Blended Failure

What is a Blended Threat?  Per TechTarget, it's one that usually employs multiple attack vectors.  In other words, the threat usually comes in via the email threat vector, but, a dropper file typically phones home to pull additional malware via the web threat vector.  Today we have an example of the Security Vendors missing on both (other than Raytheon|Websense):

- Word Attachment, with malicious macro, propagating around the internet this morning... details of the Raytheon|Websense File Sandbox Report found here.

- As is usually the case, your trust would be misplaced if you are expecting your AV engines to block this M$ Office Attachment... as only 4 of 55 AV Companies are detecting this:

- Per the above report, and screen shot below, the downloader phones home to a www site in CZ:

- You are likely asking, "would my web security solution block that outbound connection?"  Well... only 1 of 66 Web Security Companies are in fact doing that currently:

In summary, your security solution needs to have a presence in both the email & web security spaces (not to mention identification of proprietary data being ex-filtrated).  Call ESPO Systems to learn how this can be done in an effective manner.