Hackers use zero-day attacks to evade security tools

ANY.RUN cybersecurity experts have identified an active zero-day attack that uses corrupted files to bypass antivirus software, sandboxes, and spam filters.

This allows malicious emails to enter your inbox unnoticed. Hackers intentionally use corrupted files, often ZIP or DOCX, to avoid detection by security solutions, as they do not follow conventional file handling procedures.

Read also: Hackers target zero-day vulnerabilities in PTZ cameras

Applications like Microsoft Word, Outlook, and WinRAR have recovery mechanisms that hackers exploit to execute malicious code without triggering alerts.

Traditional antivirus and file scanners fail to detect these files because they cannot handle corrupted data. Sandboxes fail to detect the threat if they rely solely on automated static analysis methods. Spam filters ignore the malicious payload because the corrupted files appear harmless.

See more: Apple fixes zero-day vulnerabilities in Mac systems

The attack exploits the recovery capabilities of user applications. Corrupted ZIP or DOCX files are sent via email and are not processed correctly by security solutions. When opened by the corresponding application, recovery functions are activated, allowing malicious actions.

ANY.RUN's interactive sandbox platform proves effective against this threat, offering direct interaction with files to monitor their behavior in real time.

Read more: NSO Group used another WhatsApp zero-day

ANY.RUN’s research reveals that the attack has been active for months and continues to evolve. Cybersecurity teams are urged to adopt advanced detection tools to combat these threats.

Source: cybersecuritynews