View source for Highly Evasive Adaptive Threat

{{Short description|Information Security}}
A '''Highly Evasive Adaptive Threat''' (HEAT) is a cybersecurity attack type designed to bypass traditional network security defenses.<ref>{{Cite web|url=https://www.menlosecurity.com/blog/too-hot-to-handle-why-modern-work-has-given-rise-to-heat-attacks/|title=Too hot to handle: Why modern work has given rise to HEAT attacks|first=Menlo|last=Security|date=February 2, 2022|website=Menlo Security}}</ref> <ref>{{Cite web|url=https://www.paloaltonetworks.com/cyberpedia/3-challenges-to-identifying-evasive-threats|title=3 Challenges to Identifying Evasive Threats|website=Palo Alto Networks}}</ref> HEAT attacks are designed to find ways around protections that have been in place for years.<ref>{{Cite web|url=https://www.youtube.com/watch?v=cIOw53iXQFU|title=The Browser Renaissance: Reshaping the Enterprise Browser Landscape|via=www.youtube.com}}</ref> HEAT attacks are able to bypass typical cybersecurity controls, such as [[Social:Internet filter|Secure Web Gateways]] (SWG) and anti-malware capabilities, through malicious links disguised as common URLs that victims assume are safe. HEAT attacks go beyond traditional phishing methods, which have historically been delivered by email, by inserting themselves into links that are not flagged by anti-phishing software.<ref>{{Cite web|url=https://betanews.com/2023/03/30/heat-attacks-browser-exploit/|title=HEAT attacks: A new spin on browser exploit techniques|date=March 30, 2023|website=BetaNews}}</ref> Similar to most cybersecurity threats, the drivers of HEAT attacks are primarily monetary and political. HEAT attacks focus on technical limitations of commonly deployed security tools with the primary target being web browsers.<ref>{{Cite web|url=https://www.scmagazine.com/analysis/browser-based-heat-attacks-putting-cisos-on-the-hot-seat|title=Browser-based HEAT attacks putting CISOs on the hot seat|first=Bradley|last=Barth|date=September 27, 2022|website=SC Media}}</ref> Nation-states and cybercriminals typically use HEAT attacks for phishing attempts or ransomware initial access.<ref>https://ten-inc.com/presentations/Menlo-Threat-Landscape-HEATs-Up-with-Highly-Evasive-Adaptive-Threats.pdf</ref> 

Highly Adaptive Evasive Threats (HEAT) require adaptive threat analysis technology to detect threats missed by other approaches.<ref>{{Cite web|url=https://info.opswat.com/leverage-adaptive-threat-analysis-to-detect-highly-evasive-malware|title=Leverage Adaptive Threat Analysis to Detect Highly Evasive Malware|website=info.opswat.com}}</ref>

==Definition==
HEAT attacks demonstrate four primary characteristics<ref>{{Cite web|url=https://www.enterprisetimes.co.uk/2022/04/13/the-four-evasive-techniques-of-highly-evasive-adaptive-threats/|title=The four evasive techniques of Highly Evasive Adaptive Threats -}}</ref>
*''Evades offline categorization and threat detection''&nbsp; - HEAT attacks bypass URL filtering by using ephemeral and/or compromised malicious sites with benign categorization.
*''Evades malicious link analysis''&nbsp; - HEAT attacks bypass Email Security Tools by expanding from email phishing links to other sources such as web, social media, sms, and file sharing platforms.
*''Evades static and dynamic content inspection''&nbsp; - HEAT attacks bypass file based inspection by using dynamic file downloads (ie. HTML smuggling).
*''Evades HTTP traffic inspection''&nbsp; - HEAT attacks bypass HTTP Content/Page Inspection by using dynamically generated and/or obfuscated content (javascript code and images).

==History and Notable HEAT Attacks==
Though some of the techniques used in HEAT attacks have been in the industry for several years, the increasing trends towards remote work, increasing use of [[Software as a service|Software as a Service]] (SaaS) and browser based applications, and ransomware attacks have accelerated adoption of HEAT techniques by attackers.  

*''DURI''&nbsp; - the DURI HEAT attack was discovered in 2020. Duri's payload was malware that had been previously detected.<ref>{{Cite web|url=https://umbrella.cisco.com/blog/navigating-cybersecurity-during-a-pandemic-latest-malware-and-threat-actors|title=Navigating Cybersecurity During a Pandemic: Latest Malware and Threat Actors|first=Andrea Kaiser, Shyam Sundar|last=Ramaswami|date=April 1, 2020|website=Cisco Umbrella}}</ref>  However the delivery method evolved to use a HEAT attack technique,  HTML smuggling, to increase its infection rate of targeted endpoints <ref>{{Cite web|url=https://www.menlosecurity.com/blog/new-html-smuggling-attack-alert-duri/|title=New HTML Smuggling Attack Alert: Duri|first=Krishnan|last=Subramanian|date=August 18, 2020|website=Menlo Security}}</ref>:.   
*''Qakbot''&nbsp; - Qakbot is a banking [[Trojan horse (computing)|trojan]] that has been in use since at least 2007. Qakbot is actively maintained and recent modifications include the use of HEAT attacks such as password protected zip files.<ref>https://www.malware-traffic-analysis.net/2020/04/08/index.html/</ref>
*''Nobelium''&nbsp; - Nobelium malware is typically used in attacks focused on financial services and other highly targeted victims. The smuggling technique encoded a script within a web page or HTML attachment.  The user's web browser decodes the script which subsequently creates the malware payload on the host computer.<ref>{{Cite web|url=https://www.microsoft.com/en-us/security/blog/2021/11/11/html-smuggling-surges-highly-evasive-loader-technique-increasingly-used-in-banking-malware-targeted-attacks/|title=HTML smuggling surges: Highly evasive loader technique increasingly used in banking malware, targeted attacks|first=Microsoft Threat|last=Intelligence|date=November 11, 2021|website=Microsoft Security Blog}}</ref>   

== References ==

{{reflist}}

[[Category:Computer security]]

{{Sourceattribution|Highly Evasive Adaptive Threat}}