Cybercrime is a business that shares the same goals as an enterprise —increase return on investment (ROI). Cybercriminals are constantly evolving and shaping their business models to more effectively track the success rates of their attack techniques in order to best measure the success of their campaigns.
Proofpoint researchers have recently discovered a new image-tracking technique that malicious macro writers are using. The simple technique gives the macro developer and threat actor a cost-effective way to view how frequently the macro was executed and thus measure the effectiveness of their campaigns.
In addition to this, recent image-tracking statistics confirm that the attackers have delivered a ten-fold increase in effectiveness at evading standard email defenses, and that they are greater than 70% successful at actually installing the malware payload and infecting the target client.
Proofpoint discusses the full findings of their discovery in a new blog, however key highlights include:
Since at least February 2015, malicious macro writers have been using an image-tracking technique to measure the success of their malware. The tracking technique works when malware on a target system downloads a specific picture from a public picture-hosting service, making it possible for the attacker to generate and view statistics on how many times the image was downloaded. This simple technique gives the macro developer and attacker an easy and cost-effective way to measure the number of times their malware is triggered and installed.
Recent image-tracking statistics confirm that the attackers have delivered a ten-fold increase in effectiveness at evading standard email defenses, and that they are greater than 70% successful at actually installing the malware payload and infecting the target client. Not only is this vital threat intelligence for security researchers and practitioners; it is also essential business intelligence for threat actors who are evaluating the success of their campaigns, and for malicious macro developers who are eager to demonstrate the ROI of their campaigns and drive future business.