Transcript
A (0:00)
Foreign. This is Catalina Campano and this is a risky business. Sponsored interview with Alex Orleans, head of Threat Intelligence at Sublime Security. Welcome, Alex.
B (0:12)
Thanks so much. It's great to be here.
A (0:13)
Alex. At Sublime, you see a lot of email threats daily. But we're here to talk about a particular one, the use of zoom video conferencing. But there's two ways this is getting abused. First, I've seen threat actors lure victims to a legitimate zoom meeting where they use various tactics for social engineering attacks to get victims to to perform certain actions. And then we also have a trend where threat actors try to convince targets to install booby trapped zoom clients that deploy malware on their systems. So which one are you seeing more
B (0:44)
right now we see a fair amount of both. And then there's also, I would say a third category also where there's an attempt in the email to credential harvest through landing pages that simulate zoom updaters and needing to authorize the updater to install. So there's social engineering, there's the credential harvesting and there's the malware. But the one that's really interesting and where we're seeing more innovation in terms of how attackers are changing their tactics and improving their tradecraft is on the malware delivery side, where sometimes it's not even a backdoored installer, it's just a renamed installer for either a legitimately malicious payload or a repurposed legitimate binary that's functioning as malware in that particular operation.
A (1:34)
Like rmms, right?
B (1:36)
Yeah, especially rmms, one of the most common ones that I've seen here at Sublime. And also in the last couple of years across threat intel at various places has been screen connect, any desk, things like that.
A (1:51)
So why the spike? Is it because it's a new technique and people aren't prepared and fall for it, or is it because it's hard to detect from a cyber defensive perspective?
B (2:01)
I think it's a little bit of both. I think it's more the idea that, you know, everyone's using zoom more and more often, so you're more likely to end up with some sort of zoom fatigue where you go a little bit blind to something showing up in your inbox that says, oh, it's a zoom meeting, join here. Or sometimes we would, we see it through calendar invites, which don't necessarily go through the inbox, but can be silently pushed to your calendar. It's a different way of, we call it ICS phishing. Phishing, different way of pushing it in there. And in those cases you're taking advantage of the routine and the kind of mundane nature of everyone's used to clicking on a Zoom link, or depending on how the fish is phrased, it's an urgency thing. Hey, I need you to get on this call. Please get on this call. And that can take the form of different kinds of impersonation. On top of a false Zoom meeting, on top of impersonating Zoom, they're impersonating somebody who you would expect to be talking to you in the first place, be it a vendor or someone else in your company. So there's taking advantage of the current trend, but there's also the fact that in terms of using like, RMMs rather than traditional malicious payloads that are more likely to get detected, you have a higher chance of evading detection, higher chance of evading both email screening as well as EDR getting that payload on.