Email Threats Continue to Grow as Attackers Evolve, Innovate

Email continues to be an extremely effective vector for delivering malicious content because of how adept attackers have become at tricking users over the years.

The latest examples include the increasing use of malicious URLs in emails rather than attachments, a trend toward use of HTTPS domains for hosting malicious sites, and new variants of impersonation fraud.

FireEye recently analyzed a sample set of 1.3 billion emails for the first three months of 2019 and counted more URL-based email attacks than attachment-based ones in the first quarter.

URL attacks involve emails with embedded links pointing to a malware download site or a phishing site designed to steal a user's account credentials or credit card data. Emails containing such links are often harder to detect and block than ones with malicious attachments, according to FireEye.

In many cases, attackers have been embedding such links in emails with very little or no content in them in an attempt to bypass email filters and to try and get the recipient curious enough to click on the link. According to FireEye, there was a spike in the number of content-less emails in January. Sometimes the emails have contained nonclickable URLs that are activated when a user copies and pastes it into a browser, the vendor noted.

FireEye observed a troubling 26% quarter-over-quarter increase in malicious URLs pointing to phishing sites hosted on HTTPS domains. The sites, and the phishing lures to get users there, often spoofed major brands. In fact, in Q1 2019, FireEye observed a 17% quarter-over-quarter increase in phishing attacks involving the misuse of a well-known brand name.

Microsoft was by far the most spoofed brand, accounting for 30% of all detections in the first quarter. Other frequently spoofed brands included Apple, Amazon, PayPal, and OneDrive.

"The increase in phishing sites using HTTPS was a very interesting shift," says Ken Bagnall, vice president of email security at FireEye. Also significant was the number of phishing sites spoofed to appear like different Microsoft login pages that FireEye observed in the first quarter. "This really highlights how useful attackers see getting access to a victim's Office 365 credentials," Bagnall says.

Exploiting Trust in File-Sharing Sites
Also increasing significantly in the first quarter was the number of URL links pointing to malicious files hosted on widely trusted cloud-hosted file sharing sites, such as Dropbox, OneDrive, Google Drive, and WeTransfer. Threat actors are increasingly using such file-sharing services to host malicious content because the sites pass the domain reputation checks that many security tools use for vetting links, FireEye said.

Some of these file-sharing sites even let users preview the hosted content and offer a link that can be clicked without having to download the file, the vendor said. "Attackers are simulating user behavior here," Bagnall notes. File-sharing sites have become very common, so users are likely to be less suspicious of interacting with content on these services. "There was a very significant increase in OneDrive this quarter, and we will see more targeting based on customers usage of cloud services in their workflow," he says.

Impersonation email attacks, where an attacker might pretend to be a CEO or a CFO to trick employees into initiating a fraudulent wire transfer or some other action, continued to grow and evolve in the first quarter. In the past, such attacks targeted employees in the accounts payable department. In this year's first quarter, FireEye observed an increase in attacks targeting the payroll and supply chain departments.

For organizations, such developments highlight the need for multilayered defenses. On the technology front, they need a tool stack that innovates in line with attacker behavior, Bagnall says. Security awareness training and education are important as well. So are controls that protect payments processes and prevent individuals in an organization to change bank details or initiate similar actions based on an email communication alone, he says.

Related Content: