Blog

05Nov

FBI Warns that Financial Events are Occasions for Extortion

November 5, 2021By TecAdmin0 comment

The US Federal Bureau of Investigation (FBI) has warned that ransomware operators are targeting companies that are going through financial events. The timing is designed to elicit and exploit information in ways that will exert additional pressure on the victims.

“The FBI assesses ransomware actors are very likely using significant financial events, such as mergers and acquisitions, to target and leverage victim companies for ransomware infections,” the Bureau says. “Prior to an attack, ransomware actors research publicly available information, such as a victim’s stock valuation, as well as material nonpublic information. If victims do not pay a ransom quickly, ransomware actors will threaten to disclose this information publicly, causing potential investor backlash.”

The FBI explains that ransomware operators select their victims based on the value of the information they have access to, and thus the potential for a big payout.

“Ransomware actors are targeting companies involved in significant, time-sensitive financial events to incentivize ransom payment by these victims,” the FBI says. “Ransomware is often a two-stage process beginning with an initial intrusion through a trojan malware, which allows an access broker to perform reconnaissance and determine how to best monetize the access. However, while this malware is often mass distributed, most victims of trojans are not also victims of ransomware, indicating ransomware targets are often carefully selected from a pool based on information gleaned from the initial reconnaissance.

Once ransomware operators are within a network, they search for sensitive information that they can use to further incentivize victims to pay.

“During the initial reconnaissance phase, cyber criminals identify non-publicly available information, which they threaten to release or use as leverage during the extortion to entice victims to comply with ransom demands,” the Bureau says. “Impending events that could affect a victim’s stock value, such as announcements, mergers, and acquisitions, encourage ransomware actors to target a network or adjust their timeline for extortion where access is established.” That reconnaissance phase is often the work of initial access brokers, who pick victims likely to be attractive to the brokers’ criminal customers.

The vast majority of ransomware attacks begin via phishing attacks or technical vulnerabilities like exposed RDP ports. New-school security awareness training can give your organization an essential layer of defense by helping your employees to recognize phishing and other social engineering attacks.

03Nov

Not that You Would, but Looking for a Sugar Daddy’s a Bad Idea

November 3, 2021By TecAdmin0 comment

Scammers are using social media to target young women with offers to be their “sugar daddy,” according to Laura Josepha Zimmermann at Avast. Zimmermann received a message on Instagram from a user who appeared to be an older man. The user stated, “Hey my name is Walker and I am looking for a sugar baby. I would like to pay you 1,500 Euro weekly.” The scammer then sent a screenshot of a fake PayPal transaction, and told Zimmermann that she would need to send him some money via a Google Play card in order to activate the account and receive the €1,500.

“[A]spiring ‘sugar daddies’ lure in their victims through direct messages on Instagram with messages that sound (and are) too good to be true,” Zimmermann says. “They first try to gain your trust and before carrying on with requesting payment. When they do get around to requesting payment “verification”, these scammers will disappear as soon as the money is sent and has come into their possession. The payment for the verification is mostly done over prepaid cards, like Google Play or Amazon Cards. These are payment methods that can’t easily be refunded.”

Fortunately, Zimmermann recognized this as a scam immediately and blocked the user after stringing him along to see what he would say, but she notes that this type of scam is common.

“This scam is far from unique nowadays — many young women are affected by similar ploys from cybercriminals across the globe,” Zimmermann writes. “Some of these women may have a difficult financial situation and could use the money. Alternatively, they may just be looking for a certain standard of living that they can’t otherwise afford. The alleged ‘sugar daddies’ exploit these situations to make a profit — and end up causing a lot of damage.”

Zimmermann offers the following recommendations to avoid falling for these scams:

“Don’t answer messages from people you don’t know. If you’re in doubt, look into their profile to see if there’s anything fishy about it.

“Ignore any messages promising free money. Plain and simple.

“Don’t give your personal details to strangers. You wouldn’t do it in person, so why do it on the internet?

“Do your research. If you’d like to validate any message that you receive, there are plenty of resources from other people who have encountered similar types of scams. Read through forums and relevant online groups to obtain more information.”

So it’s the old Nigerian prince advance fee scam reinvented for the sugar community. Stay clear. New-school security awareness training can enable your employees to recognize social engineering tactics.

02Nov

Misconceptions and Assumptions about Cybersecurity

November 2, 2021By TecAdmin0 comment

Misconceptions about cybersecurity can lead to employees falling for preventable attacks, according to Jayant Chakravarti at Toolbox. One misconception is that Apple devices are inherently more secure than Windows machines. Steven Hope, CEO and co-founder of Authlogics, told Toolbox that Mac users can grow complacent due to the false impression that Macs can’t get infected with malware.

“There is a common misconception that viruses and malware only exist on Windows and that somehow macOS is immune to them,” Hope said. “While the somewhat misleading Apple ad campaign implying that a Mac can’t get a PC virus is true, they can get infected with a virus/malware designed for macOS. There are malicious apps and web sites that are designed to steal your data or logon information; Apple and Google regularly remove apps from their app stores for this reason. It is important to remember that even a MacBook needs a password and password security is just as important even if you aren’t using Windows.”

Another assumption about security is that employees will naturally be able to recognize phishing attacks. Jonathan Miles, head of strategic intelligence and security research at Mimecast, told Toolbox that a significant number of employees are susceptible to social engineering attacks.

“Organizations need to be educating their workforce on cybersecurity, as Mimecast research shows that 50% of employees still open attachments from unknown sources, and 40% are fooled by an email pretending to be from a member of their organization every week,” Miles said. “To defend and mitigate the threats, it is key that organizations build a layered approach to cybersecurity resilience, including cybersecurity responsibility and awareness embedded deeply throughout all sectors of organizational culture. Offering regular remote working cybersecurity awareness training to employees will be crucial, with organizations recommended to take the initiative on keeping their employees informed about current and prevailing threats.”

New-school security awareness training can give your organization an essential layer of defense by teaching your employees to thwart social engineering attacks.

01Nov

Multi-Stage Vishing Attacks are Coming to an Inbox Near You

November 1, 2021By TecAdmin0 comment

New attacks initially coming in via email are directing victims to make phone calls to attacker-controlled call centers in order to provide banking and credit card details.

I’ve brought these kind of phishing-turned-vishing attacks to your attention previously with examples of fake Amazon password resets or fake orders for expensive items – both pointing recipients to call phone numbers. But new examples of these kinds of increasingly frequent attacks are coming to light.

Rather than sending an email referencing an invoice attachment (usually for the purposes of installing malware), these scams simply use the email as the invoice or payment notice and drive readers towards calling a phone number to dispute the charge.

vishing-scam

These scams are intent on getting recipients to divulge their credit card or banking details – all in the name of “getting you a refund”.

Once again, this very-much unsolicited email should raise a red flag with anyone that receives it, erring on the side of “this is utter garbage” instead of “Oh my! I don’t owe that!” (which is exactly what the scammers want.) Security Awareness Training is the means by which organizations teach users how to stay in that ever-vigilant mode when interacting with email and the web. By doing so, instead of taking everything at face value and believe it by default, users interact with unfamiliar content like this in a far-more scrutinizing manner and are less likely to become victims.

28Oct

Cybercriminals are using Craigslist email notifications to send phishing links

October 28, 2021By TecAdmin0 comment

Cybercriminals are using Craigslist email notifications to send phishing links, according to Roger Kay at INKY. The emails contain links to download a document with malicious macros.

“In early October, several INKY users received real Craigslist email notifications informing them that a published ad of theirs included ‘inappropriate content’ and violated Craigslist’s terms and conditions,” Kay writes. “The notifications gave false instructions on how to avoid having their accounts deleted. In our analysis, we learned that a common thread among recipients of this particular phish was the fact that they were active Craigslist users. The notifications were ‘real’ in the sense that they really did come from a Craigslist domain, but they were fake in the sense that Craigslist itself, either its humans or its machines, did not intend to send them. Without verification from Craigslist, we can’t be sure, but it appears as if Craigslist was compromised since the recipients were not random (they posted ads on the platform) and the emails originated from Craigslist.”

Kay notes that the abuse of Craigslist’s platform allowed the messages to avoid detection by security filters.

“The phishers were able to manipulate the Craigslist email system to send a fake violation notification to that individual,” Kay says. “Since the URL to resolve the issue hosted a customized document placed on Microsoft OneDrive, it did not appear on any threat intelligence feed, allowing it to slip past most security vendors.”

Kay concludes that people should be wary of unsolicited emails that ask them to click a suspicious link.

“Recipients should be on the lookout for unusual requests,” Kay says. “A red flag ought to go up right away if a violation notice comes in that doesn’t correspond to any recipient behavior on the platform in question. Another red flag is the mixing of platforms. It doesn’t make sense to resolve a Craigslist issue through a document uploaded to OneDrive. Recipients should also be suspicious about the indirect way they are being asked to sign the form. Proper protocol would have the form attached directly to the email rather than requiring a trip up to OneDrive and an additional link-click there.”

And, sadly, urgency should always raise our suspicions. “Act now” can appeal equally to fear and greed, and those two emotions are seldom conducive to cognitive clarity or situational awareness. New-school security awareness training can give your employees a healthy sense of suspicion so they can avoid falling for social engineering attacks.

27Oct

Russian SolarWinds Hackers Newly Attack Supply Chain With Password-Spraying and Phishing

October 27, 2021By TecAdmin0 comment

Researchers at Microsoft have observed an attack phishing campaign by Russia’s SVR that’s targeting resellers and managed service providers. Microsoft tracks this threat actor as “Nobelium,” and notes that this is the same actor that was behind the SolarWinds attacks.

“Nobelium has been attempting to replicate the approach it has used in past attacks by targeting organizations integral to the global IT supply chain,” Microsoft stated. “This time, it is attacking a different part of the supply chain: resellers and other technology service providers that customize, deploy and manage cloud services and other technologies on behalf of their customers. We believe Nobelium ultimately hopes to piggyback on any direct access that resellers may have to their customers’ IT systems and more easily impersonate an organization’s trusted technology partner to gain access to their downstream customers.

Microsoft says at least 140 entities have been targeted in this campaign, with 14 being compromised.

“We began observing this latest campaign in May 2021 and have been notifying impacted partners and customers while also developing new technical assistance and guidance for the reseller community,” Microsoft says. “Since May, we have notified more than 140 resellers and technology service providers that have been targeted by Nobelium. We continue to investigate, but to date we believe as many as 14 of these resellers and service providers have been compromised.”

The researchers note that Nobelium isn’t using sophisticated techniques to gain access, and is simply relying on phishing and password spraying.

“The attacks we’ve observed in the recent campaign against resellers and service providers have not attempted to exploit any flaw or vulnerability in software but rather used well-known techniques, like password spray and phishing, to steal legitimate credentials and gain privileged access,” Microsoft says. “We have learned enough about these new attacks, which began as early as May this year, that we can now provide actionable information which can be used to defend against this new approach.”

Again, informed and resistant users are the best protection against attacks that rely on social engineering. New-school security awareness training can give your organization an essential layer of defense by teaching your employees to follow security best practices.

26Oct

Celebrity Hacks and the Frenzy of Renown

October 26, 2021By TecAdmin0 comment

Avast offers a look at incidents in which celebrities have been the victim of social engineering attacks. The firm notes that while celebrities are higher profile targets, attackers use the same tactics against them that work against everyone else.

“Most of the time, celebrities get hacked the same ways anyone else does,” Avast says. “They use weak passwords, fall for social engineering tricks, or suffer from data leaks when larger organizations holding their data are breached.”

In some cases, however, celebrities are victims of attacks they have no control over, such as the breach of law firm Grubman Shire Meiselas & Sacks.

“Celebrity law firm Grubman Shire Meiselas & Sacks, which counts among its clients such A-listers as Madonna, Lil Nas X, Robert De Niro, and LeBron James, recently found itself on the receiving end of a massive hack,” Avast says. “In May 2020, the noted hacking collective REvil — also known as Sodinokibi and one of the world’s most dangerous hacking groups — claimed to have stolen over 750 GB of contracts, emails, NDAs, and other sensitive data. REvil (short for Ransomware Evil) initially demanded a ransom of $21 million, then doubled it. Refusing to pay, the law firm instead turned to the FBI for help.”

In this case, however, the stolen information fortunately wasn’t as sensitive as the hackers made it out to be.

Avast offers the following advice if your accounts or devices are hacked:

“Isolate the hacked device: Unplug any Ethernet cables and disable Wi-Fi on the hacked device. This will prevent any malware from spreading or sending data back to the hacker.
“Change your passwords: Using an unhacked device, create long, hard-to-guess, and unique passwords for all your accounts and devices — we recommend using passphrases. Strong passwords will lock hackers out of your accounts and prevent them from using old passwords to log back in.
“Report the hack and recover your accounts: Most online services, such as Gmail or Facebook, have specific procedures in place for reporting hacks. Follow these procedures for each hacked account to regain control.”

New-school security awareness training can enable your employees to follow security best practices so they can avoid falling for these attacks.

25Oct

Deepfake Technology is Cloning a Voice from the C-Suite

October 25, 2021By TecAdmin0 comment

Criminals used deepfake technology to steal $35 million from a company in the United Arab Emirates, Forbes reports. The attackers used “deep voice” technology to spoof the voice of a company’s director in order to trick a bank manager into transferring the money to the criminals’ bank accounts.

“In early 2020, a bank manager in the United Arab Emirates received a call from a man whose voice he recognized—a director at a company with whom he’d spoken before,” Forbes writes. “The director had good news: His company was about to make an acquisition, so he needed the bank to authorize some transfers to the tune of $35 million. A lawyer named Martin Zelner had been hired to coordinate the procedures and the bank manager could see in his inbox emails from the director and Zelner, confirming what money needed to move where. The bank manager, believing everything appeared legitimate, began making the transfers.”

Jake Moore from ESET told Forbes that people need to be prepared to see more of these types of attacks as the technology becomes easier to use.

“Audio and visual deep fakes represent the fascinating development of 21st century technology yet they are also potentially incredibly dangerous posing a huge threat to data, money and businesses,” Moore said. “We are currently on the cusp of malicious actors shifting expertise and resources into using the latest technology to manipulate people who are innocently unaware of the realms of deep fake technology and even their existence. Manipulating audio, which is easier to orchestrate than making deep fake videos, is only going to increase in volume and without the education and awareness of this new type of attack vector, along with better authentication methods, more businesses are likely to fall victim to very convincing conversations.”

New-school security awareness training can enable your employees to thwart sophisticated social engineering attacks.

21Oct

Phishing Campaign Targets Organizations in India and Afghanistan

October 21, 2021By TecAdmin0 comment

A threat actor based in Pakistan is targeting entities in India and Afghanistan with malware-laden websites, according to researchers at Cisco Talos.

“The threat actor registered multiple domains with political and government themes,” the researchers write. “These domains hosted malware payloads that were distributed to their victims. Their malicious lures also contained themes related to Afghan entities, specifically diplomatic and humanitarian efforts. We assess with high confidence that the threat actor behind these attacks is an individual operating under the guise of a Pakistani IT firm called ‘Bunse Technologies.’ The infection chains consist of malicious RTF documents and PowerShell scripts that distribute malware to victims. We’ve also observed the usage of C#-based downloader binaries to deploy malware while displaying decoy images to victims to appear legitimate.”

The researchers note that criminals and nation-state actors often use commodity malware in their operations. That’s true in this case as well, as the threat actor used dcRAT and QuasarRAT to target Windows machines, and AndroidRAT to target mobile devices.

“This campaign is a classic example of an individual threat actor employing political, humanitarian and diplomatic themes in a campaign to deliver commodity malware to victims,” Cisco Talos says. “Commodity RAT families are increasingly being used by both crimeware and APT groups to infect their targets. These RATs are packed with multiple functionalities to achieve complete control over the victim’s endpoint – from preliminary reconnaissance capabilities to arbitrary command execution and data exfiltration. These families also act as excellent launch pads for deploying additional malware against their victims. Furthermore, these out-of-the-box features enable the attackers to make minimal configuration changes to the RATs taking away the need for a full-fledged development cycle of custom malware by an actor.”

The threat actor also took measures to ensure that their malicious documents would be less likely to be detected.

“The use of a custom file enumerator and infector module by the attackers indicates their intent to proliferate by infecting benign, trusted documents to achieve an even greater degree of infection,” the researchers write.

New-school security awareness training can help your employees thwart targeted phishing attacks.

20Oct

New Impersonation Attack Demonstrates That Threat Actors Don’t Need to Get the Logo Correct

October 20, 2021By TecAdmin0 comment

A new trend in social engineering and impersonation emerges as cybercriminals take advantage of a user’s inability to properly identify fake corporate logos in phishing attacks.

We’ve all seen the really bad impersonation phishing email attempts – you know the one’s where you can immediately tell it’s not the vendor it purports to be from. And then there’s the really good ones that look perfect. But one of the needs most phishing attacks have is a need to display graphics so copied logos and branding can be displayed in order to fool the recipient.

But security researchers at anti-phishing vendor Inky have spotted an attack where scammers attempting to impersonate Verizon use symbols to represent the “check” portion of the logo, making the entirety of the “logo” appear without the need for downloading images.

Verizon-freshphish-2

Source: Inky

You may think, “come on… that doesn’t even look like the Verizon logo at all!” and you’d be right. But new branding research around how well consumers memorize corporate logos correctly shows that most people actually remember a version of the logo enough to recognize it, but most don’t actually know exactly what the logo looks like. Using ten of the most well-known brands, it was concluded that, at best, 30% of people can draw a near-perfect version of the logo, with the average being only 16.6% of people.

This means that it’s far more likely than you think that if a phishing scammer can use some rendition of a logo, it may just be enough to fool them into thinking it’s the company they are attempting to impersonate.

Users that undergo Security Awareness Training are far less likely to fall for phishing attacks, regardless of how spot-on the impersonation. By reinforcing the need to scrutinize unsolicited and unexpected emails for sender details, content, type of request, and – yes – branding, it’s possible to spot nearly every phish a mile away.