Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

6/25/2019
07:10 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

Email Threats Continue to Grow as Attackers Evolve, Innovate

Threat actors increasingly using malicious URLs, HTTPS domains, file-sharing sites in email attacks, FireEye says.

Email continues to be an extremely effective vector for delivering malicious content because of how adept attackers have become at tricking users over the years.

The latest examples include the increasing use of malicious URLs in emails rather than attachments, a trend toward use of HTTPS domains for hosting malicious sites, and new variants of impersonation fraud.

FireEye recently analyzed a sample set of 1.3 billion emails for the first three months of 2019 and counted more URL-based email attacks than attachment-based ones in the first quarter.

URL attacks involve emails with embedded links pointing to a malware download site or a phishing site designed to steal a user's account credentials or credit card data. Emails containing such links are often harder to detect and block than ones with malicious attachments, according to FireEye.

In many cases, attackers have been embedding such links in emails with very little or no content in them in an attempt to bypass email filters and to try and get the recipient curious enough to click on the link. According to FireEye, there was a spike in the number of content-less emails in January. Sometimes the emails have contained nonclickable URLs that are activated when a user copies and pastes it into a browser, the vendor noted.

FireEye observed a troubling 26% quarter-over-quarter increase in malicious URLs pointing to phishing sites hosted on HTTPS domains. The sites, and the phishing lures to get users there, often spoofed major brands. In fact, in Q1 2019, FireEye observed a 17% quarter-over-quarter increase in phishing attacks involving the misuse of a well-known brand name.

Microsoft was by far the most spoofed brand, accounting for 30% of all detections in the first quarter. Other frequently spoofed brands included Apple, Amazon, PayPal, and OneDrive.

"The increase in phishing sites using HTTPS was a very interesting shift," says Ken Bagnall, vice president of email security at FireEye. Also significant was the number of phishing sites spoofed to appear like different Microsoft login pages that FireEye observed in the first quarter. "This really highlights how useful attackers see getting access to a victim's Office 365 credentials," Bagnall says.

Exploiting Trust in File-Sharing Sites
Also increasing significantly in the first quarter was the number of URL links pointing to malicious files hosted on widely trusted cloud-hosted file sharing sites, such as Dropbox, OneDrive, Google Drive, and WeTransfer. Threat actors are increasingly using such file-sharing services to host malicious content because the sites pass the domain reputation checks that many security tools use for vetting links, FireEye said.

Some of these file-sharing sites even let users preview the hosted content and offer a link that can be clicked without having to download the file, the vendor said. "Attackers are simulating user behavior here," Bagnall notes. File-sharing sites have become very common, so users are likely to be less suspicious of interacting with content on these services. "There was a very significant increase in OneDrive this quarter, and we will see more targeting based on customers usage of cloud services in their workflow," he says.

Impersonation email attacks, where an attacker might pretend to be a CEO or a CFO to trick employees into initiating a fraudulent wire transfer or some other action, continued to grow and evolve in the first quarter. In the past, such attacks targeted employees in the accounts payable department. In this year's first quarter, FireEye observed an increase in attacks targeting the payroll and supply chain departments.

For organizations, such developments highlight the need for multilayered defenses. On the technology front, they need a tool stack that innovates in line with attacker behavior, Bagnall says. Security awareness training and education are important as well. So are controls that protect payments processes and prevent individuals in an organization to change bank details or initiate similar actions based on an email communication alone, he says.

Related Content:

 

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
The Problem with Proprietary Testing: NSS Labs vs. CrowdStrike
Brian Monkman, Executive Director at NetSecOPEN,  7/19/2019
RDP Bug Takes New Approach to Host Compromise
Kelly Sheridan, Staff Editor, Dark Reading,  7/18/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Building and Managing an IT Security Operations Program
As cyber threats grow, many organizations are building security operations centers (SOCs) to improve their defenses. In this Tech Digest you will learn tips on how to get the most out of a SOC in your organization - and what to do if you can't afford to build one.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-2873
PUBLISHED: 2019-07-23
Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions that are affected are Prior to 5.2.32 and prior to 6.0.10. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox...
CVE-2019-2874
PUBLISHED: 2019-07-23
Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions that are affected are Prior to 5.2.32 and prior to 6.0.10. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox...
CVE-2019-2875
PUBLISHED: 2019-07-23
Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions that are affected are Prior to 5.2.32 and prior to 6.0.10. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox...
CVE-2019-2876
PUBLISHED: 2019-07-23
Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions that are affected are Prior to 5.2.32 and prior to 6.0.10. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox...
CVE-2019-2877
PUBLISHED: 2019-07-23
Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions that are affected are Prior to 5.2.32 and prior to 6.0.10. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox...