DIGITAL LIFE

Cyberattack sophistication grows with fake PDFs, HP report reveals

The HP Wolf Security Threat Insights Report, released September 2025, reveals how cybercriminals are refining attack techniques to bypass traditional defenses. The study, covering the second quarter of 2025, highlights the growing use of Living-off-the-land (LOTL) methods and ultra-realistic social engineering lures, such as fake PDF documents, to compromise systems.

HP's analysis, based on data collected through its Wolf Security platform, reveals that attackers don't necessarily create new tools, but rather enhance the chaining of legitimate system binaries to conceal their activity. This approach makes distinguishing between malicious and legitimate operations a significant challenge for security teams.

The HP Wolf Security report identifies several campaigns that exemplify the creativity and adaptability of threat actors. Among the techniques observed, the following stand out:

-Social engineering with fake PDFs: A campaign targeting German-speaking regions used a file that simulated an Adobe Acrobat Reader document, with a fake loading bar. The file contained a small SVG image that, when opened, executed a reverse shell, granting control of the device to the victim.

-Malware hiding in images: The attackers hid malicious code in the pixels of image files within Microsoft Compiled HTML Help documents. This technique allowed them to extract and execute the XWorm malware in a multi-phase infection chain that used tools from the operating system itself.

-Resurgence of Lumma Stealer: This malware, focused on stealing information, was one of the most active families during the analyzed period. It was distributed through disk image files (IMG), which exploit legitimate system features to bypass security filters. According to Alex Holland, principal threat researcher at HP Security Lab, "Attackers don't reinvent the wheel, but they do refine their techniques." The expert states that the chaining of more LOTL tools and the use of less common file types aims to effectively evade detection.

Main infection vectors detailed in the report:

-Data collected between April and June 2025 shows clear trends in threat delivery methods:

-Archive files--40%--.rar files remain popular (26%), exploiting the reliance on WinRAR software.

-Executables and Scripts--35--Direct use of malicious files or scripts to launch the infection.

-Gateway Bypass--13%--At least 13% of email threats bypassed one or more perimeter security scanners.

The challenge of detection for security teams... The main difficulty posed by these tactics lies in their evasive nature. Dr. Ian Pratt, global director of personal systems security at HP Inc., comments that "living-off-the-grid techniques are notoriously difficult for security teams because it's difficult to distinguish green lights from red lights."

This ambiguity presents organizations with a dilemma: block processes that may be legitimate, causing disruption, or risk a threat going undetected. For Dr. Pratt, the solution lies in defense in depth, with containment and isolation, to intercept attacks that inevitably fail detection.

The HP report reinforces that the threat landscape is defined more by the adaptation and refinement of existing methods than by disruptive innovation. The increasing sophistication of cyberattacks, combined with the use of legitimate system tools, requires organizations to adopt security strategies that don't rely solely on detection, but rather isolate threats to mitigate their impact before they cause damage.

In Summary:

-Cybercriminals are refining Living-off-the-land (LOTL) techniques to avoid detection.

-Ultra-realistic phishing lures, such as fake PDF documents, are used to initiate infections.

-Archive files (.rar, .zip) represent the most common attack vector, accounting for 40% of occurrences.

-HP recommends an isolation-based security architecture to contain threats that evade detection tools.

Frequently Asked Questions (FAQ):

-What is a Living-off-the-land (LOTL) attack?

This is a cyberattack technique in which criminals use legitimate tools and features already present in the victim's operating system (such as PowerShell or WMI) to execute their actions. This approach makes detection difficult because the malicious activity blends into the normal system operation.

-How can a company protect itself from these advanced threats?

It's essential to adopt a "defense-in-depth" strategy. In addition to traditional detection tools (antivirus, firewall), it's recommended to use threat isolation technologies (sandboxing), which execute suspicious files and processes in a contained environment, preventing them from causing damage to the main system.

-Where can I view the full HP report?

The full report, titled "HP Wolf Security Threat Insights Report," is available on the official HP Threat Research blog below link

https://threatresearch.ext.hp.com/hp-wolf-security-threat-insights-report-september-2025/

mundophone