TecAdmin – Page 32 – Tecruach Limited

24Aug

Arrests in International Fraud Scheme Due to Social Engineering

August 24, 2021By TecAdmin0 comment

Police in Romania, the Netherlands, and Ireland have arrested and charged twenty-three people accused of conducting sophisticated social engineering attacks. The organized crime group used phishing sites that purported to sell bogus goods, and raked in around one-million euros.

“A sophisticated fraud scheme using compromised emails and advance-payment fraud has been uncovered by authorities in Romania, the Netherlands and Ireland as part of an action coordinated by Europol,” Europol said. “On 10 August, 23 suspects were charged as a result of a series of raids carried out simultaneously in the Netherlands, Romania and Ireland. In total, 34 places were searched. These criminals are believed to have defrauded companies in at least 20 countries of approximately €1 million.”

Europol notes that the criminal group adapted their themes in 2020 to exploit the COVID-19 pandemic.

“The fraud was run by an organised crime group which prior to the COVID-19 pandemic already illegally offered other fictitious products for sale online, such as wooden pellets,” Europol said. “Last year the criminals changed their modus operandi and started offering protective materials after the outbreak of the COVID-19 pandemic.”

The criminals set up spoofed websites impersonating real wholesalers to trick people into paying for phony items.

“This criminal group – composed of nationals from different African countries residing in Europe, created fake email addresses and webpages similar to the ones belonging to legitimate wholesale companies,” Europol stated. “Impersonating these companies, these criminals would then trick the victims – mainly European and Asian companies, into placing orders with them, requesting the payments in advance in order for the goods to be sent. However, the delivery of the goods never took place, and the proceeds were laundered through Romanian bank accounts controlled by the criminals before being withdrawn at ATMs.”

New-school security awareness training can enable your employees to recognize social engineering attacks.

23Aug

“Compromise” is the “C” in “MICE”

August 23, 2021By TecAdmin0 comment

The FBI is warning Silicon Valley companies to be wary of insider threats, Protocol reports. FBI special agent Nick Shenkin told Protocol in an interview that authoritarian governments—mainly China and Russia—frequently pressure employees at US companies to conduct espionage.

“This is a quotidian activity,” Shenkin said. “This is a massive fundamental activity that bolsters and is one of the mainstays of many autocratic countries and their governments.”

Shenkin said the FBI is offering briefings to raise awareness about these threats.

“The reason why we’re being so much more assertive about these briefings and trying to be more open with U.S. industry is because we’ve just come to the realization that if there is no cost, then they will continue to do what they’re doing,” Shenkin said. “So the briefings are like, ‘Please American companies, raise your shields, protect yourselves, make it more expensive for the thieves to rob you, and the country is stronger, and you’re stronger.’”

Shenkin stressed that employees are most often driven to espionage in these cases because they have family members living in an authoritarian country, which their governments use as leverage against them. This is one of the four types of motivations described by the acronym “MICE,” used in counterintelligence training: “M” for “money,” “I” for “ideology,” “C” for “compromise,” and “E” for “ego.”

“A lot of what the briefings cover is the idea that this is not about the ethnicity of the individual,” Shenkin said. “This is about: What is any individual’s or entity’s vulnerability to the jurisdiction of an autocracy? Because what we see overwhelmingly is people who end up stealing intellectual property, very often, they have no desire to be stealing intellectual property.”

He also added that companies shouldn’t be complacent just because they don’t think they have anything valuable to steal.

“If you’re a quantum computing company, or a biotech company, or a green tech company, you are a juicier zebra on the Serengeti,” Shenkin said. “But they’re also going for just the slowest zebra on the Serengeti.”

So help your people out by building a supportive, non-punitive, and sympathetic culture of security. New-school security awareness training can give your organization an essential layer of defense by teaching your employees to thwart social engineering attacks.

20Aug

Deepfakes Continue to be a Concern as the Technology Improves and Becomes More Convincing

August 20, 2021By TecAdmin0 comment

In the wake of the FBI’s warning about more deepfake-based cyber attacks coming in the next year, organizations should remain vigilant against this compelling form of social engineering.

Nothing would convince you more that you should pay that invoice or purchase and email those gift cards than a call or voice mail from your boss or the CEO asking you to do so. And that’s exactly the outcome threat actors want – the compliance of their victims through clever social engineering.

And it doesn’t’ get any more clever than deepfakes. Deepfake technology has been around the last few years, and has been used to scam victims – usually in cases of attempted fraud. Lately we have seen recent advances that give it enough realism that would require a forensics expert to tell the difference from the real thing.

So, how should your users tell the difference between the real person and the deepfake?

The answer is… they shouldn’t.

Better said, they likely won’t be able to. What they can do to avoid becoming a victim is to be enrolled in Security Awareness Training that includes course material on deepfake scams so they can understand a) the possibility of a deepfake-based attack exists and b) that they need to follow establish corporate policy should a request – even from the CEO – seem suspicious or abnormal.

19Aug

Defending Against Ransomware Attacks Should Start (and Can End) With Security Awareness Training

August 19, 2021By TecAdmin0 comment

The world’s most dangerous, expensive, and impactful cyberattack can potentially be stopped with little more than a conscientious user who is paying attention.

It feels like every year I need to be saying “this year is the year of ransomware”. Every year the attacks become more frequent, the number of players increase, the ransom demands get larger, and the payouts reach new unprecedented levels.

Most cybersecurity strategies focus on layering in security solutions that prevent, detect, and respond to any kind of malware-based attacks – which includes ransomware. One aspect of the attack chain that can have a material impact on the effectiveness of your ransomware defense is the very prevalent human element. In most cases, phishing attacks are the primary initial attack vector, causing your users to stand squarely in between the ransomware attack and your organization.

No single security solution can stop every attack, so it makes sense that because ransomware gangs – in part – require users to interact with malicious email content to enable an attack, educating those users via Security Awareness Training to spot an attack to stop it from ever continuing.

So, your ransomware defense strategy should start with Security Awareness Training because you have no guarantee that the next attack will be stopped by solutions. But a user can make the difference between a boring normal workday and one where your entire operations has come to a screeching halt.

18Aug

Attackers Use Morse Code to Encode Phishing Attachments

August 18, 2021By TecAdmin0 comment

A phishing campaign is using morse code to encode malicious attachments in order to slip past security filters, according to researchers at Microsoft. The phishing emails contain HTML attachments designed to steal credentials.

“This phishing campaign exemplifies the modern email threat: sophisticated, evasive, and relentlessly evolving,” the researchers write. “The HTML attachment is divided into several segments, including the JavaScript files used to steal passwords, which are then encoded using various mechanisms. These attackers moved from using plaintext HTML code to employing multiple encoding techniques, including old and unusual encryption methods like Morse code, to hide these attack segments. Some of these code segments are not even present in the attachment itself. Instead, they reside in various open directories and are called by encoded scripts.”

(Morse code is not, of course, really encryption. It’s just another alphabetical system, but nowadays only old-school ham radio fists are likely to be fluent in Morse. And so it can function like a cipher for those not in the know.) This technique gives the emails a better chance of bypassing security technologies, since the filters are less likely to recognize the attachments as malicious.

“In effect, the attachment is comparable to a jigsaw puzzle: on their own, the individual segments of the HTML file may appear harmless at the code level and may thus slip past conventional security solutions,” the researchers write. “Only when these segments are put together and properly decoded does the malicious intent show.”

The researchers add that the attackers update their obfuscation techniques on a regular basis to stay ahead of the security industry.

“Cybercriminals attempt to change tactics as fast as security and protection technologies do,” the researchers write. “During our year-long investigation of a targeted, invoice-themed XLS.HTML phishing campaign, attackers changed obfuscation and encryption mechanisms every 37 days on average, demonstrating high motivation and skill to constantly evade detection and keep the credential theft operation running.”

New-school security awareness training can give your organization an essential layer of defense by teaching your employees to recognize social engineering attacks.

17Aug

The Anatomy of Smishing Attacks and How to Avoid Them

August 17, 2021By TecAdmin0 comment

Cybercriminals and nation-state actors continue to launch smishing attacks to steal credentials and distribute malware, according to Michael Marriott, Senior Strategy and Research Analyst at Digital Shadows. Marriott describes a new Android banking Trojan called “AbereBot” that’s being sold on cybercriminal forums. Since the Trojan targets mobile devices, it’s distributed via text messages.

“This is just one recent example, and barely a month goes by without another Android malware making news headlines,” Marriott says. “Back in January, for example, FluBot was reported to have spread quickly and significantly across targets. This malware was installed by SMS, in this case purporting to be from a delivery company providing a package tracking link. Users were prompted to download an application that would enable them to track the package, however, the malicious application enabled the attacker to capture banking credentials.”

Marriott cites advice from the UK’s National Cyber Security Centre (NCSC) on how to avoid falling for these scams:

“Only download apps from App Stores, such as the Android Play Store.
“If you suspect you have clicked on a malicious link, reset your device to factory settings and reset credentials of any accounts that you have entered since the infection.
“Even non-Android users should be cautious of clicking on links that may be attempting to capture credentials.
“Beware of unsolicited texts using high pressure tactics that introduce urgency, such as closing accounts or transferring funds, for example. When in doubt, go to the full website of the company and check notifications for your accounts there.
“Beware of anything that forces you to log in to unrelated services, such as entering banking credentials to receive a package.
“Always treat a message offering ‘something for nothing,’ such as winning money or prizes, as suspect, especially when you need to provide financial or other sensitive information.”

New-school security awareness training can enable your employees to recognize social engineering attacks.

16Aug

Military Personnel Vulnerable to Fraud

August 16, 2021By TecAdmin0 comment

US military personnel and veterans have lost more than $822 million to scams since 2017, according to researchers at AtlasVPN. The researchers analyzed data from the US Federal Trade Commission (FTC) and found that reservists and military families, lost the most money to scams ($484.4 million), followed by veterans and retirees.

“The veterans & military retirees’ financial damages encompass 35% of all losses at $290.1 million,” the researchers write. “This group fell to various types of internet crime most often, as they sent out a total of 452 thousand reports. The median loss in this category is $700. Finally, fraudsters swindled over $47.6 million from active duty service members. This group also submitted the least complaints at 52 thousand since 2017. The median loss for active duty service members is one hundred lower than that of veterans, at $600.”

The researchers found that romance scams were the most damaging type of scam, with military personnel losing $92 million to these fraudsters.

“Even though romance scams have been widely known for quite a while, victims are still not afraid to send large amounts of money to someone they met online, as the median loss to this type of crime stands at $2,400,” AtlasVPN says. “Victims submitted a total of 7,120 romance scam reports to the FTC. The second most damaging internet crime for the US military members was miscellaneous investments. As much as $90.2 million were lost to bogus investments. The median loss is not that far behind romance scams, hovering at $2,000.”

AtlasVPN concludes that everyone should have a healthy sense of suspicion and exercise caution when sending money online.

“To put the findings in the nutshell, even though the US has numerous task forces to deal with this growing epidemic of internet crime, each individual should be cautious and stay on the lookout for any red flags when dealing with internet-related money transfers,” the researchers write.

It might be easy to regard these as a purely personal matter, but of course organizations are generally alert to the well-being of their people. And social engineering in one part of anyone’s life can have repercussions elsewhere. In any case, new-school security awareness training can teach your employees to recognize social engineering attacks.

12Aug

Spear Phishing Becomes a Bigger Problem as the Average Organization is Targeted 700 Times a Year

August 12, 2021By TecAdmin0 comment

With threat actors honing their trickery skills to craft the perfect email used to fool a would-be victim recipient, new data shows cybercriminals are stepping up their game on a number of fronts.

Spear phishing only works when the misleading email content is relevant to the recipient. It’s one of the reasons social engineering plays such a critical role in today’s email-based attacks. According to security vendor Barracuda’s latest report, Spear Phishing: Top Threats and Trends, organizations are experiencing far more convincing and impactful campaigns that are focused on a wider range of roles in the organization than ever before:

1 in 10 attacks are Business Email Compromise (BEC) attacks
77% of BEC attacks target employees outside of finance and executive roles
Even so, the average CEO receives 57 targeted phishing attacks each year
IT staff still receive an average of 40 per year
Microsoft remains the top impersonated brand with WeTransfer in at number two

According to Barracuda, the roles targeted within an organization extend well-beyond that of the CEO or IT, making every employee a potential target:

7-12-21 Image

Source: Barracuda

This is the very reason why it’s so important to ensure that every user – regardless of role – continually takes part in your Security Awareness Training program. By doing so, they will remain updated on the latest scams, campaigns, social engineering tactics, etc. and be able to quickly identify malicious email content and avoid being the person responsible for a successful cyberattack.

11Aug

Android Trojan Goes After Facebook Accounts

August 11, 2021By TecAdmin0 comment

A new Android Trojan has hijacked more than 10,000 Facebook accounts by stealing session cookies, according to researchers at Zimperium. The malware uses social engineering to trick users into installing malicious apps from the Google Play Store and third-party app stores.

“The threat actors made use of several themes that users would find appealing such as free Netflix coupon codes, Google AdWords coupon codes, and voting for the best football (soccer) team or player,” Zimperium says. “Initially available in Google Play and third-party stores, the application tricked users into downloading and trusting the application with high-quality designs and social engineering.”

After the app is installed, the user is asked to log into their Facebook account. Notably, this attack uses Facebook’s legitimate single-sign-on portal rather than a credential phishing page.

“Contrary to popular belief that a phishing page is always at the forefront for compromising or hijacking an account, there are ways to hijack sessions even by logging into the original and legit domain,” the researchers explain. “This Trojan exploits one such technique known as JavaScript injection. Using this technique, the application opens the legit URL inside a WebView configured with the ability to inject JavaScript code and extracts all the necessary information such as cookies, user account details, location, and IP address by injecting malicious JS code.”

Zimperium also discovered that the attackers had left their command-and-control server exposed to the public internet, so anyone could access the stolen information and use it in further social engineering attacks.

“Malicious threat actors are leveraging common user misconceptions that logging into the right domain is always secure irrespective of the application used to log in,” the researchers write. “The targeted domains are popular social media platforms and this campaign has been exceptionally effective in harvesting social media session data of users from 144 countries. These accounts can be used as a botnet for different purposes: from boosting the popularity of pages/sites/products to spreading misinformation or political propaganda.”

New-school security awareness training can enable your employees to follow security best practices.

09Aug

79% of Employees Have Knowingly Engaged in Risky Online Activities in the Past Year

August 9, 2021By TecAdmin0 comment

With employees not believing that it’s important to personally worry about cyber security risks, they also tend to believe they’re not a target, new data suggest as the reason for the risky behavior.

In most cyberattacks, the employee plays some role – clicking on a malicious attachment, giving up their corporate credentials to an impersonated logon page on the web, or taking specific action because they were fooled into believing their CEO or boss told them to. So, it’s important for employees to not engage in risky online behaviors.

But according to new data from security vendor Thycotic, employees simply aren’t prepared and educated to think about corporate risk, let alone their role in helping to mitigate that risk. In their newly released Balancing Risk, Productivity and Security report, Thycotic point out some specific insights that clearly point to how and why employees are creating risk:

45% see the organization being at little or no risk of cyberattack
51% say IT should be solely responsible to protect the organization from cyber threats
79% of employees have engaged in one or more risky activities that include sharing credentials with colleagues, using the same password across multiple sites, using unauthorized personal devices to conduct work, and allowing family members to use their corporate device

One of the reasons is clear from the report’s data: 56% of employees have received no Security Awareness Training in the last year. Over half of employees aren’t having the concept of needing to be vigilant continually reinforced – so it’s no wonder these organizations are seeing employees introduce risk regularly.

If you want a vigilant and cyber security-minded employee, you need to continuously teach them about the importance of cyber vigilance. Otherwise, you’re going to end up with an organization that is demonstrated by the Thycotic data.

Author Archives: TecAdmin