To Stop Zero-Day Phishing Attacks Like USAID, Consider a Defense-In-Depth Approach - Abnormal Security

To Stop Zero-Day Phishing Attacks Like USAID, Consider a Defense-In-Depth Approach

The threat actor behind the SolarWinds attack, the Russian-based Nobelium, has orchestrated another successful vendor email compromise attack, this time targeting the United States Agency for International Development (USAID). According to Microsoft’s Threat Intelligence Center, Nobelium compromised the USAID’s Constant Contact account to send phishing emails that included links containing malware.

The incident highlights how zero-day, never-seen-before phishing attacks from compromised vendors (USAID) are getting past traditional email defenses that rely on threat intelligence. They exploit trusted communications between vendors and customers through personalization and social engineering. 

To stop these attacks, a defense-in-depth approach is needed, one that combines Microsoft threat-intelligence protection for spam, greymail and malware, and Abnormal’s behavioral data science approach that protects against never-seen-before, socially-engineered attacks. 

The attack itself represents the third high-profile, socially-engineered phishing attack this year, with SolarWinds and the Colonial Pipeline attack, which we can surmise both started with credential phishing attempts of a vendor or employee email account. 

Microsoft describes how Windows Defender caught the USAID attack but acknowledges some detection systems may have “successfully delivered” emails due to configurations, policy settings and prior detections in place.

This new wide-scale email campaign leverages the legitimate service Constant Contact to send malicious links that were obscured behind the mailing service’s URL (many email and document services provide a mechanism to simplify the sharing of files, providing insights into who and when links are clicked). Due to the high volume of emails distributed in this campaign, automated email threat detection systems blocked most of the malicious emails and marked them as spam. However, some automated threat detection systems may have successfully delivered some of the earlier emails to recipients either due to configuration and policy settings or prior to detections being in place.

New sophisticated email-based attack from NOBELIUM, Microsoft Threat Intelligence Center

The successful delivery of phishing emails highlights the over-reliance on threat intelligence and Indicators of Compromise (IOCs), which needs to collect and evaluate the incident first before blocking it going forward.

Cyber threat intelligence is what cyber threat information becomes once it has been collected, evaluated in the context of its source and reliability, and analyzed through rigorous and structured tradecraft techniques by those with substantive expertise and access to all-source information.

What is Cyber Threat Intelligence?, Center for Internet Security

However, a never-seen-before, zero-day attack such as the USAID incident lacks traditional IOCs as there is no prior context to analyze. The sender, an authenticated yet compromised Constant Contact marketing automation account, did not trigger authentication alarms. And the payload, a malicious URL, directed targets to a legitimate Constant Contact service and then “redirected to NOBELIUM-controlled infrastructure where a malicious file is then delivered to the system.”

In the case of this attack, Abnormal Security would have automatically detected the threat based on abnormal behavioral patterns and thus remediated the threat. Our behavioral data science approach profiles and baselines good behavior to detect anomalies. We have observed an increasing number of advanced malware and phishing attacks obfuscating malicious content behind links leading to unknown websites. To detect these attacks and detect malicious intent, we crawl these links such as the one found in the USAID attack, to analyze the landing page or malicious file.

We deliver this approach through a cloud native email security platform that can be deployed instantly through a 1-click API integration and can be used to extend and complement Microsoft Office 365 threat-intelligence-based approach as well as existing 3rd party Secure Email Gateways.

Our API-level access allows Abnormal to provide complete protection against the full spectrum of email threats including spam, graymail, as well as advanced never-seen-before, socially engineered attacks such as impersonations and employee and vendor compromises.

To protect your organization from never-seen-before attacks that get past threat intelligence based solutions, request a demo to see how Abnormal Security can help you.

Related content