chat
expand_more

Stop Zero-Day Phishing Attacks with a Defense-In-Depth Approach

The threat actor behind the SolarWinds attack, the Russian-based Nobelium, has orchestrated another successful vendor email compromise attack, this time targeting the United States Agency for International Development (USAID). According to Microsoft’s...
June 2, 2021

The threat actor behind the SolarWinds attack, the Russian-based Nobelium, has orchestrated another successful vendor email compromise attack, this time targeting the United States Agency for International Development (USAID). According to Microsoft’s Threat Intelligence Center, Nobelium compromised the USAID’s Constant Contact account to send phishing emails that included links containing malware.

The incident highlights how zero-day, never-before-seen phishing attacks from compromised vendors (USAID) are getting past traditional email defenses that rely on threat intelligence. They exploit trusted communications between vendors and customers through personalization and social engineering.

To stop these attacks, a defense-in-depth approach is needed, one that combines Microsoft threat intelligence protection for spam, graymail, and malware with Abnormal’s behavioral data science approach that protects against never-before-seen, socially-engineered attacks.

The attack itself represents the third high-profile, socially-engineered phishing attack this year, with SolarWinds and the Colonial Pipeline attack, which we can surmise both started with credential phishing attempts of a vendor or employee email account.

Microsoft describes how Windows Defender caught the USAID attack, but acknowledges that some detection systems may have “successfully delivered” emails due to configurations, policy settings, and prior detections in place.

This new wide-scale email campaign leverages the legitimate service Constant Contact to send malicious links that were obscured behind the mailing service’s URL (many email and document services provide a mechanism to simplify the sharing of files, providing insights into who and when links are clicked). Due to the high volume of emails distributed in this campaign, automated email threat detection systems blocked most of the malicious emails and marked them as spam. However, some automated threat detection systems may have successfully delivered some of the earlier emails to recipients either due to configuration and policy settings or prior to detections being in place.

New sophisticated email-based attack from NOBELIUM, Microsoft Threat Intelligence Center

The successful delivery of phishing emails highlights the over-reliance on threat intelligence and traditional indicators of compromise (IOCs), which needs to collect and evaluate the incident first before blocking it going forward.

Cyber threat intelligence is what cyber threat information becomes once it has been collected, evaluated in the context of its source and reliability, and analyzed through rigorous and structured tradecraft techniques by those with substantive expertise and access to all-source information.

What is Cyber Threat Intelligence?, Center for Internet Security

However, a never-before-seen, zero-day attack such as the USAID incident lacks traditional IOCs since there is no prior context to analyze. The sender, an authenticated yet compromised Constant Contact marketing automation account, did not trigger authentication alarms. And the payload, a malicious URL, directed targets to a legitimate Constant Contact service and then “redirected to NOBELIUM-controlled infrastructure where a malicious file is then delivered to the system.”

In the case of this attack, Abnormal Security would have automatically detected the threat based on abnormal behavioral patterns, and thus remediated the threat before it reached inboxes. Our behavioral data science approach profiles and baselines good behavior to detect anomalies. We have observed an increasing number of advanced malware and phishing attacks obfuscating malicious content behind links leading to unknown websites. To detect these attacks and detect malicious intent, we crawl these links, such as the one found in the USAID attack, to analyze the landing page or malicious file.

We deliver this approach through a cloud-native email security platform that can be deployed instantly through a one-click API integration and can be used to extend and complement Microsoft Office 365 threat-intelligence-based approach as well as existing third-party wecure email gateways.

Our API-level access allows Abnormal to provide complete protection against the full spectrum of email threats including spam and graymail, as well as advanced never-before-seen, socially engineered attacks including executive impersonations and employee and vendor compromises.

To protect your organization from never-before-seen attacks that bypass threat intelligence-based solutions, request a demo of the Abnormal Securtiy platform.

Stop Zero-Day Phishing Attacks with a Defense-In-Depth Approach

See Abnormal in Action

Get a Demo

Get the Latest Email Security Insights

Subscribe to our newsletter to receive updates on the latest attacks and new trends in the email threat landscape.

 

See the Abnormal Solution to the Email Security Problem

Protect your organization from the full spectrum of email attacks with Abnormal.

 
Integrates Insights Reporting 09 08 22

Related Posts

B Earn Your CPE Credits with Abnormal
Earn your continuing education credits with ISC2 by viewing cybersecurity content from Abnormal Security.
Read More
B Seg Lessons
Discover key insights gleaned from replacing 100+ SEGs for Abnormal customers.
Read More
B Europe Attack Data Blog
Discover what our research uncovered about the European threat landscape and attack trends for organizations in the region.
Read More
B SAT
Abnormal aims to provide superior detection of email attacks while also directly and indirectly influencing the security awareness of your employees.
Read More
B 6 3 24 BEC Attacks
Discover how cybercriminals obtain corporate data from brokers like ZoomInfo and Apollo to enable targeted business email compromise (BEC) attacks.
Read More
B Addressing Account Takeovers Blog
Discover how security leaders are protecting their organizations against account takeover with insights from our survey of 300 cybersecurity stakeholders.
Read More