A new method for spreading malware online has been discovered, and it involves taking advantage of email threads to deploy malware loaders.

Email threads can quickly build, especially if there are more than two participants. As such, it can be difficult to keep up with who is saying what and, crucially, who is attaching files to the thread. Accordingly, this creates the perfect scenario for threat actors to get involved and turn the situation to their advantage. And, as a result of a vulnerability in Microsoft Exchange servers, this is exactly what has been happening.

If you work in any modern organization, the chances are that you use email on, at least, an hourly basis to keep up to date with the rest of the world. Therefore, this new threat is one that you need to understand.

How Email Threads are Being Hijacked

This latest campaign is particularly deceptive and relies on the presence of unpatched Microsoft Exchange servers. This email service is commonly used by businesses to synchronize email between an Exchanger server and an email client e.g. Outlook. The vulnerability offered up by these unpatched servers allows hackers to harvest login credentials; the threat actors are then presented with the opportunity to illegally access specific email accounts. Once they are logged in, the hackers can view all the email threads that the account is involved with.

By viewing the various email threads, the hacker can then decide which is best to launch their attack through. All they have to do is choose an email thread and start replying to it. More crucially, they will also attach some infected attachments. These are packaged within a ZIP archive and comprise an ISO file which contains both a DLL file and an LNK file. Once the LNK file is activated, it will run the DLL file and activate the IcedID malware loader. IcedID is a well-known banking trojan which can steal financial information, login credentials and start the installation of further malware.

Protecting Your Emails

First and foremost, it’s vital that you install new updates as soon as they are available. This will instantly minimize the chances of vulnerabilities being exploited on your network. Fail to implement these upgrades, however, and you could fall victim to attacks such as the one we have been discussing. In addition to this, it also pays to take notice of the following:

  • Verify Any Email Attachments: if, in the middle of an email thread, a suspicious file attachment suddenly appears, verify it with the person it appears to have been sent by. However, do not do this over email; if the email account has been compromised then the hacker will simply confirm it is genuine. Instead, speak in-person or over the phone to the sender to get confirmation.
  • Use Multi-Factor Authentication: one of the simplest ways to reduce the impact of stolen login credentials is by strengthening the login procedure with multi-factor authentication. This approach will provide an extra layer of security and ensure that any threat actors will struggle to navigate their way through it.

For more ways to secure and optimize your business technology, contact your local IT professionals.

Read More


The backbone of any IT infrastructure is always the server room. It’s here that your most crucial IT tasks will be processed. And it needs to be secure.

A server room is a dedicated area within an organization which is used to house networking devices and storage servers. These are used to provide your business with the fundamentals of a fully functioning IT structure in the 21st century. But, as with all elements of IT, security is paramount. The data storage, alone, represents a rich source of intrigue to outside parties. And the networking solutions contained within a server room offer a shortcut deep into an organization. The potential damage from a server room breach, therefore, is huge.

Securing Your Server Room

It’s important that you secure your server room to protect both yourself and your customers. Thankfully, it’s straightforward once you understand the basics of server room security. Make sure you carry out the following:

  • Secure Racks and Cages: The best way to organize your storage and networking servers is by using racks and cages. These structures will allow you to neatly store your devices and locate them quickly for maintenance. But these racks and cages need to be secure. Aside from the confidential data stored on these devices, the equipment typically housed in racks and cages is expensive. Accordingly, you will need to secure these housings to minimize the risk of your server equipment leaving the premises.
  • Multi-factor Authentication: One of the strongest security measures you can implement involves multi-factor authentication. The need for a key, for example, is a fantastic way to provide security. But what if you doubled this up with the need for a credential card or even a biometric input? This strategy minimizes the problems that can arise when a key is lost or stolen. Naturally, it may seem time consuming and expensive, but the enhanced security provided by multi-factor authentication is more than worth it.

For more ways to secure and optimize your business technology, contact your local IT professionals.

Read More