August 20, 2018 By Douglas Bonderud 2 min read

Security researchers discovered a new malware email campaign that uses an updated version of AZORult Stealer to distribute the Hermes ransomware.

On July 17, malware downloader AZORult received an update. One day later security firm ProofPoint reported a new email campaign leveraging AZORult and targeting North American users.

The researchers noted that the attack likely stems from a threat actor known as TA516 who has been actively leveraging this type of malware since 2017. The new campaign sends emails with “employment-related themes,” such as job applications or requests for employment information, along with a password-protected attachment using the format “firstname.surname_resume.doc.”

Because the protected document is not malicious, it goes unnoticed by most antivirus programs. Once the password (contained in the email body) is entered and the user enables macros, however, the document runs scripts that download AZORult.

Why AZORult Is a Persistent Problem

AZORult is a problem for organizations because the malicious code is regularly updated. According to ProofPoint, version 3.2 includes the capability to steal history from web browsers, detect multiple cryptocurrency wallets and use system proxies to connect. Other notable features include support for unlimited loader links, allowing malicious actors to specify how the loader works — such as telling it to download cookies or saved passwords for specific websites.

In addition, AZORult takes the less common route of both stealing information and installing ransomware. While this increases the chances of detection by antimalware programs, successful installation puts users at risk of both initial data theft and follow-up ransomware attacks. The malware also enjoys substantial actor interest; within a day of the update, thousands of attack emails had been created and distributed.

How to Reduce the Risk of Malware Email Attacks

To reduce the risk of successful email attacks, IBM security professionals recommend conducting phishing simulations to boost security awareness among employees. IT teams should draft mock phishing attacks, send them to users across the company, and collect data on success rates and reporting to uncover trends about email security.

Security experts also suggest developing an integral cybersecurity culture that extends to end users. This means embedding cybersecurity throughout business processes, encouraging collaboration across departments and promoting the concept of shared responsibility for IT security.

Source: ProofPoint

More from

How will the Merck settlement affect the insurance industry?

3 min read - A major shift in how cyber insurance works started with an attack on the pharmaceutical giant Merck. Or did it start somewhere else?In June 2017, the NotPetya incident hit some 40,000 Merck computers, destroying data and forcing a months-long recovery process. The attack affected thousands of multinational companies, including Mondelēz and Maersk. In total, the malware caused roughly $10 billion in damage.NotPetya malware exploited two Windows vulnerabilities: EternalBlue, a digital skeleton key leaked from the NSA, and Mimikatz, an exploit…

3 Strategies to overcome data security challenges in 2024

3 min read - There are over 17 billion internet-connected devices in the world — and experts expect that number will surge to almost 30 billion by 2030.This rapidly growing digital ecosystem makes it increasingly challenging to protect people’s privacy. Attackers only need to be right once to seize databases of personally identifiable information (PII), including payment card information, addresses, phone numbers and Social Security numbers.In addition to the ever-present cybersecurity threats, data security teams must consider the growing list of data compliance laws…

ICS CERT predictions for 2024: What you need to know

4 min read - As we work through the first quarter of 2024, various sectors are continuously adapting to increasingly complex cybersecurity threats. Sectors like healthcare, finance, energy and transportation are all regularly widening their digital infrastructure, resulting in larger attack surfaces and greater risk exposure.Kaspersky just released their ICS CERT Predictions for this year, outlining the key cybersecurity challenges industrial enterprises will face in the year ahead. The forecasts emphasize the persistent nature of ransomware threats, the increasing prevalence of cosmopolitical hacktivism, insights…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today