# Saints Turned Evil By Sushant Kumar Arya, Daksh Kapur and Rohan Shah · January 02, 2024 ![Saints turned evil](https://www.trellix.com/en-us/img/newsroom/stories/saints-turned-evil.jpg) (Attribution at the Bottom) As technology advances, attackers are constantly developing new evasion mechanisms to bypass security products and stay one step ahead of security vendors and their products. We have seen various types of evasion mechanisms employed by attackers in recent years. ## Evasions * Geofencing, where a URL serves malicious content only when accessed from the target country or region, while remaining legitimate or providing no content to users from other countries. * Captcha to bypass automated crawling thus restricting analysis of URL payload by security products. * IP evasion, where attackers blacklist the public IPs of specific services or organizations. By doing so, they ensure that their phishing or malicious payload is not served when requests come from those blacklisted IPs. This approach effectively blocks the analysis of URLs by security products. * QR codes serve phishing attacks as discussed in our recent blog, since QR code hides the embedded payload, it evades detection from traditional email security products thus bypassing them. Trellix Email security has recently discovered a novel evasion tactic. In this method, attackers aim to deceive the caching mechanism of security products. Their strategy involves caching a seemingly benign version of the attack vector and subsequently altering it to deliver a malicious payload. ## What is caching? In simple terms, caching involves temporarily storing the result for an input element. When that same input comes in again, the stored result is swiftly retrieved, cutting down on time and processing costs. Security Products frequently use caching to boost speed and efficiency. So, when a URL gets scanned, the result is stored and cached for a set time. If the same URL is checked within the pre-set time frame, the security product doesn't reprocess it — it just serves up the stored result. ## Attack flow ### Phase 1 The attack begins with the targeted individual receiving an email containing a Call To Action (CTA) URL, guiding them to a website or document containing an additional link or button. Our researchers have noted a recurring pattern where attackers often employ OneDrive Document URLs as CTA URLs. This choice is attributed to the sense of trust added by the reputation of Microsoft owned domain. ![Figure-1: Phishing email containing OneDrive CTA URL](https://www.trellix.com/en-us/img/newsroom/stories/saints-turned-evil-1.jpg) Figure-1: Phishing email containing OneDrive CTA URL ### Phase 2 In the second phase, the Security Engine checks the CTA URL. This URL has a link/button that leads to well-known and harmless sites like google.com or microsoft.com. Since there's nothing suspicious about a URL linking to such trusted sites, the security engines label the CTA URL as safe and save this verdict in their cache. ![Figure-2: The CTA URL leading to a One Note document](https://www.trellix.com/en-us/img/newsroom/stories/saints-turned-evil-2.jpg) Figure-2: The CTA URL leading to a One Note document ![Figure-3: The hyperlink inside One Note page leading to a trusted website](https://www.trellix.com/en-us/img/newsroom/stories/saints-turned-evil-3.jpg) Figure-3: The hyperlink inside One Note page leading to a trusted website ### Phase 3 In the third phase, the attackers wait for security vendors to process the CTA URL and cache their verdict. Once this happens, the attackers make their move: they tweak the link/button on the CTA URL. The link which was earlier leading to trusted websites, now redirects to the actual malicious page. ![Figure-4: One Note page with modified phishing hyperlink](https://www.trellix.com/en-us/img/newsroom/stories/saints-turned-evil-4.jpg) Figure-4: One Note page with modified phishing hyperlink Since the page was initially cached as benign after the first scan by security vendors, until the cache period expires, every encounter with the same CTA URL prompts the security engine to consistently return a benign verdict stored in the cache. With the verdict being benign, the email smoothly lands in the victim's inbox. Now, should the unsuspecting recipient decide to open the email and click on the link/button within the CTA URL, they would be redirected to the malicious page. ![Figure-5: The Final Phishing Page](https://www.trellix.com/en-us/img/newsroom/stories/saints-turned-evil-5.jpg) Figure-5: The Final Phishing Page ![Figure-6: When CTA URL is scanned the first time](https://www.trellix.com/en-us/img/newsroom/stories/saints-turned-evil-6.jpg) Figure-6: When CTA URL is scanned the first time (Attribution at the Bottom) ![Figure-7: When CTA URL is scanned the next time](https://www.trellix.com/en-us/img/newsroom/stories/saints-turned-evil-7.jpg) Figure-7: When CTA URL is scanned the next time (Attribution at the Bottom) ## Trellix email security Trellix Email Security performs force analysis of CTA URL at the time of user interaction, hence it sees the phishing URL embedded into the CTA URL, thus detecting the phishing URL. Consequently, any detected phishing URLs are instantaneously blocked, preventing the user from accessing potentially harmful content. Moreover, a protective block page is presented to the user, ensuring the safety of both the individual and the organization. ## Trellix email security telemetry We have witnessed these attacks occurring on a large scale rather than being aimed at specific customers, regions, or industries. Instead, they have encompassed various regions and industries. The following diagrams depict the impact of this attack on various industries and countries. ![Figure-8: Targeted Industry distribution](https://www.trellix.com/en-us/img/newsroom/stories/saints-turned-evil-8.jpg) Figure-8: Targeted Industry distribution ![Figure-9: Targeted Country distribution](https://www.trellix.com/en-us/img/newsroom/stories/saints-turned-evil-9.jpg) Figure-9: Targeted Country distribution ## Indicators of Compromise (IOC) ### URL hxxps://onedrive[.]live[.]com/redir?resid=31B302B132DC1EB7!416&authkey=!AIHVM4Etxtu4Hl4&ithint=onenote hxxps://onedrive[.]live[.]com/redir?resid=3FBB4C466D5C47B%214007&authkey=%21AMAoWtlsRjtgU3s&page=View&wd=target%28Quick%20Notes.one%7C9b74b45d-3dcb-486c-bfa8-1690485577d1%2FNAKED% hxxps://onedrive[.]live[.]com/redir?resid=4A2A68C638DBFAD1%21728&authkey=%21AAoJZlYdkU4qM_M&page=View&wd=target%28Quick%20Notes.one%7C79a985b7-6c15-43cf-aac6-a2c70122f021%2FMartina% hxxps://onedrive[.]live[.]com/redir?resid=4E0D3BBD3561F29%2120527&authkey=%21ABNV5f0-VxuHve4&page=View&wd=target%28Quick%20Notes.one%7C2b938392-c42c-44b7-954c-42737e7cb805% hxxps://onedrive[.]live[.]com/redir?resid=531CBDB0711FA26E%21635&authkey=%21AIezNqQXzKf1HvM&page=View&wd=target%28Quick%20Notes.one%7C0490e0b3-c320-4f83-8c11-667055e276f6%2FSolar%20% hxxps://onedrive[.]live[.]com/redir?resid=6B61A37433C0FFD8%214320&authkey=%21AEwQuZ5OAuQm9aY&page=View&wd=target%28Quick%20Notes.one%7Caa694bfb-16b3-4c1b-909d-140f5bfcd39e%2FStudio% hxxps://onedrive[.]live[.]com/redir?resid=E98E045C25A9D63F%219773&authkey=%21AAgvN_6yASvZ5u8&page=View&wd=target%28Quick%20Notes.one%7Ce4fa6a0b-a9ca-47e1-80ff-29ec7ea3d43f%2FStadex% hxxps://onedrive[.]live[.]com/redir?resid=56249906518A0B!283&authkey=!AH4y6GfOPnM-SvI&ithint=onenote hxxps://onedrive[.]live[.]com/redir?resid=9B866E89934F86E9%21301&authkey=%21ACM7iv3lZ7k7tU0&page=View&wd=target%28Quick%20Notes.one%7Cad20f96d-515e-4b1c-a675-f30969b3b9f6%2FDavide% hxxps://onedrive[.]live[.]com/redir?resid=9E42FE8C29238AB1%2115147&authkey=%21AOqiv3AcYY3aMpQ&page=Edit&wd=target%28Quick%20Notes.one%7C1c9129d0-c8bd-48b0-8df2-3c4e154b0891%2FMTS% hxxps://onedrive[.]live[.]com/redir?resid=AE5A5924C2D9CC14!48410&authkey=!ALfMjOMjP1PxCi8&ithint=onenote hxxps://onedrive[.]live[.]com/redir?resid=B3783CBEB3CBD28E%211178&authkey=%21AP5JEq30FkehUj4&page=View&wd=target%28Quick%20Notes.one%7Cce65b048-b0c5-4ea3-bc3d-0a9084267a0e%2FPROMO% hxxps://onedrive[.]live[.]com/redir?resid=DB167F6D99BE2335%2157103&authkey=%21AMTkDK3lCKHG-N8&page=View&wd=target%28Quick%20Notes.one%7Ceba8f278-5578-464e-829f-b794f6ba1321%2FFybra% hxxps://onedrive[.]live[.]com/redir?resid=E1D28F66AD9ED4A1%211490&authkey=%21AGPrkBNKqNRG3dE&page=View&wd=target%28Quick%20Notes.one%7C5f3e1cce-b367-4d85-9f9c-de4381a6a8b8% hxxps://onedrive[.]live[.]com/redir?resid=E3CBC738A4D9118B%2115853&authkey=%21ADWYKGPcM4Ck0UU&page=View&wd=target%28Quick%20Notes.one%7C293d7920-3cf2-4338-beec-83627581afc5%2FElbo% hxxps://onedrive[.]live[.]com/redir?resid=E7459548557E7DD0%211823&authkey=%21AGh8Y18gIf2LBKk&page=View&wd=target%28Quick%20Notes.one%7C49d9deb6-98cb-45ad-a8d3-708081e249d0% hxxps://onedrive[.]live[.]com/redir?resid=62E45C9F0AC9D873!539&authkey=!AHvrEUEeKYZWc&ithint=onenote hxxps://onedrive[.]live[.]com/redir?resid=EFB4967AA612AAF7%21517&authkey=%21AAw9pPYWRqS0Xgs&page=View&wd=target%28Quick%20Notes.one%7C1fe14282-98e8-46fa-8f66-ebe00ac0795d%2FMarco% hxxps://onedrive[.]live[.]com/view.aspx?resid=EA104CA31FC03329!142&ithint=onenote&wdo=2&authkey=!AIBTpgciuKI2Yeo ### Subjects FYI [EXT] Stadex/Offerte nr. 20233054 dd. 25/07/23 [EXTERNAL] contratto SUB APPALTO [EXTERNAL] PROPOSAL FROM NATIONAL TRANSPORTATION SERVICE Invoice 7027 re Work ORDER 04-02102016.0 ORDINE /Re: richiesta di offerta R: [EXT] R: Richiesta d'offerta per K350 QUOTAZIONE E TEMPI DI CONSEGNA - RQ18009 richiesta vs offerta ## Trellix product protections The following is a subset of the Trellix Security detections that have been observed for the ongoing campaigns: Detection Signature Trellix Email Security Phishing_OneNote_Evasion_SS_1 Phishing_OneNote_Abuse_SS_1 Phish.Live.DTI.URL ## Conclusion In summary, we have observed that attackers have devised an innovative method of evading security products by targeting their architecture and design to carry out successful attacks. However, thanks to Trellix email security's force scanning of URLs during user interaction, altered phishing links are swiftly identified and detected. As a result, this novel evasion technique is effectively mitigated, ensuring the protection of our valued customers. ## Attributions We would like to give proper credit and recognition to the various elements that have contributed to the content of this blog. The following list outlines the attributions for these elements: ### Images * [Image by Freepick]() ### Icons * [Email icons created by Freepik - Flaticon]() * [Search icons created by Freepik - Flaticon]() * [Link icons created by Freepik - Flaticon]() * [Shield icons created by Freepik - Flaticon]() * [Cache icons created by Freepik - Flaticon]() * [Anti virus software icons created by phatplus - Flaticon]() * [Security icons created by Freepik - Flaticon]() * [User icons created by Freepik - Flaticon]() * [Click icons created by Freepik - Flaticon]() We sincerely appreciate the contributions of these elements to our blog and acknowledge the importance of giving credit where it's due. Should there be any concerns regarding attributions or if corrections are needed, please don't hesitate to contact us. Your understanding and support are greatly valued. _ This document and the information contained herein describes computer security research for educational purposes only and the convenience of Trellix customers. _