Attackers Disguise Malware as Calendar Invite Attachment

December 9, 2021

Meeting invites are one of the most common types of emails sent today, so it should come as no surprise that attackers have found a way to manipulate them. Multiple organizations that utilize Abnormal Security recently received emails which contained a .ics attachment—an invitation file commonly used to populate online calendar applications with meeting and event information.

The potential danger arises when a user clicks on the supposed ICS file, unknowingly commencing the process to download malware exploiting the Dynamic Data Exchange (DDE) vulnerability present in Microsoft applications.

About the Calendar Invite Attack

First discovered in summer 2021, calendar invite attacks (CIAs) have been increasingly targeting Abnormal customers across a wide range of industries. Unlike credential phishing attacks, which request a recipient’s login credentials for a popular email service provider or other service, calendar invite attacks are disguised as ICS files, which are commonly used to reserve time on the recipient’s calendar application for an event such as a Zoom or Microsoft Teams meeting.

Unfortunately, the popularity of hosting events or holding meetings virtually makes it easier than ever for bad actors to persuade recipients into clicking a malicious attachment masquerading as a calendar invite file. In this example, the email simply states “download to read” and includes an ICS file attachment.

Calendar invite email with a disguised ICS file

Because the attachment is a known file type, these attacks bypass traditional email security tools and may trick recipients into opening them, believing the file type to be safe.

Calendar invite email ICS attachment

Using Social Engineering for ICS Attacks

Before analyzing the contents of the malware, let’s take a look at the social engineering techniques involved in this attack. In this campaign, attacks with the same subject line were sent to various types of organizations, including media companies.

It would not be unforgiving to speculate that, given the subject line and the sender domain, the recipient was perhaps expecting information regarding a judgment for an employee against a school district in California, as noted in this article. By targeting those who would be most interested in the information, the attacker encourages recipients to click—ultimately downloading the malware that has bypassed security filters with its ICS file type.

Making it even harder to detect, the attack passed authentication from the sender domain. Further analysis by Abnormal shows that the messages were sent from numerous different country domains, including India, Italy, and South Korea, all containing vague and succinct language that was followed by a .ics attachment ready to be downloaded.

The Virus That Evades Antivirus

What makes this attack quite dangerous when compared to others is how much more covert it is. The bad actor simply has to find a way to force the recipient into commencing the Dynamic Data Exchange (DDE) protocol, a protocol in which a plethora of Microsoft applications use to communicate with one another, and provide a prompt to ask the user whether they would like the application to run. The most active portion of the code has been highlighted below.

Calendar invite malware code

Upon completion, the malware has been installed after which the threat actor can perform a variety of nefarious acts.

Detecting and Removing the Calendar Invite Attack

Fortunately for the customer described in this scenario, the attack was stopped within nine seconds of reaching the user’s mailbox. It was remediated once again when a carbon copy of the attack was received by the same user five days later.

And it appears that this attack type may not be going away in the near future, as cybercriminals have found a new way to bypass secure email gateways. After all, ICS files are used in millions of legitimate emails each day, and recipients are likely to click on something they see as familiar.

In the dozens of calendar invite attacks that have been found since, Abnormal’s machine learning algorithm and security analysts worked in tandem to label each calendar invite attack as malicious, remediating it from the recipients' inboxes before the malware could be accessed.

To learn how Abnormal detects ICS file attacks, without blocking all calendar invitations sent to your organization, request a demo today.

Demo 2x 1

See the Abnormal Solution to the Email Security Problem

Protect your organization from the attacks that matter most with Abnormal Integrated Cloud Email Security.

Related Posts

B 06 21 22 Threat Intel blog
Executives are no longer the go-to impersonated party in business email compromise (BEC) attacks. Now, threat actors are opting to impersonate vendors instead.
Read More
B 06 7 22 Disentangling ML Pipelines Blog
Learn how explicitly modeling dependencies in a machine learning pipeline can vastly reduce its complexity and make it behave like a tower of Legos: easy to change, and hard to break.
Read More
B 04 07 22 SEG
As enterprises across the world struggle to stop modern email attacks, it begs the question: how are these attacks evading traditional solutions like SEGs?
Read More
Enhanced Remediation Blog Cover
The most effective way to manage spam and graymail is to leverage a cloud-native, API-based architecture to understand identity, behavior, and content patterns.
Read More
B 05 16 22 VP of Recruiting
We are thrilled to announce the addition of Mary Price, our new Vice President of Talent. Mary will support our continued investment in the next generation of talent here at Abnormal.
Read More
B 06 01 22 Stripe Phishing
In this sophisticated credential phishing attack, the threat actor created a duplicate version of Stripe’s entire website.
Read More
B Podcast Engineering9
In episode 9 of Abnormal Engineering Stories, Dan sits down with Mukund Narasimhan to discuss his perspective on productionizing machine learning.
Read More
B 05 31 22 RSA Conference
Attending RSA Conference 2022? So is Abnormal! We’d love to see you at the event.
Read More
B 05 27 22 Active Ransomware Groups
Here’s an in-depth analysis of the 62 most prominent ransomware groups and their activities since January 2020.
Read More
B 05 24 22 ESI Season 1 Recap Blog
The first season of Enterprise Software Innovators (ESI) has come to a close. While the ESI team is hard at work on season two, here’s a recap of some season one highlights.
Read More
B 05 13 22 Hiring Experience
Abnormal Security is committed to offering an exceptional experience for candidates and employees. Hear about our recruiting and onboarding firsthand from three Abnormal employees.
Read More
B 05 11 22 Scaling Out Redis
As we’ve scaled our customer base, the size of our datasets has also grown. With our rapid expansion, we were on track to hit the data storage limit of our Redis server in two months, so we needed to figure out a way to scale beyond this—and fast!
Read More