Cyber criminals tap into data analytics to launch attacks
This is according to global technology firm HP’s Wolf Security Threat Insights Report, which details how
cyber criminals diversify attack methods to bypass security policies and detection tools.
Using data gathered from consenting HP Wolf Security
customers from October to December 2023, HP Wolf Security’s threat research
team detected several notable campaigns. Among them was a DarkGate campaign
which uses ad tools to enhance attacks.
Malicious PDF attachments, posing as OneDrive error
messages, direct users to sponsored content hosted on a popular ad network.
This leads to DarkGate malware.
HP notes: “By using ad services, threat actors can analyse
which lures generate clicks and infect the most users – helping them refine
campaigns for maximum impact. Threat actors can use CAPTCHA tools to prevent
sandboxes from scanning malware and stopping attacks by ensuring only humans
click. DarkGate hands backdoor access to cyber criminals into networks, exposing
victims to risks like data theft and ransomware.”
Another noteworthy campaign involves a shift from macros to
Office exploits.
The company explains: “In fourth quarter, at least 84 per
cent of attempted intrusions involving spreadsheets, and 73 per cent involving
Word documents, sought to exploit vulnerabilities in Office applications –
continuing the trend away from macro-enabled Office attacks. But macro-enabled
attacks still have their place, particularly for attacks leveraging cheap
commodity malware like Agent Tesla and XWorm.”
HP also warns that PDF malware is on the rise and says 11 per
cent of malware analysed in fourth quarter used PDFs to deliver malware,
compared to just four per cent in first and second quarter of last year. A
notable example was a WikiLoader campaign using a fake parcel delivery PDF to trick
users into installing Ursnif malware.
No comments