Stop Zero-Day Phishing Attacks with a Defense-In-Depth Approach

June 2, 2021
The threat actor behind the SolarWinds attack, the Russian-based Nobelium, has orchestrated another successful vendor email compromise attack, this time targeting the United States Agency for International Development (USAID). According to Microsoft’s Threat Intelligence Center, Nobelium compromised the USAID’s Constant Contact account to send phishing emails that included links containing malware.

The incident highlights how zero-day, never-before-seen phishing attacks from compromised vendors (USAID) are getting past traditional email defenses that rely on threat intelligence. They exploit trusted communications between vendors and customers through personalization and social engineering.

To stop these attacks, a defense-in-depth approach is needed, one that combines Microsoft threat intelligence protection for spam, graymail, and malware with Abnormal’s behavioral data science approach that protects against never-before-seen, socially-engineered attacks.

The attack itself represents the third high-profile, socially-engineered phishing attack this year, with SolarWinds and the Colonial Pipeline attack, which we can surmise both started with credential phishing attempts of a vendor or employee email account.

Microsoft describes how Windows Defender caught the USAID attack, but acknowledges that some detection systems may have “successfully delivered” emails due to configurations, policy settings, and prior detections in place.

This new wide-scale email campaign leverages the legitimate service Constant Contact to send malicious links that were obscured behind the mailing service’s URL (many email and document services provide a mechanism to simplify the sharing of files, providing insights into who and when links are clicked). Due to the high volume of emails distributed in this campaign, automated email threat detection systems blocked most of the malicious emails and marked them as spam. However, some automated threat detection systems may have successfully delivered some of the earlier emails to recipients either due to configuration and policy settings or prior to detections being in place.

New sophisticated email-based attack from NOBELIUM, Microsoft Threat Intelligence Center

The successful delivery of phishing emails highlights the over-reliance on threat intelligence and traditional indicators of compromise (IOCs), which needs to collect and evaluate the incident first before blocking it going forward.

Cyber threat intelligence is what cyber threat information becomes once it has been collected, evaluated in the context of its source and reliability, and analyzed through rigorous and structured tradecraft techniques by those with substantive expertise and access to all-source information.

What is Cyber Threat Intelligence?, Center for Internet Security

However, a never-before-seen, zero-day attack such as the USAID incident lacks traditional IOCs since there is no prior context to analyze. The sender, an authenticated yet compromised Constant Contact marketing automation account, did not trigger authentication alarms. And the payload, a malicious URL, directed targets to a legitimate Constant Contact service and then “redirected to NOBELIUM-controlled infrastructure where a malicious file is then delivered to the system.”

In the case of this attack, Abnormal Security would have automatically detected the threat based on abnormal behavioral patterns, and thus remediated the threat before it reached inboxes. Our behavioral data science approach profiles and baselines good behavior to detect anomalies. We have observed an increasing number of advanced malware and phishing attacks obfuscating malicious content behind links leading to unknown websites. To detect these attacks and detect malicious intent, we crawl these links, such as the one found in the USAID attack, to analyze the landing page or malicious file.

We deliver this approach through a cloud-native email security platform that can be deployed instantly through a one-click API integration and can be used to extend and complement Microsoft Office 365 threat-intelligence-based approach as well as existing third-party wecure email gateways.

Our API-level access allows Abnormal to provide complete protection against the full spectrum of email threats including spam and graymail, as well as advanced never-before-seen, socially engineered attacks including executive impersonations and employee and vendor compromises.

To protect your organization from never-before-seen attacks that bypass threat intelligence-based solutions, request a demo of the Abnormal Securtiy platform.

Image

Prevent the Attacks That Matter Most

Get the Latest Email Security Insights

Subscribe to our newsletter to receive updates on the latest attacks and new trends in the email threat landscape.

Demo 2x 1

See the Abnormal Solution to the Email Security Problem

Protect your organization from the attacks that matter most with Abnormal Integrated Cloud Email Security.

Related Posts

B 05 13 22 Spring Product Release
This quarter, the team at Abnormal launched new features to improve lateral attack detection, role-based access control (RBAC), and explainable AI. Take a deep dive into all of the latest product enhancements.
Read More
B 05 11 22 Champion Finalist
Abnormal has been selected as a Security Customer Champion finalist in the Microsoft Security Excellence Awards! Here’s a look at why.
Read More
Blog series c cover
When we raised our Series B funding 18 months ago, I promised our customers greater value, more capabilities, and better customer support. We’ve delivered on each of those promises and as we receive an even larger investment, I’m excited about how we can continue to further deliver on each of them.
Read More
B 05 09 22 Partner Community
It’s an honor to be named one of CRN’s 2022 Women of the Channel. Here’s why I appreciate the award and what I love about being a Channel Account Manager at Abnormal.
Read More
B 05 05 22 Fast Facts
Watch this short video to learn current trends and key issues in cloud email security, including how to protect your organization against modern threats.
Read More
B 05 03 22
Like all threats in the cyber threat landscape, ransomware will continue to evolve over time. This post builds on our prior research and looks at the changes we observed in the ransomware threat landscape in the first quarter of 2022.
Read More
B 04 28 22 8 Key Differences
At Abnormal, we pride ourselves on our excellent machine learning engineering team. Here are some patterns we use to distinguish between effective and ineffective ML engineers.
Read More
B 04 26 22 Webinar Re Replacing Your SEG
Learn how Microsoft 365 and Abnormal work together to provide comprehensive defense-in-depth protection in part two of our webinar recap.
Read More
Blog mitigate threats cover
Learn about the most common socially-engineered attacks and why these tactics are still so successful—despite a growing awareness from employees.
Read More
B Podcast Engineering8
In episode 8 of Abnormal Engineering Stories, Kevin interviews Saminda Wijegunawardena, an engineering leader who is no stranger to fast-growing enterprise startups.
Read More
B 04 04 22 Webinar Recap Krebs
High-impact emails are on the rise and secure email gateways (SEGs) don’t have the functionality to mitigate them. Learn how your SEG is letting you down.
Read More
B 04 19 22 Facebook Phishing
While phishing emails have long been a popular way to steal Facebook login credentials, we’ve recently seen an increase in more sophisticated phishing attacks.
Read More