{"id":6825,"date":"2024-03-12T11:36:17","date_gmt":"2024-03-12T09:36:17","guid":{"rendered":"https:\/\/blog.eset.ee\/?p=6825"},"modified":"2024-03-12T11:40:16","modified_gmt":"2024-03-12T09:40:16","slug":"when-an-employees-social-mindset-becomes-a-threat-to-business","status":"publish","type":"post","link":"https:\/\/blog.eset.ee\/et\/en\/2024\/03\/12\/when-an-employees-social-mindset-becomes-a-threat-to-business\/","title":{"rendered":"When an employee\u2019s social mindset becomes a threat to business"},"content":{"rendered":"\n

As our lives settle ever deeper into online environments and digital behaviors, cybercriminals are leveraging new vectors that allow for phishing, data theft, and spreading malware. Recent incidents show that mixing people\u2019s professional and personal minds (an ever-present human factor) can create new weaknesses in a business\u2019s cybersecurity.  <\/p>\n\n\n\n

Imagine your employees browsing their favorite social media platform on their personal time; they might find an interesting picture or emoji and its embedded link, which they then share \u2014 no one would mind such a distraction. Now, imagine your employees checking their various professional chats and threads; something between their personal and professional interests sparks their minds. Hence, they react by sharing an article, an interesting picture, or an emoji and its embedded link. This time, they share with their colleagues on a cloud-based platform such as Microsoft Teams . . . just for fun or even for professional inspiration. 

A pretty common thing in an office, right? Well, bad actors can abuse even these everyday activities. Putting it simply, behaviors common to navigating and enjoying social media platforms can raise risks for business platforms, which have now become ubiquitous for small and medium businesses (SMBs) and enterprises alike.
Fortunately, multilayered ESET cybersecurity technology has an answer for such incidents with ESET Cloud Office Security (ECOS), which is now expanding beyond Microsoft 365 applications to include the Google Workspace.<\/p>\n\n\n\n

\"\"
Image 1. ECOS Dashboard with an overview of protected apps <\/figcaption><\/figure>\n\n\n\n

Sharing reports, jokes, and malware <\/h3>\n\n\n\n

Let\u2019s start with weaponized pictures, GIFs, and emojis. The technique of concealing a file, message, image, or video within another file, message, image, or video is called digital steganography<\/a>, and it is nothing new in cybersecurity. <\/p>\n\n\n\n

The first documented case of its use in a cyberattack dates back to 2011, when the Duqu<\/a> malware was discovered. This malware gathers data about the infected device and transmits them back to the command-and-control (C&C) server hidden in a JPEG file meant to look like an innocent picture.  <\/p>\n\n\n\n

Since then, ESET researchers<\/a> have analyzed numerous similar attacks. <\/p>\n\n\n\n

In 2022, BleepingComputer reported about a new attack technique called GIFShell<\/a> that allows threat actors to abuse Microsoft Teams for phishing attacks and executing commands to steal data using GIFs.<\/p>\n\n\n\n

Using numerous Teams vulnerabilities, GIFShell allows an attacker to create a reverse shell. This technique tricks users into installing malware that connects the victim\u2019s device to the attacker\u2019s command-and-control server. After the connection is established, the command-and-control server delivers malicious commands via weaponized GIFs in Teams. These commands can, for example, scan the device for sensitive data and then exfiltrate the output, again, through GIFs retrieved by Microsoft\u2019s own infrastructure.<\/p>\n\n\n\n

Large cloud-based platforms like Microsoft 365 with its Teams app saw rapid growth during the pandemic and, by Q1 2023, had approximately 280 million users. With such growth and new online behaviors, the scope for abuse on large platforms has only grown. 

However, increasing attention has been shown to these threat vectors by researchers. In June 2023, UK-based security services provider Jumpsec’s<\/a> Red Team discovered an easy way to deliver malware using Microsoft Teams<\/a> via an account outside the target organization. Even though Microsoft Teams has client-side protection preventing file delivery from external sources, Red Team\u2019s members bypassed it by changing the internal and external recipient ID in the POST request of a message. <\/p>\n\n\n\n

That way, researchers were able to fool the system into thinking that an external user was, in fact, an internal account. Specifically, they successfully delivered a command-and-control payload into a target organization\u2019s inbox. If this attack had happened in a real-life environment, bad actors could have taken over the control of a business\u2019s devices.<\/p>\n\n\n\n

Users shielded via multilayered protection <\/h3>\n\n\n\n

To deal with threats coming from increasingly popular cloud-based applications, ESET created its Cloud Office Security (ECOS)<\/a> solution. It is a powerful combination of spam filtering, anti\u2011malware scanning, anti\u2011phishing, and advanced threat defense capabilities able to mitigate even never-before-seen threat types.<\/p>\n\n\n\n

With this multitenant and scalable product, businesses can protect their entire Office 365 suite, including Exchange Online, MS Teams, OneDrive, and SharePoint Online. For example, one of the things that ECOS does is that it scans all files transmitted through MS Teams and those uploaded or downloaded to SharePoint Online, scanning it regardless of who the author of the content is.<\/p>\n\n\n\n

ECOS effectivity in numbers: <\/strong><\/h4>\n\n\n\n