The latest attack from the Cobalt Gang targeting banking institutions used specific tactics to ensure AV doesn’t detect the malicious PDF at the heart of the attack.
Antivirus engines are designed to scan documents looking for anything malicious and, more recently, anything out of the ordinary. But when cybercriminals take the time to figure out what looks “normal” to AV engines, it’s tough to spot the malicious.
That’s exactly what happened with the latest attack from the Cobalt Gang – an organized cybercrime group focused on stealing money from banks and financial institutions. Cobalt designed a PDF-based attack that used no malicious code (e.g. JavaScript) and was crafted to look like a legitimate PDF file – complete with multiple pages of text.
Instead, the PDF attachment, used as part of a social engineering scam, used an embedded link within the document that redirected recipients to a legitimate Google location which, in turn, redirected the browser to a Microsoft Word document containing malicious macros.
Due to the meticulous work put into the PDF document, matched with the use of redirections, all before introducing the malicious code, Cobalt was able to avoid being detected by AV solutions, putting banking and financial institutions at risk.
So, what’s the lesson learned?
Simple: You can’t assume that just because you have AV (or any other solution designed to detect malicious files, links, and the like) in place, you’re protected. Instead, users should be conscious of how unusual it is to open a PDF, click a link, be redirected, automatically open a Word doc, and be asked to enable macros. This kind of thinking only comes from education. IT gets it over time from their everyday work, but users require formal education in the form of Security Awareness Training. By putting users through continual training – along with phishing testing – they become mindful of what scams, hacks, and social engineering look like, and can spot them a mile away.
Cobalt figured out how to fool AV. But with properly educated users, cybercriminals will need a lot more than just a multi-page PDF to see their attacks be successful.
