Tag Archive for: phishing

,

How to spot ‘spear phishing’, an insidious cybercrime trend

True story: At a company I once worked for, employees received an email about an unexpected bonus. In private Slack channels, we wondered whether it was a well-played phishing attempt. Turns out, the bonus was legit, but so was our inclination to question it. Phishing—when cybercriminals pose as legitimate institutions to get info or money from you—is the origin of up to 90 percent of breaches and hacking incidents, says Frank Cilluffo, director of Auburn University’s McCrary Institute for Cyber and Critical Infrastructure Security in Alabama.

These cyber bad guys have even taken it to the next level with “spear phishing,” a practice of sending emails that appear to be from someone you personally know. “This happened to me once and it was a humbling experience,” says Adam Doupé, director of the Center for Cybersecurity and Digital Forensics at Arizona State University in Tempe. Turns out, the email seemed to be coming from a colleague, and Doupé was boarding a plane when he got it so he wasn’t as careful as he would normally be. “I ended up replying with my cell phone number,” recalls Doupé. “When the phisher responded with a request to send gift cards, the alarm bells went off.”

Knowing that a cybersecurity expert got played, an average person has to be hypervigilant. But could you be missing out on legit offers and emails because you’re being too cautious? Your first line of defense: install a protection software (like Malwarebytes). This sort of protection that lives on your computer, coupled with our expert tips below, will stop phishers in their tracks.

3 Ways To Tell If It’s Phishing Or Not

Experts say there are a few things you can do if you’re unsure whether an email is a phishing attempt.

1. Check the email address carefully.

Hover your cursor over the full email—not just the sender’s name—to see if anything looks off. “For instance, instead of .com, the address may contain .ru,” says Cilluffo. (.Ru indicates that it’s from a Russian server.) Compare the address on a recent email to one that you’ve responded to previously.

2. Call or text the person you think may have sent the email.

Ever receive an email from a friend or colleague and it seems off? Maybe it’s much briefer than usual or perhaps they addressed you by your full name rather than a nickname. Trust your gut, and don’t respond or click on any links or attachments until you’ve verified the email. While it truly may just be a link to their kids’ fundraiser, it could be the work of a cyber criminal trying to get you to download malware—aka malicious software.

3. Verify through an independent news source.

Sometimes you may receive an email about an important recall notice or info about a class-action lawsuit. Search on a trustworthy news site whether the link contained in your email appears in any news articles, suggests Doupé.

Bottom line?

Cyber criminals are getting more and more creative at making their phishing attempts appear legitimate. Go with your gut, slow down to verify the validity of messages you receive and install a protection software (like Malwarebytes) to stop phishers before they start.

Are you interested in learning more about cybersecurity? Call us today and discover how our wide array of tech services can safeguard your business.

If you are looking for an expert to help you find the best solutions for your business talk to GCInfotech about a free technology assessment

Published with consideration from yahoo.com SOURCE

/by
,

HTML attachments remain popular among phishing actors in 2022

HTML files remain one of the most popular attachments used in phishing attacks for the first four months of 2022, showing that the technique remains effective against antispam engines and works well on the victims themselves.

HTML (HyperText Markup Language) is a language that defines the meaning and structure of web content. HTML files are interactive content documents designed specifically for digital viewing within web browsers.

In phishing emails, HTML files are commonly used to redirect users to malicious sites, download files, or to even display phishing forms locally within the browser.

As HTML is not malicious, attachments tend not to be detected by email security products, thus doing a good landing in recipients’ inboxes.

Statistical data from Kaspersky indicates that the trend of using HTML attachments in malicious emails is still going strong, as the security company detected 2 million emails of this kind targeting its customers in the first four months of the year.

The numbers culminated in March 2022, when Kaspersky’s telemetry data counted 851,000 detections, while a drop to 387,000 in April could be just a momentary shift.

How HTML evades detection

The phishing forms, redirection mechanisms, and data-stealing elements in HTML attachments are typically implemented using various methods, ranging from simple redirects to obfuscating JavaScript to hide phishing forms.

Attachments are base64 encoded when present in email messages, allowing secure email gateways and antivirus software to easily scan attachments for malicious URLs, scripts, or other behavior.

To evade detection, threat actors commonly use JavaScript in the HTML attachments that will be used to generate the malicious phishing form or redirect.

The use of JavaScript in HTML attachments to hide malicious URLs and behavior is called HTML smuggling and has become a very popular technique over the past few years.

To make it even harder to detect malicious scripts, threat actors obfuscate them using freely-available tools that can accept custom configuration for a unique, and thus less likely to be detected, result and thus evade detection.

For example, in November, we reported that threat actors used morse code in their HTML attachment to obfuscate a phishing form that the HTML attachment would display when opened.

Kaspersky notes that in some cases, the threat actors use encoding methods involving deprecated functions like the “unescape()”, which substitutes “%xx” character sequences in the string with their ASCII equivalents.

While this function has been replaced by decodeURI() and decodeURIComponent() today, most modern browsers still support it. Still, it might be ignored by security tools and antispam engines that focus more on current methods.

Conclusion

HTML attachment distribution was first seen spiking in 2019, but they remain a common technique in 2022 phishing campaigns, so they should be seen as red flags.

Remember, merely opening these files is often enough to have JavaScript run on your system, which may lead to automatic malware assembly on the disk and the bypassing of security software.

As the security software doesn’t detect an attachment as malicious, recipients may be more likely to open them and become infected.

Even if your email security solution doesn’t generate any warnings, you should always treat HTML attachments as highly suspicious.

Are you interested in learning more about cybersecurity? Call us today and discover how our wide array of tech services can safeguard your business.

If you are looking for an expert to help you find the best solutions for your business talk to GCInfotech about a free technology assessment

Published with consideration from bleepingcomputer.com SOURCE

/by
,

FBI says business email compromise is a $43 billion scam

The Federal Bureau of Investigation (FBI) said today that the amount of money lost to business email compromise (BEC) scams continues to grow each year, with a 65% increase in the identified global exposed losses between July 2019 and December 2021.

From June 2016 until July 2019, IC3 received victim complaints regarding 241,206 domestic and international incidents, with a total exposed dollar loss of $43,312,749,946.

“Based on the financial data reported to the IC3 for 2021, banks located in Thailand and Hong Kong were the primary international destinations of fraudulent funds,” the FBI said.

“China, which ranked in the top two destinations in previous years, ranked third in 2021 followed by Mexico and Singapore.”

This was revealed in a new public service announcement published on the Internet Crime Complaint Center (IC3) site as an update to a previous PSA from September 2019, when the FBI said losses to BEC attacks reported by victims between June 2016 and July 2019 reached a total of over $26 billion.

According to the IC3 2021 Internet Crime Report [PDF], BEC scams were the cybercrime type with the highest reported total victim losses last year.

Victims reported losses of almost $2.4 billion in 2021, based on 19,954 recorded complaints linked to BEC attacks targeting individuals and businesses.

BEC scam?

BEC scammers are employing various tactics — including social engineering, phishing, and hacking — to compromise business email accounts which will get used to redirect payments to attacker-controlled bank accounts.

In this type of scam (also known as EAC or Email Account Compromise), the crooks will commonly target small, medium, and large businesses. Still, they’re also attacking individuals if the payout is worth it.

Their success rate is also very high, given that they generally impersonate someone who has the target’s trust, such as business partners or company executives.

However, “the scam is not always associated with a transfer-of-funds request,” as the FBI explained in the PSA alert.

“One variation involves compromising legitimate business email accounts and requesting employees’ Personally Identifiable Information, Wage and Tax Statement (W-2) forms, or even crypto currency wallets.”

BEC defense guidance

The FBI also provided guidance on how to defend against BEC scam attempts:

  • Use secondary channels or two-factor authentication to verify requests for changes in account information.
  • Ensure the URL in emails is associated with the business/individual it claims to be from.
  • Be alert to hyperlinks that may contain misspellings of the actual domain name.
  • Refrain from supplying login credentials or PII of any sort via email. Be aware that many emails requesting your personal information may appear to be legitimate.
  • Verify the email address used to send emails, especially when using a mobile or handheld device, by ensuring the sender’s address appears to match who it is coming from.
  • Ensure the settings in employees’ computers are enabled to allow full email extensions to be viewed.
  • Monitor your personal financial accounts on a regular basis for irregularities, such as missing deposits.

The federal law enforcement agency advises those who fall victim to BEC fraud to immediately reach out to their bank to request a recall of funds.

They’re also urged to file a complaint with the FBI at BEC.ic3.gov, regardless of the lost amount, and as soon as possible.

Published with consideration from BleepingComputer  SOURCE

/by
,

Why managed IT services is best for SMB cybersecurity

Without technology, businesses cannot compete and succeed. But with the advancement in technology comes the ever-constant threat of hackers and cybercriminals. That’s why small- and mid-sized businesses (SMBs) need to protect themselves with robust cybersecurity solutions managed by reputable managed IT services providers (MSPs).

The numbers

Through the years, the number of SMBs falling victim to cyberattacks has drastically increased. Ransomware attacks, misconfigured systems, credential stuffing, and social engineering are among the many cyberthreats that SMBs face. Also, according to Verizon’s 2021 Data Breach Investigations Report, one in every five data breach victims was an SMB. What’s more, only 47% of SMBs are able to detect breaches within days.

The financial consequences have also considerably increased. IBM’s Cost of a Data Breach Report 2021 shows that “data breach costs rose from USD 3.86 million to USD 4.24 million.”

The numbers don’t lie, so it’s only about time SMBs take cybersecurity seriously. You can safeguard your business from cyberattacks and provide a more secure customer experience by working with a trusted MSP.

Why managed services?

Partnering with MSPs is the most effective way to prevent attacks and defend against malicious threats. MSPs offer a full range of proactive IT support that focuses on advanced security, such as around-the-clock monitoring, data encryption and backup, real-time threat prevention and elimination, network and firewall protection, security awareness training, and more. Here are some of the services an MSP can offer:

    • Around-the-clock monitoring – A cyberattack can happen at any moment. By having someone watching your networks and systems 24/7, MSPs ensure that any potential threats are identified and dealt with quickly.
    • Data encryption and backup – Data encryption transforms readable data into an unreadable format. This can be done through the use of a key, which is only accessible to authorized users. This way, even if the data is compromised, it can’t be read without the key. Meanwhile, data backup is the process of creating and preserving copies of data so that it can be restored in the event of data loss.
    • Real-time threat prevention and elimination – By using technology that can detect and stop threats as they happen, this security solution can minimize the impact of an attack and keep your business data safe.
    • Network and firewall protection – Networks and firewalls create a barrier between the business network and the internet, securing confidential data, such as customer information, employee records, and trade secrets. Networks can be configured to allow certain types of traffic through while blocking others, so that only authorized users can access specific resources.
    • Security awareness training – Now, more than ever, SMBs need to be aware of cybersecurity threats and how to protect themselves. MSPs can facilitate security awareness training that can help employees spot red flags and know what to do (and not do) to keep company data safe.

Managed IT services are designed to identify and fix weak spots in your IT infrastructure, enabling you to optimize the digital backbone of your business processes. With managed IT, you’ll also have faster network performance, a solid business continuity and disaster recovery strategy, and minimal downtime. You’ll also get a dedicated team of IT professionals ready to assist you with any technology-related problems. This is much more effective and budget-friendly than having in-house personnel juggling all of your business IT needs.

Being proactive when it comes to cybersecurity is the only way to protect what you’ve worked hard to build. If you’d like to know more about how managed services can benefit your business, just give us a call — we’re sure to help.

Are you interested in learning more about cybersecurity? Call us today and discover how our wide array of tech services can safeguard your business.

If you are looking for an expert to help you find the best solutions for your business talk to GCInfotech about a free technology assessment

Published with consideration from techadvisory.org SOURCE

/by
,

How to protect your business from Mac ransomware

Windows users are often the victims of ransomware attacks. For example, in 2017, WannaCry and Petya ransomware infected hundreds of thousands of Windows PCs around the world. Unfortunately, ransomware strains that specifically target Macs are expected to grow in number as well. If you have a Mac, follow the security best practices below to avoid getting infected.

What is ransomware?

Ransomware is a type of malicious software that holds computer systems hostage via encryption until a ransom is paid. Attackers typically threaten to release the encrypted information to the public or destroy sensitive data if victims don’t pay within a certain deadline. Healthcare and finance organizations, in particular, are more likely to pay the ransom because these organizations tend to be worth a lot of money and have many valuable assets, and can’t afford to lose access to their critical data.

As its name suggests, Mac ransomware is simply ransomware that targets Mac desktops and laptops. And just like other types of ransomware, it is typically distributed via phishing emails.

Types of Mac ransomware

In 2016, the KeRanger ransomware was distributed through the popular BitTorrent app Transmission. KeRanger was signed with an authorized security certificate, allowing it to evade macOS’s built-in security measures and infect more than 7,000 Mac computers.

Meanwhile, the Mac ransomware strain Patcher was discovered in 2017. It disguised itself as a patching app for programs like Microsoft Office. When launched, Patcher would encrypt files in user directories and ask for a Bitcoin ransom. But the ransomware was poorly built, so there was no way to retrieve the decryption key once the ransom was paid.

In 2019, the EvilQuest ransomware encrypted files and forced victims into paying a Bitcoin ransom. Much like Patcher, however, there was no decryption key, leaving those who paid the ransom with nothing.

Ransomware attacks like these can make a resurgence at any time, which is why you need to be prepared in case of an attack.

An ounce of prevention goes a long way

Preventive measures are the best way to keep your Macs safe from ransomware. This involves installing only programs from the official App Store and the latest software patches to defend against the latest threats.

Since phishing emails are the usual delivery method of ransomware, be wary of suspicious links and email attachments. Always be on alert even if the email appears to come from a legitimate company or someone you know.

You must also maintain offline backups and have a disaster recovery plan to keep your business running in the event that ransomware successfully infiltrates your systems.

Responding to ransomware

If your Mac is infected with ransomware, do not pay the ransom fee, as there’s no guarantee that hackers will provide a decryption key and release your data. Instead, use an up-to-date anti-malware program to remove ransomware from your computer. There are also free ransomware decryption tools online that you can use to remove the infection.

If these tools don’t work, contain the spread of the ransomware by disconnecting from the network. Afterwards, run data recovery procedures and immediately seek the help of our cybersecurity experts. We stay abreast of the latest Mac security threats and know just how to keep your business safe.

If you are looking for an expert to help you find the best solutions for your business talk to GCInfotech about a free technology assessment

Published with consideration from TechAdvisory.org SOURCE

/by