by Nick Kael
Posted on November 17, 2021
Microsoft’s 365 Defender Threat Intelligence Team recently issued a warning about a worrying increase in HTML smuggling attacks, in which hackers “smuggle” encoded malicious script via emails, using either a specially created HTML attachment or a link to an HTML smuggling page.
Nobelium, the cybergang that was responsible for the Solar Winds supply chain attack, launched an HTML smuggling campaign in January 2021. The campaign, which is ongoing, has evolved, indicating that Nobelium has been experimenting with different ways to foil cyber defenses.
Starting in May 2021, Nobelium used Constant Contact, one of the most popular mass emailing services, to distribute malicious URLS. The cybercriminals masqueraded as a development organization. This campaign is known to have targeted at least 3,000 accounts in 150 different organizations. The attacks were tailor-made for each organization, designed to allow the attack to remain undetected for as long as possible within a particular organization.
As for phishing campaigns, organizations rely on educated users to serve as the first line of defense against HTML smuggling attacks. As the argument goes, if users do not click on links or open an HTML attachment of emails that might be suspicious, the attack will be foiled before it begins.
However, as we’ve reported, 65% of organizations that were hit with a phishing attack had previously conducted anti-phishing training. Effective training can reduce the number of users who click on suspicious emails, although the reduction is rarely to zero. For the most well-crafted social engineering appeals, the percentage of clickers is significantly higher. And for an HTML smuggling attack, even one click can result in ransomware being deployed across a network.
A far more reliable way to foil HTML smuggling attacks even if a user clicks the link or opens the attachment is with Remote Browser Isolation (RBI).
RBI is just one element of a comprehensive Zero Trust approach to network security. Web Isolation is built into ZTEdge, Ericom’s comprehensive Zero Trust Secure Access Service Edge (SASE) platform for midsize enterprises. ZTEdge provides protection against many other kinds of threats as well, while simplifying secure, from-anywhere no-VPN access to the resources users need. Capabilities including microsegmentation and identity and access management (IAM) help minimize damage in the event that a breach does occur.
Phishing soared in 2021, building on a record-breaking 2020. Variations leading the growth included “smishing,” “vishing” and malicious social media.
The LAPSUS$ cybercrime gang gained access to T-Mobile’s VPN simply by purchasing initial access from a site that sells access to compromised systems.
RBI stops steganographic attacks, in which malware is concealed within the code of images or other presumably innocent content, in ways that AV/firewalls cannot detect.