Attackers strike once again in an interesting and obscure way at end users of secure email gateways. These gateways are made to scan through emails to filter out spam and malicious content, but attackers have found a way to trick the gateways. By creating a dual archive in a single zip file, they were able to bypass security measures by tricking the gateway into extracting the first archive that had no harmful content, while ignoring the secondary archive with a malicious RAT. The only problem with this approach is that not all archiving utilities will be able to extract the RAT properly, therefore greatly diminishing the malware’s effectiveness.

Specially Crafted ZIP Files Used to Bypass Secure Email Gateways

Topic