Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

6/25/2019
07:10 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

Email Threats Continue to Grow as Attackers Evolve, Innovate

Threat actors increasingly using malicious URLs, HTTPS domains, file-sharing sites in email attacks, FireEye says.

Email continues to be an extremely effective vector for delivering malicious content because of how adept attackers have become at tricking users over the years.

The latest examples include the increasing use of malicious URLs in emails rather than attachments, a trend toward use of HTTPS domains for hosting malicious sites, and new variants of impersonation fraud.

FireEye recently analyzed a sample set of 1.3 billion emails for the first three months of 2019 and counted more URL-based email attacks than attachment-based ones in the first quarter.

URL attacks involve emails with embedded links pointing to a malware download site or a phishing site designed to steal a user's account credentials or credit card data. Emails containing such links are often harder to detect and block than ones with malicious attachments, according to FireEye.

In many cases, attackers have been embedding such links in emails with very little or no content in them in an attempt to bypass email filters and to try and get the recipient curious enough to click on the link. According to FireEye, there was a spike in the number of content-less emails in January. Sometimes the emails have contained nonclickable URLs that are activated when a user copies and pastes it into a browser, the vendor noted.

FireEye observed a troubling 26% quarter-over-quarter increase in malicious URLs pointing to phishing sites hosted on HTTPS domains. The sites, and the phishing lures to get users there, often spoofed major brands. In fact, in Q1 2019, FireEye observed a 17% quarter-over-quarter increase in phishing attacks involving the misuse of a well-known brand name.

Microsoft was by far the most spoofed brand, accounting for 30% of all detections in the first quarter. Other frequently spoofed brands included Apple, Amazon, PayPal, and OneDrive.

"The increase in phishing sites using HTTPS was a very interesting shift," says Ken Bagnall, vice president of email security at FireEye. Also significant was the number of phishing sites spoofed to appear like different Microsoft login pages that FireEye observed in the first quarter. "This really highlights how useful attackers see getting access to a victim's Office 365 credentials," Bagnall says.

Exploiting Trust in File-Sharing Sites
Also increasing significantly in the first quarter was the number of URL links pointing to malicious files hosted on widely trusted cloud-hosted file sharing sites, such as Dropbox, OneDrive, Google Drive, and WeTransfer. Threat actors are increasingly using such file-sharing services to host malicious content because the sites pass the domain reputation checks that many security tools use for vetting links, FireEye said.

Some of these file-sharing sites even let users preview the hosted content and offer a link that can be clicked without having to download the file, the vendor said. "Attackers are simulating user behavior here," Bagnall notes. File-sharing sites have become very common, so users are likely to be less suspicious of interacting with content on these services. "There was a very significant increase in OneDrive this quarter, and we will see more targeting based on customers usage of cloud services in their workflow," he says.

Impersonation email attacks, where an attacker might pretend to be a CEO or a CFO to trick employees into initiating a fraudulent wire transfer or some other action, continued to grow and evolve in the first quarter. In the past, such attacks targeted employees in the accounts payable department. In this year's first quarter, FireEye observed an increase in attacks targeting the payroll and supply chain departments.

For organizations, such developments highlight the need for multilayered defenses. On the technology front, they need a tool stack that innovates in line with attacker behavior, Bagnall says. Security awareness training and education are important as well. So are controls that protect payments processes and prevent individuals in an organization to change bank details or initiate similar actions based on an email communication alone, he says.

Related Content:

 

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 7/9/2020
4 Security Tips as the July 15 Tax-Day Extension Draws Near
Shane Buckley, President & Chief Operating Officer, Gigamon,  7/10/2020
Russian Cyber Gang 'Cosmic Lynx' Focuses on Email Fraud
Kelly Sheridan, Staff Editor, Dark Reading,  7/7/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal, a Dark Reading Perspective
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
The Threat from the Internetand What Your Organization Can Do About It
The Threat from the Internetand What Your Organization Can Do About It
This report describes some of the latest attacks and threats emanating from the Internet, as well as advice and tips on how your organization can mitigate those threats before they affect your business. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-15105
PUBLISHED: 2020-07-10
Django Two-Factor Authentication before 1.12, stores the user's password in clear text in the user session (base64-encoded). The password is stored in the session when the user submits their username and password, and is removed once they complete authentication by entering a two-factor authenticati...
CVE-2020-11061
PUBLISHED: 2020-07-10
In Bareos Director less than or equal to 16.2.10, 17.2.9, 18.2.8, and 19.2.7, a heap overflow allows a malicious client to corrupt the director's memory via oversized digest strings sent during initialization of a verify job. Disabling verify jobs mitigates the problem. This issue is also patched in...
CVE-2020-4042
PUBLISHED: 2020-07-10
Bareos before version 19.2.8 and earlier allows a malicious client to communicate with the director without knowledge of the shared secret if the director allows client initiated connection and connects to the client itself. The malicious client can replay the Bareos director's cram-md5 challenge to...
CVE-2020-11081
PUBLISHED: 2020-07-10
osquery before version 4.4.0 enables a priviledge escalation vulnerability. If a Window system is configured with a PATH that contains a user-writable directory then a local user may write a zlib1.dll DLL, which osquery will attempt to load. Since osquery runs with elevated privileges this enables l...
CVE-2020-6114
PUBLISHED: 2020-07-10
An exploitable SQL injection vulnerability exists in the Admin Reports functionality of Glacies IceHRM v26.6.0.OS (Commit bb274de1751ffb9d09482fd2538f9950a94c510a) . A specially crafted HTTP request can cause SQL injection. An attacker can make an authenticated HTTP request to trigger this vulnerabi...