Today’s cyber attacks appear relentless, growing in frequency and intensity, and proliferating throughout all industries. There is no ‘normal’ and the impact of each attack is felt throughout organizations--from supply chain to customers, partners, and beyond.
Prevent Advanced Malware and Ransomware Attacks from Striking
Today’s cyber attacks appear relentless, growing in frequency, intensity and proliferating throughout all industries. There is no ‘normal’ and the impact of each attack is felt throughout the business through the organization’s supply chain to its customers, partners and beyond. It is almost impossible not to notice the cybersecurity stories in the media. It doesn’t seem to matter where you are in the world, or what industry you are in. But what has come to light is traditional cybersecurity protection is becoming increasingly ineffective against this next generation of ever evading malware and the myriad attacks.
Cyber attackers have become patient. Mounting increasingly sophisticated campaigns against both organizations and the individuals within them using all the latest social engineering methods available. Silently harvesting information from social media platforms and hidden document metadata readily found on the company website or cloud collaboration tools, preparing for targeted attack. To combat this onslaught, organizations need to deploy a more effective layer of advanced threat protection, aimed at securing
their most valuable asset—critical information. Mitigating the new threat vectors of embedded malware in conjunction with supporting collaborative working practices enable the business to remain secure, yet agile.
Are the Number of Threats Really Increasing?
For most CFOs, their favorite graph is ‘up and to the right’, unfortunately for the CIO, when it comes to cyber threats this is certainly not what they want to see. While they have come down steadily when they peaked in 2018 at 10.5 billion, the total number of reported malware attacks was still at 5.5 billion in 2022.¹ But numbers are difficult to get to grips with; it is the impact of the malware on organizations which is easier to relate to.
With a deeper layer of inspection and sanitization, the automated removal of hidden malware is the cornerstone to providing a more complete and cost- effective solution to mitigating the new threats.
1Annual number of malware attacks worldwide from 2015 to 2022”, Statista 2024
The Next Generation of Evading Malware
Today’s cyber attacks are not just after credit cards or bank details, they are also targeting critical information. The information could be new product designs or personnel records, contract information, or customer details. Critical information takes on many forms, and is pertinent to each organization, but each guise of critical information can be monetized very easily on the dark web or simply for the attackers own personal gain or held hostage for ransom.
Spear Phishing
Most people are aware of phishing; an email which appears to be sent to you from a friendly source which you then act upon, creating the problem. This could be opening an attachment or clicking on a link - both resulting in a malware infection. Spear phishing is very similar, but it is an attack which targets an individual or group of individuals with content which is very specific. Rather than a blanketapproach of ‘you are a customer of grocery store X, click here for a super deal’, it’s a crafted attack using personal references.
According to Fortra’s Digital Guardian research in 2023, spear phishing is a targeted attempt to steal sensitive information such as account credentials or financial information from a specific victim, often for malicious reasons. This is achieved by acquiring personal details on the victim such as their friends, hometown, employer, locations they frequent, and what they have recently bought online. The attackers then disguise themselves as a trustworthy friend or entity to acquire sensitive information, typically through email or other online messaging. This is the most successful form of acquiring confidential information on the internet, accounting for 91% of attacks.
Ransomware
Ransomware is the latest branch of malware to move from being a consumer to enterprise blight. Rather than having to exfiltrate information, the malware encrypts it in place and then displays a demand for money. There has been a spate of attacks, particularly in the healthcare vertical, when the New York-based healthcare network, Henry Schein, endured two adjacent attacks in a one-month timespan from BlackCat, a notorious ransomware group that terrorized victim organizations throughout 2023.2 Likewise, while healthcare was targeted, attacks have been reported across other verticals, including local government.
For today’s business, ransomware is a real threat and has evolved so that the outcome can be potentially devastating. Ransomware is just a process and infection is as simple as 1, 2, 3. One recent example is DRIDEX, see Figure 1.
Figure 1: Ransomware through DRIDEX malware
Evolution of Attacks
The early hackers were motivated by fame rather than fortune and the targets used to be high-profile ‘trophy’ organizations.
The next round of hackers went after the low-hanging fruit, information which could be easily monetized, credit card details, and then bank account details. The value here was the immediacy of the monetization and an industry grew up around being able to process the stolen information as quickly as possible.
After credit card details, came other personally identifiable information (PII), which could be used for identity theft and hence, monetization through impersonation. Medical information is now worth ten times more than credit cards. Usernames and passwords can also be monetized with demand for corporate credentials, as well as consumer. Today we are at the point where all critical information carries a value – to someone – and so is now a target, or in the case of hacktivists, it is about disruption (who also deploy other attack mechanisms, such as Distributed Denial of Service, or DDoS attacks.)
Thanks to the Internet, there are no boundaries, the perpetrators are no longer just individuals who are out for ‘fame’, but rather larger groups— from hacktivists to organized crime to alleged governments themselves—and can be based anywhere on the planet.
The attack vector has moved on from expecting someone to open an executable in an email, to clicking on a malicious link, to today’s malware which is now embedded in innocuous-looking documents. Open the document, infect the machine, infect the network. This malware is almost impossible to detect using traditional mechanisms as it has been crafted for a specific individual or organization, evading even next-generation firewalls, anti-virus and sandbox solutions. Once installed it operates ‘low and slow’, carrying out its task over a period of time rather than instantly, in order to avoid detection and is most frequently referred to as an Advanced Persistent Threat, or APT.
2 https://www.techtarget.com/searchsecurity/news/366564303/10-of-the-biggest-ransomware-attacks-in-2023
What Are the Options to Mitigate APTs?
Information-borne threats are particularly difficult to mitigate against. In essence, the malware is embedded into the document – but the document can also contain information which is actually required for legitimate business; for example, infecting documents stored in a cloud-based collaboration repository so that their payload is delivered when they are opened while on a corporate network. Cloud-based collaboration is now the defacto standard when working with other organizations, but due to lack of control, they can become the weakest link in the security chain.
What About sandboxing?
APTs are seldom detected by traditional anti-virus solutions, detection can be improved by using multiple AV engines, however even this is not 100% effective. Another approach is to use a sandbox. This is where the executable is run, or the document is opened in a controlled environment, such as a sandbox, and its behavior monitored. The major disadvantage of this approach is the ever-increasing sophistication of the malware, which can now evade detection in sandboxes.
“Malware sandboxes have registered good results and potential in curbing the problem; however, authors of the malware have found ways of bypassing the analysis measures put in place. It is sound to say that sandboxes no longer provide or guarantee the needed protection that required to be afforded computing systems to prevent against malware attacks.”
Sandboxing’s secondary impact is the delay in delivery while the behavioral monitoring is taking place. Business communication is frequently time-critical, especially those with documents attached (which is why people tend to open them before considering where they came from, and who might have sent it), so any delay is a delay to business. Organizations who deploy sandboxing technology often switch off the technology to ensure that the communication is delivered immediately and then take a copy for analysis. If malware is detected, they then have a process to try and delete the offending document before it infects the organization; the remediation often being too late.
What about a Dual Anti-Virus Solution?
Most companies today have an anti-virus solution of one sort or another. Best practice is to have different vendor solutions on the ingress points to that which is on the endpoint. The reason for this being that each will detect viruses slightly differently, especially through heuristics. While it is not practical to have multiple AV solutions on each endpoint, it is on the ingress points, the email and web gateways. Over time, all the anti-virus engines will detect the same viruses, but it is that additional coverage when a virus is first discovered which makes dual anti-virus effective.
What About Next-Generation Anti-Virus?
Anti-virus solutions are only as good as the virus signatures and heuristics that they support. Signature updates from most vendors happen multiple times during the day and are automatically downloaded. However, there is the time from when a virus is detected to when the new signatures are installed. The next generation of anti-virus solutions enable a cloud-based lookup, which makes the new signatures available in the time before it is downloaded as an update. This does reduce the risk with the reduction of the window of opportunity for the cyber attacker, between the release of the virus and it being detected and blocked. However, fundamentally, the risk still exists.
What About Clearswift and Why Is Our Approach Different?
Clearswift has built its reputation on a technology called Deep Content Inspection, which is the ability to take a document or an archive and pull it apart and then analyze the constituent pieces. Further innovation came in 2013 with the launch of Adaptive Redaction and with it the ability to rebuild documents having removed any data which breaks information security policies. While the technology was originally developed as part of an Adaptive Data Loss Prevention solution, it has been refined to additionally deliver an easy-to-use, cost-effective, advanced threat protection solution; the key component being Structural Sanitization.
Structural Sanitization from Clearswift
Deep Content Inspection (DCI) is used to fully understand a document and its constituent parts in real time. When it comes to protecting against APTs, it is primarily about detecting and removing active content. These are embedded macros and scripts which activate when a document is opened. It can also look for and remove piggybacked content which is attached to other embedded objects, such as images.
In order to be effective, DCI doesn’t stop at one level, it recurses through 50 of them until the end is found. So if there is embedded malware in a spreadsheet, which is embeddedin a Word document, which is in an archive, then DCI will find and remove it. Unlike anti-virus solutions, it doesn’t rely on signatures and doesn’t require constant updating.
Structural Sanitization can be rapidly deployed and typically costs less than a fifth of sandbox technology. It requires no specialist training and does not impact business agility. It can also be combined with sandboxing, enabling a safe version of the document to be delivered while analysis takes place, at which point the original can be forwarded on if there are no threats detected. Furthermore, active DCI within the email (or web gateway) can ensure that only documents with active content are forwarded to the sandbox solution, reducing the overhead of the sandbox scanning non-malicious files.
Document Sanitization from Clearswift
Today’s documents contain other threats embedded in them, outside of the obvious information, appearing in the guise of metadata. Metadata is the detail available to users that provides more insight into information; for example, it will describe where information was created (such as GPS information in photographs or the name of the computer a document was created on) and hence, the location of individuals can be tracked. It might provide details about authors, time, and date of creation of information, amongst other property-based description. This information is a gold mine for phishers and cyber attackers – by providing the inside track to the organization which makes phishing all the more successful. Would you be more likely to open a document purporting to be from your IT department which has your corporate username as the title? Or maybe one referring to internal printer names? These innocuous-looking pieces of data should never make it outside the organization, else it makes it easy for the cyber criminal.
Another class of information hidden inside a document is the revision history. This might be obvious if you have ‘track changes’ switched on, or it might be embedded in thedocument by default; for example, in fast-save information. Either way, this can contain sensitive data which could result in a data leak.
Deep Content Inspection can identify metadata and revision information and using Document Sanitization can automatically remove it and the threat it poses as it crosses the organizational boundary. This can be done through email and the web; for example, when uploadingdocuments to cloud collaboration platforms. Document Sanitization can also be used in front of an externally facing website using a configuration known as a ‘reverse proxy’,whereby any documents at the start of the download process can be checked and metadata or revision history which inadvertently remains is automatically removed before being delivered to the requestor.
Distributed Operational Management
As with any security solution, there is often a management overhead. For many solutions, this administration falls to the IT department or other system administrators. The Clearswift DCI technology is not restricted to understanding the content in documents (or emails), but also to the context, the sender, the recipient, and the means of communication. Integration with Active Directory or an LDAP service enables the solution to route simplified management tasks to the sender’s manager or any other nominated group or individual.
In Summary
Organizations are under constant attack from today’s advanced malware and ransomware attacks, with the proliferation urgently requiring a new approach to overcome the problem. As the attacks are becoming increasingly sophisticated and evasive, there is a need to rethink the defenses used. Unfortunately, there is no silver bullet, so this is about augmenting existing defenses rather than just replacing them.
Structural Sanitization offers organizations effective mitigation against the information-borne, evading threats, by automatically removing malware and ensuring there is no piggybacked data. Document Sanitization ensures that no critical information is leaked via metadata, revision history, or identifiable information which can then be used by cyber criminals to build spear phishing attacks against the organization.
A Sanitization approach is a cost-effective solution to augment sandboxing techniques, traditional anti-virus, dual and next- generation anti-virus, IP reputation, intrusion detection, and other security applications to build a comprehensive defense-in- depth architecture; applicable for organizations of all sizes, in all industries, to secure against today’s advanced threats.