Cleaning the atmosphere

This Group-IB report examines three corporate-email attack cases detected by its Business Email Protection product: a phishing campaign delivering TrickBot via a compromised feedback form that bypassed sender verification; a non-standard Windows Help file used to stage TrueBot/Silence malware; and a PPT macro-based BEC campaign by TMT/SilverTerrier that evaded sandboxes by mimicking typical user actions. The article highlights weaknesses in common email security stacks (sender verification, file-format checks, and sandbox analysis), describes sandbox-evasion techniques, and promotes an automated email security test (Trebuchet) to help organizations detect gaps.