Navigating email hazards: Malware threats—strengthening your defense line

Malware refers to any software or code specifically designed to harm, exploit, or gain unauthorized access to computer systems, networks, or devices without the knowledge or consent of the user. It encompasses a broad range of harmful programs, including viruses, worms, trojans, ransomware, spyware, adware, and other malicious applications. Cybercriminals use email to deliver files containing malware. Data shows that 94% of malware is delivered through emails. Typically, the virus is either downloaded from an external website through an embedded script, or it’s buried within the file itself. Some of the common types of malware include:

1. Ransomware: A type of malware designed to encrypt a victim's data, where the attacker demands a ransom in order to restore access to the encrypted files. It typically infiltrates systems through infected email attachments, malicious websites, or exploit kits. In 2022, ransomware attackers extorted around $457 million from victims.
2. Fileless malware: A form of malware that uses legitimate native tools built into a system to execute an attack. It operates entirely in a device's memory without leaving traces on the hard drive. The stealthy nature of the attack makes it 10 times more successful than traditional malware attacks because it doesn’t require an attacker to install any code on a target’s system, making it harder to detect.
3. Spyware: A type of malware that secretly monitors and gathers information about a user's activities. This stolen information is then transmitted to unauthorized individuals or organizations, often for malicious purposes such as identity theft, financial fraud, or targeted advertising. 
4. Adware: A type of malware that secretly installs itself on a device, tracks the user's surfing activity, and displays unwanted advertisements and pop-ups. They can be intrusive and disruptive, but not necessarily malicious in nature.
5. Trojans: A type of malware that disguises itself as legitimate or desirable software and deceives the user to download and install them. Trojans can then create backdoors and provide unauthorized access to cybercriminals. They’re commonly distributed through email attachments, software downloads from untrusted sources, or compromised websites. 
6. Bots/botnets: A form of malware that performs automated tasks on command to infect a system, steal data, or commit other fraudulent activities. It’s designed to propagate and communicate with other infected devices, forming a network that cybercriminals can use for various malicious activities. 
7. Keyloggers: A type of malware designed to record and monitor keystrokes made on a compromised device without the user's knowledge or consent. The primary purpose of keyloggers is to capture sensitive information, such as passwords, credit card details, login credentials, and other confidential data.
8. Rootkits: A type of malware that gives threat actors control of a computer, a network, or an application. The root-level access allows attackers to spy on personal information, steal sensitive data, deactivate anti-virus software, or inject the device with other malware.

Characteristics

These key characteristics help identify and understand the unique aspects of the different types of malware attacks, allowing organizations to implement targeted preventive measures and enhance their email security defenses.

Impact assessment 

Attack vectors 

These malware attack vectors aim to trick recipients into engaging in harmful activities.  

• Malicious email attachments: Attackers send emails with malicious file attachments, such as infected documents or executables. Once the victim opens the attachment, the malware can be executed.

• Phishing links: Attackers send emails or messages containing deceptive links that appear legitimate but lead to malicious websites. These links trick recipients into providing sensitive information, such as login credentials or financial details.

• Deceptive URLs: Attackers create URLs that appear trustworthy but actually lead to websites hosting malware.

• Social-engineering techniques: Attackers manipulate human psychology through social engineering tactics such as impersonation, building trust, creating a sense of urgency, or exploiting emotions to persuade victims into installing malware or disclosing sensitive information.

• Fileless malware: Malware that doesn't leave any traces on the file system runs by residing purely in the computer's memory. It executes malicious code directly in the memory by taking advantage of vulnerabilities in software or scripts, making it challenging to detect and remove.

• Embedded scripts: Attackers use malicious scripts embedded within documents, web pages, or other files to exploit vulnerabilities in software or execute harmful actions.

• Drive-by downloads: Attackers exploit vulnerabilities in websites or web browsers to automatically download malware onto a user's computer without their consent or knowledge.

Indicators of compromise 

These indicators of compromise in malware can serve as warning signs of potentially malicious or fraudulent messages. Recognizing these indicators allows organizations to investigate further and take appropriate actions to prevent security breaches:

• Suspicious email attachments

• Unusual file behavior

• URLs leading to suspicious or untrusted websites

• Unusual network traffic

• Antivirus software alerts

• Anamolous logins

• Unusual domain names

• Email addresses with random alphanumeric strings

• Misspelled or altered domain names

• Generic greetings or subject lines

• Unusual email formatting, excessive grammatical errors

• Requests for sensitive information

Preventive measures 

By implementing these preventive measures, organizations can significantly reduce malware, protect users, and maintain email security:

• Create awareness: Educate users on how to identify and handle spam, avoid clicking on unknown links, and report suspicious emails.

• Be careful about what you download: Only download files from trusted sources. Malware can often be spread through downloaded files.

• Robust email filtering: Implement advanced email filters and spam detection systems that include malware scanning capabilities using content filtering, blacklisting, whitelisting, and heuristic analysis.

• Sender authentication and reputation: Use sender authentication protocols (e.g., SPF, DKIM, and DMARC) to verify sender authenticity and prevent email spoofing.

• Anti-malware scanning: Deploy anti-malware software on mail servers, desktops, and mobile devices to scan and detect malicious attachments or embedded malware within emails.

• Patch management: Maintain a rigorous patch management process to ensure that operating systems, applications, and email servers are up to date with the latest security patches.

• Attachment and link analysis: Employ advanced analysis techniques, such as sandboxing or isolation environments, to scan email attachments and URLs for potential malware.

• Secure email gateways: Deploy secure email gateways with features such as advanced threat protection, URL filtering, and sandboxing that act as a first line of defense against emails containing malware.

• Traffic monitoring and anomaly detection: Monitor email traffic patterns and behavior to identify and block abnormal or malicious email behavior.

Detection mechanisms 

Some common detection mechanisms for detecting malware include:

• Signature-based detection: Compares incoming emails and attachments against known malware signatures to identify known malware strains.

• Checksumming: Compares the system's checksum with the sender's generated hash, and if they don't match, the mail attachment can be considered to be not authentic.

• Heuristic analysis: Identifies suspicious patterns, anomalies, or behaviors that may indicate the presence of previously unknown malware.

• Blocklisting: Maintains a list of known malware sources, IP addresses, or domain names and blocking incoming emails from those sources.

• Allowlisting: Creates a list of trusted email senders or domains that are permitted to deliver messages to an inbox without being filtered or blocked by spam filters or security systems.  

• Reputation-based systems: Checks incoming email attachments against databases of known malicious files based on their reputations.

• Real-time analysis: Analyzes emails and email attachments in real time, comparing them against known malware patterns or behaviors using either static analysis, dynamic analysis, or a hybrid of the two.

• Machine-learning behavioral analysis: Utilizing artificial intelligence algorithms to learn and adapt to new malware patterns and continuously improve detection accuracy.

Tools to detect malware threats in emails include:

• Email filters

• Email security gateways

• Security information and event management systems

• Email reputation systems

• Endpoint detection response

• Security orchestration, automation, and response (SOAR) platforms

Mitigation 

These mitigation techniques help organizations proactively detect and respond to malware in order to minimize its impact, protect users, and maintain a secure email environment.

• Incident response plan: Establish a clear plan to respond to malware threats, including escalation procedures, communication protocols, and recovery steps.

• Data backup: Implement a robust backup strategy to ensure critical data can be recovered in case of a malware incident. Regularly test and verify the effectiveness of backup and recovery processes.

• Network segmentation: Segment the network to isolate critical systems and restrict the lateral movement of malware in case of a successful email-based attack.

• Sandboxing: Isolate a potential malware within a secure and restricted environment, referred to as a sandbox, to prevent it from affecting the underlying system or network.

• Security information and event management (SIEM) Tools: Utilize SIEM tools to aggregate and analyze log data from various sources to detect patterns, anomalies, or indicators of compromise. 

• Advanced threat protection (ATP) solutions: Deploy comprehensive email security solutions that incorporate multiple detection mechanisms, including sandboxing, machine learning, behavior analysis, and threat intelligence feeds.

• User education and awareness: Conduct ongoing training to educate employees about malware, teaching them how to identify and handle suspicious emails and encouraging them to report potential threats.

Reporting and incident response

Regulatory compliance considerations

Some notable regulations and standards include:

• The NIST Cybersecurity Framework: A set of guidelines, best practices, and standards to manage and mitigate cybersecurity risks. It includes controls for mitigating malware, such as implementing antivirus software, keeping software up to date, and using strong passwords.
• General Data Protection Regulation (GDPR): A European Union regulation that aims to protect the personal data and privacy of EU citizens. 
• Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA): A U.S. act that allows the Cybersecurity and Infrastructure Security Agency (CISA) to develop and implement regulations requiring covered entities to report covered cyber incidents and ransom payments to CISA.
• Health Insurance Portability and Accountability Act (HIPAA): A set of regulations that protect the privacy and security of health information. HIPAA includes controls for mitigating malware, such as encryption and access control.
• ISO/IEC 27001: An international standard for information security management systems. ISO/IEC 27001 includes controls for mitigating malware, such as risk assessment, incident response, and data security.

Case studies

• WannaCry ransomware attack: A malware that was primarily spread through phishing emails containing malicious attachments or links. Once activated, WannaCry exploited a vulnerability in Windows systems, encrypting files and demanding ransom payments in Bitcoin to restore access. The attack impacted organizations across various sectors, including healthcare, government, and business, causing significant disruptions and financial losses.
• CovidLock ransomware attack: In 2020, during the COVID-19 pandemic, a ransomware called CovidLock emerged, targeting Android devices. This malware was primarily distributed through malicious websites and phishing campaigns, leveraging the fear and uncertainty surrounding the pandemic. Users were tricked into downloading a fake COVID-19 tracking app, which, once installed, locked the device and displayed a ransom message.
• NotPetya cyberattack: In June 2017, the NotPetya cyberattack targeted organizations globally, particularly in Ukraine. The malware disguised itself as a software update and spread through phishing emails. Once inside a network, NotPetya rapidly propagated using multiple techniques, encrypted the victim's files, and made their systems inoperable. 
• Emotet malware: A sophisticated Trojan that primarily spreads through spam emails and malicious attachments. It uses social engineering techniques to trick users into opening infected documents. Once a user opens the infected attachment, Emotet infiltrates the system and establishes persistence, allowing it to download additional modules and payloads. It can then spread laterally within the network, compromising other devices and stealing sensitive information.

This article is co-authored by Sandeep Kotla and Vignesh S.

Sandeep is an accomplished inbound marketer at Zoho Corporation, specializing in digital workplace strategies, digital transformation initiatives, and enhancing employee experiences. Previously, he handled analyst relations and corporate marketing for Manage Engine (a division of Zoho Corp) and its suite of IT management products. He currently spends most of his time re-imagining and writing about how work gets done in large organizations, reading numerous newsletters, and Marie Kondo-ing his inbox.

Vignesh works as a Marketing Analyst at Zoho Corporation, specializing in content initiatives and digital workplace strategies. He's a passionate creator with a penchant for marketing and growth. In his free time, you can see him shuffling between books, movies, music, sports, and traveling, not necessarily in the same order.