Security researchers discovered a new malware email campaign that uses an updated version of AZORult Stealer to distribute the Hermes ransomware.

On July 17, malware downloader AZORult received an update. One day later security firm ProofPoint reported a new email campaign leveraging AZORult and targeting North American users.

The researchers noted that the attack likely stems from a threat actor known as TA516 who has been actively leveraging this type of malware since 2017. The new campaign sends emails with “employment-related themes,” such as job applications or requests for employment information, along with a password-protected attachment using the format “firstname.surname_resume.doc.”

Because the protected document is not malicious, it goes unnoticed by most antivirus programs. Once the password (contained in the email body) is entered and the user enables macros, however, the document runs scripts that download AZORult.

Why AZORult Is a Persistent Problem

AZORult is a problem for organizations because the malicious code is regularly updated. According to ProofPoint, version 3.2 includes the capability to steal history from web browsers, detect multiple cryptocurrency wallets and use system proxies to connect. Other notable features include support for unlimited loader links, allowing malicious actors to specify how the loader works — such as telling it to download cookies or saved passwords for specific websites.

In addition, AZORult takes the less common route of both stealing information and installing ransomware. While this increases the chances of detection by antimalware programs, successful installation puts users at risk of both initial data theft and follow-up ransomware attacks. The malware also enjoys substantial actor interest; within a day of the update, thousands of attack emails had been created and distributed.

How to Reduce the Risk of Malware Email Attacks

To reduce the risk of successful email attacks, IBM security professionals recommend conducting phishing simulations to boost security awareness among employees. IT teams should draft mock phishing attacks, send them to users across the company, and collect data on success rates and reporting to uncover trends about email security.

Security experts also suggest developing an integral cybersecurity culture that extends to end users. This means embedding cybersecurity throughout business processes, encouraging collaboration across departments and promoting the concept of shared responsibility for IT security.

Source: ProofPoint