Author: CyberDudeBivash
Powered by: CyberDudeBivash Brand | cyberdudebivash.com
Related:cyberbivash.blogspot.com

Published by CyberDudeBivash • Date: Nov 1, 2025 (IST)

Stop the Multilingual ZIP Attack – Why This New Method Is Highly Effective Against Enterprise

Threat actors are pushing multilingual ZIP lures—emails crafted in multiple languages that attach ZIP archives engineered to evade filters using polyglot/format tricks and filename deception. Recent reporting shows coordinated campaigns against finance and government in East/Southeast Asia, with infrastructure scaled for language-specific targeting. CyberDudeBivash Ecosystem:Apps & Services · CyberBivash (Threat Intel) · CryptoBivash · News Portal · Subscribe: ThreatWire

TL;DR — Why This Works & What To Do

Why it works: Archives built or bundled to appear as multiple formats (polyglots) plus filename spoofing (e.g., RTL override) confuse filters and users.
High success rate: Multilingual lures raise open rates; concatenated/ambiguous ZIP structures can slip past email/EDR heuristics.
Do now: Block risky archive combos, detect RLO/odd Unicode, enforce sandbox-open for archives, and deploy the hunts/rules below.

What Is a “Multilingual ZIP” Attack?

Two ingredients:

Multilingual social engineering — localized subject/body and documents per region to grow trust and click-through. Recent campaigns: government/finance targeting in East/Southeast Asia.
Archive ambiguity — polyglot or concatenated files that are valid as more than one format (e.g., ZIP+PDF/IMG), or nested ZIPs with crafted metadata/filenames to slip defenses.

Attackers also abuse the Unicode Right-to-Left Override (RLO, U+202E) so “invoicefdp.exe” appears as “invoice.pdf”. This persists across platforms and still tricks users and some tools.

Why Enterprises Miss It

Format confusion: Signature-based email/EDR looks at headers/extensions; polyglot/concatenated structures and benign-looking MIME slip through.
Language coverage: Lures in multiple languages defeat keyword filters and raise user trust.
Filename deception: RLO/RTL-override makes dangerous files look like docs/images.

Detections & Hunts (Mail, Endpoint, Network)

Mail Gateway / M365 / Google Workspace

Block risky combos: ZIPs containing .lnk, .js, .scr, .iso, or double-nested archives; quarantine ZIPs with mismatched MIME/extension or “dual-type” signatures.
RLO flag: Alert/quarantine attachments whose filenames include U+202E. MITRE ATT&CK: T1036.002.
Localization anomalies: Rule: message language ≠ recipient tenant’s default + archive attachment ⇒ heighten score (multilingual lure heuristic). :

Endpoint / EDR

Archive-launch chains: explorer.exe → archive tool → immediate cmd.exe/powershell.exe/wscript.exe with temp-path payloads. (Detect and block post-extract “script/spawn” within 30s.)
RLO/RLO-like names: Hunt for processes spawned from files whose names contain RTL control chars. Guidance from Red Canary & vendor analytics.

Network / NDR

Beacon heuristics after extract: sudden egress to paste/code hosts (raw.githubusercontent.com, pastebin, etc.) from non-dev VLANs within 10 minutes of archive open.

Sigma / Suricata “concepts” (tune before prod)

# Sigma — Attachment with RTL override + archive
title: EmailAttachment_RTL_Archive
logsource: { product: o365, service: exchange }
detection:
  sel1: { AttachmentExtensions|contains: ['zip','rar','7z'] }
  sel2: { AttachmentNames|contains: '\u202E' }
  condition: sel1 and sel2
level: high

# Suricata — post-extract callback to code hosts (non-dev subnets)
alert http $HOME_NET any -> $EXTERNAL_NET any (
  msg:"Post-extract callback to public code host";
  http.host; pcre:"/(raw\\.githubusercontent\\.com|api\\.github\\.com|pastebin\\.com)/";
  threshold:type both, track by_src, count 5, seconds 600;
  classtype:trojan-activity; sid:9051001; rev:1;
)

Mitigation & Hardening Checklist

Archive policies: Disallow nested archives and executable content inside ZIPs for external mail; force detonation in cloud sandbox (open-in-safe-viewer).
RLO defense: Strip or rewrite filenames containing RTL controls; warn users with banner + block auto-open.
Polyglot sanity: Content-disarm/reconstruct (CDR) or server-side normalization for uploads; reject ambiguous type matches.
User training (localized): Teach teams to distrust multi-language requests + archives; validate out-of-band for finance/HR/legal.
Dev/ops segmentation: Non-dev VLANs should not reach code/paste hosts without break-glass approvals.

FAQ

Is this “new malware” or better packaging?

Mostly packaging/engineering: multilingual social lures + polyglot/ambiguous archives and filename spoofing. Very effective at bypassing filters and fooling users.

Will blocking ZIPs break business?

Use conditional policies: allow ZIPs from trusted senders after detonation and content normalization; block nested archives and executables.

Does EDR catch it?

EDR often sees only the post-extract stage. Add rules for archive-launch chains + RTL filenames; correlate with network callbacks to raise fidelity.

Sources

Breaking: Multilingual ZIP phishing against finance/government in East/Southeast Asia.
Polyglot file research (dual-type, bypassing filters) incl. academic survey.
Kaspersky guidance on polyglot disguises; archive-handling hardening.
MITRE ATT&CK & vendor analytics on RLO/RTL filename abuse.
CDR/type-sanity techniques for uploads & attachments.

CyberDudeBivash — Services, Apps & Ecosystem

Mail Security Engineering (M365/GWS policies, sandboxing, CDR, multilingual lure detection)
Threat Hunting (archive-spawn chains, RTL filename hunts, post-extract beaconing)
IR Retainers (containment runbooks, forensic triage for archive-borne intrusions)

Apps & Products · Consulting & Services · ThreatWire Newsletter · CyberBivash (Threat Intel) · News Portal · CryptoBivash

Edureka: Email Security & SOC Kaspersky: Endpoint/EDR AliExpress WW Alibaba WW

Ecosystem: cyberdudebivash.com | cyberbivash.blogspot.com | cryptobivash.code.blog | cyberdudebivash-news.blogspot.com | ThreatWire

#CyberDudeBivash #CyberBivash #MultilingualZIP #PolyglotFiles #EmailSecurity #RLO #EDR #NDR #ThreatWire

Cyberdudebivash