Blog
/
Email
/
August 10, 2022

Bytesize Security: A Guide to HTML Phishing Attachments

Darktrace guides you through the common signs of HTML phishing attachments, including common phishing emails, clever impersonations, fake webpages, and more.
Inside the SOC
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Written by
Connor Mooney
SOC Analyst
Default blog imageDefault blog imageDefault blog imageDefault blog imageDefault blog imageDefault blog image
10
Aug 2022

Common phishing emails

One of the most common types of phishing email seen by the Darktrace SOC, involves the use of HTML attachments (Figure 1). These emails make use of an attachment to hide redirects to overtly malicious or suspicious domains. Some even impersonate legitimate web pages and send any entered or captured information back to the attacker's infrastructure once opened or filled out by the recipient. Indicators of these attempts can be identified from a few key patterns found across multiple emails.

Figure 1: An example of a suspicious HTML attachment containing dynamic content

A typical feature of these HTML attachments is the use of a generic-sounding filename that relates to the message's subject line, but with no specific information pertaining to the recipient or their line of business. These files almost always contain some form of Javascript code, as they often make use of external Javascript libraries to accomplish whatever goal is being pursued. For example, an attacker might use Javascript to convincingly impersonate a trustworthy website and trick the recipient into providing credentials or sensitive information, or they might use it to deploy malware and get a foothold on the device for further compromise once opened. This can be further identified by the presence of certain links in the HTML file itself (Figure 2).

Figure 2: The HTML file previously referenced contained multiple rare and suspicious links

Figure 2 above is an example of an HTML file containing multiple links with calls for .js files. This shows that the attachment contains Javascript and is making calls for external libraries for an undetermined purpose. 

Another common red flag is when the file contains links to common Product or Service images from domains wholly unrelated to those services, as seen below (Figure 3).

Figure 3: An example of an unusual .png call from a rare domain. The subsequent image called is for a company with no apparent relation to the hosting domain

The examples above imply an obvious (and poor) attempt by the HTML file to impersonate a Microsoft webpage, likely a fake login page set up for credential harvesting, as the ‘Microsoft’ logo is being pulled from a domain entirely unrelated to Microsoft or any common image-hosting service. 

Rather than impersonating a website directly in the file and loading resources from external sources, these HTML files will instead directly point toward a webpage that already contains these elements. This comes with its own set of pros and cons: by hosting their phishing page in a public setting, they are far more likely to be taken down, however it may be easier to appear legitimate than if they were to build it all out in the HTML file itself. 

The final routine element in these types of HTML phishing emails is the mechanism by which the attacker intends to receive any successfully scammed credentials or information. If the fake webpage is entirely contained in the HTML file, this often presents as a suspicious PHP link present in the file itself (Figure 4).

Figure 4: Phishing HTMLs often include links to rare domains with PHP destinations as an indication that it will engage in some form of HTTP POST communication

PHP calls suggest that some part of the webpage is intended to submit an HTTP POST or equivalent ‘submission’ call, often present in the ‘Login’ button in these scenarios. After the victim clicks this button, the webpage sends all the form-submission items to the endpoint hosting the PHP page, which is commonly an indicator of the webserver hosting the attacker infrastructure running the phishing attack.

If the HTML file redirects to an externally hosted phishing page, identical PHP links are often found in the source code of those pages (Figure 5). This serves the same function as sending any entered credentials back to the attacker.

Figure 5: The source-code of an external-hosted phishing page, showing calls for PHP pages hosted on alternate attacker infrastructure

The process of HTML attacks is so standardized that they are commonly released in the form of easily deployable phishing kits. These can be deployed on unsuspecting compromised webservers with little to no modification, resulting in virtually identical attacks being seen year-round. WordPress seems to be a prime target for hosting such attacks, with the site owners often becoming unsuspecting victims in propagating these phishing campaigns. An unfortunate side effect of these kits being readily available is that the attackers often don't bother to set any sort of access restrictions on their phishing servers once established, which can result in their entire setup being publicly viewable with a simple link modification. One example is seen below (Figure 6).

Figure 6: The parent directory of the website hosting a suspicious PHP page was fully accessible without restriction

In this incident, the website hosting the PHP link seen earlier had a publicly accessible parent directory structure, where both the PHP file above and an additional suspicious .txt file could be seen. This .txt file appears to be where any information submitted by victims ultimately ended up written to (Figure 7).

Figure 7: The TXT file in the parent directory above appeared to contain the login information that was likely submitted to the PHP page referred to in the initial HTML attachment

Figure 7 above presents the unusual risk of not only having the victims’ credentials at the disposal of the original attacker, but also potentially exposed to any malicious actor that can get creative with a web-crawler to identify key elements of the files used by these particular phishing kits. 

Fortunately, due to the standardized nature of these ready-made phishing kits, these types of attacks often conform to a series of common behaviors that Darktrace / EMAIL excels in identifying. Despite being a popular technique, it is extremely rare for attempts using this HTML attachment method to successfully get through a correct Darktrace / EMAIL  deployment. Overall, this means one less risk for the end user to worry about.

Inside the SOC
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Written by
Connor Mooney
SOC Analyst

More in this series

No items found.

Blog

/

/

April 22, 2025

Obfuscation Overdrive: Next-Gen Cryptojacking with Layers

man looking at multiple computer screensDefault blog imageDefault blog image

Out of all the services honeypotted by Darktrace, Docker is the most commonly attacked, with new strains of malware emerging daily. This blog will analyze a novel malware campaign with a unique obfuscation technique and a new cryptojacking technique.

What is obfuscation?

Obfuscation is a common technique employed by threat actors to prevent signature-based detection of their code, and to make analysis more difficult. This novel campaign uses an interesting technique of obfuscating its payload.

Docker image analysis

The attack begins with a request to launch a container from Docker Hub, specifically the kazutod/tene:ten image. Using Docker Hub’s layer viewer, an analyst can quickly identify what the container is designed to do. In this case, the container is designed to run the ten.py script which is built into itself.

 Docker Hub Image Layers, referencing the script ten.py.
Figure 1: Docker Hub Image Layers, referencing the script ten.py.

To gain more information on the Python file, Docker’s built in tooling can be used to download the image (docker pull kazutod/tene:ten) and then save it into a format that is easier to work with (docker image save kazutod/tene:ten -o tene.tar). It can then be extracted as a regular tar file for further investigation.

Extraction of the resulting tar file.
Figure 2: Extraction of the resulting tar file.

The Docker image uses the OCI format, which is a little different to a regular file system. Instead of having a static folder of files, the image consists of layers. Indeed, when running the file command over the sha256 directory, each layer is shown as a tar file, along with a JSON metadata file.

Output of the file command over the sha256 directory.
Figure 3: Output of the file command over the sha256 directory.

As the detailed layers are not necessary for analysis, a single command can be used to extract all of them into a single directory, recreating what the container file system would look like:

find blobs/sha256 -type f -exec sh -c 'file "{}" | grep -q "tar archive" && tar -xf "{}" -C root_dir' \;

Result of running the command above.
Figure 4: Result of running the command above.

The find command can then be used to quickly locate where the ten.py script is.

find root_dir -name ten.py

root_dir/app/ten.py

Details of the above ten.py script.
Figure 5: Details of the above ten.py script.

This may look complicated at first glance, however after breaking it down, it is fairly simple. The script defines a lambda function (effectively a variable that contains executable code) and runs zlib decompress on the output of base64 decode, which is run on the reversed input. The script then runs the lambda function with an input of the base64 string, and then passes it to exec, which runs the decoded string as Python code.

To help illustrate this, the code can be cleaned up to this simplified function:

def decode(input):
   reversed = input[::-1]

   decoded = base64.decode(reversed)
   decompressed = zlib.decompress(decoded)
   return decompressed

decoded_string = decode(the_big_text_blob)
exec(decoded_string) # run the decoded string

This can then be set up as a recipe in Cyberchef, an online tool for data manipulation, to decode it.

Use of Cyberchef to decode the ten.py script.
Figure 6: Use of Cyberchef to decode the ten.py script.

The decoded payload calls the decode function again and puts the output into exec. Copy and pasting the new payload into the input shows that it does this another time. Instead of copy-pasting the output into the input all day, a quick script can be used to decode this.

The script below uses the decode function from earlier in order to decode the base64 data and then uses some simple string manipulation to get to the next payload. The script will run this over and over until something interesting happens.

# Decode the initial base64

decoded = decode(initial)
# Remove the first 11 characters and last 3

# so we just have the next base64 string

clamped = decoded[11:-3]

for i in range(1, 100):
   # Decode the new payload

   decoded = decode(clamped)
   # Print it with the current step so we

   # can see what’s going on

   print(f"Step {i}")

   print(decoded)
   # Fetch the next base64 string from the

   # output, so the next loop iteration will

   # decode it

   clamped = decoded[11:-3]

Result of the 63rd iteration of this script.
Figure 7: Result of the 63rd iteration of this script.

After 63 iterations, the script returns actual code, accompanied by an error from the decode function as a stopping condition was never defined. It not clear what the attacker’s motive to perform so many layers of obfuscation was, as one round of obfuscation versus several likely would not make any meaningful difference to bypassing signature analysis. It’s possible this is an attempt to stop analysts or other hackers from reverse engineering the code. However,  it took a matter of minutes to thwart their efforts.

Cryptojacking 2.0?

Cleaned up version of the de-obfuscated code.
Figure 8: Cleaned up version of the de-obfuscated code.

The cleaned up code indicates that the malware attempts to set up a connection to teneo[.]pro, which appears to belong to a Web3 startup company.

Teneo appears to be a legitimate company, with Crunchbase reporting that they have raised USD 3 million as part of their seed round [1]. Their service allows users to join a decentralized network, to “make sure their data benefits you” [2]. Practically, their node functions as a distributed social media scraper. In exchange for doing so, users are rewarded with “Teneo Points”, which are a private crypto token.

The malware script simply connects to the websocket and sends keep-alive pings in order to gain more points from Teneo and does not do any actual scraping. Based on the website, most of the rewards are gated behind the number of heartbeats performed, which is likely why this works [2].

Checking out the attacker’s dockerhub profile, this sort of attack seems to be their modus operandi. The most recent container runs an instance of the nexus network client, which is a project to perform distributed zero-knowledge compute tasks in exchange for cryptocurrency.

Typically, traditional cryptojacking attacks rely on using XMRig to directly mine cryptocurrency, however as XMRig is highly detected, attackers are shifting to alternative methods of generating crypto. Whether this is more profitable remains to be seen. There is not currently an easy way to determine the earnings of the attackers due to the more “closed” nature of the private tokens. Translating a user ID to a wallet address does not appear to be possible, and there is limited public information about the tokens themselves. For example, the Teneo token is listed as “preview only” on CoinGecko, with no price information available.

Conclusion

This blog explores an example of Python obfuscation and how to unravel it. Obfuscation remains a ubiquitous technique employed by the majority of malware to aid in detection/defense evasion and being able to de-obfuscate code is an important skill for analysts to possess.

We have also seen this new avenue of cryptominers being deployed, demonstrating that attackers’ techniques are still evolving - even tried and tested fields. The illegitimate use of legitimate tools to obtain rewards is an increasingly common vector. For example,  as has been previously documented, 9hits has been used maliciously to earn rewards for the attack in a similar fashion.

Docker remains a highly targeted service, and system administrators need to take steps to ensure it is secure. In general, Docker should never be exposed to the wider internet unless absolutely necessary, and if it is necessary both authentication and firewalling should be employed to ensure only authorized users are able to access the service. Attacks happen every minute, and even leaving the service open for a short period of time may result in a serious compromise.

References

1. https://www.crunchbase.com/funding_round/teneo-protocol-seed--a8ff2ad4

2. https://teneo.pro/

Continue reading
About the author
Nate Bill
Threat Researcher

Blog

/

/

April 22, 2025

How NDR and Secure Access Service Edge (SASE) Work Together to Achieve Network Security Outcomes

woman looking out at buildingsDefault blog imageDefault blog image

Modern networks are evolving rapidly, with traffic patterns, user behavior, and critical assets extending far beyond the boundaries of traditional network security tools. As organizations adopt hybrid infrastructures, remote working, and cloud-native services, it is essential to maintain visibility and protect this expanding attack surface.

Network Detection and Response (NDR) and Secure Access Service Edge (SASE) are two technologies commonly used to safeguard organizational networks. While both play crucial roles in enhancing security, one does not replace the other. Instead, NDR and SASE complement each other, taking on different roles to create a robust network security framework. This blog will unpack the relationship between NDR and SASE, including the component functionalities that comprise SASE, highlighting their unique contributions to maintaining a comprehensive and resilient network security strategy.

Network Detection and Response (NDR) and Secure Access Service Edge (SASE) explained

NDR solutions, such as Darktrace / NETWORK, are designed to detect, investigate, and respond to suspicious activities within any network. By leveraging machine learning and behavioral analytics, NDR continuously monitors network traffic to identify anomalies that could indicate potential threats and to contain those threats at machine speed. These solutions analyze both North-South traffic (between internal and external networks) and East-West traffic (within internal networks), providing comprehensive visibility into network activities.

SASE, on the other hand, comprises multiple solutions, focused on providing hybrid and remote users access to services while adhering to the Zero Trust principle of "never trust, always verify". Within SASE architectures, Zero Trust Network Access (ZTNA) solutions provide secure remote access to private applications and services the user has been explicitly granted, and Secure Web Gateways (SWG) provide Internet access, again based on policy groups. Unlike traditional security models that grant implicit trust to users within the network perimeter, ZTNA requires continuous verification of user identity and device health before granting access to resources. This approach minimizes the attack surface and reduces the risk of unauthorized access to sensitive data and internal applications. Similarly, SWGs filter web traffic based on the verified user identity and can block known malware, further reducing the attack surface for the client estate.

Limitations of SASE highlights the importance of NDR

While SASE, including ZTNA and SWG, is a powerful tool for enforcing secure access to company networks and resources as well as the Internet, it is not a comprehensive security solution, or a replacement for dedicated network monitoring and NDR capabilities. Some of the main limitations include:

  • Focused on policies rather than security: SASE delivers strong networking outcomes but provides policy-based protections, rather than a full suite of security features. It can provide simple alerting for disallowed actions, but it lacks the security context needed for comprehensive threat detection, such as knowing if user credentials have been compromised.
  • Can only detect known threats: SASE solutions cannot detect novel attacks such as zero-days and insider threats. This is because they rely on a rule-based approach that does not have a behavioral understanding of network entities that can detect anomalies or suspicious activity.
  • Limited response capabilities: Due to the limited detection capabilities of SASE solutions, it is not possible to automate response actions to threats that slip past existing policies.  While access to internal resources and the Internet can be revoked or severely limited as part of a response, this must be done after human investigation and analysis, allowing more time for the threat to continue before being contained.
  • Limited scope: SASE provides cloud-hosted secure networking, which lends itself much more toward the client estate of any organization. As a result, servers and unmanaged devices—whether IT/IoT/OT—are mostly out of scope and do not benefit from the policies SASE enforces.

The complementary roles of NDR and ZTNA

NDR solutions provide full visibility into network activity, with the ability to detect and respond to threats that may bypass initial access controls and filters. When combined, NDR and SASE create a layered security approach that addresses different aspects of network security, for example:

  • Detection of novel, unknown and insider threats: NDR solutions can monitor all network traffic using behavioral anomaly detection. This can identify suspicious activities, such as insider threats from authorized users who have passed policy checks, or novel attacks that have never been seen before.
  • Validation of policies: By continuously monitoring network traffic, NDR can validate the effectiveness of existing policies and identify any gaps in security that need addressing due to organizational changes or outdated rule sets.
  • Reducing risk and impact of threats: Together, SASE and NDR solutions shift toward proactive security by reducing the potential impact of a threat through predefined policies and by detecting and containing a threat in its earliest stages, even if it is novel or nuanced.
  • Enhanced contextual information: Alerts raised by SASE solutions can provide additional context into potential threats, which can be used by NDR solutions to increase investigation quality and context.
  • Containment of network threats: SASE solutions can prohibit access to resources on an internal company network or on the Internet if predefined access control criteria are not met or a site matches a threat signature. When combined with an NDR solution, organizations can go far beyond this, detecting and responding to a much wider variety of network threats to prevent attacks from escalating.

When implementing SASE and NDR solutions, it is also crucial to consider the best configurations to maximize interoperability, and integrations will often increase functionality. Well-designed implementations, combined with integrations, will strengthen both SASE and NDR solutions for organizations.

How Darktrace continues to secure SASE networks

With the latest 6.3 update, Darktrace continues to extend its capabilities with new innovations that support modern enterprise networks and the use of SASE across remote and hybrid worker devices. This expands on existing Darktrace integrations and partnerships with SASE vendors such as Netskope and Zscaler.

Traditional methods to contain remote access and internet-born threats are either signature or policy based, and response to nuanced threats requires manual, human-led investigation and decision-making. By the time security teams can react, the damage is often already done.

With Darktrace 6.3, customers using Zscaler can now configure Darktrace Autonomous Response to quarantine ZPA-connected user devices at machine speed. This provides a powerful new mechanism for containing remote threats at the earliest sign of suspicious activity, without disrupting broader operations.

By automatically shutting down ZPA access for compromised user accounts, Darktrace gives SOC teams valuable time to investigate and respond, while continuing to protect the rest of the organization. This integration enhances Darktrace’s ability to take actions for remote user devices, helping customers contain threats faster and keep the business running smoothly.

For organizations using SASE technologies to address the challenges of securing large, distributed networks across a range of geographies, SaaS applications and remote worker devices, Darktrace also now integrates with Netskope Cloud TAP to provide visibility into and analysis over tunneled traffic, reducing blind spots and enabling organizations to maintain detection capabilities across their expanding network perimeters.

Conclusion

While NDR and ZTNA serve distinct purposes, their integration is crucial for a comprehensive security strategy. ZTNA provides robust access controls, ensuring that only authorized users can access network resources. NDR, on the other hand, offers continuous visibility into network activities, detecting and responding to threats that may bypass initial access controls. By leveraging the strengths of both solutions, organizations can enhance their security posture and protect against a wide range of network security threats.

Understanding the complementary roles of NDR and ZTNA is essential for building a resilient security framework. As cyber threats continue to evolve, adopting a multi-layered, defense-in-depth security approach will be key to safeguarding organizational networks.

Click here for more information about the latest product innovations in Darktrace 6.3, or learn more about Darktrace / NETWORK here.

Continue reading
About the author
Mikey Anderson
Product Marketing Manager, Network Detection & Response
Your data. Our AI.
Elevate your network security with Darktrace AI