The Recycler
  • G&G Masthead August 2024
  • Ambiente 2025 Masthead
  • Katun web banner December 2022 NEW
  • Biuromax Masthead web banner March 2024

HP catches cybercriminals ‘Cat?Phishing’ users

May 17, 2024

Invoice lures were the weapon of choice last quarter, while threat actors used Living-off-the-Land techniques to evade detection, according to the latest HP Wolf Security Threat Insights Report.

HP Inc. issued its quarterly HP Wolf Security Threat Insights Report, showing attackers are relying on open redirects, overdue invoice lures, and Living-off-the-Land (LotL) techniques to sneak past defences.

The report provides an analysis of real-world cyberattacks, helping organizations to keep up with the latest techniques cybercriminals use to evade detection and breach PCs in the fast-changing cybercrime landscape.

Based on data from millions of endpoints running HP Wolf Security, notable campaigns identified by HP threat researchers include:

  • Attackers using open redirects to ‘Cat?Phish’ users: In an advanced WikiLoader campaign, attackers exploited open redirect vulnerabilities within websites to circumvent detection. Users were directed to trustworthy sites, often through open redirect vulnerabilities in ad embeddings. They were then redirected to malicious sites – making it almost impossible for users to detect the switch.
  • Living-off-the-BITS: Several campaigns abused the Windows Background Intelligent Transfer Service (BITS) – a legitimate mechanism used by programmers and system administrators to download or upload files to web servers and file shares. This LotL technique helped attackers remain undetected by using BITS to download the malicious files.
  • Fake invoices leading to HTML smuggling attacks: HP identified threat actors hiding malware inside HTML files posing as delivery invoices which, once opened in a web browser, unleash a chain of events deploying open-source malware, AsyncRAT. Interestingly, the attackers paid little attention to the design of the lure, suggesting the attack was created with only a small investment of time and resources.

Patrick Schläpfer, Principal Threat Researcher in the HP Wolf Security threat research team, commented: “Targeting companies with invoice lures is one of the oldest tricks in the book, but it can still be very effective and hence lucrative. Employees working in finance departments are used to receiving invoices via email, so they are more likely to open them. If successful, attackers can quickly monetise their access by selling it to cybercriminal brokers, or by deploying ransomware.”

By isolating threats that have evaded detection-based tools – but still allowing malware to detonate safely – HP Wolf Security has specific insight into the latest techniques used by cybercriminals. To date, HP Wolf Security customers have clicked on over 40 billion email attachments, web pages, and downloaded files with no reported breaches.

The report details how cybercriminals continue to diversify attack methods to bypass security policies and detection tools. Other findings include:

  • At least 12% of email threats identified by HP Sure Click bypassed one or more email gateway scanners.
  • The top threat vectors in Q1 were email attachments (53%), downloads from browsers (25%) and other infection vectors, such as removable storage – like USB thumb drives – and file shares (22%).
  • This quarter, at least 65% of document threats relied on an exploit to execute code, rather than macros.

Dr. Ian Pratt, Global Head of Security for Personal Systems at HP Inc., commented: “Living-off-the-Land techniques expose the fundamental flaws of relying on detection alone. Because attackers are using legitimate tools, it’s difficult to spot threats without throwing up a lot of disruptive false positives. Threat containment provides protection even when detection fails, preventing malware from exfiltrating or destroying user data or credentials, and preventing attacker persistence. This is why organisations should take a defence-in-depth approach to security, isolating and containing high-risk activities to reduce their attack surface.”

HP Wolf Security runs risky tasks in isolated, hardware-enforced disposable virtual machines running on the endpoint to protect users, without impacting their productivity. It also captures detailed traces of attempted infections. HP’s application isolation technology mitigates threats that slip past other security tools and provides unique insights into intrusion techniques and threat actor behaviour.

Categories : Around the Industry

Tags : Business Cybercriminals HP Wolf Security Report Report

  • TN Group Oct 2024 Web ad
  • Static Control June 2022 Big & Bold Ad
  • Apex September 2024 Web ad
  • IR Italiana Web ad January 2021
  • Cartridge Web Oct 2024 Web Banner
  • Biuromax web banner July 2024
  • GM Technology October 2024
  • Ink Tank September 2024 Web ad
  • G&G Big & Bold Web banner January 2024
  • Denner Feb 2024 Web Ad
  • denner UK Web Banner Jul 2024
  • Mito Web banner June 2024
  • ITP Web ad January 2021
  • CET Web ad December 2023
  • HYB Web banner Jan 2024
  • Zhono Web ad March 2024
  • PCL Oct 2024 Web banner
  • HYB Web banner Jan 2024
  • CET Web ad December 2023
  • PCL Oct 2024 Web banner
  • ITP Web ad January 2021
  • Denner Feb 2024 Web Ad
  • Mito Web banner June 2024
  • Zhono Web ad March 2024
  • denner UK Web Banner Jul 2024
  • Zhono Web ad March 2024
  • HYB Web banner Jan 2024
  • CET Web ad December 2023
  • PCL Oct 2024 Web banner
  • Denner Feb 2024 Web Ad
  • Mito Web banner June 2024
  • ITP Web ad January 2021
  • denner UK Web Banner Jul 2024

The Recycler, Wittas House, Two Rivers, Station Lane, Witney, OX28 4BH, United Kingdom | Tel: +44 (0) 1993 899800 | Fax : +44 (0) 1993 226899
©2006-2023 The Recycler - Terms & Conditions - Privacy Policy including cookie use

Web design Dorset | Websites by Mark