May 5, 2016 By Douglas Bonderud 2 min read

Employees are getting smarter, paying more attention to emails in their inbox and treading cautiously before downloading a suspect file or responding to requests from an impostor CEO. But this is an arms race, and malware creators aren’t shutting down servers and calling it a day just yet.

As noted by SC Magazine, malware campaigns are now using designer tactics to more effectively target local and niche businesses. Here’s a look at the new world of couture cybercrime.

Breaking Brand

Most companies are familiar with traditional malware brands. Often using spray-and-pray tactics, these large-scale threats went after every target they could find in hopes of getting just a few to take the bait. But generic is no longer getting the job done.

SC Magazine stated that cybercriminals are “becoming ever more proficient at using localized language and vernacular in phishing emails and ransomware notes.”

According to ComputerWeekly, there’s been a sharp rise in the number of properly written and perfectly punctuated emails — a far cry from the familiar, barely legitimate dreck of common phishing attempts. Criminals are also narrowing their focus to spoof brands, logos and even enforcement agencies native to a particular region or culture for maximum impact.

It makes sense; when an email arrives that appears to be from local authorities, comes with seemingly legitimate contact details and is written in a flawless local dialect, the chance of fooling users increases.

Many malware-makers have taken the step of employing professional translation freelancers to do some of their dirty work. Those doing the conversion don’t know the ultimate purpose, and the fee incurred for this high-quality job is minimal compared to the potential windfall.

In addition, designer malware campaigns are actively avoiding certain regions. If an online geo IP lookup returns the address of a nontargeted country, the malware fails to activate or may even delete itself.

Malware Campaigns Go Back and Forth

This isn’t to say there’s no progress on the malware front. As noted by ZDNet, the Russian cybercriminal who developed and sold the Gozi malware has been handed a $7 million bill in addition to time served. While this is cold comfort to the millions victimized by Gozi, it’s a step in the right direction.

On the flip side, researchers have discovered an exploit of Windows’ so-called God Mode, which creates hidden folders and lets uses access advanced functions. The Dynamer malware leverages this feature to hide itself and wreak havoc without detection. But it’s not all bad — Dynamer isn’t hard to delete when found.

This is a market that’s primed for the kind of designer malware recently discovered. Criminals aren’t looking for millions of infections that will attract the attention of international authorities, and they don’t want the hit-or-miss results garnered by simple exploit tools like Dynamer.

Culture rather than code has become the weapon. It’s the new way to slide past spam sensors and convince targeted companies that they’re completely safe while they’re vastly increasing their risk. Couture cybercrime makes it tougher to tell counterfeit online interactions from the genuine article.

More from

Adversarial advantage: Using nation-state threat analysis to strengthen U.S. cybersecurity

4 min read - Nation-state adversaries are changing their approach, pivoting from data destruction to prioritizing stealth and espionage. According to the Microsoft 2023 Digital Defense Report, "nation-state attackers are increasing their investments and launching more sophisticated cyberattacks to evade detection and achieve strategic priorities."These actors pose a critical threat to United States infrastructure and protected data, and compromising either resource could put citizens at risk.Thankfully, there's an upside to these malicious efforts: information. By analyzing nation-state tactics, government agencies and private enterprises are…

6 Principles of Operational Technology Cybersecurity released by joint NSA initiative

4 min read - Today’s critical infrastructure organizations rely on operational technology (OT) to help control and manage the systems and processes required to keep critical services to the public running. However, due to the highly integrated nature of OT deployments, cybersecurity has become a primary concern.On October 2, 2024, the NSA (National Security Agency) released a new CSI titled “Principles of Operational Technology Cybersecurity.” This new guide was created in collaboration with the Australian Signals Directorate’s Australian Cyber Security Centre (ASD SCSC) to…

Strela Stealer: Today’s invoice is tomorrow’s phish

12 min read - As of November 2024, IBM X-Force has tracked ongoing Hive0145 campaigns delivering Strela Stealer malware to victims throughout Europe - primarily Spain, Germany and Ukraine. The phishing emails used in these campaigns are real invoice notifications, which have been stolen through previously exfiltrated email credentials. Strela Stealer is designed to extract user credentials stored in Microsoft Outlook and Mozilla Thunderbird. During the past 18 months, the group tested various techniques to enhance its operation's effectiveness. Hive0145 is likely to be…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today