HTML attachments found to be the most malicious type of file

Barracuda Networks found that HTML attachments were malicious more than double than the next leading type of file.

Users of email have long thought of executable and .dll attachments as the main focus when cyberattacks arise, but there may be another type of highly used malicious file to be aware of. According to findings from IT security company Barracuda Networks, HTML attachments are being employed by adversaries the most when it comes to cyberattacks and 21% of all HTML attachments scanned by the company were found to be malicious.

“These attacks are difficult to detect because HTML attachments themselves are not malicious,” wrote Olesia Klevchuk, Principal Product Marketing Manager for email security at Barracuda Networks. “Attackers do not include malware in the attachment itself but instead use multiple redirects with Java script libraries hosted elsewhere.”

Why are HTML attachments being used in attacks?

HTML attachments are being more widely used due to attacks being harder for both users and systems to identify. In the example provided by Barracuda, HTML attachment itself is not malicious, but eventually routes the user to a malicious site instead.

HTML attachments almost double the rate of the next type of file that was found to be malicious. For reference, here are the other types of malicious files:

• Text (9%)
• XHTML (4%)
• Binaries (0.3%)
• Scripts (0.08%)
• Rtf (0.04%)
• MS Office (0.03%)
• PDF (0.009%)

So what we learned is that HTML attachments are far and away the most popular type of malicious file used by adversaries, but how does this work?

Barracuda found that hackers have been embedding malicious HTML files into emails that users receive regularly, such as a link to a report. In reality, this is a phishing email with a harmful URL attached to it. Through this method, cybercriminals are no longer required to put links in the body of an email, making them easy to detect. The HTML method is much trickier than previous attempts, and also can circumvent anti-spam and anti-virus policies at a greater rate.

When these are opened, the HTML uses a Java script to send the user to a third party machine, requesting that the user enter their personal credentials to log in or download a file that is malware. This method also does not require the adversary to create a fake website to carry this attack out, but instead can create a phishing form directly embedded in the attachment, sending phishing sites as attachments instead of links.

“Potential protection against these attacks should take into account an entire email with HTML attachments, looking at all redirects and analyzing the content of the email for malicious intent,” Klevchuk wrote.

SEE: Mobile device security policy (TechRepublic Premium)

How to protect systems from malicious HTML attachments

Barracuda emphasizes three main tips to help prevent users from falling victim to these types of attacks:

1. Ensure your email protection scans and blocks malicious HTML attachments
2. Train your users to identify and report potentially malicious HTML attachments
3. If malicious email did get through, have your post delivery remediation tools ready

Both organizations and individuals can do a better job of helping identify these phony emails. On the enterprise side, companies investing in greater email detection and response can prevent this malware from ever reaching a user’s inbox. Barracuda suggests “machine learning and static code analysis that evaluate the content of an email and not just an attachment”.

On the individual side, in the event one of these emails makes it into the inbox, employing a zero-trust model and not clicking anything until it has been verified to be safe from an organization’s IT department can save a great deal of hassle both for the user and business.

Lastly, having automated incident responses can help save time and money for businesses in the event one of these emails is mistakenly clicked. By stopping a potential attack before attacks spread throughout an organization, credentials or sensitive information can be salvaged before it falls into the hands of cybercriminals.