How Companies Can Prevent Email Malware Attachment Attacks

According to a study of 35,000 organizations and 12.6 million individuals by KnowBe4, over 33% of users are susceptible to becoming victims of phishing attacks.

These attacks often come via phishing emails carrying malicious attachments in the form of .js files, PDFs, excel sheets containing malicious macros, or script files, each of which allows the attacker to execute malicious code.

While email security tools often detect these attachments, many still get through, posing a risk to less-trained employees who aren’t paying attention. This can lead to a damaging compromise that leads to data breaches or network impact resulting in business disruptions.

Here’s how to prevent malicious attachments from making it through to your organization.

Types of malicious email attachments

Malicious attachments can come in several forms:

• EXE files: Directly executable files that can lead to full device access. These files pose the highest risk but are often easily detected.
• JavaScript, VB Script code files, batch (.BAT) files: These are designed to evade detection and will execute code, often to download a program file to compromise a device.
• HTML and PDF files: These files will direct a device to visit a malicious website or contain JavaScript code. In both cases, the result is the same: your browser visits a malicious site to download a malicious payload.
• Microsoft Office files: These files contain malicious macros that execute when you open the file. This remains one of the riskiest types of attachments to open because the malicious code is hidden from surface-level scanners.
• Zipped files: Hackers sometimes include malicious files inside a zip file to get around email filters and scanners.

Threat actors will often find ways to hide these files or code within a number of different file types including screensavers, ISO images, and other installation files that can directly access more embedded systems within a device.

Risks of email malware attachments

The malicious payload within attachments can lead to several issues for a device and connected network, including:

Data monitoring and exfiltration

Malware can monitor and exfiltrate data in several ways:

• Man-in-the-Middle: Malware, such as Trojans, allows a remote hacker to monitor user activity and intercept data.
• Keyloggers: This records keystrokes and transmits the data to an external recipient.
• Clipboard Hijacking: Malware can monitor the clipboard, capturing anything the user copies, such as account numbers, passwords, and personal information.
• Browser Extensions/Add-Ons: Malicious browser extensions can monitor browsing activity and steal data.
• Email Forwarding Rules: Attackers can create or modify email forwarding rules to exfiltrate incoming or outgoing emails to an external account.

Ransomware

Ransomware will encrypt your files until you pay a ransom, usually in cryptocurrency. Sometimes, attackers threaten to expose the locked file unless you pay the fee.

Botnet conscription

A botnet is a network of infected computers that a cybercriminal can control to carry out nefarious activities across a linkage of many computers. These activities include:

• DDoS (Distributed Denial of Service) attacks: The botnet will flood a website with an overwhelming amount of traffic, slowing it or bringing it down completely.
• Spam: Sending spam emails from users’ personal email accounts.
• Cryptojacking: Mining cryptocurrency using someone else’s computer.

APT/backdoor attacks

Malware can lead to an Advanced Persistent Threat (APT) attack, where an intruder accesses a network and remains undetected for an extended period, monitoring and exfiltrating data.

Credential theft

A common purpose of malware is to steal sensitive information such as login credentials, financial info, or personal data to carry out further attacks.

Stopping email malware attacks

Several layers of protection exist to prevent email attacks.

1. Email filtering: You can configure advanced email filters that detect spam and prevent it from reaching users.
2. Attachment restrictions: This will block certain types of attachments such as .exe files or anything with scripts in them. Legitimate companies will often transfer these types of files in more secure ways.
3. Antivirus scanning: AV tools can detect malicious attachments either by signature or identity, flagging them before they infect a computer.
4. AI monitoring and natural language processing (NLP): AI and NLP can help detect malicious emails based on their content.
5. User privilege management: Users should be blocked from running any software that hasn’t been officially installed on their machines. Additionally, the principle of least privilege should be used to make certain users are granted only the permissions needed to fulfill their roles. This ensures that even if an account is compromised, the attacker’s access is limited which helps reduce potential damage by thwarting malware from expanding into the entire network.

Robust cyber resiliency helps prevent malware and more

Having a robust cybersecurity strategy helps reduce the chance that your organization will fall victim to a malicious email attachment. Prevention goes a long way but a comprehensive security strategy should address what happens if a compromise does occur. However, in-house cybersecurity can be costly, especially as it becomes more and more specialized.

A managed security program takes care of this by being a single point of contact for your company that implements all the necessary email security tools you need, while you deal with only a single vendor.

To learn more about SolCyber’s managed security program, contact us for a no-obligation chat.