Uptick Seen in ISO Email Attachments Delivering Malware

guest · Dec 23, 2019

Uptick Seen in ISO Email Attachments Delivering Malware
December 23, 2019
https://www.bleepingcomputer.com/ne...-in-iso-email-attachments-delivering-malware/

Security researchers analyzing malicious spam campaigns noticed an increase in delivering malware in disk image file formats, .ISO being the most prevalent.

Among the most popular threats delivered this way are remote access tools (NanoCore, Remcos) and LokiBot information stealer.
Choosing ISO to deliver malware makes sense since Windows operating system has the ability to mount this file type when double-clicked. This allows scammers to disguise the threat as an innocent file.

In a recent campaign caught by Trustwave, cybercriminals created a fake FedEx shipment email message to trick recipients into downloading a malicious ISO that included an executable.
ISO is not the only image file abused this way. In what appears to be a targeted attack, the cybercriminals sent invoice-themed emails with an attachment in DAA (Direct Access Archive) format.
Click to expand...

Unlike ISO, the DAA type of image needs specialized software to be mounted and get to the files within, indicating that the crooks knew that the recipient had the necessary application installed.

Based on observations this year, Trustwave believes that cybercriminals have started to experiment more with disk image archives to conceal their malware in a way that slips past security solutions.
However, Trustwave believes that ISO is used for wider attacks that do not focus on a particular victim. DAA and similar image formats that require additional tools to open are reserved for targeted attacks.
Click to expand...

Trustwave: Leveraging Disk Imaging Tools to Deliver RATs

guest · Jan 22, 2020

In enterprise attack wave, NetWire Trojan now buries itself in disk image files
January 22, 2020
https://www.zdnet.com/article/in-ne...wire-rat-trojan-buries-itself-in-image-files/

A new NetWire RAT campaign has been spotted that uses fake disk image attachments loaded with malware in business email scams.

According to IBM X-Force researchers Megan Roddie and Limor Kessem, the Trojan has been connected to a wide range of campaigns "that range from cybercrime endeavors by Nigerian scammers to advanced persistent threat (APT) attacks."
IBM has suggested that in this campaign it is likely local fraudsters who have bought into the commercially-available Trojan in order to rob victims.
Click to expand...

IBM X-Force: New NetWire RAT Campaigns Use IMG Attachments to Deliver Malware Targeting Enterprise Users

The RAT is hidden inside an IMG file, which is a file extension used by disk imaging software. Since many attachments can be automatically blocked by email security controls, spammers often carefully choose the type of file extensions they use in malspam messages, and shuffle the types of files they conceal malware in.

X-Force’s analysis shows that emails delivered by the NetWire RAT in this campaign are being sent from a small number of unique senders supposedly located in Germany.
Click to expand...

guest · May 4, 2020

Microsoft warns of multiple malspam campaigns carrying malicious disk image files
Microsoft: Threat group uses malware-laced ISO and IMG files to infect companies with a remote access trojan
May 4, 2020
https://www.zdnet.com/article/micro...ampaigns-carrying-malicious-disk-image-files/

Microsoft says its advanced machine learning threat detection models have helped its staff detect multiple malicious spam (malspam) campaigns distributing disk image files infected with malware.

In a series of tweets today, Microsoft said these files are infected with a version of the Remcos remote access trojan (RAT), which gives attackers full control over the infected hosts.

"They're using image files and ISO files, which is not super common. It's not like this is the first time ever we have seen it, but it is also not like extremely common for attackers to do this."
Companies receiving these types of email attachments are advised against running the attached files.
These ongoing attacks were uncovered after Microsoft detected some suspicious behavior across Defender installs.
Click to expand...

Log in or Sign up

Uptick Seen in ISO Email Attachments Delivering Malware

guest Guest

guest Guest

guest Guest

Log in or Sign up

Uptick Seen in ISO Email Attachments Delivering Malware

guest Guest

guest Guest

guest Guest

Useful Searches