Blog
‍

Eメール

Email Attack Trends: How phishing attacks are becoming more sophisticated and harder to identify

Mar 2024

Using data from Darktrace's End of Year Threat Report this blog describes how advanced phishing attacks pose significant cyber risk to signature based threat detection tools and shows how AI can be leveraged by security solutions to defend against these threats.

The state of email security and phishing attacks

Employees send and receive hundreds of emails a day to keep businesses moving. Unfortunately, it just takes one employee to interact with an undetected phishing email to potentially put an entire organization at risk from cyber disruption. Attackers know this, which is why they continue to develop and improve email phishing attacks.

Increased attack sophistication makes it harder than ever for traditional cyber security solutions like SEGs, firewalls, and spam filters to detect and mitigate increasingly novel and sophisticated email threats.

When there are tell-tale signs of a threat, these solutions can identify an incoming message as suspicious. Pointers such as emails from unknown senders, messages which contain an unusual amount of poor spelling and grammar or encourage the receiver to respond to an unexpected but supposedly urgent request.

That is, if the phishing attacks weren’t blocked by security measures before reaching the victim’s inbox. But, this is happening more and more often as phishing campaigns are becoming more advanced. Attackers are showing signs of consistently bypassing traditional protections and getting through to exploit victims.

Darktrace email threat reporting

In its End of Year Threat Report, Darktrace analyzed over 10 million phishing emails targeting customer environments between September 1 and December 31, 2023. Our findings signal that attackers are starting to take advantage of advancements in artificial intelligence (AI), including using Generative AI tools such as Large Language Models (LLMs) to create more convincing and sophisticated phishing messages – and at scale.

LLMs and Phishing

With the right AI prompts, attackers can use these LLMs to help write convincing email messages designed to target specific countries, companies or even individuals – all without the suspicious hallmarks which are traditionally associated with standard phishing attacks. The attackers don’t even need to speak the language of the individuals or groups they’re targeting. LLMs lower language barriers for attackers; using their native tongue, they can simply ask the Generative AI to write a message in the language of their choosing.

These techniques are designed to build trust and manipulate recipients into giving up sensitive information like user credentials, intellectual property or bank information or coerce them into downloading malicious payloads which can be used to launch further attacks on business infrastructure. With the appropriate research, attackers can tailor the messages to increase the chances of being successful, like making them look like a legitimate company email or request.

Social engineering phishing attacks

A year ago. Darktrace shared research which found a 135% increase in ‘novel social engineering attacks’ in the first two months of 2023, corresponding with the widespread adoption of ChatGPT. These novel phishing attacks showed a strong linguistic deviation compared to other phishing emails, which suggested to us that Generative AI was already providing an avenue for threat actors to craft sophisticated and targeted attacks at speed and scale

We’ve seen this trend continue. Our End of Year Threat Report found 38% of these emails were identified as utilizing novel social engineering techniques.

Attackers are also deploying another technique to make phishing emails look more convincing – they’re making the emails themselves longer and more sophisticated.

A potential victim might be suspicious of an ‘urgent’ email which prompts them to take action without an explanation - but if there’s additional context in the text, it adds an aura of legitimacy which is difficult to act against.

And threat actors know this; 28% of phishing emails analyzed by Darktrace over the period were identified as having “significant” amount of text – containing over 1,000 characters, which equates to over 200 words.

It’s a sign that attackers are innovating and bolstering their efforts to craft sophisticated phishing campaigns, potentially leveraging Generative AI tools to automate social engineering activity by creating longer, more convincing phishing emails.

QR code phishing

But this is far from the only innovative method which attackers are using to bypass traditional security defences. Among the 10 million plus emails analyzed during the reporting period, Darktrace/Email detected over 639,000 malicious QR codes within the messages.

Malicious QR codes placed within emails have become an increasingly common form of phishing attack, especially as QR codes have become a more common method for sharing links to information or buying links for products in recent years.

Attackers are deploying QR codes because they provide a way of directing unsuspecting victims to malicious websites or download links without needing to use a traditional phishing URL.

The advantage of implanting QR codes for attackers is that while phishing URLs are something which traditional security solutions are actively looking to identify and mitigate, malicious QR codes are more difficult for them to detect.

Applying AI to email security

Traditional security solutions which rely heavily on previously identified malicious emails and known bad senders are struggling to identify and defend against these novel and increasingly sophisticated email threats.

But by using AI that learns the unique digital environment and patterns of each business, Darktrace/Email can recognize the subtle deviations in expected email activity to determine whether any given email could represent a threat to the business. It is then able to make highly accurate decisions to mitigate and neutralize any email attack it faces helping to keep your organization safe from cyber disruption.

It’s therefore imperative that in the battle against ever-evolving, ever more sophisticated cyber threats, defenders are also embracing AI to keep businesses safe. By effectively applying AI to cyber security challenges, defenders can take a proactive approach to cyber security, staying one step ahead of malicious attackers, with real-time detection and automated response to known and unknown threats looking to disrupt the business via the inbox.

Darktrace/Email was recently awarded a 2024 AI Excellence Award for Machine Learning by Business Intelligence Group.

Join Darktrace on 9 April for a virtual event to explore the latest innovations needed to get ahead of the rapidly evolving threat landscape. Register today to hear more about our latest innovations coming to Darktrace’s offerings.

INSIDE THE SOC

Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.

AUTHOR

ABOUT ThE AUTHOR

The Darktrace Community

Watch the NIS2 Webinar

この記事を共有

More in this series

該当する項目はありません。

Blog
‍

Eメール

How Empowering End Users can Improve Your Email Security and Decrease the Burden on the SOC

May 2024

Why do we pay attention to the end user?

Every email security solution filters inbound mail, then typically hands over false positives and false negatives to the security team for manual triage. A crucial problem with this lifecycle is that it ignores the inevitability of end users being at the front line of any organization. Employees may receive point in time security awareness training, but it is rarely engaging or contextualized to their reality. While an employee may report a suspicious-looking email to the security team, they will rarely get to understand the outcome or impact of that decision. This means that the quality of reporting never improves, so the burden on the security team of triaging these emails – of which 90% are falsely reported – persists and grows with the business over time.

At Darktrace, we recognize that employees will always be on the front line of email security. That’s why we aim to improve end-user reporting from the ground up, reducing the overall number of emails needing triage and saving security team resource.

How does Darktrace improve the quality of end-user reporting?

Darktrace prioritizes improving users’ security awareness to increase the quality of end-user reporting from day one. We train users and optimize their experience, which in turn provides better detection. 

That starts with training and security awareness. Traditionally, organizations oblige employees to attend point-in-time training sessions which interrupt their daily work schedules. With Darktrace/Email, if a message contains some potentially suspicious markers but is most likely safe, Darktrace takes a specific action to neutralize the risky components and presents it to the user with a simple narrative explaining why certain elements have been held back. The user can then decide whether to report this email to the security team. 

Figure 1: AI shares its analysis in context and in real time at the moment a user is questioning an email

The AI narrative gives the user context for why their specific email may carry risk, putting their security awareness training into practice. This creates an element of trust with the security solution, rather than viewing it as outside of daily workflows. Users may also receive a daily or weekly digest of their held emails and make a decision on whether to release or report them.  

Whatever the user’s existing workflow is for reporting emails, Darktrace/Email can integrate with it and improve its quality. Our add-in for Outlook gives users a fully optimized experience, allowing them to engage with the narratives for each email, as well as non-productive mail management. However, if teams want to integrate Darktrace into an existing workflow, it can analyze emails reported to an internal SOC mailbox, the native email provider’s 'Report Phish’ button, or the ‘Knowbe4’ button.

By empowering the user with contextual feedback on each unique email, we foster employee engagement and elevate both reporting quality and security awareness. In fact, 60% fewer benign emails are reported because of the extra context supplied by Darktrace to end users. The eventual report is then fed back to the detection algorithm, improving future decision-making.  

Reducing the amount of emails that reach the SOC

Out of the higher-quality emails that do end up being reported by users, the next step is to reduce the amount of emails that reach the SOC. 

Once a user reports an email, Darktrace will independently determine if the mail should be automatically remediated based on second level triage. Darktrace/Email’s Mailbox Security Assistant automates secondary triage by combining additional behavioral signals and the most advanced link analysis engine we have ever built. It detects 70% more sophisticated malicious phishing links by looking at an additional twenty times more context than at the primary analysis stage, revealing the hidden intent within interactive and dynamic webpages. This directly alleviates the burden of manual triage for security analysts.

Following this secondary triage the emails that are deemed worthy of security team attention are then passed over, resulting in a lower quantity and higher quality of emails for SOC manual triage.

Centralizing and speeding analysis for investigations

For those emails that are received by the SOC, Darktrace also helps to improve triage time for manual remediation.

AI-generated narratives and automated remediation actions empower teams to fast-track manual triage and remediation, while still providing security analysts with the necessary depth. With live inbox view, security teams gain access to a centralized platform that combines intuitive search capabilities, Cyber AI Analyst reports, and mobile application access. With all security workflows consolidated within a unified interface, users can analyze and take remediation actions without the need to navigate multiple tools, such as e-discovery platforms – eliminating console hopping and accelerating incident response.

Our customers tell us that our AI allows them to go in-depth quickly for investigations, versus other solutions that only provide a high-level view.

Figure 2: Cyber AI Analyst provides a simple language narrative for each reported email, allowing teams to quickly understand why it may be suspicious

結論

Unlike our competitors, we believe that improving the quality of users’ experience is not only a nice-to-have, but a fundamental means for improving security. Any modern solution should consider end users as a key source of information as well as an opportunity for defense. Darktrace does both – optimizing the user experience as well as our AI learning from the user to augment detection.

The benefits of empowering users are ultimately felt by the security team, who benefit from improved detection, a reduction in manual triage of benign emails, and faster investigation workflows.

Augmented end user reporting is just one of a range of features new to Darktrace/Email. Check out the latest Innovations to Darktrace/Email in our recent blog.

著者について

Carlos Gray

Product Manager

Blog
‍

Inside the SOC

Detecting Attacks Across Email, SaaS, and Network Environments with Darktrace’s AI Platform Approach

Apr 2024

The State of AI in Cybersecurity

In a recent survey outlined in Darktrace’s State of AI Cyber Security whitepaper, 95% of cyber security professionals agree that AI-powered security solutions will improve their organization’s detection of cyber-threats [1]. Crucially, a combination of multiple AI methods is the most effective to improve cybersecurity; improving threat detection, accelerating threat investigation and response, and providing visibility across an organization’s digital environment.

In March 2024, Darktrace’s AI-led security platform was able to detect suspicious activity affecting a customer’s email, Software-as-a-Service (SaaS), and network environments, whilst its applied supervised learning capability, Cyber AI Analyst, autonomously correlated and connected all of these events together in one single incident, explained concisely using natural language processing.

攻撃の概要

Following an initial email attack vector, an attacker logged into a compromised SaaS user account from the Netherlands, changed inbox rules, and leveraged the account to send thousands of phishing emails to internal and external users. Internal users fell victim to the emails by clicking on contained suspicious links that redirected them to newly registered suspicious domains hosted on same IP address as the hijacked SaaS account login. This activity triggered multiple alerts in Darktrace DETECT™ on both the network and SaaS side, all of which were correlated into one Cyber AI Analyst incident.

In this instance, Darktrace RESPOND™ was not active on any of the customer’s environments, meaning the compromise was able to escalate until their security team acted on the alerts raised by DETECT. Had RESPOND been enabled at the time of the attack, it would have been able to apply swift actions to contain the attack by blocking connections to suspicious endpoints on the network side and disabling users deviating from their normal behavior on the customer’s SaaS environment.

Nevertheless, thanks to DETECT and Cyber AI Analyst, Darktrace was able to provide comprehensive visibility across the customer’s three digital estate environments, decreasing both investigation and response time which enabled them to quickly enact remediation during the attack. This highlights the crucial role that Darktrace’s combined AI approach can play in anomaly detection cyber defense

Attack Details & Darktrace Coverage

1. Email: the initial attack vector

The initial attack vector was likely email, as on March 18, 2024, Darktrace observed a user device making several connections to the email provider “zixmail[.]net”, shortly before it connected to the first suspicious domain. Darktrace/Email identified multiple unusual inbound emails from an unknown sender that contained a suspicious link. Darktrace recognized these emails as potentially malicious and locked the link, ensuring that recipients could not directly click it.

Figure 1: Suspected initial compromise email from an unknown sender, containing a suspicious link, which was locked by Darktrace/Email.

2. Escalation to Network

Later that day, despite Darktrace/Email having locked the link in the suspicious email, the user proceeded to click on it and was directed to a suspicious external location, namely “rz8js7sjbef[.]latovafineart[.]life”, which triggered the Darktrace/Network DETECT model “Suspicious Domain”. Darktrace/Email was able to identify that this domain had only been registered 4 days before this activity and was hosted on an IP address based in the Netherlands, 193.222.96[.]9.

3. SaaS Account Hijack

Just one minute later, Darktrace/Apps observed the user’s Microsoft 365 account logging into the network from the same IP address. Darktrace understood that this represented unusual SaaS activity for this user, who had only previously logged into the customer’s SaaS environment from the US, triggering the “Unusual External Source for SaaS Credential Use” model.

4. SaaS Account Updates

A day later, Darktrace identified an unusual administrative change on the user’s Microsoft 365 account. After logging into the account, the threat actor was observed setting up a new multi-factor authentication (MFA) method on Microsoft Authenticator, namely requiring a 6-digit code to authenticate. Darktrace understood that this authentication method was different to the methods previously used on this account; this, coupled with the unusual login location, triggered the “Unusual Login and Account Update” DETECT model.

5. Obfuscation Email Rule

On March 20, Darktrace detected the threat actor creating a new email rule, named “…”, on the affected account. Attackers are typically known to use ambiguous or obscure names when creating new email rules in order to evade the detection of security teams and endpoints users.

The parameters for the email rule were:

“AlwaysDeleteOutlookRulesBlob: False, Force: False, MoveToFolder: RSS Feeds, Name: ..., MarkAsRead: True, StopProcessingRules: True.”

This rule was seemingly created with the intention of obfuscating the sending of malicious emails, as the rule would move sent emails to the "RSS Feeds” folder, a commonly used tactic by attackers as the folder is often left unchecked by endpoint users. Interestingly, Darktrace identified that, despite the initial unusual login coming from the Netherlands, the email rule was created from a different destination IP, indicating that the attacker was using a Virtual Private Network (VPN) after gaining a foothold in the network.

Figure 2: Hijacked SaaS account making an anomalous login from the unusual Netherlands-based IP, before creating a new email rule.

6. Outbound Phishing Emails Sent

Later that day, the attacker was observed using the compromised customer account to send out numerous phishing emails to both internal and external recipients. Darktrace/Email detected a significant spike in inbound emails on the compromised account, with the account receiving bounce back emails or replies in response to the phishing emails. Darktrace further identified that the phishing emails contained a malicious DocSend link hidden behind the text “Click Here”, falsely claiming to be a link to the presentation platform Prezi.

Figure 3: Darktrace/Email detected that the DocSend link displayed via text “Click Here”, was embedded in a Prezi link.

7. Suspicious Domains and Redirects

After the phishing emails were sent, multiple other internal users accessed the DocSend link, which directed them to another suspicious domain, “thecalebgroup[.]top”, which had been registered on the same day and was hosted on the aforementioned Netherlands-based IP, 193.222.96[.]91. At the time of the attack, this domain had not been reported by any open-source intelligence (OSINT), but it has since been flagged as malicious by multiple vendors [2].

Figure 4: External Sites Summary showing the suspicious domain that had never previously been seen on the network. A total of 11 “Suspicious Domain” models were triggered in response to this activity.

8. Cyber AI Analyst’s Investigation

As this attack was unfolding, Darktrace’s Cyber AI Analyst was able to autonomously investigate the events, correlating them into one wider incident and continually adding a total of 14 new events to the incident as more users fell victim to the phishing links.

Cyber AI Analyst successfully weaved together the initial suspicious domain accessed in the initial email attack vector (Figure 5), the hijack of the SaaS account from the Netherlands IP (Figure 6), and the connection to the suspicious redirect link (Figure 7). Cyber AI Analyst was also able to uncover other related activity that took place at the time, including a potential attempt to exfiltrate data out of the customer’s network.

By autonomously analyzing the thousands of connections taking place on a network at any given time, Darktrace’s Cyber AI Analyst is able to detect seemingly separate anomalous events and link them together in one incident. This not only provides organizations with full visibility over potential compromises on their networks, but also saves their security teams precious time ensuring they can quickly scope out the ongoing incident and begin remediation.

Figure 5: Cyber AI Analyst correlated the attack’s sequence, starting with the initial suspicious domain accessed in the initial email attack vector.

Figure 6: As the attack progressed, Cyber AI Analyst correlated and appended additional events to the same incident, including the SaaS account hijack from the Netherlands-based IP.

Figure 7: Cyber AI Analyst correlated and appended additional events to the same incident, including additional users connecting to the suspicious redirect link following the outbound phishing emails being sent.

結論

In this scenario, Darktrace demonstrated its ability to detect and correlate suspicious activities across three critical areas of a customer’s digital environment: email, SaaS, and network.

It is essential that cyber defenders not only adopt AI but use a combination of AI technology capable of learning and understanding the context of an organization’s entire digital infrastructure. Darktrace’s anomaly-based approach to threat detection allows it to identify subtle deviations from the expected behavior in network devices and SaaS users, indicating potential compromise. Meanwhile, Cyber AI Analyst dynamically correlates related events during an ongoing attack, providing organizations and their security teams with the information needed to respond and remediate effectively.

Credit to Zoe Tilsiter, Analyst Consulting Lead (EMEA), Brianna Leddy, Director of Analysis

付録

参考文献

[1] https://darktrace.com/state-of-ai-cyber-security

[2] https://www.virustotal.com/gui/domain/thecalebgroup.top

Darktrace DETECT Model Coverage

SaaS Models

- SaaS / Access / Unusual External Source for SaaS Credential Use

- SaaS / Compromise / Unusual Login and Account Update

- SaaS / Compliance / Anomalous New Email Rule

- SaaS / Compromise / Unusual Login and New Email Rule

Network Models

- Device / Suspicious Domain

- Multiple Device Correlations / Multiple Devices Breaching Same Model

Cyber AI Analyst Incidents

- Possible Hijack of Office365 Account

- Possible SSL Command and Control

Indicators of Compromise (IoCs)

IoC – Type – Description

193.222.96[.]91 – IP – Unusual Login Source

thecalebgroup[.]top – Domain – Possible C2 Endpoint

rz8js7sjbef[.]latovafineart[.]life – Domain – Possible C2 Endpoint

https://docsend[.]com/view/vcdmsmjcskw69jh9 - Domain - Phishing Link

著者について

Zoe Tilsiter

Cyber Analyst

Our ai. Your data.

Elevate your cyber defenses with Darktrace AI

無償トライアルを開始

Darktrace AI protecting a business from cyber threats.

Check out this article by Darktrace: Email Attack Trends: How phishing attacks are becoming more sophisticated and harder to identify

Blog
‍

Eメール

Email Attack Trends: How phishing attacks are becoming more sophisticated and harder to identify

The state of email security and phishing attacks