attachments Archives

Email Threads Are Being Hijacked to Spread Malware

attachments, email links, fake emails, Hijacks, multi factor authentication, Ophtek, Updatesattachments, email links, fake emails, Hijacks, multi-factor authentification, Ophtek, updatesOphtek, LLC

Apr 2022

A new method for spreading malware online has been discovered, and it involves taking advantage of email threads to deploy malware loaders.

Email threads can quickly build, especially if there are more than two participants. As such, it can be difficult to keep up with who is saying what and, crucially, who is attaching files to the thread. Accordingly, this creates the perfect scenario for threat actors to get involved and turn the situation to their advantage. And, as a result of a vulnerability in Microsoft Exchange servers, this is exactly what has been happening.

If you work in any modern organization, the chances are that you use email on, at least, an hourly basis to keep up to date with the rest of the world. Therefore, this new threat is one that you need to understand.

How Email Threads are Being Hijacked

This latest campaign is particularly deceptive and relies on the presence of unpatched Microsoft Exchange servers. This email service is commonly used by businesses to synchronize email between an Exchanger server and an email client e.g. Outlook. The vulnerability offered up by these unpatched servers allows hackers to harvest login credentials; the threat actors are then presented with the opportunity to illegally access specific email accounts. Once they are logged in, the hackers can view all the email threads that the account is involved with.

By viewing the various email threads, the hacker can then decide which is best to launch their attack through. All they have to do is choose an email thread and start replying to it. More crucially, they will also attach some infected attachments. These are packaged within a ZIP archive and comprise an ISO file which contains both a DLL file and an LNK file. Once the LNK file is activated, it will run the DLL file and activate the IcedID malware loader. IcedID is a well-known banking trojan which can steal financial information, login credentials and start the installation of further malware.

Protecting Your Emails

First and foremost, it’s vital that you install new updates as soon as they are available. This will instantly minimize the chances of vulnerabilities being exploited on your network. Fail to implement these upgrades, however, and you could fall victim to attacks such as the one we have been discussing. In addition to this, it also pays to take notice of the following:

Verify Any Email Attachments: if, in the middle of an email thread, a suspicious file attachment suddenly appears, verify it with the person it appears to have been sent by. However, do not do this over email; if the email account has been compromised then the hacker will simply confirm it is genuine. Instead, speak in-person or over the phone to the sender to get confirmation.

Use Multi-Factor Authentication: one of the simplest ways to reduce the impact of stolen login credentials is by strengthening the login procedure with multi-factor authentication. This approach will provide an extra layer of security and ensure that any threat actors will struggle to navigate their way through it.

For more ways to secure and optimize your business technology, contact your local IT professionals.

3 Million Windows PCs at Risk of Login Credential Theft

attachments, email links, malware, Ophtek, Updates, Windows PCattachments, links, Login, malware, Ophtek, updates, Windows PCOphtek, LLC

Jul 2021

Login credentials are a sure-fire way to protect your IT systems. But hackers are now using a new piece of malware to steal them from your organization.

User ID / Password combinations have been a cornerstone of IT security since the earliest days of computers. Traditionally, it was almost impossible to guess both of these values. The only option a hacker had was to literally look over the shoulder of the user as they entered the details. But a lot has changed in the way we use computers since then. And the possibilities created by the internet mean that hackers can now steal login credentials from anywhere in the world. All they need is some malware and a potential victim.

A new piece of malware has recently been discovered which has been used in a large scale attack, so it’s important we take a closer look.

What is this Latest Attack?

This latest malware – discovered by Nord Security and currently unnamed – to hit the digital headlines is classified as a Trojan. As the name suggests, a Trojan is a piece of malware which disguises itself as genuine software, but contains malicious code. Little is known about the origins of this latest malware or its exact mechanisms, but its strength is beyond question. This has been demonstrated by the malware carrying out the following:

Infecting three million Windows PCs
Stealing 1.2TB of data which includes email addresses, cookies and over six million individual files
Using infected PCs in-built webcams to take photos of the victims

How Do You Avoid Falling Victim to Malware?

Malware is a complex threat to tackle due to the ease with which it can be constructed by hackers. This allows the hacker to give their malware an individual blueprint with unique features that are difficult to detect. Even the best defenses in the world can easily fall victim to malware. Nonetheless, you are far from helpless when it comes to combatting the threat of malware. To help strengthen your defenses, make the following part of your security structure:

Always Verify Links: Almost every website and email will contain at least one link. But these links can easily be disguised to contain something nasty. A link may, for example, claim to take you to a Microsoft security fix, but the true destination within the link may be for a malicious website. Therefore, always make sure you hover your cursor over links to reveal their true destination.

Double Check Email Attachments: Highly powerful malware can easily be packed into a small file and delivered as an email attachment. Accordingly, you need to be suspicious of all files entering your organization. Even if an email is received from a reputable source you need to remain vigilant. Genuine email addresses can easily be hacked and used to spread malware. If something doesn’t feel right about an email then check with an IT professional.

Install all Updates: All software and hardware is prone to vulnerabilities due to the amount of code involved in their operation. And these vulnerabilities provide hackers with quick and easy access to your IT systems. Thankfully, manufacturers regularly issue security patches to plug these holes. Make sure that these are always installed quickly to minimize any risk.

For more ways to secure and optimize your business technology, contact your local IT professionals.

Tag Archives: attachments