{"id":53403,"date":"2023-01-02T07:07:00","date_gmt":"2023-01-01T23:07:00","guid":{"rendered":"http:\/\/www.upgrademag.com\/web\/?p=53403"},"modified":"2023-01-01T11:09:13","modified_gmt":"2023-01-01T03:09:13","slug":"archive-files-zip-past-office-docs-as-most-common-malicious-file-type-for-first-time","status":"publish","type":"post","link":"http:\/\/www.upgrademag.com\/web\/2023\/01\/02\/archive-files-zip-past-office-docs-as-most-common-malicious-file-type-for-first-time\/","title":{"rendered":"Archive files &#8220;.ZIP past&#8221; Office docs as most common malicious file type for first time"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\"><strong>HP Inc. issued its third quarter\u00a0<a rel=\"noreferrer noopener\" href=\"https:\/\/threatresearch.ext.hp.com\/hp-wolf-security-threat-insights-report-q3-2022\/\" target=\"_blank\">HP Wolf Security Threat Insights Report<\/a>, finding that archive file formats \u2013 such as ZIP and RAR files \u2013 were the most common file type for delivering malware, surpassing Office files for the first time in three years. This report provides an analysis of real-world cyberattacks, helping organizations to keep up with the latest techniques cybercriminals use to evade detection and breach users in the fast-changing cybercrime landscape.<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Based on data from millions of endpoints running HP Wolf Security, the research found 44% of malware was delivered inside archive files \u2013 an 11% rise on the previous quarter \u2013 compared to 32% delivered through Office files such as Microsoft Word, Excel, and PowerPoint.<sup>1<\/sup><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The report identified several campaigns that were combining the use of archive files with new HTML smuggling techniques \u2013 where cybercriminals embed malicious archive files into HTML files to bypass email gateways \u2013 to then launch attacks.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For example, recent QakBot and IceID campaigns used HTML files to direct users to fake online document viewers that were masquerading as Adobe. Users were then instructed to open a ZIP file and enter a password to unpack the files, which then deployed malware onto their PCs.&nbsp;&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">As the malware within the original HTML file is encoded and encrypted, detection by email gateway or other security tools is very difficult. Instead, the attacker relies on social engineering, creating a convincing and well-designed web page to fool people into initiating the attack by opening the malicious ZIP file. In October, the same attackers were also found using fake Google Drive pages in an ongoing effort to trick users into opening malicious ZIP files.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u201cArchives are easy to encrypt, helping threat actors to conceal malware and evade web proxies, sandboxes, or email scanners. This makes attacks difficult to detect, especially when combined with HTML smuggling techniques. What was interesting with the QakBot and IceID campaigns was the effort put in to creating the fake pages \u2013 these campaigns were more convincing than what we\u2019ve seen before, making it hard for people to know what files they can and can\u2019t trust,\u201d explains Alex Holland, Senior Malware Analyst, HP Wolf Security threat research team, HP Inc.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">HP also identified a complex campaign using a modular infection chain, which could potentially enable attackers to change the payload \u2013 such as spyware, ransomware, keylogger \u2013 mid-campaign, or to introduce new features, like geo-fencing. This could enable an attacker to change tactics depending on the target they have breached. By not including malware directly in the attachment sent to the target, it is also harder for email gateways to detect this type of attack.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u201cAs shown, attackers are constantly switching up techniques, making it very difficult for detection tools to spot,\u201d comments Dr Ian Pratt, Global Head of Security for Personal Systems, HP Inc. \u201cBy following the Zero Trust principle of fine-grained isolation, organizations can use micro-virtualization to make sure potentially malicious tasks \u2013 like clicking on links or opening malicious attachments \u2013 are executed in a disposable virtual machine separated from the underlying systems. This process is completely invisible to the user, and traps any malware hidden within, making sure attackers have no access to sensitive data and preventing them from gaining access and moving laterally.\u201d&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">HP Wolf Security runs risky tasks like opening email attachments, downloading files and clicking links in isolated, micro-virtual machines (micro-VMs) to protect users, capturing detailed traces of attempted infections. HP\u2019s application isolation technology mitigates threats that can slip past other security tools and provides unique insights into novel intrusion techniques and threat actor behavior. By isolating threats on PCs that have evaded detection tools, HP Wolf Security has specific insight into the latest techniques being used by cybercriminals. To date, HP customers have clicked on over 18 billion email attachments, web pages, and downloaded files with no reported breaches.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Based on data from millions of endpoints running HP Wolf Security, the research found 44% of malware was delivered inside archive files \u2013 an 11% rise on the previous quarter \u2013 compared to 32% delivered through Office files such as Microsoft Word, Excel, and PowerPoint.1<\/p>\n","protected":false},"author":6,"featured_media":47558,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[19,18],"tags":[6498,6151,51,4852,286,54,2103,3914,53,4100],"class_list":["post-53403","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-headlines","category-white-papers","tag-good-tech","tag-high-tech","tag-hp","tag-hp-philippines","tag-it-security","tag-security","tag-security-breach","tag-security-platform","tag-security-risk-management","tag-security-solutions"],"_links":{"self":[{"href":"http:\/\/www.upgrademag.com\/web\/wp-json\/wp\/v2\/posts\/53403","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/www.upgrademag.com\/web\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/www.upgrademag.com\/web\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/www.upgrademag.com\/web\/wp-json\/wp\/v2\/users\/6"}],"replies":[{"embeddable":true,"href":"http:\/\/www.upgrademag.com\/web\/wp-json\/wp\/v2\/comments?post=53403"}],"version-history":[{"count":0,"href":"http:\/\/www.upgrademag.com\/web\/wp-json\/wp\/v2\/posts\/53403\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"http:\/\/www.upgrademag.com\/web\/wp-json\/wp\/v2\/media\/47558"}],"wp:attachment":[{"href":"http:\/\/www.upgrademag.com\/web\/wp-json\/wp\/v2\/media?parent=53403"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/www.upgrademag.com\/web\/wp-json\/wp\/v2\/categories?post=53403"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/www.upgrademag.com\/web\/wp-json\/wp\/v2\/tags?post=53403"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}