls were implemented to prevent misuse, but they continued their research after restrictions were added to the tool, clearly demonstrating the potential for misuse.

The potential for misuse does not stop there. The technology underlying the chatbot can also be used to generate code and researchers have demonstrated ChatGPT and its underlying codex technology are capable of generating functional malware. Researchers at CyberArk were able to bypass the restrictions and generate a new strand of polymorphic malware, then were able to rapidly generate many different unique variations of the code. Researchers at Check Point similarly generated malicious code, in fact, they generated the full infection process from spear phishing email to malicious Excel document for downloading a payload, and the malicious payload itself – a reverse shell.

At present, it is only possible to generate working malicious code with good textual prompts, which requires a certain level of knowledge, but even in its current form, the technology could help to rapidly accelerate malware coding and improve the quality of phishing emails. There are already signs that the tool is already being misused, with posts on hacking forums including samples of malware allegedly written using the technology, such as a new information stealer and an encryptor for ransomware.

With malicious emails likely to be generated using these tools, and the potential for new malware to be rapidly coded and released, it has never been more important to ensure that email security defenses are up to scratch. Email security solutions should be put in place that are capable of detecting computer-generated malware. SpamTitan includes signature-based detection mechanisms for identifying known malware along with email sandboxing. The sandbox is an isolated and secure testing environment where suspicious email attachments are subjected to behavioral analysis. The next-gen sandbox means SpamTitan can detect zero-day malware variants that would otherwise not be detected since their signatures have yet to be added to the blocklists. SpamTitan also uses machine learning mechanisms for detecting zero-day phishing threats, based on deviations from the standard messages received by companies.

TitanHQ also recommends implementing multifactor authentication, web filtering for blocking access to malicious websites, and security awareness training for employees. The quality of phishing emails may get better, but there will still be red flags that employees can be trained to recognize.

The Emotet Botnet is Back with a Large-Scale Phishing Campaign

by titanadmin | Nov 23, 2022 | Phishing & Email Spam |

This month has seen a return of the Emotet botnet after a 4-month period of inactivity, with a high-volume email campaign identified that is increasing the size of the botnet. Emotet started life as a banking Trojan but has been updated over the years to add new functionality. Devices infected with Emotet are added to the botnet and can be used for a variety of purposes, but one of the main functions of Emotet is as a malware dropper, delivering additional malicious payloads on devices once the botnet operator has achieved their own goals. Currently, Emotet is being used to drop a new variant of the IcedID loader. IcedID is a banking Trojan that is similarly used to drop other malware variants.

Emotet is primarily spread via phishing emails, with the campaigns typically consisting of hundreds of thousands of emails a day. The lures used in these messages are often changed, but the threat actor behind Emotet tends to opt for traditional lures such as IRS notifications and business-themed emails. The Emotet Trojan is able to hijack message threats from infected devices and reply, including a copy of itself in the emails. Since the emails come from a genuine email account and appear to be a response to a past conversation, the probability of the recipient opening the email and attachment is all the greater.

The emails in the latest campaign still use XLS attachments with Auto_Open macros to deliver the malicious payload, despite Microsoft disabling macros in files delivered via the Internet. In some of the emails, the .xls file is directly attached to the email, although it is commonly included in a .zip file. The zip files are often password-protected to prevent them from being scanned by email security solutions, with the password – and often little else other than the file name and a signature – included in the message body.

To get around Microsoft’s macro protections, the user is advised when they open to the .xls file to copy the file to a whitelisted directory and reopen it. The user is told this is a necessary requirement of their security policy to be able to view the contents of the file, with instructions provided for different Microsoft Office versions. By copying the file to the suggested location and then reopening it, Microsoft’s protections will not be applied, and the macro will be able to run. The latest campaign is predominantly targeting the United States, although it is likely that the campaign will be expanded to target other geographical regions.

Defending against Emotet requires a combination of measures. While email security solutions such as SpamTitan can detect and block Emotet phishing emails, a defense-in-depth approach is recommended that includes comprehensive security awareness training for the workforce and more advanced endpoint detection solutions than standard antivirus software.

TitanHQ offers security awareness training and phishing simulations through the SafeTitan platform which trains employees how to recognize the phishing emails that are being used to deliver Emotet. The phishing simulator includes real-world examples of the types of emails that the gang uses to trick employees into installing Emotet.

For further information on improving your defenses against Emotet and other email threats, give the TitanHQ team a call. All TitanHQ cybersecurity solutions are available on a free trial to allow you to test them for effectiveness and usability before making a decision about a purchase.

StrelaStealer Malware Distributed via Email and Targets Outlook and Thunderbird Credentials

by titanadmin | Nov 18, 2022 | Phishing & Email Spam |

A new malware variant called StrelaStealer has been identified that is being distributed via email that targets credentials for two of the most popular email clients: Outlook and Thunderbird. This previously unknown malware was first identified earlier this month, and so far, has been used to target Spanish speakers.

The campaign was identified by security researchers at DCSO CyTec. The intercepted emails have an ISO (optical disc image) file attachment. These files contain all the data that would normally be written to an optical such as a CD, DVD, or Blu-ray disc, sector by sector, with the content bundled into a single file.

One of the files analyzed by the researchers contained an executable file that sideloads the malware contained in the ISO file via DLL order hijacking. The ISO file also contains a .lnk file and polyglot file. A polyglot file can be treated as several different file formats depending on the application that opens it. In this case, the polyglot file is an x.html file, which is both an x.html file and a DLL program that loads StrelaStealer malware. Execution sees the malware loaded in the memory and simultaneously a decoy document is displayed in the web browser while the malware is executed.

Interestingly the malware does not target browser data, cryptocurrency wallets, and other data commonly obtained by information-stealing malware. Instead, it searches for the %APPDATA%\Thunderbird\Profiles directory looking for login.json and key4.db. The former contains the account and password, and the latter is the password database. Both are then exfiltrated to the attacker’s command and control server.

The malware also searches the Windows Registry and retrieves the Outlook software key, and locates the IMAP User, IMAP Server, and IMAP password values. The passwords for Outlook are encrypted, but the malware uses the CryptUnprotectData function of Windows to decrypt the data before exfiltrating the decrypted data to the C2 server

Cybercriminals are constantly developing new techniques for distributing malware. Security awareness training typically focuses on raising awareness of the most common methods of malware delivery, such as Office files containing malicious macros. Since employees are likely to be much less familiar with ISO files, they may not identify these emails as malicious, or may not report them to their security teams due to the decoy document that is displayed, in the belief that nothing untoward has happened.

To improve protection against campaigns such as this, businesses should consider configuring their email security solution to quarantine emails containing risky file attachments such as executable files, and also configure their web filter to block downloads of these file types from the Internet. That is a simple process with SpamTitan cloud-based anti-spam service and the WebTitan web filter.

IceXLoader Malware Phishing Campaign Targets Corporate Devices

by titanadmin | Nov 15, 2022 | Phishing & Email Spam |

A new phishing campaign has been detected that is being used to distribute a relatively new malware threat called IceXLoader. The malware was first identified in the summer and is being actively developed, with version 3.3 of the malware being distributed in the latest campaign. The malware appears to be a work in progress, with the latest version of the malware having enhanced functionality and a new method of installation is now being used. While it has only been distributed for a few months, it already represents a significant threat.

As the name suggests, IceXLoader is a malware dropper that is designed to deploy additional malicious payloads on infected devices. This could include additional tools to help the operators of the malware achieve their aims or it could be offered to a range of threat actors under the malware-as-a-service model for delivering information stealers, ransomware, and other malicious payloads. The malware was first identified by researchers at Fortinet, who named the malware IceXLoader due to the presence of ICE_X strings in samples of the malware code.

The malware is delivered via phishing emails with a .zip compressed file attachment, which contains the first stage extractor. If allowed to run, this will create a new hidden folder in C:\Users\<username>\AppData\Local\Temp, and will then drop and execute the second stage executable file, which creates a new registry key and deletes the temporary folder. The second stage executable downloads a PNG file from a hardcoded URL, and converts it into an obfuscated DLL file, which is IceXLoader. The dropper will perform checks to see if it is running in a virtual environment and will wait 35 seconds before executing IceXLoader to avoid sandbox detection. IceXLoader will collect a variety of information about its host, will connect to its command-and-control server and exfiltrate that information, and will then drop additional malicious payloads.

The malware is capable of evading Windows Defender and other anti-malware programs to prevent scanning of the folder where IceXLoader resides. Researchers at Minerva Labs note that the exfiltrated data is freely accessible on the C2 server, so the threat actors are currently not interested in securing the stolen data.

Due to the ability of the malware to evade traditional antivirus software solutions, the key to blocking this threat is implement next-generation endpoint detection solutions that are able to identify malware by their behavior, and ensure that strong, multi-layered anti phishing defenses are implemented to block the initial phishing emails, including an advanced spam filter for blocking the email and web filtering technology to prevent downloads of malicious files from the Internet.

It is also important not to neglect the human element of defenses. Security awareness training for the workforce will go a long way toward preventing these and other email-based attacks from succeeding, by teaching employees email security best practices.