Hornetsecurity warns of phishing and malware attacks that pretend to be from global health organizations

Reports of new cases of Coronavirus infection are appearing rapidly. The pictures of sealed-off cities and people in quarantine suggest a horrifying scenario. But the virus is not only a risk in the analogue world: the growing fear is shamelessly exploited by cyber criminals with targeted phishing and malware campaigns. Sadly, there is now a Coronavirus infection risk via email.

Since the beginning of February, the Hornetsecurity Security Lab has observed an increased volume of emails sent in the name of the World Health Organization and the Centers for Disease Control and Prevention. The messages explicitly take advantage of people’s fear of the virus.

For example, a link provides an alleged list of new cases of infection in the immediate vicinity. The recipient would be able to access this list by entering an email address and a password. This is a classic phishing email that is intended to steal sensitive data. In other cases a download link or an attached document is offered. Both promise information on security measures to protect against infection.

If the link is clicked or the document is opened, a malicious file will be downloaded. There is a substantial risk that the IT system could be infected with a virus or ransomware.

Increase in attacks that reference current events

The experts at Hornetsecurity point out that more and more often, current events with a high emotional charge are being used as hooks for large-scale phishing and malware campaigns. By exploiting people’s emotions, cyber criminals know their emails will receive more attention and be seen as more credible. The probability that the messages will be opened increases.

The Coronavirus mailing is only one of many current cases. There have been similar mail attacks referencing the climate protests initiated by Greta Thunberg, GDPR and the bush-fires in Australia—all of these are actual exploits that have been intercepted by Hornetsecurity.

Since email communication in companies is still the number one gateway for cyber attacks, employees must be made aware of this issue in addition to setting up effective protection mechanisms. Detecting phishing emails is not easy – but not impossible either. To vet suspicious messages, the following areas should be checked:

• The sender’s email address can provide information about the true origin of the message. If it is not plausible or contains spurious letters or cryptic symbols, this is a warning sign.
• Large-scale phishing campaigns often only use a generic form of address for the recipient.
• Incorrect spelling and grammar and an unprofessional layout are also an indication.
• The use of pressure is a common tactic. This is intended to undermine critical thinking.
• Cyber criminals often try to get the recipient to open a URL or attachment. Email attachments can present serious risks.

Further Information:

• Blogpost: Cyber-criminals spread Emotet in the name of Greta Thunberg
• Blogpost: Formjacking – The New Invisible Threat in Cyberspace

Currently there are about 180 million corporate customers reported by the international technology company Microsoft using their cloud service Office 365. With the end of support for Windows 7 on January 14 and the termination of support for Office 2010 in October this year, a significant increase in Microsoft Office 365 users is expected. Companies are now weighing the risks of cyber-attacks on cloud services against the technological opportunities. They are facing the choice of either storing their data in the cloud and upgrading their IT systems or being left behind by the competition of the future.

Microsoft is already countering the increasing number of cyber-attacks on Office 365 users with numerous security measures enabled to protect its customers’ important data and information from unauthorized access and insight. The main vector for malware and phishing attacks is email communication, for which Microsoft has integrated special security mechanisms. However, security experts recommend to not only rely on Microsoft’s safety measures, but to additionally secure Office 365 accounts with third-party solutions. Why? We will explain in the following blogpost.

Office 365 – ‘account hijacking’ vulnerability?

With greater flexibility, cost savings, outsourcing of storage capacity, relevant tools and the latest software available in seconds – all these factors point to the benefits of cloud computing. Already 73 percent of German companies rely on cloud services and see this as a growing market for the future. In upcoming years, other companies will no longer be able to avoid the upgrade of their systems – or they will be left behind by their competitors.

Microsoft is regarded as the major driver of the cloud movement, and has brought the world’s most widely used office suite to the cloud with Office 365. Critical and sensitive files are uploaded and exchanged daily by more than 100 million business customers in the Office Cloud … a fact that cyber-criminals are well aware of. Recently, Microsoft reported a 250 percent increase in targeted attacks on Office 365 accounts. Microsoft has already integrated some security features into Office 365 – but the question you should ask, are these measures really enough? What additional solutions can provide comprehensive security?

Attacks on Office 365 accounts increase from quarter to quarter

IT Security: What are the challenges with Office 365?

The key factor for migration to the cloud is the protection of personal data, in addition to comprehensive security, especially after implementation of GDPR. The worldwide increase in cyber-crime is placing the challenge of these factors even more clearly in focus.

Identifying an Office 365 user is very simple for an attacker, because the MX records and autodiscover entries are visible to the public online. Comprehensive security features are being implemented to prevent possible attacks from Office 365 accounts, but it must be kept in mind that the data in the cloud itself – even in the event of unauthorized access – can be accessed from anywhere. By using Office 365, an important security aspect is no longer available to companies: the firewall. If an attacker succeeds in gaining unauthorized access to an Office 365 account, all data is available to them without any restrictions.

Email communication is the main gateway for attacks

95 percent of all cyber-attacks on companies occur via email, because email is considered a central channel of communication by companies worldwide. A single mailbox often contains numerous email messages with personal data of other users, sensitive files and sometimes even internal confidential information. Attackers can enter a company’s IT directly via email without authentication. All it takes is for one user to interact with a piece of infected content or attachment that takes over the user’s account. If an administrator account has been taken over, the attacker is given the same rights as the account owner and has the opportunity to gain access to the data of all users within the company.

A Hijack attack specifically targeting Office 365 users

A new level of security is necessary

The focus of additional security features should primarily be on the area of email communication. It is important to secure Office 365 accounts with a third-party solution. Specialized providers hide Microsoft DNS and MX records, which means that Office 365 users are not easily identifiable to attackers and are therefore less likely to be targeted. In addition, they provide much better protection against targeted attacks on Office 365 accounts, which the attacker has successfully tested against the basic Microsoft protection mechanisms. In addition, a small number of providers allow full Microsoft 365 email encryption of mailbox data stored within the cloud, which is then protects against spying even if an account hijacking was successful.

The IT market research institute Gartner predicts that this year already 50 percent of the organizations using Microsoft Office as SaaS will secure their email communication through third-party providers. 35 percent of all companies that switch to the Office 365 cloud will use such a solution from the very beginning.

Further Information

• Blogpost: The understanding of data protection – beyond borders

• Microsoft 365 Email Encryption: Encrypt the content of all email stored in the Microsoft Office 365 Cloud.

Encrypted malicious attachments, phishing and fake application mails are known attack methods used by cyber criminals to deliver malware such as ransomware into corporate systems. Once in the system, malware can cause losses of millions of dollars through encrypted corporate documents, theft of relevant files and information, or a slowdown of business processes through illegal crypto mining. Sophisticated filter systems for the detection of hidden malware make the way into a company’s system increasingly challenging for cybercriminals.

Therefore, the focus of cyber criminals is shifting more and more to the human vulnerability: They address employees of selected companies with simple but very individual and strictly textual email messages – this procedure is known as business email compromise (BEC). The Hornetsecurity Security Lab has been recording a significant increase of this type of attack for around 1 ½ year now.

What is business email compromise?

Large sums of money are fraudulently transferred to an external account, important internal company and access data as well as other confidential information leave the company unnoticed – without any malware being introduced. With a BEC, a hacker relies on special insider knowledge as opposed to simple spam. Known names and email addresses of employees or customers as well as current signatures and disclaimers make a fake email appear authentic.

By using fake email addresses similar to the one of the CEO, a customer or a clerk, the cybercriminals send a short, purely text-based email specifically to a selected employee. The display name is shown exactly as it would appear in an email from the actual person. This makes it difficult to detect the fraud behind it.

What do cybercriminals do?

In the first email, the cybercriminal gets a feel for the subject. The alleged CEO or supervisor addresses an urgent concern to a target person in a company. The criminal asks for a quick written answer by email, because the boss is allegedly in a meeting or cannot be reached by telephone. The hacker puts the recipient under pressure in terms of time and psychology to veil he fraud.

If the criminal receives an answer, he becomes more precise in a second message: The alleged superior requests the transfer of a certain amount of money to the account of an alleged customer, business partner or service provider. But not only financial resources are captured in this way. The hackers can also get internal company data as well as information to misuse them for other purposes. The CEO fraud is the best-known cybercriminal procedure to date but the fraud of the business email compromise can occur in different ways:

• The hacker masquerades as a company’s customer and announces a change in payment information to trigger future transactions to the attacker’s account.
• Covered with an employee’s alleged email address, the cybercriminal sends invoices to the company’s customers.
• Using a lawyer’s compromised email account, pressure is put on a targeted recipient within a company to make a payment or return information.

Current risk situation

According to the FBI’s latest internet crime report, the business email compromise along ransomware, banking trojan virus and phishing is responsible for much of the world’s financial losses caused by cybercrime. In 2018, the fraud caused by fake emails led to global losses of around 1.2 billion dollars. And the threat posed by BEC is expected to persist and increase.

„Once a company is affected, it is very likely that this type of attack will be repeated. Any additional internal information unknowingly sent by an employee via email makes more fake emails look even more authentic“, said an expert from the Hornetsecurity Security Lab. „Every month, we see an increasing number of incoming emails in which cybercriminals try to impersonate real employees or customers. And each time, the method becomes more sophisticated: in some cases, the logo, disclaimer and signature of the targeted company are reproduced one-to-one. The recipient of such a fraudulent email needs to know exactly what to look out for.“

Which companies are largely affected?

Cybercriminals often target large and internationally operating companies via business email compromise. Information about people in certain administrative positions is easy to find out, logos or current market activities are usually accessible on the internet. In addition, international financial transactions are not uncommon and in large companies, there is a high probability that employees have never met in person and the simple exchange of emails is a normal part of everyday working life.

In 2015, the German cable specialist Leoni AG became a victim of such a fraud. Cybercriminals cheated the company by around 40 million euros. . The globally known social network Facebook and the Google Group were also robbed of a total of 100 million US dollars for more than two years. This became known in 2017, when the fraud was discovered and made public by the US American magazine Fortune. According to the FBI’s report, the current focus is on real estate companies.

How can comanies protect themselves against it?

The Hornetsecurity Security Lab assumes that the business email compromise will remain one of the biggest cyber threats in the future: „: Classic anti-phishing or spam services fail to recognize BEC emails due to their generic content. We offer our customers highly customizable and complex anti-fraud protection to ensure the highest level of security. Consequently, we receive only positive feedback from companies using our targeted fraud forensics engines. “ Precisely targeted engines verify the authenticity and integrity of metadata and email content. They identify specific content patterns that suggest fraudulent email. This prevents fake emails from reaching your inbox. Even trainings which additionally draw employees’ attention to the characteristic elements of a business email compromise can put a stop to the growing danger.

Further information:

• Blogpost: Social Engineering – How hackers get at your data without programming skills
• Service: Advanced Threat Protection

Mit dem Laden des Videos akzeptieren Sie die Datenschutzerklärung von YouTube.
Mehr erfahren

Video laden

YouTube immer entsperren

The name says it all

What do the digital pirates want to achieve?

I have been a victim of a phishing attack – what should I do now?

How can I effectively protect myself from phishing?

1. Sensibilisation

2. Active protection

Example of a phishing email:

Example of a spear phishing email:

Additional information:

• • Blog post: Current wave of phishing attack: Valyria downloader reloads spyware
  • Blogbeitrag: Dangerous Amazon phishing emails cause trouble
  • Hornetsecurity Services to protect against phishing and spear phishing attacks: Spamfilter Service & Advanced Threat Protection.

+++ UPDATE 05.12.2018: The Hornetsecurity Security Lab is currently observing an immense increase in the number of dangerous emails, which come with the malicious malware “Emotet“. Also the BSI informs about the growing threat, by the current Phishing and Spam campaign, which spreads “Emotet”. The affected companies suffered from failures of their entire IT infrastructure, which resulted in immense capital damage.

Disguised as an Office Word document attached to a legitimate email, the malware is installed on a computer when opened and reads contacts and email content from the mailboxes of the infected system. Furthermore, Emotet has the ability to reload additional malware that allows hackers to read access data and provide remote access to the system.

In September this year, Hornetsecurity already published a report about the appearance of the malware as an invoice disguised as a PDF document, which reloads a banking Trojan when executed.+++

The malware specialists from our security lab found a new type of the banking Trojan Emotet on Thursday, 06.09.18 and investigated the attacking method in more detail.

Earlier versions of Emotet were mainly distributed directly in email attachments or through links in email bodies. This new type uses a more complex delivery method: it is hidden in the form of a PDF document disguised as an invoice and attached to a phishing email.

Phishing email with attached PDF document

PDF document with link to Office file

The content of this PDF document contains a link to download an Office file.

Office document

Once the user opens the file, a macro is executed that downloads the dangerous malware.

Static analysis – code fragment

Emotet uses this cover-up technique to circumvent virus filters and sandbox analyses. So far this seems to work well, because not even a third of the antivirus programs listed on VirusTotal classify the file as dangerous.

On the safe side with Advanced Threat Protection

The URL scanning feature of Hornetsecurity’s Advanced Threat Protection detects files, however well hidden they may be, and protects customers’ IT from this persistent blended attack even before the phishing mail arrives.

Additional information:

• Blog post: All about Malware + Infographic
• Perfectly protected against Emotet: Hornetsecurity Advanced Threat Protection

When the question is brought up as to what the term “malware“ is all about, most people do not understand what the term is about. Often words like “virus” or “Trojan” are used. This is not necessarily wrong, but also not actually right. After all, the topic is much more complex and is not just about viruses and Trojans.

More than just viruses and Trojans

“Malware” is a neologism composed of the two English words “malicious” and “software”. Mistakenly, malware is often used synonymously for the words virus or trojan, but the world of malware is much larger and more complex. In fact, malware is simply a collective term for various malicious programs, which in addition to viruses and Trojans also include “exploits”, “backdoors”, “spyware”, “worms” and “ransomware“ – to name just a few of the most important representatives.

Ransomware – When the computer demands ransom money

Ransomware is a form of malware that is able to prevent access to all data stored on a computer. The hackers encrypt the files stored on the hard disk and after a successful infection usually leave a message on the screen of the victim with the demand a ransom. If this doesn’t happen, it is threatened that the encrypted files – depending on the implementation of the Ransomware – will not be decrypted or even deleted.

There are plenty of ways to infect computers with ransomware. By far the most common gateway, however, is email communication. The cybercriminals often use social engineering to impersonate a well-known organization or a familiar person in order to suggest trust.

to impersonate a well-known organization or a familiar person in order to suggest trust.
In many cases, the Ransomware is contained in an Office document that is sent as an attachment. A pretext is used to persuade the recipient to open the file. In this case, all data on the hard disk is encrypted. Especially in recent years, there have been massive Ransomware attacks, known as „WannaCry“ or „Petya“. Even if Ransomware only appears rarely in the frequency of occurrence: The damage that can be caused by the aggressive cryptotrojans should never be underestimated! Measured in absolute figures, one percent of total malware worldwide is still a significant number.

Exploits and Backdoors – The ace up the sleeve

Exploits are a popular tool used by hackers to exploit vulnerabilities or security gaps in software and use them to enter computer systems. An exploit can be a simple theoretical description of a vulnerability or a directly runable program code.

The range of different types of exploits is so wide that there is the right exploit for almost every occasion. They differ not only in the type of attack, but also in their effects. Depending on its type, the malicious program can write or read data, for example, or even crash a system. Well-known exploit types are the zero-day attack and the denial of service exploit (DoS exploit).

Many types of malware, one solution?

The professionalism of malware attacks is increasing day by day. In particular, attacks through ransomware are very popular among cybercriminals. Those who think that there is THE solution to the problem of malware are unfortunately mistaken. Rather, a company should have a sophisticated security concept with many different measures. In the following we will describe in detail which measures can be considered.

Many components must work well together to achieve an optimum of protection against malware. However, the most important point is to increase the awareness of employees against cyber attacks. A company’s employees must be conscious of the threats caused by malware. Information about the various malware distribution channels should therefore be integrated into the daily work routine in regular training courses, for example.

To be on the safe side, companies are advised to use a spam filtering service to prevent malicious emails from reaching employees’ email inboxes in the first place. In the unlikely event that a malware program should ever be able to infect an employee’s computer, then an antivirus program is still a useful method of defeating the invader.

Also updates should not only be common for antivirus programs. It is advisable to establish a process that regularly reviews the actuality of the programs used, in order to update them if necessary. Those who stick to these tips are at least less likely to become a victim for cybercriminals.

Additional information:

• • Blog post: Spam emails + infographic
  • Blog Post: Successful Product CEO fraud + infographic
  • Further information on the subject of cybercrime can now be found in the Hornetsecurity Knowledge Database.