SEG vs. SEG: How Threat Actors are Pitting Email Security Products Against Each Other With Encoded URLs

By Max Gannon, Cofense Phishing Defense Center 

Email security tools such as Secure Email Gateways (SEGs) often encode URLs that are embedded in emails. This enables the security appliance to scan the URL before the recipient visits the website. Oftentimes when SEGs detect URLs in emails that are already SEG encoded they do not scan the URLs, or the scanning shows only the security tool’s scanning page and not the actual destination. As a result, when an email already has SEG encoded URLs the recipient’s SEG often allows the email through without properly checking the embedded URLs. Threat actors have abused this for some time, but Q2 of this year, and May in particular, saw an increase in threat actors taking advantage of SEG encoding malicious URLs before sending them to victims.

Tools Used in The Wild

The 4 tools most commonly seen in use by threat actors to encode URLs and bypass SEGs in Q2 2024 are VIPRE Email Security, BitDefender LinkScan, Hornet Security Advanced Threat Protection URL Rewriting, and Barracuda Email Gateway Defense Link Protection. Email campaigns using these tools to bypass SEGs have been seen in environments protected by everything from Proofpoint to Microsoft ATP.

VIPRE Email Security

URLs encoded by VIPRE Email Security, especially URLs encoded by url[.]emailprotection[.]link were seen with 12 unique subjects in early June 2024. These emails had subjects similar to the following subset:

Figure 1: Email with embedded URL encoded by VIPRE Email Security’s url[.]emailprotection[.]link.

URLs encoded with VIPRE Email Security’s other encoding URLs: url2[.]mailanyone[.]net, url10[.]mailanyone[.]net, url12[.]mailanyone[.]net, etc. were seen primarily in May of 2024 with over 200 unique subjects. These emails had subjects similar to the following subset:

Figure 2: Email with embedded URL encoded by VIPRE Email Security’s url10[.]mailanyone[.]net.

BitDefender LinkScan

URLs encoded by BitDefender LinkScan, especially URLs encoded by lsems[.]gravityzone[.]bitdefender[.]com were seen most often in early June 2024 with 8 unique subjects. These emails had subjects similar to the following subset:

Figure 3: Email with embedded URL encoded by BitDefender LinkScan’s lsems[.]gravityzone[.]bitdefender[.]com.

URLs encoded with BitDefender LinkScan’s other encoding URL, linkscan[.]io, were only seen in two campaigns in June of 2024. These emails had subjects similar to the following subset:

Figure 4: Email with embedded URL encoded by BitDefender LinkScan’s linkscan[.]io.

Hornet Security Advanced Threat Protection URL Rewriting

URLs encoded with Hornet Security Advanced Threat Protection URL Rewriting (seclinks[.]cloud-security[.]net) were seen primarily in late May and early June of 2024 with 8 unique subjects. These emails had subjects similar to the following subset:

Figure 5: Email with embedded URL encoded by Hornet Security Advanced Threat Protection URL Rewriting’s seclinks[.]cloud-security[.]net.

URLs encoded with Hornet Security Advanced Threat Protection URL Rewriting’s other encoding URL, atpscan[.]global[.]hornetsecurity[.]com, were only seen in campaigns in late May and early June of 2024 with 16 unique subjects. These emails had subjects similar to the following subset:

Figure 6: Email with embedded URL encoded by Hornet Security Advanced Threat Protection URL Rewriting’s atpscan[.]global[.]hornetsecurity[.]com.

Barracuda Email Gateway Defense Link Protection

URLs encoded by Barracuda Email Gateway Defense Link Protection, especially URLs encoded by linkprotect[.]cudasvc[.]com were seen with 19 unique subjects in Q2 2024. These emails had subjects similar to the following subset:

Figure 7: Email with embedded URL encoded by Barracuda Email Gateway Defense Link Protection’s linkprotect[.]cudasvc[.]com.

Types Of Campaigns Seen Using SEG Encoded URLs

There were many different types of campaigns making use of SEG encoded URLs in Q2. Some of the most common themes were content requiring a signature and voicemail or withheld email notifications. As can be seen from the above Figures, DocuSign and Microsoft were often spoofed.

DocuSign

A large number of campaigns themed around content requiring a signature spoofed DocuSign. Despite this spoofing, relatively few of the campaigns made use of an actual DocuSign link which is not uncommon among Credential Phishing emails spoofing DocuSign. This is likely because the DocuSign links are typically used to bypass SEGs and if the threat actor is already bypassing a SEG by encoding the malicious URL then they have no need for an extra step that might get taken down.

Microsoft

Second only to DocuSign, Microsoft was the most commonly spoofed brand in email campaigns making use of SEG encoded URLs in Q2 2024. Although not all the Microsoft spoofing made sense, for example, the Microsoft spoofing Time Sheet Report in Figure 3, it was still commonly seen. This is a common tactic for threat actors seeking to abuse victims’ inherent trust in well-known brands.