• Skip to primary navigation
  • Skip to main content
  • Skip to primary sidebar
  • Skip to footer

My TechDecisions

  • Best of Tech Decisions
  • Topics
    • Video
    • Audio
    • Mobility
    • Unified Communications
    • IT Infrastructure
    • Network Security
    • Physical Security
    • Facility
    • Compliance
  • RFP Resources
  • Resources
  • Podcasts
  • Subscribe
  • Project of the Week
  • About Us
    SEARCH
IT Infrastructure, Network Security, News

HP: Archive File Format Use Among Hackers on the Rise

Archive files such as ZIP and RAR files are the file type of choice for malware delivery, according to a new report from HP Wolf Security.

December 5, 2022 Zachary Comeau Leave a Comment

Malware file types, HP Wolf security

Office files are no longer the most common file type for delivering malware, as archive file formats such as ZIP and RAR files are the file type of choice for threat actors to deliver malware, according to a new report from HP Wolf Security.

The findings come from a quarterly report from HP’s endpoint security division, which found that 44% of malware was delivered inside archive files, an 11% rise from the previous quarter. In comparison, 32% of malware was delivered through Microsoft Office files such as Word, Excel and PowerPoint.

HP Wolf Security’s report identifies several campaigns that were combining the use of archive files with new HTML smuggling techniques, which is when cybercriminals embed malicious archive files into HTML files to bypass email gateways.

For example, recent QakBot and IceID campaigns used HTML files to direct users to fake online document viewers masquerading as Adobe. Users were instructed to open a ZIP file and enter a password to unpack the files, which then deployed malware on their PCs, the company says.

The malware within the original HTML file is encoded and decrypted, making detection by email gateway and other email security tools challenging. The attacker relies on social engineering and creates a well-designed website to fool users into initiating the attack by opening the malicious ZIP file, according to HP Wolf Security.

Alex Holland, a senior malware analyst on HP Wolf Security’s threat research team, says archives are easy to encrypt and help conceal malware and avoid detection.

“This makes attacks difficult to detect, especially when combined with HTML smuggling techniques,” Holland says. “What was interesting with the QakBot and IceID campaigns was the effort put in to creating the fake pages – these campaigns were more convincing than what we’ve seen before, making it hard for people to know what files they can and can’t trust,”

The company also identified a complex campaign leveraging a modular infection chain that could enable attackers to change the payload mid campaign, potentially allowing them to change between spyware, ransomware or keyloggers midcampaign. This could also allow the introduction of new features, such as geo-fencing.

By not including malware directly in an email attachment, this could also help attackers evade detection by email security tools.

Dr. Ian Pratt, global head of security for personal systems at HP, says attackers are constantly changing their techniques and making it difficult for detection tools to spot.

“By following the Zero Trust principle of fine-grained isolation, organizations can use micro-virtualization to make sure potentially malicious tasks – like clicking on links or opening malicious attachments – are executed in a disposable virtual machine separated from the underlying systems,” Pratt says. “This process is completely invisible to the user, and traps any malware hidden within, making sure attackers have no access to sensitive data and preventing them from gaining access and moving laterally.”

Tagged With: Cybersecurity, HP, HP Wolf Security, Malware

Related Content:

  • Microsoft Loop IT What You Need to Know About Microsoft Loop
  • YAMAHA UC ADECIA Yealink Yamaha UC Partners With Yealink for Audio &…
  • Microsoft, ChatGPT, GPT-4, GPT-3.5 What’s New With ChatGPT and Generative AI This…
  • CISA Ransomware CISA Wants You To Report Anything You Know…

Free downloadable guide you may like:

  • Four IT Trends That Will Define 2023Expert Series: Four IT Trends That Will Define 2023

    Learn about four key technologies we identified as critical to your IT organization’s success in 2023, as well as how to invest in new innovations emerging from each.

Reader Interactions

Leave a Reply Cancel reply

Your email address will not be published. Required fields are marked *

Get the FREE Tech Decisions eNewsletter

Sign up Today!

Latest Downloads

Four IT Trends That Will Define 2023
Expert Series: Four IT Trends That Will Define 2023

Learn about four key technologies we identified as critical to your IT organization’s success in 2023, as well as how to invest in new innovations ...

Harnessing the Power of Digital Signage
Harnessing the Power of Digital Signage

Choosing the best solutions for messaging, branding, and communicating in today’s content-everywhere landscape

Blueprint Series Cover: What works for hybrid work
Blueprint Series: What Works for Hybrid Work

Download this free resource to learn about how IT leaders can effectively manage and implement a hybrid work model.

View All Downloads

Would you like your latest project featured on TechDecisions as Project of the Week?

Apply Today!
Sharp Microsoft Collaboration HQ Logo

Learn More About the
Windows Collaboration Display

More from Our Sister Publications

Get the latest news about AV integrators and Security installers from our sister publications:

Commercial IntegratorSecurity Sales

AV-iQ

Footer

TechDecisions

  • Home
  • Welcome to TechDecisions
  • Subscribe to the Newsletter
  • Contact Us
  • Media Solutions & Advertising
  • Comment Guidelines
  • RSS Feeds
  • Twitter
  • Facebook
  • Linkedin

Free Technology Guides

FREE Downloadable resources from TechDecisions provide timely insight into the issues that IT, A/V, and Security end-users, managers, and decision makers are facing in commercial, corporate, education, institutional, and other vertical markets

View all Guides
TD Project of the Week

Get your latest project featured on TechDecisions Project of the Week. Submit your work once and it will be eligible for all upcoming weeks.

Enter Today!
Emerald Logo
ABOUTCAREERSAUTHORIZED SERVICE PROVIDERSTERMS OF USEPRIVACY POLICY

© 2023 Emerald X, LLC. All rights reserved.