Telltale sign

Kahng An, a member of the Cofense Intelligence Team, said in an email interview that there’s a tell-tale sign of this kind of attack: “In general, virtual hard drive files are expected to be fairly large as they are intended to be storage volumes for large amounts of information,” he wrote. As a result, “particularly small virtual hard drive files should be treated with suspicion as they are likely not being used appropriately. Email typically isn’t a good medium for large file transfers either, so an attached virtual hard drive file should also be treated with suspicion regardless of its size.

“From a mitigation standpoint, it might be worth removing file associations for various virtual hard drive file extensions such as .vhd and .iso from most users’ workstations. The average user in an organization probably won’t ever have a legitimate reason to need to use virtual hard drive files, and those who do need access to them could have file associations restored as needed.”

So far this year, Cofense has seen threat actors use email campaigns containing virtual hard drives sent to several of its business customers. They included emails sent in May to employees at an unnamed bank with the subject line “2023 Tax supporting Documents.”