Attacks/Breaches

2/21/2019
05:50 PM
Connect Directly
Twitter
Twitter
RSS
E-Mail
50%
50%

Attack Campaign Experiments with Rapid Changes in Email Lure Content

It's like polymorphic behavior - only the changes are in the email lures themselves, with randomized changes to headers, subject lines, and body content.

A new email Trojan campaign spotted by security researchers has added another twist in evasive attacker behavior: Researchers with GreatHorn report that the waves of attacks they've observed since yesterday afternoon are rapidly randomizing the email content characteristics of their lures.

"Masquerading as a confirmation on a paid invoice, the attack is sophisticated in that it lacks the consistency of a typical volumetric attack, making it more challenging for email security tools to identify and block," says E.J. Whaley, solutions engineer at GreatHorn. 

Attackers have long leaned on metamorphic and polymorphic malware techniques to make swift changes to the code in order to evade detection. It was only a matter of time before they started taking that philosophy to the scam delivery vehicles. This method is in contrast to what Whaley says is typical in most Trojan phishing email lures, where they'll stick to a single pattern with "slight customizations." Instead, these attacks are switching up subject lines, email content, email addresses, display name spoofs, and destination URLs. 

"Body content generally follows a pattern that confirms the receipt of a payment for an invoice but uses slightly different language to evade capture," Whaley says.

While the subject lines vary, they all seem to cluster around references to receipts or invoices. Sometimes the attacks are very targeted — using spoofed names of a fellow employee of the target — and sometimes they use random names, sent from numerous compromised email accounts. The bulk of the compromise accounts are coming from South American companies. 

The attackers are trying to trick users into downloading a Word template with a VBA downloader trojan embedded within. GreatHorn says the attack was detected in about one in 10 accounts in its user base.

Paid invoice attacks like these are increasingly at the top of phishers’ playbooks. Last year six of 10 phishing messages used some variation of "invoice" as its subject.

Related Content:

 

 

Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry's most knowledgeable IT security experts. Check out the Interop agenda here.

Ericka Chickowski specializes in coverage of information technology and business innovation. She has focused on information security for the better part of a decade and regularly writes about the security industry as a contributor to Dark Reading.  View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Crowdsourced vs. Traditional Pen Testing
Alex Haynes, Chief Information Security Officer, CDL,  3/19/2019
BEC Scammer Pleads Guilty
Dark Reading Staff 3/20/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
5 Emerging Cyber Threats to Watch for in 2019
Online attackers are constantly developing new, innovative ways to break into the enterprise. This Dark Reading Tech Digest gives an in-depth look at five emerging attack trends and exploits your security team should look out for, along with helpful recommendations on how you can prevent your organization from falling victim.
Flash Poll
The State of Cyber Security Incident Response
The State of Cyber Security Incident Response
Organizations are responding to new threats with new processes for detecting and mitigating them. Here's a look at how the discipline of incident response is evolving.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-6149
PUBLISHED: 2019-03-18
An unquoted search path vulnerability was identified in Lenovo Dynamic Power Reduction Utility prior to version 2.2.2.0 that could allow a malicious user with local access to execute code with administrative privileges.
CVE-2018-15509
PUBLISHED: 2019-03-18
Five9 Agent Desktop Plus 10.0.70 has Incorrect Access Control (issue 2 of 2).
CVE-2018-20806
PUBLISHED: 2019-03-17
Phamm (aka PHP LDAP Virtual Hosting Manager) 0.6.8 allows XSS via the login page (the /public/main.php action parameter).
CVE-2019-5616
PUBLISHED: 2019-03-15
CircuitWerkes Sicon-8, a hardware device used for managing electrical devices, ships with a web-based front-end controller and implements an authentication mechanism in JavaScript that is run in the context of a user's web browser.
CVE-2018-17882
PUBLISHED: 2019-03-15
An Integer overflow vulnerability exists in the batchTransfer function of a smart contract implementation for CryptoBotsBattle (CBTB), an Ethereum token. This vulnerability could be used by an attacker to create an arbitrary amount of tokens for any user.