Cybercriminals have begun leveraging website contact forms to deliver malware and the IcedID banking trojan to unsuspecting enterprise employees over email according to new research from Microsoft.
The Microsoft 365 Defender Threat Intelligence Team has been tracking a new campaign in which attackers are abusing legitimate infrastructure including website contact forms and Google URLs to bypass email security filters.
According to Microsoft, these attacks begin with emails containing legal threats claiming that the recipient allegedly used their images or illustrations without consent and that legal action will be take against them. These emails create a sense of urgency as the recipients will likely want to avoid being sued and the site.google.com link used by the attackers makes their threats appear more legitimate.
Upon discovering the campaign, Microsoft reached out to Google’s security team which is already looking into the matter.
IcedID malware
If a targeted employee decides to investigate the contents of one of the campaign’s emails further and click on the site.google.com link, the page automatically downloads a ZIP file which contains a JavaScript file that downloads the IcedID malware as a .DAT file. However, a component of the penetration testing kit Cobalt Strike is also downloaded and this allows the cybercriminals behind the campaign to control a user’s device over the internet.
Microsoft’s Emily Hacker and Justin Carrol provided further insight on this new campaign in a blog post, saying:
“While this specific campaign delivers the IcedID malware, the delivery method can be used to distribute a wide range of other malware, which can in turn introduce other threats to the enterprise. IcedID itself is a banking trojan that has evolved to become an entry point for more sophisticated threats, including human-operated ransomware. It connects to a command-and-control server and downloads additional implants and tools that allow attackers to perform hands-on-keyboard attacks, steal credentials, and move laterally across affected networks to delivering additional payloads.”
As this new campaign is capable of delivering a wide range of malware, employees should be on the lookout for any suspicious emails claiming they violated copyright. They should also avoid clicking on any links in emails from unknown senders.
Via ZDNet
