BI.ZONE Mail Security 3.0 Enhances Detection of Password-Protected Archives and Spam Variants

BI.ZONE has released Mail Security 3.0, introducing new mechanisms to detect email threats and improved tools for administrators. The updated system now assigns additional risk scores to password-protected archives when their contents cannot be unpacked, without automatically classifying the archive itself as malicious. It also compares message texts to identify near-identical emails used in spam campaigns where attackers slightly alter wording to evade filters. Administrators can now incorporate SPF and DKIM verification results into delivery rules to better distinguish legitimate senders from impersonators. According to BI.ZONE statistics, phishing accounted for 90 percent of illegitimate email traffic in the first half of 2026. Additional protections include CAPTCHA challenges after repeated failed login attempts on administrative accounts. The release also adds bulk management of rules, improved logging with a side panel for message details, a new Events section, and Syslog export to external SIEM systems.

AntiMalwareTranslated from Russian

Read at source

BI.ZONE has released Mail Security 3.0, adding new detection mechanisms for email threats and expanded administrative capabilities. The solution now pays closer attention to password-protected archives, verifies sender authenticity, and identifies mass mailings in which attackers make minor text changes to bypass filters.

When the contents of a password-protected archive, including nested files, cannot be extracted, the system assigns additional risk points to the message. The archive itself is not automatically marked as malicious, but it loses its previous immunity simply because its contents are locked. This approach allows analysts to investigate suspicious encrypted attachments without false negatives caused by encryption.

A second new method compares message texts and detects series of nearly identical emails. BI.ZONE uses this technique to uncover spam campaigns where threat actors rearrange a few words in an attempt to evade detection. Delivery rules can now take into account the results of SPF and DKIM checks, helping to separate legitimate senders from those who spoof familiar names to steal credentials.

According to BI.ZONE statistics, phishing accounted for 90 percent of illegitimate email traffic in the first half of 2026. Protection for administrative accounts has been strengthened with a mechanism against automated password brute-force attacks. After a defined number of failed login attempts, users must complete a CAPTCHA challenge.

Administrators can now enable, disable, or delete rules in bulk, download quick rules as a group, and perform operations on multiple messages simultaneously. The updated journal displays message information in a side panel, while a new Events section alerts users to important changes and upcoming license expiration. User activity logs can be forwarded to external monitoring and SIEM systems via Syslog.

Meridian digestThe week's most consequential security stories, distilled into one briefing.See the digest

More in Fraud & Social Engineering

Scammers Use *#62# USSD Command to Fabricate Surveillance Claims and Steal Victims' Funds
Aroshka Cloud Faces Scrutiny Over Alleged False Claims of SOC 24/7 Operations and High-End Infrastructure
Reports Surface on Alleged De-Anonymization of Admins Running Major Russian Hacker Forums