Cybercriminals have begun leveraging website contact forms (opens in new tab) to deliver malware (opens in new tab) and the IcedID banking trojan to unsuspecting enterprise employees over email according to new research from Microsoft.
The Microsoft 365 Defender Threat Intelligence Team has been tracking a new campaign in which attackers are abusing legitimate infrastructure including website contact forms and Google URLs to bypass email security filters (opens in new tab).
According to Microsoft, these attacks begin with emails containing legal threats claiming that the recipient allegedly used their images or illustrations without consent and that legal action will be take against them. These emails create a sense of urgency (opens in new tab) as the recipients will likely want to avoid being sued and the site.google.com link used by the attackers makes their threats appear more legitimate.
- Keep your devices virus free with best malware removal (opens in new tab) software
- These are the best ransomware protection (opens in new tab) solutions on the market
- Also check out our roundup of the best antivirus (opens in new tab) software
Upon discovering the campaign, Microsoft reached out to Google's security team which is already looking into the matter.
IcedID malware
If a targeted employee decides to investigate the contents of one of the campaign's emails further and click on the site.google.com link, the page automatically downloads a ZIP file which contains a JavaScript file that downloads the IcedID malware (opens in new tab) as a .DAT file. However, a component of the penetration testing kit Cobalt Strike (opens in new tab) is also downloaded and this allows the cybercriminals behind the campaign to control a user's device over the internet.
Microsoft's Emily Hacker and Justin Carrol provided further insight on this new campaign in a blog post (opens in new tab), saying:
“While this specific campaign delivers the IcedID malware, the delivery method can be used to distribute a wide range of other malware, which can in turn introduce other threats to the enterprise. IcedID itself is a banking trojan that has evolved to become an entry point for more sophisticated threats, including human-operated ransomware. It connects to a command-and-control server and downloads additional implants and tools that allow attackers to perform hands-on-keyboard attacks, steal credentials, and move laterally across affected networks to delivering additional payloads.”
As this new campaign is capable of delivering a wide range of malware, employees should be on the lookout for any suspicious emails claiming they violated copyright. They should also avoid clicking on any links in emails from unknown senders.
- We've also featured the best endpoint protection (opens in new tab)
Via ZDNet (opens in new tab)
