Q2 Threat Insights Report | Phishing emails account for 69% of attack vectors

HP Wolf Security recently released its Q2 security threat insights report, which shows that in the second quarter, enterprises were most vulnerable to employees opening email attachments, clicking links in emails, and downloading files from the Web.

▌Significant Threats

▶ CVE-2022-30190

A high-risk zero-day vulnerability in the Microsoft Support Diagnostic Tool (MSDT) URL protocol allows attackers to access systems without macros. The SecurityAssure validation platform can already simulate attacks targeting this vulnerability (including related phishing emails, malicious file transfers, C&C, and destructive action execution of malicious files). Warning! High-risk Windows zero-day vulnerability has been exploited by hackers

▌Key Findings

▶ Attackers Shift to "Macro-free" Formats to Distribute Malware

For years, attackers have relied on malicious macros as the first step to infect target computers. In February, Microsoft announced that Office would disable macros by default in documents downloaded from the Web, effectively closing this technique to attackers. In the second quarter, attackers responded to this change by experimenting with alternative macro-free code. On April 22, Emotet operators began testing shortcut (.lnk) files to deliver malicious files instead of Office documents. Shortcut files work by placing a command in the target path to download and run malware from the web. Early versions of these malicious shortcut files used the "findstr" command to extract and run a Visual Basic script appended to the shortcut file. Variants with commands as batch or PowerShell scripts also appeared in the second quarter. Other malware families spread by attackers through shortcut files include QakBot, IcedID, Bumblebee, NjRAT, and RedLine Stealer. Since mid-June, several shortcut file malware builders have been sold on hacker forums, making the spread of malware even easier.

▶ Notable New Techniques Emerge

At the end of April, a new malicious spam campaign spread an unknown malware family called SVCReady Loader. The malware is notable for its unusual delivery to target endpoints, spreading by using shellcode hidden in Microsoft Office document properties.

▶ Archive Threats Increased by 11% Compared to Q1

Since the first quarter, threats delivered in archives increased by 11%, while scripts and executables decreased by 15%. This is likely due to attackers putting malware into archives, such as malicious .lnk shortcuts stored in .zip archives, before sending it to the target. Archive file formats are more likely to pass through email gateways and can be encrypted, increasing the attacker's ability to bypass security controls that rely on scanning to detect malicious content and reach more users.

▶ Spreadsheets Remain the Preferred File Type for Distributing Malware

Emotet is targeting organisations in the Asia-Pacific region, and the spreadsheet file type is favored by it.

Key Malware File Types

▶ The Most Popular Phishing Email Lures are Commercial Transactions

Phishing emails of the commercial transaction class usually contain keywords such as "order", "invoice", "purchase", etc. In addition, in the second quarter, words related to "shipping" and "delivery" rose to become common phishing email lures.

▶ 14% of Malware-spreading Emails Bypassed Email Gateway Scanners

In the second quarter, the top five file formats delivering malware via email were .xlsx, .xls, .rar, .zip, and .doc, and the most popular file formats delivered via web browsers were .exe, .msi, .rar, .zip, and .pdf. This indicates that attackers are using file formats familiar to users.

Key Attack Vectors. The SecurityAssure validation platform can simulate a series of cyber fraud attack behaviors, such as phishing emails containing malicious links or malicious attachments and attackers using email leaks to collect information, providing enterprises with defense system effectiveness validation services. You can easily select validation experiments for phishing emails containing malicious links or malicious attachments in the SecurityAssure validation platform, and specify AI offensive and defensive bots to send these emails to specified email addresses in the enterprise email system to verify whether your enterprise's email security products have the capability to detect these phishing emails and isolate or delete them.

For browsers or various other forms of attack vectors, SecurityAssure validation can also replicate their attack behaviors. You only need to select the scenarios or actions you need to validate in the SecurityAssure validation platform to test the detection and defense capabilities of the security defense measures you have adopted. | Reference Source: https://threatresearch.ext.hp.com/hp-wolf-security-threat-insights-report-q2-2022/