Proofpoint researchers recently identified an increase in threat actor use of OneNote documents to deliver malware via email to unsuspecting end-users in December 2022 and January 2023. OneNote is a digital notebook created by Microsoft and available via the Microsoft 365 product suite. Proofpoint has observed threat actors deliver malware via OneNote documents, which are .one extensions, via email attachments and URLs.

While there is an increase in the number of campaigns utilizing OneNote to deliver malware, its use is unusual. Based on Proofpoint’s observed characteristics of past threat campaigns, it is believed that threat actors have increasingly adopted OneNote as of result of their experimentation with different attachment types to bypass threat detection. Since Microsoft began blocking macros by default in 2022, threat actors have experimented with many new tactics, techniques, and procedures (TTPs), including the use of previously infrequently observed filetypes such as virtual hard disk (VHD), compiled HTML (CHM), and now OneNote (.one).

Observed email campaigns that use OneNote for malware delivery share similar characteristics. While the message subjects and senders vary, nearly all campaigns use unique messages to deliver malware, and do not typically utilize thread hijacking. Messages typically contain OneNote file attachments with themes such as invoice, remittance, shipping, and seasonal themes such as Christmas bonus, among other subjects. In mid-January 2023, Proofpoint researchers observed actors using URLs to deliver OneNote attachments that use the same TTPs for malware execution.

The OneNote documents contain embedded files, often hidden behind a graphic that looks like a button. When the user double-clicks the embedded file, they will be prompted with a warning. If the user clicks continue, the file will execute. The technique may be effective for now. At the time of analysis, multiple OneNote malware samples observed by Proofpoint were not detected by numerous anti-virus vendors on VirusTotal.

It is important to note, an attack is only successful if the recipient engages with the attachment, specifically by clicking on the embedded file and ignoring the warning message displayed by OneNote. Organizations should educate end users about this technique and encourage users to report suspicious emails and attachments.

Acronis has released its latest cyberthreats and trends report for the second half of 2022 which found that phishing and the use of MFA fatigue attacks, an extremely effective method used in high-profile breaches, are on the rise. Conducted by Acronis’ Cyber Protection Operation Center, the report provides an in-depth analysis of the cyberthreat landscape including ransomware threats, phishing, malicious websites, software vulnerabilities, and a security forecast for 2023.

Of note, the report found that threats from phishing and malicious emails have increased by 60% and the average data breach cost is expected to reach US$5 million by next year. The research team who authored the report also saw social engineering attacks jump in the last four months, accounting for 3% of all attacks. Leaked or stolen credentials, which allow attackers to easily execute cyberattacks and ransomware campaigns, were the cause of almost half of reported breaches in H1 2022.

“The last few months have proven to be as complex as ever – with new threats constantly emerging and malicious actors continuing to use the same proven playbook for big payouts,” said Candid Wüest, Acronis VP of Cyber Protection Research. “Organizations must prioritize all-encompassing solutions when looking to mitigate phishing and other hacking attempts in the new year. Attackers are evolving, using some of the tools, like MFA, that we rely on to protect our employees and businesses against us.”

Middle East and Africa Cybersecurity Landscape
As the Middle East region continues to grow its digital ecosystem, solid cybersecurity strategies remain a top priority on the back of heightened data breaches. According to security analysts, breaches reported in the Kingdom of Saudi Arabia, for example, could reach an average of US$7 million as the country continues to report one out of five attacks to be ransomware.

With the average cost of ransomware attacks increasing every year, factors such as weak credentials, phishing emails, and unpatched vulnerabilities remain the top cyber-attacking vectors. In the UAE, targeted organizations lost over US$1.4 million in ransomware, forcing over 40% of the impacted companies to shut down. Following this worrying trend, the UAE Cyber Security Council announced the adoption of stringent cybersecurity standards to safeguard the country’s digital space.

Ranked as the sixth-most dense region for cybercrime in the world, cybercrime victims in South Africa surged from 14.1 victims per one million internet users in 2019 to 50.8 victims in 2020. Most recently, the country enacted its cybersecurity act, which clearly defines cybercrimes in a bid to effectively regulate and prosecute them.

In Kenya and Nigeria, financial phishing attempts rose significantly in Q1 and Q2 of 2022 as banks, online payment systems, and e-commerce websites were targeted. In Kenya, over 100,000 financial phishing attacks were detected – a 201% increase compared to Q1 and Nigeria has reported over 61,000 financial phishing attacks, representing an increase of 79% compared to Q1.

Report Highlights: Threat Landscape Sees New Challenges
As security tactics and the technologies associated with them evolve, so do the threat actors trying to break into organizations and their ecosystems. The constant feed of ransomware, phishing, and unpatched vulnerabilities demonstrates how crucial it is for businesses to reevaluate their security strategies.

Ransomware Continues to Worsen:

• Ransomware continues to be the number one threat to enterprises and businesses including government, healthcare, and organizations in other sectors.
• Each month in the second half of this year, ransomware gangs were adding 200-300 new victims to their combined list.
• The market of ransomware operators was dominated by 4-5 players. By the end of Q3 the total number of compromised targets published for the main operators in 2022 were as follows:
  • LockBit – 1157
  • Hive – 192
  • BlackCat – 177
  • Black Basta – 89
• 576 publicly mentioned ransomware compromises in Q3, a slight increase from Q2.
• The number of ransomware incidents decreased slightly in Q3, after a high during the summer months. From July to August, Acronis saw a 49% increase in blocked ransomware attacks globally, followed by a decrease of 12.9% in September and 4.1% in October.
• There is a shift towards more data exfiltration as the main actors are continuing to professionalize their operations. Most of the large players have expanded to macOS and Linux and are also looking at the cloud environment.

Phishing and Malicious Emails Remain Successful for Threat Actors:

• The most-attacked countries in terms of malware per user in Q3 of 2022 were South Korea, Jordan, and China.
• An average of 7.7% of endpoints tried to access some malicious URLs in Q3 2022, slightly reduced from 8.3% in Q2.
• The country with the most clients experiencing malware detections in October 2022 was the United States with 22.1%, followed by Germany with 8.8% and Brazil with 7.8% which are very similar to the Q2 numbers, except for US and Germany which had a small increase, especially in financial trojans.
• Spam rates have increased by over 15% — reaching 30.6% of all inbound traffic.
• Email-borne attacks are targeting virtually all industries. By analyzing the top 50 most attacked organizations, it seems that the most attacked industries are:
  • Construction
  • Retail
  • Real estate
  • Professional Services (Services and computers & IT)
  • Finance
• Between July and October 2022, the proportion of phishing attacks has risen by 1.3x reaching 76% of all email attacks (up from 58% in H1 ‘2022). This rise is at the expense of the proportion of malware attacks.

Unpatched Vulnerabilities Prove Fruitful into the Second Half of the Year:

• Acronis continues to see and warn businesses and home users that new zero-day vulnerabilities and old unpatched ones are the top vectors of attack to compromise systems.
• While software vendors try to keep up and release patches regularly, quite often it is still not enough — a lot of attacks succeed due to unpatched vulnerabilities.
• Microsoft:
  • Another phishing campaign targeting Microsoft did impersonate “the Microsoft team” and tried to bait the recipients into adding their memo text onto an online memorial board “in memory of Her Majesty Queen Elizabeth II” when she passed away in September.

Another large-scale phishing campaign was spotted targeting credentials for Microsoft’s M365 email services. It is aimed at fin-tech, lending, accounting, insurance, and Federal Credit Union organizations in the US, UK, New Zealand, and Australia.

Veeam Software has released findings of the company’s fourth annual Data Protection Trends Report to better understand how data protection is evolving in a digital world.

Notable insights from the report include:

• Reliability and consistency (of protecting IaaS and SaaS alongside data center servers) are the key drivers for improving data protection in 2023. For organizations that are struggling to protect cloud-hosted data with legacy backup solutions, it is likely they will supplement their data center backup solution with IaaS/PaaS and/or SaaS capabilities.
• Ransomware is both the most common and most impactful cause of outages, alongside natural disasters (fire, flood, etc.) and user errors (overwrites, deletion, etc.). Organizations should implement backup and recovery solutions that support a holistic approach to data protection, and that can integrate with other cyber detection and remediation technologies to ensure comprehensive cyber resilience.
• Cloud-based services seem nearly inevitable for organizations of all sizes. But similar to how there isn’t just one type of production cloud, there isn’t just one protection cloud scenario. Organizations should consider cloud tiers for retention, Backup as a Service (BaaS), and ultimately, Disaster Recovery as a Service (DRaaS).

“IT leaders are facing a dual challenge. They are building and supporting increasingly complex hybrid environments, while the volume and sophistication of cyberattacks are increasing,” said Danny Allan, CTO and Senior Vice President of Product Strategy at Veeam. “This is a major concern as leaders think through how they mitigate and recover business operations from any type of disruption. Legacy backup approaches won’t address modern workloads – from IaaS and SaaS to containers – and result in an unreliable and slow recovery for the business when it’s needed most. This is what’s focusing the minds of IT leaders as they consider their cyber resiliency plan. They need Modern Data Protection.”

The report shows that data protection budgets are increasing. Globally, organizations expect to increase their data protection budget in 2023 by 6.5%, which is notably higher than overall spending plans in other areas of IT. Of the 85% of organizations planning on increasing their data protection budgets, their average planned increase is 8.3% and often in concert with increased investments in cybersecurity tools.

The Middle East and Africa market throw up some interesting findings:

Protection and Availability Gap in the MEA region

• 78% have an “Availability Gap” between how quickly they need systems to be recoverable and how quickly IT can bring them back
• 79% have a “Protection Gap” between how much data they can lose and how frequently IT protects their data

Ransomware in the MEA region

Ransomware attacks continue to be more frequent

• Only 14% experienced no ransomware attacks in 2022
• 18% experienced only one attack
• 48% experienced two or three attacks
• And 21% experienced four or more attacks in 2022
• 45% of organizations stated that ransomware (including both prevention and remediation) was their biggest hindrance to Digital Transformation or IT modernization initiatives, due to its burden on budgets and manpower
• When organizations were asked about their most significant attacks suffered in 2022:
  • 39% of their entire production data set was successfully encrypted or destroyed
  • Only 55% of the encrypted/destroyed data was recoverable

“Ransomware is indiscriminatory – every business is a target. Rather than be gripped with fear at the prospect of being attacked, organizations must focus on what they can control – their defence. The fundamental principles of how to prepare defences against even the most sophisticated and powerful ransomware stay relatively the same. The first is the practice of impeccable digital hygiene. All employees must be trained to identify suspicious content and be warned of the impact that malpractice using work devices can lead to. Secondly, all businesses must prepare for their defences to fail. Concepts such as zero trust and deploying techniques such as two-factor authentication can be useful for restricting the access an attacker has to data. The best way to protect data is to ensure that it has been securely backed up and is fully recoverable before an incident takes place with the 3-2-1-1-0 backup rule – there should always be at least three copies of data, on at least two different types of media, at least one off-site and one immutable or offline, with zero unverified backups or errors,” concludes Rizk.

Business Continuity and Disaster Recovery (BC/DR) initiatives in the MEA region

• Every facet of IT continues to be a candidate for cloudification, with data protection being a common scenario.
  • 84% of Middle East & Africa organizations anticipate using Backup as a Service (BaaS) or Disaster Recovery as a Service (DRaaS) to protect at least some of their servers over the next two years.
• That said, cloud-based storage is not misunderstood as the “tape killer” that early pundits tried to sell it as. When discussing the media used within their backup systems, the Middle East & Africa organizations reported that in addition to disk-based protection:
  • 64% of production data is stored in a cloud at some point in its lifecycle
  • 52% of production data is stored on a tape at some point in its lifecycle
• 86% organizations consider their cyber and (traditional) BC/DR initiatives to be either mostly or completely integrated. To achieve that among organizations in the Middle East & Africa:
  • 41% want to orchestrate recovery workflows, instead of relying on manual processes
  • 25% will leverage on-premises infrastructures for their BC/DR
  • 41% will leverage cloud infrastructures for their BC/DR, using IaaS or DRaaS

“It is no surprise that BaaS and DRaaS are becoming so popular among regional organizations. They provide viable alternatives to managing everything. It can be more cost effective to outsource backup and disaster recovery needs instead of hiring and training in-house resources. A BaaS provider can ensure backups are not only successful but regularly tested and restorable. A DRaaS provider can support with as little as an off-site replication or fully manage your complete disaster recovery plan from testing and execution to failing over and failing back, should an unplanned event occur,” comments Rizk.

“Veeam understands these changing market dynamics and data protection needs of enterprises today. From critical workloads running on-premises to the sprawl of data in the cloud and at home offices, Veeam-powered BaaS and DRaaS service provider partners offer the off‑site backup, monitoring and management, and disaster recovery services organizations need to stay resilient in the face of any threat.”