HP Inc. has issued its quarterly HP Wolf Security Threat Insights Report, showing that thriving cybercriminal marketplaces are offering low-level attackers the tools needed to bypass detection and infect users.

Based on data from millions of endpoints running HP Wolf Security, key findings include:

• Houdini's Last Act: A new campaign targeted businesses with fake shipping documents concealing Vjw0rm JavaScript malware. Its obfuscated code allowed the malware to slip past email defenses and reach endpoints. The analyzed attack delivered Houdini, a 10-year-old VBScript RAT. This shows that, with the right prepackaged tools from cybercrime marketplaces, hackers can still use vintage malware effectively by abusing the scripting features built into operating systems.
• Cybercriminals Deploy "Jekyll and Hyde" Attacks: HP discovered a Parallax RAT campaign launching two threads when a user opens a malicious scanned invoice designed to trick users. The "Jekyll" thread opens a decoy invoice copied from a legitimate online template, reducing suspicion, while the "Hyde" runs the malware in the background. This attack would be easy for threat actors to carry out, as prepackaged Parallax kits have been advertised on hacking forums for $65 USD per month.

"Threat actors today can easily purchase prepackaged, user-friendly malware 'meal kits,' that infect systems with a single click," said Alex Holland, senior malware analyst, HP Wolf Security threat research team. "Instead of creating their own tools, low-level cybercriminals can access kits that use living-off-the-land tactics. These stealthy in-memory attacks are often harder to detect due to security tool exclusions for admin use, like automation."

HP also identified attackers are "hazing" aspiring cybercriminals by hosting fake malware building kits on code sharing platforms like GitHub. These malicious code repositories trick wannabe threat actors into infecting their own machines. One popular malware kit, XWorm, is advertised on underground markets for as much as $500 USD, driving resource-strapped cybercriminals to buy fake cracked versions.

By isolating threats that have evaded detection tools on PCs — but still allowing malware to detonate safely — HP Wolf Security has specific insight into the latest techniques used by cybercriminals in the fast-changing cybercrime landscape. To date, HP Wolf Security customers have clicked on more than 30 billion email attachments, web pages and downloaded files with no reported breaches.

The report details how cybercriminals continue to diversify attack methods to bypass security policies and detection tools. Other findings include:

• Archives were the most popular malware delivery type for the sixth quarter running, used in 36% of cases analyzed by HP.
• Despite being disabled by default, macro-enabled Excel add-in threats (.xlam) rose to the 7th most popular file extension abused by attackers in Q3, up from 46th place in Q2. Q3 also saw malware campaigns abusing PowerPoint add-ins.
• At least 12% of email threats identified by HP Sure Click bypassed one or more email gateway scanner in both Q3 and Q2.
• Q3 saw an increase in attacks using exploits in Excel (91%) and Word (68%) formats.
• There was a 5%-point rise in PDF threats isolated by HP Wolf Security compared to Q2.
• The top threat vectors in Q3 were email (80%) and downloads from browsers (11%).

"While the tools for crafting stealthy attacks are readily available, threat actors still rely on the user clicking," Holland said. "To neutralize the risk of prepackaged malware kits, businesses should isolate high-risk activities, like opening email attachments, link clicks and downloads. This significantly minimizes the potential for a breach by reducing the attack surface."

HP Wolf Security runs risky tasks in isolated, hardware-enforced virtual machines running on the endpoint to protect users, without impacting their productivity. It also captures detailed traces of attempted infections. HP's application isolation technology mitigates threats that slip past other security tools and provides unique insights into intrusion techniques and threat actor behavior.

This data was gathered from consenting HP Wolf Security customers from July to September 2023.