Blog

19Oct

Iranian Phishing Campaigns Are Running Rampant

October 19, 2021By TecAdmin0 comment

Researchers at Google’s Threat Analysis Group (TAG) are tracking phishing campaigns by the Iranian threat actor APT35 (also known as Charming Kitten). The attackers used compromised websites to harvest users’ credentials.

“In early 2021, APT35 compromised a website affiliated with a UK university to host a phishing kit,” the researchers write. “ Attackers sent email messages with links to this website to harvest credentials for platforms such as Gmail, Hotmail, and Yahoo. Users were instructed to activate an invitation to a (fake) webinar by logging in. The phishing kit will also ask for second-factor authentication codes sent to devices. APT35 has relied on this technique since 2017 — targeting high-value accounts in government, academia, journalism, NGOs, foreign policy, and national security. Credential phishing through a compromised website demonstrates these attackers will go to great lengths to appear legitimate – as they know it’s difficult for users to detect this kind of attack.”

Google notes that the attackers also posed as conference officials to target people interested in events held in Munich and Italy.

“One of the most notable characteristics of APT35 is their impersonation of conference officials to conduct phishing attacks,” the researchers write. “Attackers used the Munich Security and the Think-20 (T20) Italy conferences as lures in non-malicious first contact email messages to get users to respond. When they did, attackers sent them phishing links in follow-on correspondence. Targets typically had to navigate through at least one redirect before landing on a phishing domain. Link shorteners and click trackers are heavily used for this purpose, and are oftentimes embedded within PDF files. We’ve disrupted attacks using Google Drive, App Scripts, and Sites pages in these campaigns as APT35 tries to get around our defenses. Services from Dropbox and Microsoft are also abused.”

New-school security awareness training can enable your employees to thwart both criminal and state-sponsored social engineering attacks.

14Oct

Two-Thirds of Organizations Have Been a Target of Ransomware

October 14, 2021By TecAdmin0 comment

The latest data reveals ransomware’s pervasiveness throughout every industry, size, and type of organization, confirming its’ place as the number one cyberthreat today – and a glaring clue why…

We told you last month about Fortinet’s findings where ransomware grew over 1000% between July 2020 and June 2021. This new data from Fortinet’s 2021 Ransomware Survey Report shows just how egregious ransomware attacks are today, and how organizations aren’t making the connection between the cyberattack and their own users. First a bit of data on the state of ransomware attacks:

67% of orgs have been a target of ransomware attacks
16% have been hit three or more times
96% feel at least moderately prepared (despite the % of attacks indicating otherwise)

So, organizations should take a look at why they are being hit so much, right? I don’t think they seeing what I’m seeing in the rest of the data – take a look:

Nearly a third (32%) say there’s a lack of Security Awareness Training
61% have user training – but as part of an incident response plan (after and not before???)
58% of ransomware attacks in North America start with phishing a user

And most importantly:

In the list of protection and defensive measures essential to secure against ransomware, nowhere to be found is Security Awareness Training:

10-11-21 Image Source: Fortinet

I can only conclude that organizations today are not making the connection between their own users playing a part in either helping or stopping ransomware attacks and the value Security Awareness Training brings to a proactive security stance designed to stop ransomware attacks that start with phishing as the initial attack vector.

09Oct

What’s Next for the 3.8 Billion Entries in the Clubhouse-Facebook Database? Plenty of Social Engineering Attacks

October 9, 2021By TecAdmin0 comment

What do you get when you add a totally free 1.3 Billion set of phone numbers and data from millions of Facebook profiles? A massive dox database of users now up for sale for $100,000.

The Clubhouse data breach earlier this year, while headline-worthy, resulted in a big nothing where all the phone numbers exfiltrated were simply posted on the Dark Web. But one enterprising hacker combined the Clubhouse data with several of the already famous Facebook breaches, along with other data sources to create a 3.8 billion-strong database of accounts.

It’s been posted up for sale for $100,000 to any and all takers who believe they can do some effective mischief and malice with it.

There are a few ways this data can be used:

SMiShing Attacks – if threat actors have your phone number and name, they can use texting to trick you into all kinds of badness; credential attacks, fraud, malware, and more.
Account Takeover Attacks – with the Facebook account details and phone number, it’s possible to potentially brute force account logins, even perform SIM-swapping for accounts using SMS as their 2Fa.
Social Engineering Attacks – I’ve seen successful attacks with less pertinent or valuable details over the years. Having your current phone number and Facebook logon is easily enough to trick users into giving up their credentials, credit card details, and more.

This latest sale of data raises a major red flag for organizations – with literally billions of users prime for social engineering scams, this data set can easily be used to target executives, those in the Finance department, etc. in an interest to infect corporate endpoints, install ransomware, etc.

Users should be warned against any kind of notification that either overtly is tied to Facebook or could remotely be associated with their Facebook account. Users that undergo continual Security Awareness Training should already be aware of this potential scam and be vigilant against it.

07Oct

Telecom Company Responsible for Routing Billions of Text Messages Annually Acknowledges Multi-Year Breach

October 7, 2021By TecAdmin0 comment

Mentioned in passing as part of a Securities and Exchange Commission (SEC) filing, Syniverse admits to hackers having access for five years, potentially impacting millions of mobile phone users worldwide.

In the middle of a recent 837-page SEC filing, telecom company Syniverse mentioned to shareholders of a 2016 data breach that was only discovered earlier this year. Under the topic of how breaches, lapses in data privacy, and other damages to IT operations could impact Syniverse’s business operations, Syniverse acknowledged the 2016 breach flippantly, presenting it merely as “an example.” From the filing (emphasis is mine):

For example, in May 2021, Syniverse became aware of unauthorized access to its operational and information technology systems by an unknown individual or organization (the “May 2021 Incident”). Promptly upon Syniverse’s detection of the unauthorized access, Syniverse launched an internal investigation, notified law enforcement, commenced remedial actions and engaged the services of specialized legal counsel and other incident response professionals. Syniverse has conducted a thorough investigation of the incident.

The results of the investigation revealed that the unauthorized access began in May 2016. Syniverse’s investigation revealed that the individual or organization gained unauthorized access to databases within its network on several occasions, and that login information allowing access to or from its Electronic Data Transfer (“EDT”) environment was compromised for approximately 235 of its customers. All EDT customers have been notified and have had their credentials reset or inactivated, even if their credentials were not impacted by the incident. All customers whose credentials were impacted have been notified of that circumstance.

It’s not clear exactly how hackers were able to compromise the Syniverse network, but, for perspective, I’ve covered how the average dwell time for recent ransomware attacks is 13 days – whereas the Syniverse breach lasted 5 years (1825 days)!!! The filing does mention “All customers whose credentials were impacted have been notified of that circumstance,” which denotes that credentials were compromise and lateral movement is likely.

The potential access gained, data exfiltrated, systems misused, and damage done is incalculable – despite Syniverse’s claims that “there was no attempt to monetize the unauthorized activity.” Cyber forensics is only as good as the logging that exists and whether the threat actor worked to delete their trail.

This attack is a reminder that the best position in a data breach is to be so well-protected the breach never happens. And, given it took Syniverse’s IT team 5 years to even identify the attack, it’s also a reminder that your security strategy needs to include detection and remediation, in addition to prevention and protection.

05Oct

Phishing: Low- Middle- and High-Level

October 5, 2021By TecAdmin0 comment

Phishing attacks have varying levels of technical sophistication, according to Mark Nicholls from Redscan. In an article published by ITProPortal, Nicholls explains that the lowest level of phishing attacks are simple emails designed to rope a victim into a scam.

“The most basic phishing emails are designed to establish a relationship with the target,” Nicholls says. “There are no links or malicious attachments to open. The phish is simply a primer for future communications, such as requests for payment. Messages are typically plain text and sent via widely used email services such as Gmail, which means they are very likely to bypass mail filters rather than be marked as spam. The sender’s name used is often a senior person within an organization, such as the CEO.”

More sophisticated phishing campaigns involve setting up spoofed websites and luring victims into entering sensitive information or downloading malware.

“To conduct mid-level phishing campaigns, attackers use basic hacking tactics, techniques and procedures,” Nicholls says. “A very common technique involves cybercriminals purchasing a private domain and using it to host a landing page that is cloned from a legitimate website. It’s a more sophisticated version of copy and paste, but with the right know-how is quick to perform. With a cloned site set-up, an attacker will email their target, share a link to the fake page and lure them into entering their details.”

The most sophisticated and damaging attacks are highly targeted phishing operations that involve a great deal of preparation and intelligence gathering on specific organizations and employees.

“Highly skilled cybercriminals use similar techniques to mid-level attackers,” Nicholls writes. “However, they are more skillful and better-resourced, making their attacks increasingly challenging to safeguard against. The professionals that create and leverage advanced phishing campaigns such as Business Email Compromise (BEC) attacks conduct extensive open-source intelligence gathering on their targets. This involves profiling individuals but also the organizations they work for. Job advertisements are often a good source of information, disclosing details about the types of systems, applications and security tools organizations use.”

New-school security awareness training can enable your employees to defend themselves against phishing attacks of all levels of sophistication.

04Oct

Hackers rob thousands of Coinbase customers using phishing attacks and an MFA flaw

October 4, 2021By TecAdmin0 comment

Bleepingcomputer was first to report: “Crypto exchange Coinbase disclosed that a threat actor stole cryptocurrency from 6,000 customers after using a vulnerability to bypass the company’s SMS multi-factor authentication security feature.

Coinbase is the world’s second-largest cryptocurrency exchange, with approximately 68 million users from over 100 countries.

In a notification sent to affected customers this week, Coinbase explains that between March and May 20th, 2021, a threat actor conducted a hacking campaign to breach Coinbase customer accounts and steal cryptocurrency.

To conduct the attack, Coinbase says the attackers needed to know the customer’s email address, password, and phone number associated with their Coinbase account and have access to the victim’s email account.

While it is unknown how the threat actors gained access to this information, Coinbase believes it was through phishing campaigns targeting Coinbase customers to steal account credentials, which have become common. Additionally, banking trojans traditionally used to steal online bank accounts are also known to steal Coinbase accounts. Full story at Bleepingcomputer.

02Oct

90% of All Cyber Attacks on Organizations Involve Social Engineering

October 2, 2021By TecAdmin0 comment

It’s official: threat actors and cybercriminal gangs alike are enlightened and have locked in on the use of social engineering as the primary means to trick recipients into becoming victims.

At the end of the day, any attack that utilizes email as the delivery mechanism requires the engagement of the email recipient. Whether your users are clicking a link, opening an attachment, or performing the requested task, your users have to do something to enable an attack.

It’s one of the reasons social engineering has become a staple in the threat actor’s arsenal of tools. And, according to Positive Technologies’ Cybersecurity Threatscape: Q2 2021 report, social engineering is nearly ubiquitous across all attacks and are involved in 90% of all cyberattacks. With email used as the primary method of distribution of malware (58% of attacks), it’s necessary to use social engineering to both get the recipient’s attention and motivate them to engage with the malicious email content.

To get a better sense of how social engineering is used, take a look at some of the other stats from this report:

77% of attacks were targeted (spoofing of a brand or individual is likely used)
73% of attacks involve malware (an attachment or link is the singular focus)

Additionally, the report highlights the focus for the majority of campaigns:

69% of attacks on organizations involve ransomware
59% of attacks were intent on gaining access to data

With social engineering taking such a prominent place in cyberattacks, it has become necessary to counteract these tactics with Security Awareness Training. Your users can be both vigilant on the types of attacks and the specific campaigns so they are armed with an understanding of current social engineering tactics and know how to identify them.

01Oct

Europol: Italian Mafia Tied to Cybercriminals Responsible for €10 Million in Cyberattacks

October 1, 2021By TecAdmin0 comment

The recent dismantling of a cybercriminal gang has uncovered ties to the Italian Mafia, demonstrating that even traditional organized crime is moving to cyber.

This month, a collaborative effort between Europol and Eurojust law enforcement agencies with Italian National Police resulted in the taking down of a cybercrime group responsible for phishing attacks, business email compromise, and money laundering, taking hundreds of victims for millions of euros.

According to the Europol, “The Spanish National Police (Policía Nacional), supported by the Italian National Police (Polizia di Stato), Europol and Eurojust, dismantled an organised crime group linked to the Italian Mafia involved in online fraud, money laundering, drug trafficking and property crime.”

Of the 106 arrested, most are Italian nationals that have ties to the Italian Mafia. The money collected via mostly fraud was laundered using networks of shell companies and money mules within Italy.

When we hear about a Mafia, we tend to think about the one we see on TV, complete with tough guys, alcohol, drugs, and large sums of cash. But this latest takedown demonstrates that the mafia’s of old are realizing the opportunity to make money online.

Most of the attacks carried out by this group leveraged phishing and social engineering techniques to trick their victims. Users within organizations that undergo Security Awareness Training are better prepared to identify these kinds of attacks, eliminating their effectiveness.

30Sep

Travel-Related Phishing Scams and Websites Surge More Than 400%

September 30, 2021By TecAdmin0 comment

Pent-up demand for traveling – both domestically and internationally – has driven an interest by cybercriminals to take advantage of those traveling to become phishing victims.

Security researchers at Palo Alto Network’s Unit 42 have identified a material jump in the number of travel-related phishing URLs of over 4x that of January of this year. One of the primary pieces of malware using these URLs is Dridex. Phishing campaigns using Dridex typically focuses on campaigns around billing or invoicing. But Unit 42 has spotted a jump in URLs related to travel – words like “vacation” or “airline” are commonly a part of the URL.

Their tactics remain the same – use a malicious Excel spreadsheet that is either attached to the email or linked to via Dropbox. But the campaign tone and theming is now very much travel-related.

Beyond the Dridex banking trojan, Unit42 also notes that in many cases, collection of details (e.g., personal data, credit card information, online credentials, etc.) is also a focus, as it can be sold on the Dark Web.

As long as users are vigilant through continual Security Awareness Training, they will recognize these emails as being unsolicited and suspicious, making them powerless and ineffective.

29Sep

Someone’s Impersonating the California DMV in Texts

September 29, 2021By TecAdmin0 comment

The California DMV has warned of an ongoing smishing campaign seeking customers’ personal and financial information, Pasadena Now reports.

“The California Department of Motor Vehicles (DMV) reminds customers that it will never ask for personal information related to driver’s license number, Social Security number or financial information through text or unsolicited phone calls or email,” the DMV said in a statement. “The DMV has heard from multiple customers who have received text messages directing them to an unfamiliar link. If a link does not direct customers to the main DMV website at dmv.ca.gov, it is NOT from the DMV.

The department stressed that, while it sometimes does send texts or emails to customers, it won’t contact you out of the blue asking for personal information.

“The DMV does not send customers unsolicited requests for information,” the DMV stated. “When the DMV texts or emails customers, it is based on action initiated by the customer. For example, customers may receive an appointment reminder or cancelation notice by text or email from the DMV. Customers may also receive an email related to DMV services that directs customers to the dmv.ca.gov website to take an action if they choose. Also, when a customer establishes an online account with DMV or has initiated an interactive, assisted online transaction with the DMV, further information may be requested.”

The DMV added that people should either ignore or report these phishing attempts.

“The department recommends customers ignore or delete any unsolicited texts or emails requesting personal information claiming to be on behalf of the DMV. Customers can report the phishing attack to the FTC at ftc.gov. If you receive a phishing email, forward it to the Anti-Phishing Working Group at reportphishing@apwg.org. For a phishing text message, forward it to SPAM (7726).”

New-school security awareness training can enable your employees to avoid falling for social engineering attacks.