Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

6/25/2019
07:10 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

Email Threats Continue to Grow as Attackers Evolve, Innovate

Threat actors increasingly using malicious URLs, HTTPS domains, file-sharing sites in email attacks, FireEye says.

Email continues to be an extremely effective vector for delivering malicious content because of how adept attackers have become at tricking users over the years.

The latest examples include the increasing use of malicious URLs in emails rather than attachments, a trend toward use of HTTPS domains for hosting malicious sites, and new variants of impersonation fraud.

FireEye recently analyzed a sample set of 1.3 billion emails for the first three months of 2019 and counted more URL-based email attacks than attachment-based ones in the first quarter.

URL attacks involve emails with embedded links pointing to a malware download site or a phishing site designed to steal a user's account credentials or credit card data. Emails containing such links are often harder to detect and block than ones with malicious attachments, according to FireEye.

In many cases, attackers have been embedding such links in emails with very little or no content in them in an attempt to bypass email filters and to try and get the recipient curious enough to click on the link. According to FireEye, there was a spike in the number of content-less emails in January. Sometimes the emails have contained nonclickable URLs that are activated when a user copies and pastes it into a browser, the vendor noted.

FireEye observed a troubling 26% quarter-over-quarter increase in malicious URLs pointing to phishing sites hosted on HTTPS domains. The sites, and the phishing lures to get users there, often spoofed major brands. In fact, in Q1 2019, FireEye observed a 17% quarter-over-quarter increase in phishing attacks involving the misuse of a well-known brand name.

Microsoft was by far the most spoofed brand, accounting for 30% of all detections in the first quarter. Other frequently spoofed brands included Apple, Amazon, PayPal, and OneDrive.

"The increase in phishing sites using HTTPS was a very interesting shift," says Ken Bagnall, vice president of email security at FireEye. Also significant was the number of phishing sites spoofed to appear like different Microsoft login pages that FireEye observed in the first quarter. "This really highlights how useful attackers see getting access to a victim's Office 365 credentials," Bagnall says.

Exploiting Trust in File-Sharing Sites
Also increasing significantly in the first quarter was the number of URL links pointing to malicious files hosted on widely trusted cloud-hosted file sharing sites, such as Dropbox, OneDrive, Google Drive, and WeTransfer. Threat actors are increasingly using such file-sharing services to host malicious content because the sites pass the domain reputation checks that many security tools use for vetting links, FireEye said.

Some of these file-sharing sites even let users preview the hosted content and offer a link that can be clicked without having to download the file, the vendor said. "Attackers are simulating user behavior here," Bagnall notes. File-sharing sites have become very common, so users are likely to be less suspicious of interacting with content on these services. "There was a very significant increase in OneDrive this quarter, and we will see more targeting based on customers usage of cloud services in their workflow," he says.

Impersonation email attacks, where an attacker might pretend to be a CEO or a CFO to trick employees into initiating a fraudulent wire transfer or some other action, continued to grow and evolve in the first quarter. In the past, such attacks targeted employees in the accounts payable department. In this year's first quarter, FireEye observed an increase in attacks targeting the payroll and supply chain departments.

For organizations, such developments highlight the need for multilayered defenses. On the technology front, they need a tool stack that innovates in line with attacker behavior, Bagnall says. Security awareness training and education are important as well. So are controls that protect payments processes and prevent individuals in an organization to change bank details or initiate similar actions based on an email communication alone, he says.

Related Content:

 

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Data Leak Week: Billions of Sensitive Files Exposed Online
Kelly Jackson Higgins, Executive Editor at Dark Reading,  12/10/2019
Intel Issues Fix for 'Plundervolt' SGX Flaw
Kelly Jackson Higgins, Executive Editor at Dark Reading,  12/11/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
The Year in Security: 2019
This Tech Digest provides a wrap up and overview of the year's top cybersecurity news stories. It was a year of new twists on old threats, with fears of another WannaCry-type worm and of a possible botnet army of Wi-Fi routers. But 2019 also underscored the risk of firmware and trusted security tools harboring dangerous holes that cybercriminals and nation-state hackers could readily abuse. Read more.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-5252
PUBLISHED: 2019-12-14
There is an improper authentication vulnerability in Huawei smartphones (Y9, Honor 8X, Honor 9 Lite, Honor 9i, Y6 Pro). The applock does not perform a sufficient authentication in a rare condition. Successful exploit could allow the attacker to use the application locked by applock in an instant.
CVE-2019-5235
PUBLISHED: 2019-12-14
Some Huawei smart phones have a null pointer dereference vulnerability. An attacker crafts specific packets and sends to the affected product to exploit this vulnerability. Successful exploitation may cause the affected phone to be abnormal.
CVE-2019-5264
PUBLISHED: 2019-12-13
There is an information disclosure vulnerability in certain Huawei smartphones (Mate 10;Mate 10 Pro;Honor V10;Changxiang 7S;P-smart;Changxiang 8 Plus;Y9 2018;Honor 9 Lite;Honor 9i;Mate 9). The software does not properly handle certain information of applications locked by applock in a rare condition...
CVE-2019-5277
PUBLISHED: 2019-12-13
Huawei CloudUSM-EUA V600R006C10;V600R019C00 have an information leak vulnerability. Due to improper configuration, the attacker may cause information leak by successful exploitation.
CVE-2019-5254
PUBLISHED: 2019-12-13
Certain Huawei products (AP2000;IPS Module;NGFW Module;NIP6300;NIP6600;NIP6800;S5700;SVN5600;SVN5800;SVN5800-C;SeMG9811;Secospace AntiDDoS8000;Secospace USG6300;Secospace USG6500;Secospace USG6600;USG6000V;eSpace U1981) have an out-of-bounds read vulnerability. An attacker who logs in to the board m...