Cyber Defense eMagazine March Edition for 2022

content to the endpoint by adapting to the targeted environment. Since July of last year, our research
team has seen a 224% increase in HEAT attacks.
Given that many of us now spend around three-quarters of our day using a web browser, it’s an obvious
target.
HEAT attacks leverage one or more of the following core techniques that bypass legacy network security
defences:
1. Evades both static and dynamic content inspection: HEAT attacks evade both signature and
behavioural analysis engines to deliver malicious payloads to the victim using innovative techniques,
such as HTML Smuggling. This technique was used by Nobelium the hacking group behind the
SolarWinds ransomware attack. In a recent case, dubbed ISOMorph, the campaign used the popular
Discord messaging app to host malicious payloads. Menlo Labs identified over 27,000 malware attacks,
which were delivered using HTML Smuggling within the last 90 days.
2. Evades malicious link analysis: These threats evade malicious link analysis engines traditionally
implemented in the email path where links can be analysed before arriving at the user.
3. Evades offline categorisation and threat detection: HEAT attacks evade web categorisation by
delivering malware from benign websites, either by compromising them, or patiently creating new ones.
Referred to as Good2Bad websites. Menlo Labs has been tracking an active threat campaign dubbed
SolarMarker, which employs SEO poisoning. The campaign started by compromising a large set of low
popularity websites that had been categorised as benign, infecting these websites with malicious content.
Good2Bad websites have increased 137% year-over-year from 2020 to 2021.
4. Evades HTTP Traffic Inspection: In a HEAT attack, malicious content such as browser exploits,
crypto-mining code, phishing kit code and images impersonating known brands’ logos is generated by
JavaScript in the browser by its rendering engine, making any detection technique useless. The top three
brands impersonated in phishing attacks are Microsoft, PayPal, and Amazon. A new phishing website
imitating one of these brands is created every 1.7 minutes.
The case for Zero Trust and SASE
Be it file inspections performed by SWG anti-virus engines and sandboxes, network and HTTP-level
inspections, malicious link analysis, offline domain analysis, or indicator of compromise (IOC) feeds,
many legacy defences are rendered near useless when confronted with these evasive techniques.
A significant part of the challenge lies in the fact that HEAT characteristics equally have genuine uses.
Therefore, they cannot simply be blocked at the function level. Rather, they need to be prevented.
To achieve this, a shift in mindset and an updated security posture is required. Trying to overcome the
challenges of web security with endpoint security creates a square peg in a round hole scenario – it
simply does not guarantee protection.
Cyber Defense eMagazine – March 2022 Edition 104
Copyright © 2022, Cyber Defense Magazine. All rights reserved worldwide.