Cybercriminals leverage AceCryptor and Rescoms (RAT) to upgrade spam phishing messages difficult to recognize by both humans and machines. To defend, MSPs automate protection. 

When cybersecurity experts and vendors describe phishing attacks, they usually split them into two big groups.

The first group consists of spam campaigns targeting a broad general audience with simple fraudulent messages. This approach has a low success rate but can be easily deployed en masse. The second group involves sophisticated attacks tailored for a specific person or group of people. This requires more time and planning; however, this effort pays off with higher success rates and/or other value that attackers derive.

But there are also attacks that stand somewhere in the middle and benefit from both approaches. For example, their fraudulent messaging is simple and can target broader audiences, but at the same time they are able to avoid the usual phishing red flags, largely because malicious email attachments are obfuscated with specialized tools.

ESET researchers documented such an attack when they discovered an email phishing campaign targeting European businesses.

Advanced phishing campaigns using AI and various evasion techniques are on the rise and can pose a challenge even for managed service providers (MSPs), which aim to deliver seamless IT services, including cybersecurity, to their customers while also keeping in mind their own protection. Risk from these types of campaigns are mounting because even the most focused employees may fall victim to malicious emails despite previous awareness training. Moreover, basic types of anti-phishing protection may be unable to detect these threats.

To address these risks, ESET has beefed up the prevention capabilities, incorporating advanced Anti-Malware, Antispam, and Anti-Phishing protection into ESET PROTECT, a formidable cyber threat prevention, detection, and response platform that MSPs can utilize. Having all these automated layers of protection in one service, ESET PROTECT minimizes the email attack surface, simultaneously reducing the complexity of subsequent security processes.

Year after year, numerous surveys and reports confirm that phishing is the most prevalent attack vector.

The latest ESET H2 2023 Threat Report shows that malicious HTML files sending victims to phishing websites (HTML/Phishing.Agent trojan) remain by far the most numerous type of email threat. Overall, these attacks comprise almost a quarter (23.4 percent) of all cyber threats detected by ESET.

When it comes to the business sector, one in four U.S. companies that faced a cyberattack noticed that the initial vector was phishing in 2022.

Between 2017 and 2023, the proportion of phishing attacks among all cyberattacks reported by U.K. organizations (businesses and charities) rose from 72% to 79%, according to a survey conducted by the U.K. Department for Science, Innovation and Technology. Also, 56% of the surveyed businesses responded that they consider phishing attacks as the most disruptive that businesses face.

Many of these phishing campaigns can be easily dodged by following simple awareness advice. However, as with most things in the world of IT, things are getting more complex and sophisticated — so is phishing.

ESET researchers spotted one of the latest examples of this trend just recently when monitoring the Remote Access Trojan (RAT) Rescoms, also known as Remcos.

RATs are malware that allows attackers to remotely control an infected computer, and ESET researchers discovered several recent email phishing campaigns using Rescoms and targeting businesses in European countries, including Spain, Poland, Slovakia, Bulgaria, and Serbia.

The goal of those campaigns of an unknown actor was to obtain credentials stored in browsers or email clients, which in case of a successful compromise would open the possibility for further attacks.

What makes these Rescoms campaigns special is that they use AceCryptor, a cryptor-as-a-service malware that is designed to hide other malware from cybersecurity tools.

In H2 2023, ESET detection engines saw and blocked over double the attacks using AceCryptor in comparison with H1 2023.

Moreover, this cryptor wasn’t the only tool that did its bit. In order to make phishing emails look as credible as possible, the threat actor deployed several strategies:

• All emails look like B2B offers for the victim companies.
• Email addresses used to send spam emails were imitating domains of other companies.
• Business email compromise (BEC) was involved in multiple campaigns — attackers abused previously compromised email accounts of other company employees to send spam emails.
• Attackers did their research and used existing companies and even existing employees’/owners’ names and contact information when they were signing those emails.
• The content of emails was in many cases quite elaborate.

Translated message:

Dear Sir,

I am Sylwester [redacted] from [redacted]. Your company was recommended to us by a business partner. Please quote the attached order list. Please also inform us about the payment terms.

We look forward to your response and further discussion.

—

Best Regards,

Because regular cybersecurity awareness training for employees may not be enough, and MSPs often need to take care not only about their protection but also their clients’ protection, the answer to this situation must be multilayered protection.

The main idea is to protect businesses during several stages of the attack — when a malicious email arrives in the mailbox, when an employee opens it, when they click on an attached link or file, and when malware enters the company’s system if all previous defenses were avoided.

For example, look at the multilayered protection incorporated in the ESET PROTECT Platform:

• Anti-Spam technology filters spam messages with almost 100% accuracy.
• Anti-Phishing prevents users from accessing web pages known for phishing by parsing message bodies and subject lines to identify URLs. URLs are then compared against the phishing database and rules to determine the presence of a phishing attempt.
•  Anti-malware scans email attachments to determine whether it is malicious, unknown, or safe.
• ESET’s in-product Sandbox assists in identifying the real behavior hidden underneath the surface of obfuscated malware.
• If ESET Mail Security is unsure of the potential threat, it can forward the attachment to the proactive cloud-based threat defense tool called ESET LiveGuard Advanced. It analyzes samples in a cloud sandbox, and then submits the result back to Mail Security within minutes.
• If the malicious attachment is opened, it will face ESET Endpoint Security monitoring and evaluating all executed applications based on their behavior and reputation. It is designed to detect and block suspicious processes.

Such multilayered and automated protection can detect even advanced phishing email threats such as the recent Rescoms campaigns. In fact, ESET PROTECT placed second in the latest AV-Comparatives Awards with 99.9% malware samples blocked with zero false positives in enterprise category. Overall, ESET received a Top-Rated Product Award in 2023.

An important part of an MSPs’ defense is also mitigation of alert fatigue, a situation where IT admins are so overwhelmed by alerts that they miss or ignore serious issues.

To make MSPs admins’ lives easier, the ESET PROTECT Platform allows admins to automate a variety of actions, including the resolution of sophisticated incidents. ESET also has complex MSP program with subscription flexibility, a unified ecosystem, automated responses, and integrations with the major RMM and PSA players.

All these efforts have been proven to decrease disruptions in daily workflow of ESET customers:

“Day-to-day life doesn’t tend to get overly disrupted with ESET, which is brilliant for the help desk. They don’t want to be receiving calls, truth be told. But we want to be ensured that we are on top of things, and our customers can work without having to chew up too much of our time,” says Andrew Owens, Head of Sales in Risc IT Solutions, a cloud solutions provider cooperating with ESET for the last 10 years.

It is estimated that there are 361 billion emails sent and received daily around the world, with more than 45 percent of them spam. With such a plentiful threat landscape, it is important for businesses to be prepared for attacks on an almost daily basis without wearing down the IT team.

Having a highly automated security ecosystem from a global leader in digital security is a great way to master vigilance in the world of constant cyberthreats.

“How could this happen?”

This is what both executives and Security Operations Center (SOC) teams of enterprises might keep asking themselves after a successful ransomware attack.

The story is often the same – a random phishing email finds its way into the inbox of an employee, who then proceeds to provide personally identifiable information, including work account details, to a seemingly legitimate-looking entity.

Social engineering and email scams remain some of the top threats facing businesses worldwide, with ESET Research finding phishing and fraud trojans at the top of email threat detections.

Recently, Insomniac Games, a subsidiary of PlayStation Studios, was compromised by the Rhysida ransomware, ending up with terabytes of leaked data, as the studio refused to pay the ransom asked of them (which, despite the result, is a legitimate strategy, since threat actors are not the most trustworthy of entities).

Is there an approach to security that could have prevented an attack like this? Let’s explore a prevention-first approach employing Extended Detection and Response (XDR) or Managed Detection and Response (MDR).

Just as fairy tales tell of big villains that kidnap princesses and valiant heroes running to save them, the same is true for ransomware and cyberattacks in general.

However, instead of dragons trying to burn down castles, we’re discussing dangerous forms of malware deployed to penetrate and occupy them. Valiant heroes, in the form of security specialists, then try to hold what was supposed to be a rather secure castle with all the defensive bells and whistles available … apart from that big gaping hole right under the north-facing castle walls, obscured by a green bush.
Perhaps the metaphor went a bit too far, but the idea is clear – there will always be certain vulnerabilities, unprotected threat surfaces/vectors, or gaps in defenses that might not be as obvious at first sight as we would assume.

Threat actors will always try to gain entry to a business’s internal systems because that’s where to find the most important access rights/files/data that are dear to the managers and CEOs. That value can be enumerated in millions and in some cases even billions of (dollars, Euros/other). And crooks know that, so they will keep trying their best to pull the chair from under the people tasked with securing businesses.

Consider the SolarWinds and the MOVEit supply chain attacks, for example. The former happened in 2020 because of understated and poorly communicated vulnerabilities, while the latter, in 2023, was caused by hackers exploiting a flaw within the file transfer software, gaining access to sensitive customer data.

The result of the MOVEit hack? According to Emsisoft’s estimate, USD 15 billion in damages. This after having impacted around 2,726 organizations. They say you can’t put a price on many things, like health and safety … however, this is not the case for cybersecurity.

Regarding both attacks, it didn’t matter whether a particular business was targeted, since due to the nature of a supply-chain attack, any partner/client can sustain collateral damage, often having their information accessed and leaked as a result. Therefore, it can be said that as far as a supply-chain attack is concerned, no one in it is safe … unless they take some specific precautions, such as by investing in XDR or an MDR service.

Now, zero-day vulnerabilities are tough to prevent, since they usually crop up due to flaws in software that not even the developer may know about – hence the name.

Vulnerabilities can be disclosed, and subsequently recorded, by organizations like MITRE, which maintains the registry of common vulnerabilities and exposures (CVEs).

One way to prevent the exploitation of vulnerabilities is to always keep systems and apps up to date, such as with security updates, or by patching vulnerabilities through patch management functions, which are often a requirement of cyber insurance nowadays.

The reason vulnerabilities are so important in the grand scheme of things is that successful patching and updates are make or break for the management of a company’s threat surfaces. Security admins have to demonstrate effectiveness here, both in the office and for employees working hybrid or fully remotely. This is true regardless of how device use expands beyond the limits of company premises and must even extend security to areas and activities security admins may not see. This brings with it a whole slew of problems, including potential new vulnerabilities, the resulting incidents, and users being targeted who have access to critical internal networks and data through their computers, phones, or tablets.

This fact is driven home, especially as cloud-based tools become the norm. As a result, cloud security has become a key component of prevention, since most companies now use products like SharePoint or other cloud-powered internal data repositories and sharing networks. And what’s more, both the benefits and the risks trickle down to cloud-powered apps like Office 365 or Google Workspace Suite, meaning that the more connection there is between an internal server and an external user, the more opportunities there are for exploitation. This is very evident when we look at cases where, for example, Microsoft Teams was used to share malware through external accounts that did not even belong to the targeted organization.

Cloud security is important, but it is not enough, especially from the perspective of a security admin who might want to have a deeper understanding of their company network, with specific alerts, rules, and triggers that would highlight and specify issues arising during crucial moments – like when an attacker is trying to exploit one of the company’s assets.

Skilled admins would probably pick an XDR solution to gain an understanding of their environment, with access to quick remediation of potential incidents. This is all well and nice – when an organization has the necessary resources to purchase and maintain such a solution.

Sure, XDR tasks can be made easier by employing effective and intuitive software solutions like the ones offered via ESET Inspect, which makes the lives of security admins easier by coming pre-loaded with certain rules, with further enhancement being rather easy to configure thanks to its elegant interface. But that takes time, and it also asks the admin to know their environment enough to recognize which rules need to be configured, customized, and set up in a prioritized manner.

From there, capabilities like the automatic incident creator found in ESET Inspect can work wonders to speed up incident remediation, giving the admin more time and room to focus on other important matters.

But is that enough? Can XDR prevent ransomware attacks such as the one that targeted the above-mentioned game studio?

Indeed, while using XDR is one way to stop the execution of ransomware, the admins need to be fast enough to respond on time, stopping the threat in all locations, and killing it as soon as possible by knowing where the breach occurred.

XDR can help with that, as it offers a granular view of a company’s environment. During the MOVEit saga, for example, ESET Inspect managed to detect the compromise and supply admins with logs pertaining to it.

And if that is not enough, or a company requires more professional help to rapidly address mitigation and remediation needs, services including a larger capacity of security experts supplied with professional software –MDR solutions – are where it’s at.

MDR is a lot like XDR, but it adds another dimension – it is a service that also employs real-life experts to manage company cybersecurity. While XDR is a great pick for businesses with enough personnel, institutional knowledge, and capacity to tackle complex threats, MDR pushes security to greater heights as it supplies experts with deep knowledge of both the security tool at hand (XDR) and the threat environment.

This means high-level support in case of an incident, be it a random weekday, holiday, or weekend, as MDR is a 24/7/365 service. So, in case a ransomware attack happens when most of a business is out, the MDR team can still immediately respond to a threat despite the lack of in-house staff.

This rings true even for small and medium-size businesses (SMBs), which can lack such staff by design, due to limited resources. Regardless, SMBs face the same threats as large enterprises, including ransomware. And in such cases, quick action is always necessary.

It’s one thing to stop an ongoing incident, but it’s an entirely different thing to proactively prevent an incident from happening in the first place.

XDR and MDR are both excellent choices in the fight against ransomware and related threats, as they empower companies to be on the lookout for even the most insidious threats.

And while all the components of a security platform such as ESET PROTECT help in protecting specific environments, a detection and response solution, whether in-house or as a service, combines all of this into a single view. It provides a refined and clear understanding of the security apparatus of a company, giving admins the right tools to respond and remediate on time.