WEBINAR | From Deal to Defense: Unifying Cybersecurity Post-M&A
Reduce Alert Noise and False Positives
Boost your team's productivity by cutting down alert noise and false positives.
Automate Security Operations
Boost efficiency, reduce burnout, and better manage risk through automation.
Dark Web Monitoring
Online protection tuned to the need of your business.
Maximize Existing Security Investments
Improve efficiencies from existing investments in security tools.
Move your security operations beyond the limitations of MDR.
Secure with Microsoft 365 E5
Boost the power of Microsoft 365 E5 security.
Secure Multi-Cloud Environments
Improve cloud security and overcome complexity across multi-cloud environments.
Secure Mergers and Acquisitions
Control cyber risk for business acquisitions and dispersed business units.
Solve security operations challenges affecting critical operational technology (OT) infrastructure.
Force-Multiply Your Security Operations
Whether you’re just starting your security journey, need to up your game, or you’re not happy with an existing service, we can help you to achieve your security goals.
Detection Investigation Response
Modernize Detection, Investigation, Response with a Security Operations Platform.
Locate and eliminate lurking threats with ReliaQuest GreyMatter
Find cyber threats that have evaded your defenses.
Security metrics to manage and improve security operations.
Breach and Attack Simulation
GreyMatter Verify is ReliaQuest’s automated breach and attack simulation capability.
Digital Risk Protection
Continuous monitoring of open, deep, and dark web sources to identify threats.
GreyMatter Phishing Analyzer removes the abuse mailbox management by automating the DIR process for you.
The GreyMatter cloud-native Open XDR platform integrates with a fast-growing number of market-leading technologies.
Unify and Optimize Your Security Operations
ReliaQuest GreyMatter is a security operations platform built on an open XDR architecture and designed to help security teams increase visibility, reduce complexity, and manage risk across their security tools, including on-premises, clouds, networks, and endpoints.
Brands of the world trust ReliaQuest to achieve their security goals.
Learn how to achieve your security outcomes faster with ReliaQuest GreyMatter.
The latest security trends and perspectives to help inform your security operations.
Industry Guides and Reports
The latest security research and industry reports.
Catch up on the latest cybersecurity podcasts, and mindset moments from our very own mental performance coaches.
A deep dive on how ReliaQuest GreyMatter addresses security challenges.
The latest white papers focused on security operations strategy, technology & insight.
Current and future SOC trends presented by our security experts.
Events & Webinars
Explore all upcoming company events, in-person and on-demand webinars
From prevention techniques to emerging security trends, our comprehensive library can arm you with the tools you need to improve your security posture.
Get the latest threat analysis from the ReliaQuest Threat Research Team. ReliaQuest ShadowTalk Weekly podcast featuring discussions on the latest cybersecurity news and threat research.
ReliaQuest's ShadowTalk is a weekly podcast featuring discussions on the latest cybersecurity news and threat research. ShadowTalk's hosts come from threat intelligence, threat hunting, security research, and leadership backgrounds providing practical perspectives on the week's top cybersecurity stories.
February 20, 2024
We bring our best attitude, energy and effort to everything we do, every day, to make security possible.
Security is a team sport.
No Show Dogs Podcast
Mental Performance Coaches Derin McMains and Dr. Nicole Detling interview world-class performers across multiple industries.
Make It Possible
Make It Possible reflects our focus on bringing cybersecurity awareness to our communities and enabling the next generation of cybersecurity professionals.
Join our world-class team.
Press and Media Coverage
ReliaQuest newsroom covering the latest press release and media coverage.
Become a Channel Partner
When you partner with ReliaQuest, you help deliver world-class cybersecurity solutions.
How can we help you?
A Mindset Like No Other in the Industry
Many companies tout their cultures; at ReliaQuest, we share a mindset. We focus on four values every day to make security possible: being accountable, helpful, adaptable, and focused. These values drive development of our platform, relationships with our customers and partners, and further the ReliaQuest promise of security confidence across our customers and our own teams.
Welcome to the third blog in a series designed to accompany the launch of ReliaQuest’s new, globally available GreyMatter Phishing Analyzer (GMPA)—which facilitates automated, efficient analysis of potential malicious emails. To support the launch, and provide that all-important context and threat intelligence about phishing and its impact on defenders, the ReliaQuest Photon Research team recently published a piece looking at phishing campaigns orchestrated by the initial access broker “Exotic Lily.” Prior to that, we released an overview of a popular technique called HTML smuggling, which threat actors use to deploy remote-access trojans (RATs), banking malware, and other malicious payloads. Although HTML smuggling is not new, adversaries are still using the methodology because of its continued effectiveness and because the topic appears frequently on cybercriminal forums that threat actors use to learn about new attack methods. In this blog, we’ll look at examples of cybercriminal forum chatter about HTML smuggling and the ways in which users seek to push the boundaries even further and develop alternatives to the technique.
One of the reasons for the continued popularity of cybercriminal forums—despite their outdated technology and obvious operational security risks—is that they provide a way for threat actors to ask for help and to crowd-source solutions to their problems. Forum sections dedicated to phishing and spamming are often some of the most popular on these platforms, with users advertising phishing and spamming services, providing tutorials, sharing email databases, or seeking guidance on ensuring emails land in inboxes and not junk folders. We’ve repeatedly observed cybercriminals discussing the advantages of using HTML smuggling to conduct phishing campaigns, with users describing the technique and sharing technical articles about different variations of the methodology.
For example, a post on a prominent Russian-language cybercriminal forum, from January 2023, recommended using “a combination” of redirects, encoding, and HTML smuggling to “protect” a “scampage” from a “red flag;” i.e., so that the phishing email ends up where it should. (See Figure 1 below.)
On another forum, in September 2022, a user sought methods to “spread” a malicious link “over email.” A respondent suggested using HTML smuggling combined with the XOR Cipher encryption method. Other users immediately expressed interest, requesting tutorials for the technique, sharing related articles and guides, and exploring variations to the methodology. (See Figure 2 below.)
“QakBot” spam campaigns leveraging malicious OneNote files have been in the news a lot lately. These types of attacks use Microsoft’s OneNote to deliver malware that grants initial access to a victim system. Our research across the cybercriminal underground revealed users on multiple dark-web forums sharing information and articles about QakBot’s operators using HTML smuggling techniques to deliver malware using SVG images embedded in HTML email attachments towards the end of last year (see Figure 3). Media articles like this tend to generate discussion and further TTP development on cybercriminal platforms; forum users may be inspired by the QakBot operators’ example to find further uses for HTML smuggling techniques.
HTML smuggling appears to be such an established methodology among the cybercriminal community that threat actors have even started to take the next step, building on this technique and searching for alternatives in case defenders have wised up. We noted an advertisement on a top-level cybercriminal forum in November 2022 that promoted an alternative to HTML smuggling for attackers “who send only links.” The vendor explained that their service consists of a “PDF landing page” that “combines both the layout and a link to your payload, which is automatically delivered when clicked on in any browser.” They offered landing pages relating to multiple well-known services, including DropBox, Office365, Microsoft Office, and Adobe Acrobat—even providing an example of the latter (see Figure 4.)
The vendor emphasized the service’s ease of use: All adversaries need do is select a clickbait title, upload malicious attachments, select a landing page, and provide the payloads. The phishing emails only contain an image and a link that allegedly ensures all mail providers will accept the email. All the text on landing pages would reportedly be translated into the target language by a native speaker, increasing the appearance of legitimacy. The vendor priced the offering at $800 for a weekly subscription to the service and also offered to design bespoke infrastructure to suit clients’ needs. Responses from other forum members were generally positive: Users left good feedback about working with the vendor and expressed enthusiasm about the technique. One threat actor highlighted that this technique was also gaining traction on Twitter. Not all such offerings are so well-received on cybercriminal platforms…
As recently as February 2023, a user of the English-language cybercriminal forum BreachForums—the forum that emerged after the seizure of the popular English-language cybercriminal forum RaidForums—initiated a thread seeking advice about an “infection stage 1 tool” they were developing. The tool was intended to pack malicious scripts into Hypertext Markup Language Applications (HTAs), as well as optical disc image (ISO) files. The threat actor developing the tool also noted that there is an option to implement HTML smuggling into the tool. As discussed earlier, the fact that threat actors are still considering implementing and using HTML smuggling indicates that the technique still trends and is still considered a reliable method for executing phishing and spamming attacks.
The key takeaway is that older techniques such as HTML smuggling are still relevant and popular among cybercriminals. There are clear indications that threat actors continue to utilize and improve HTML smuggling, which is why it’s important to update detections and review previous detections. The ReliaQuest Photon Research team continues to monitor HTML smuggling, providing intelligence to stay up-to-date with current developments and to further reduce HTML smuggling risks. In our previous blog about the subject, we provided crucial steps you can take to minimize risks related to HTML smuggling.
The GreyMatter Phishing Analyzer eliminates the struggles of monitoring abuse mailboxes, and allows you to identify and remove email threats before it’s too late.