Hornetsecurity Blog

Get regular updates from the world of cloud security

In our blog, the Hornetsecurity team – especially the experts from the Security Lab – regularly report on IT security topics as well as on current innovations and events at Hornetsecurity.

Email Conversation Thread Hijacking

Email Conversation Thread Hijacking

You should only open email attachments and links from senders you know is an advice often given when it comes to preventing email-based malware and phishing attacks. However, in this article we outline an attack technique called email conversation thread hijacking, which uses victim’s existing email conversations and thus trust-relationships to spread to new victims. Against this attack the previous advice will not help. We explain how email conversation thread hijacking is used by attackers, and why it dramatically increases the likelihood for victims to open malicious links or malicious attachments.
Hornetsecurity announces new partnership with Infinigate UK

Hornetsecurity announces new partnership with Infinigate UK

Hornetsecurity, the leading German email cloud security provider in Europe has signed an agreement with Infinigate UK, the CRN UK Security Distributor of the Year 2019. As one of the fastest growing German tech companies, Hornetsecurity makes with this new partnership another important step to become market leader in UK and Ireland. The ambitious plan is to achieve this within the next 12 months…
Emotet Update increases Downloads

Emotet Update increases Downloads

The Hornetsecurity Security Lab observed a 1000 % increase in downloads of the Emotet loader. The increase in Emotet loader downloads correlates with Emotet’s packer change, which causes the Emotet loader to be less detected by AV software. Our gathered data suggests that the increase in Emotet loader downloads stems from the loader being detected less and thus also the Emotet loader download URLs being blocked less by security mechanisms. Our data, however, also suggests that AV vendors are already closing the detection gap and the detection of the Emotet loader should increase again and thus the number of downloads decreasing again. This analysis is a good display of the impact of the changes to the Emotet loader’s packer.
The webshells powering Emotet

The webshells powering Emotet

The Hornetsecurity Security Lab presents details on the webshells behind the Emotet distribution operation, including insights into payload downloads and how from 2020-07-22 to 2020-07-24 Emotet payloads on Emotet download URLs were replaced with HTML code displaying GIFs. The analysis shows that the number of downloads of the malicious content behind the Emotet download URLs is significant and has been observed peaking at 50,000 downloads per hour. Highlighting that Emotet emails do get clicked. The analysis further shows that compromised websites are not just compromised once but multiple times by different actors and cleanup efforts by the website administrators are often insufficient leading to re-enabling of the malicious Emotet downloads.
Providence Strategic Growth and Verdane Invest in Hornetsecurity

Providence Strategic Growth and Verdane Invest in Hornetsecurity

LONDON, OSLO, AND HANOVER – [23] JULY 2020 – Providence Strategic Growth (“PSG”), the growth equity affiliate of premier asset management firm Providence Equity Partners (“Providence”), and Verdane, the specialist Northern European growth equity investor, today announced that they have entered into a definitive agreement for an investment in Hornetsecurity Group (“Hornetsecurity”), a leading European provider of cloud-based email security and data protection, whereby affiliates of PSG become new shareholders in the Company whereas Verdane re-invests.
Emotet is back

Emotet is back

On 2020-07-17 the Hornetsecurity Security Lab detected the return of Emotet malspam. The reemerging Emotet malspam was already blocked by existing detection rules. The current Emotet malspam wave again uses malicious macro documents spread either via attachments or via malicious download links. As usual, the VBA macros in the document download the Emotet loader that the Hornetsecurity Security Lab has previously analyzed.

Sign Up Hornet News

The new Cyberthreat Report