Attackers Disguise Malware as Calendar Invite Attachment

December 9, 2021

Meeting invites are one of the most common types of emails sent today, so it should come as no surprise that attackers have found a way to manipulate them. Multiple organizations that utilize Abnormal Security recently received emails which contained a .ics attachment—an invitation file commonly used to populate online calendar applications with meeting and event information.

The potential danger arises when a user clicks on the supposed ICS file, unknowingly commencing the process to download malware exploiting the Dynamic Data Exchange (DDE) vulnerability present in Microsoft applications.

About the Calendar Invite Attack

First discovered in summer 2021, calendar invite attacks (CIAs) have been increasingly targeting Abnormal customers across a wide range of industries. Unlike credential phishing attacks, which request a recipient’s login credentials for a popular email service provider or other service, calendar invite attacks are disguised as ICS files, which are commonly used to reserve time on the recipient’s calendar application for an event such as a Zoom or Microsoft Teams meeting.

Unfortunately, the popularity of hosting events or holding meetings virtually makes it easier than ever for bad actors to persuade recipients into clicking a malicious attachment masquerading as a calendar invite file. In this example, the email simply states “download to read” and includes an ICS file attachment.

Calendar invite email with a disguised ICS file

Because the attachment is a known file type, these attacks bypass traditional email security tools and may trick recipients into opening them, believing the file type to be safe.

Calendar invite email ICS attachment

Using Social Engineering for ICS Attacks

Before analyzing the contents of the malware, let’s take a look at the social engineering techniques involved in this attack. In this campaign, attacks with the same subject line were sent to various types of organizations, including media companies.

It would not be unforgiving to speculate that, given the subject line and the sender domain, the recipient was perhaps expecting information regarding a judgment for an employee against a school district in California, as noted in this article. By targeting those who would be most interested in the information, the attacker encourages recipients to click—ultimately downloading the malware that has bypassed security filters with its ICS file type.

Making it even harder to detect, the attack passed authentication from the sender domain. Further analysis by Abnormal shows that the messages were sent from numerous different country domains, including India, Italy, and South Korea, all containing vague and succinct language that was followed by a .ics attachment ready to be downloaded.

The Virus That Evades Antivirus

What makes this attack quite dangerous when compared to others is how much more covert it is. The bad actor simply has to find a way to force the recipient into commencing the Dynamic Data Exchange (DDE) protocol, a protocol in which a plethora of Microsoft applications use to communicate with one another, and provide a prompt to ask the user whether they would like the application to run. The most active portion of the code has been highlighted below.

Calendar invite malware code

Upon completion, the malware has been installed after which the threat actor can perform a variety of nefarious acts.

Detecting and Removing the Calendar Invite Attack

Fortunately for the customer described in this scenario, the attack was stopped within nine seconds of reaching the user’s mailbox. It was remediated once again when a carbon copy of the attack was received by the same user five days later.

And it appears that this attack type may not be going away in the near future, as cybercriminals have found a new way to bypass secure email gateways. After all, ICS files are used in millions of legitimate emails each day, and recipients are likely to click on something they see as familiar.

In the dozens of calendar invite attacks that have been found since, Abnormal’s machine learning algorithm and security analysts worked in tandem to label each calendar invite attack as malicious, remediating it from the recipients' inboxes before the malware could be accessed.

To learn how Abnormal detects ICS file attacks, without blocking all calendar invitations sent to your organization, request a demo today.

 

See the Abnormal Solution to the Email Security Problem

Protect your organization from the full spectrum of email attacks with Abnormal.

See a Demo
 
Integrates Insights Reporting 09 08 22

Related Posts

B 1500x1500 Types of Email Platform Attacks L1 R2
Discover the most common types of email platform attacks in your cloud network and how you can prevent them.
Read More
B 1500x1500 Lilac Wolverine L1 R1
Threat group Lilac Wolverine is fine-tuning the art of exploiting people’s willingness to help others in some of the largest gift card attacks we've seen.
Read More
B 1500x1500 Modern Email Attacks Webinar Series L4 R2
Our Modern Email Attacks series has wrapped! Here are some of the biggest takeaways from Chris Krebs, Troy Hunt, and Theresa Payton.
Read More
B 1500x1500 Gartner Insights L1 R1
See our commitment to providing our customers with the best possible solution and support with these reviews from Gartner® Peer Insights™.
Read More
B 11 14 22 SPM Launch Blog Graphics
Security Posture Management gives organizations insight into cloud configuration risks and gaps across user and app privileges.
Read More
B 11 14 22 SPM Launch Blog 2
Cloud email platforms enable better collaboration, but they also create new entry points, making sensitive data more accessible to attackers.
Read More
B 1500x1500 Q3 Ransomeware L1 R2
This post explores the continuation of the sharp decline in ransomware attacks as well as a few other notable data points from Q3 2022.
Read More
B 10 05 22 Cloud Email Security Platform Essentials
Learn the 7 key capabilities a cloud email security platform should have in order to address and resolve common email security challenges.
Read More
B 11 07 22 Valimail
Discover the benefits of a modern, best-of-breed solution to email security with Abnormal Security and Valimail’s New Partnership.
Read More