Author: Madalynn Carr, Intelligence Team

Modern enterprise environments make use of multiple tools such as Secure Email Gateways (SEGs) and Endpoint Detection and Response (EDR) solutions to prevent malware from getting onto a user’s device. However, many of these protection measures have flaws that threat actors often take advantage of. One of the easiest ways for threat actors to bypass many of these protections is by putting malware inside certain types of archives. Notably, since November of 2023, Cofense has seen an increase in the use of attached archives other than .zips. This is greatly contributed to by Windows building native support to unarchive a wider variety of archive files in November of 2023. These files include .rar, .7z, .tar, and .gz archives. There are other archive formats, which will be covered briefly in this report, however the main emphasis will be on the most popular file extensions threat actors use, such as .zip archives as well as the relatively new native Windows archives, as Cofense has witnessed a higher volume with these formats.

Overview

There are a few key items to note regarding this report. This data is between May 2023 and May 2024, which allows a clearer analysis on the impact regarding Windows building in native support for more archived formats, which occurred in November 2023. Another major factor to take into consideration is that the data acquired contains the perceived archive file based on the file extension. Some threat actors would label their archive as one format, while the true file is actually a different archiving format. This is a very common tactic used by threat actors, and this is likely a tactic threat actors use to bypass SEGs. Some tools can help determine the actual archive file format. However, not all SEGs and EDR use such tools, and by using the wrong extraction format, the archive file will fail to extract its contents. Lastly, this report is only analyzing attached archive files which have bypassed SEGs as seen by Cofense Intelligence. This is reflected in the data, as the majority of company employees use Windows, and therefore there will be more focus on archived files and malware which are compatible with Windows infrastructure and programs. Figure 1 shows a Venn diagram including examples of different archived files and which operating system natively supports unpacking the file. This is not a complete Venn diagram; however, this helps aid understanding as to why a threat actor may use a specific archived file.

Figure 1: Venn diagram showing commonly used archives that are natively supported on Windows and Unix-Based (including Mac) operating systems as of November 2023.

Threat actors will purposefully decide on the archive format to use depending on the malware, which is discussed in more detail later. Certain aspects, such as which archive file type to use, may be due to the way the threat actor bought the malware or the distribution method they chose. Threat actors, especially threat actors that are inexperienced, typically buy malware and distribution methods for that malware from the dark web or other threat actors, and the only aspects they need to change is the Command and Control (C2) locations.

During this time frame, a total of 15 different archive formats were seen being used at Cofense. Although .zip files take up 50% of the overall archives being used, many other archive formats have also been used. Figure 2 depicts the top archive extensions, excluding .zip files. The popular archive files of .img, .tar, .rar, .7z, and .gz make up more than 50% of the remaining top archives seen. However, most of these would be far less common without Windows building in native support for these archiving formats. The only outlier is the .img archived files, which will be later explained in this report.

Figure 2: Pie graph showing the vast number of different archives seen being used in SEG protected environments by Cofense between May 2023 and May 2024.

.zip Files

The most common archive type seen between the date range was .zip files, which accounted for just over 50% of all archived files. This may come as a surprise, since one may assume that .zip archives would not bypass SEGs. However, this archive format is not only one of the oldest and most popular archive formats, yet it is also one of the most versatile, as nearly every operating system natively supports this format. It is also a main component in other necessary file formats, such as Open Document Formats (ODFs) and Java Archives (JARs). This can explain why .zip archives are not only the most common while delivering malware, yet it is also the most common archive in general, as the public also widely uses this archiving format. They are also very easy to password protect which allows them to bypass many SEGs with minimal effort.

Over the course of the date range, .zip files have always been a popular archive choice for threat actors. Figure 3 shows how many perceived .zip files were seen as attachments in SEG protected environments during the date range. Other than the expected drop in December, .zip files have always been common. The reason for the expected drop in December is due to threat actors typically taking time off during the holidays and fewer employees being in the office, therefore providing fewer targets for threat actors. Despite other file formats becoming popular, which will be further explained in the next section, .zip files do not seem to be declining.

Figure 3: Line graph showing how many attached .zip archive files Cofense has witnessed in SEG protected environments between May 2023 and May 2024.

Newly Native Microsoft Archive Files

On October 31^st, 2023, Microsoft rolled out an update labelled KB5031455, which allowed native support to extract contents out of .rar, .gz, .7z, and .tar archives, along with a few more uncommon archive formats, such as .bz and .xz archives. This has caused an increase in attached archives using these file extensions, as very few archives using these extensions were seen in SEG protected environments prior to October 2023. Threat actors typically target Windows machines since many businesses use Windows, which explains the increase in volume regarding these archives. Figure 4 shows another line graph representing how many of these file formats combined were observed by Cofense in SEG protected environments. Between May 2023 and October 2023, there was a large spike of these files during the summer, yet the other months saw minimal amounts of these file extensions. However, when October and November 2023 came around with the new Windows update being released, more threat actors used the new supported archived files. There was an expected drop in December, and all throughout 2024, with a spike in January and a low yet consistent flow of these archive files. Although .zip file archives are very popular, the archived files which are now natively supported by Microsoft have been more frequently used by threat actors.

Figure 4: Line graph showing the percentage of how many .rar, .gz, .7z, .bz, .xz, and .tar archive files combined Cofense has witnessed in SEG protected environments between May 2023 and May 2024.

Other Archived Formats

Although archives listed previously such as .zip, .rar, and .7z are very common, there are a few archives which are not often seen attached in emails. Figure 5 shows the 7 other archive formats Cofense had seen in SEG protected environments from May 2023 to May 2024.

Figure 5: Pie graph showing the other perceived archive formats delivered via an attachment which delivered malware in a SEG protected environment between May 2023 and May 2024.

Even though these account for a miniscule amount of the data, it is important to take note as to why these are less often seen attached to emails. Other archived formats were seen, however these were not added to Figure 5, as these archives were rarely seen. Specifically, .vhd, .img, and .zpaq files are often seen as downloadable files from embedded links or other mechanisms, rather than attachments. Another archived file to note is .img files, which closely resemble .iso files. These files are also typically used as backup for other programs or operating systems. The fact that many of these file formats are not often seen being delivered via email could be due to a few reasons, however the largest reason could be because many SEGs should and do block these attachment files, since there is little reason as to why SEGs should allow these files to be delivered into inboxes.

Other well-known archived files were not seen in significant numbers, and this can be due to SEGs blocking these files as they are not transferred often via emails. For example, .iso files are an archive that is supposed to contain a virtual optical disk. These files are often used to backup data on computers, and therefore there would not be much reason to send these files via email. However, computers would not view these files as malicious solely due to the file extension, as it is a very common file type on certain operating systems. Another example is .arj files, which were one of the most popular archiving formats in the 1990s, until .zip and .rar files began to appear and become more common. This is why threat actors prefer to deliver these through different delivery mechanisms, rather than as a straight attachment.

Malware Families with Specific Archives

Malware families have been seen in patterns, where although they are not part of the same campaign, they have similar traits, such as being delivered with certain kinds of archives. This specific data range analyzes over a dozen different malware families. Figure 6 shows a graph with the top 10 malware families seen, meanwhile Figure 7 shows the malware types in a bar graph, displaying which malware types are typically delivered. These were all within the May 2023 to May 2024 date range and are only applied towards SEG-protected environments.

Figure 6: Graph representing the top 10 malware families Cofense observed between May 2023 and May 2024 which were delivered via an attached archive to a SEG protected environment.

As mentioned previously, campaigns delivering malware are distinguished by different traits, such as having a specific delivery mechanism associated with the malware family as an example. One highly notable malware family seen in this graph is StrelaStealer, which was first observed by Cofense in July of 2022. One key feature of this malware is that it is delivered solely by .zip archived files. Another noticeable aspect in Figure 6 is NetSupport RAT, which was also all delivered only through .zip files.

<

p style=”text-align: center”>Figure 7: Bar graph representing the amount of each malware type which was delivered via an attached archive to a SEG protected environment between May 2023 and May 2024.

Regarding the malware types, primarily Information Stealers and Remote Access Trojans (RATs) have been seen being delivered via an archived file. However, these are the most common malware types in general, so this data is to be expected. Many malware families have been observed to be delivered using attached archives, even if they are not in the same campaign, and this can be seen in both Figure 6 and Figure 7.

Password-Protected Archives

A typical way many threat actors will bypass SEGs is by password-protecting their archives. Although the password is typically in the same email as the archive, most SEGs, even AI and ML driven SEGs, are not technologically advanced enough to distinguish the password from the lure text of the email. Because of this, many threat actors can get their malware into inboxes by utilizing password protection. About 5% of all attached archives were password protected. This may indicate that SEGs have been better able to detect suspicious emails with the password attached in the email. However, this low percentage could also be due to the majority of password-protected archives being delivered via an embedded URL, with the password being contained in the email.