Opening Unknown Emails Can Install Malware In Your PC; How To Stay Safe

A threat intelligence team named Unit 42 has released a report on the malware that managed to avoid the firewall of 56 known antivirus products. As per the team, the pattern of the malware’s build and packaging is similar to the techniques of the APT29 threat group. This group is associated with Russia’s Foreign Intelligence Service (SVR), indicating a nation-state affair.

 

Malware Disguised As ISO File

As per Unit 42, the malware first came to light in May this year, and it was found hidden in a strange file type -- ISO, a disk image file. The file contains a malicious payload that the team believes was built with the help of a tool known as Brute Ratel (BRC4). 

This ISO file is disguised as a resume of a person named Roshan Bandara. When it reaches the recipient’s email box, it doesn’t do anything, but when the recipient clicks on it, they can see a Windows drive with a file “Roshan-Bandara_CV_Dialog.” As the file appears to be a typical MS Word file, users can fall prey to it and click on it, which results in the installation of BRC4.

Is It A State-Backed Cyberattack?

Depending on what the attackers have planned, anything can happen to the recipient’s PC. According to Unit 42, finding this malware is concerning as it’s probably linked to APT29. Besides, the links suggest that it is a state-backed cyberattack and is deployed at a vulnerable time. 

Moreover, the undetectability of the malware is concerning. Creating malware that is so stealthy requires a lot of work, and it suggests that such attacks can be a huge threat when used by people with nefarious intentions.

How To Stay Safe From Malware?

Since cyberattacks have been on the rise in recent times, users have become more conscious of the consequences of trusting random people. However, these cyber attacks can hit users from anywhere and in any form. So here’s how to stay safe from them.

Firstly, it’s imperative to understand that these large-scale cyberattacks are created to target organizations and not individuals. However, in cases where an ISO file is hiding under the disguise of a resume, it’s likely to be opened by people in different HR settings.

Keeping that in mind, it’s good to avoid attachments from unknown senders. It might be difficult for the HR department that actively gets resumes for job applications, but as an individual users should avoid such emails. Well, the best way to stay safe could be browsing carefully and not visiting websites that look fishy and can be harmful.