Does this make you trust email?

Hackers have been using social engineering tricks to get their malicious code onto the systems of unsuspecting victims. This has been happening for almost as long as the internet has been around.

It's one of the most common tactics in use today, primarily because it's so simple and effective.

Trial and error have shown hackers that users are more likely to trust an email if it looks like it's part of an ongoing conversation. So, they often try to spoof that. Unfortunately, spoofing an ongoing conversation is a lot harder to do than it might first seem. As technology has advanced, they've hit on an even better solution.

 

Maybe a hijacked conversation does the trick

Instead of spoofing a conversation, why not hijack one?

That's right, hackers now have the capability to hijack a legitimate and ongoing conversation between you and another individual and lace that conversation with malware.

Since the conversation is one the user is currently having naturally, that individual will trust any links or attached files that might be a part of the conversation. That translates into a greater likelihood that those links will be clicked, or those files will be opened.

Right now, the main source for this innovative attack variant is the group spreading Qakbot.

 

Here's how the malware works

Qakbot spreads via infected Windows computers.  The malware downloads a payload that scans for email accounts.  It finds them and steals login credentials while other automated tools are busy going through the user's inbox and sending out phishing emails. They do this by using the "reply all" function when it finds an existing email thread.

The original message is quoted in the reply, which makes it look that much more authentic.

After the original message, the bot will append a few lines of text that contain a request to "look at an attachment" which is often a zip file.  Anyone not paying attention is bound to open the file without thinking, and you know the rest of the story.

 

Check-in with other cybersecurity experts

Feb 2022: QakBot Campaign Attempts to Revive Old Emails to Gain the Upper Hand

Mar 2022: QakBot Banking Trojan Evolves and Now Takes Over Email Conversations to Spread Malware

Mar 2022: Qakbot Botnet Sprouts Fangs, Injects Malware into Email Threads

 

My perspective

Keep this one high on your radar, it's particularly sneaky.

 

You've got to be smarter than the average bear if you going to stop this one.

 


By Denis Wilson

Cybersecurity Expert, Small Business Technology Consultant, Managed Services Provider, Managed IT Support

Thanks for reading this post. I always take into mind that your time and attention are precious. And these posts need to be timely, to the point, and short.

For more tips on thriving with small business technology, check out the other blog posts at DWPIA Blogs. You can also find me on LinkedIn, Facebook, and Twitter

I am also a published author and speaker on cloud computing, work-at-home, and cybersecurity. I work extensively with business and professional associations to provide free small business technology education programs.

 

Contact me if you would like me to speak to your association