In 2020, the year of remote working, cyber crime increased by 80%. That’s equal to an attack every 39 seconds.
To help you avoid getting caught out, expert Karl Susman, Susman Insurance Agency, Cyberman365 reseller, reveals his top 5 tips on how to work remotely safely in the Spring edition of Tort, Trial & Insurance Practice Law Journal from the American Bar Association.
These are essential and easy to implement tips that anyone working from home can do, such as making sure your computer automatically updates.
Check out the featured spread here:
If your organisation is using Microsoft Outlook for email, you can enable and set-up 2FA to protect your email in less than 15 minutes (depending on the number of email accounts).
If you have a policy with us visit Node Prevent and our pre-paid cybersecurity experts will assist.
Passwords are no longer good enough to protect email accounts. We strongly recommend you implement this simple and cost-effective measure. 2FA protects your organization because it adds another layer of protection to password-protected remote access to your email.
2FA is an authentication method that includes a password (something you know) and a time sensitive token or code (something you have).
In other words, even if the hacker has stolen an employee’s login credentials, 2FA should prevent them from accessing an email account, since they would also need to have the employee’s mobile phone which is being used as the 2nd authentication factor.
Microsoft just released new information on a widespread malicious email campaign by Nobelium, the same hackers behind the massive SolarWinds incident.
This active campaign has already targeted 3,000 email accounts across 150 organizations. Microsoft reports the emails are crafted to look like they are from the United States Agency for International Development (USAID), including some that read “special alert” and “Donald Trump has published new documents on election fraud.”
The links go to Nobelium infrastructure and deliver a malicious file which allows hackers “persistent access to compromised machines.” Microsoft published this sample email screenshot from the malicious campaign.
Example email below:
If you receive an email similar to this or purportedly from the USAID, please forward it to your IT department and do NOT click on any links in the email.
Node Prevent
When you purchase one of our cyber insurance policies you’ll receive vital cybersecurity updates such as this and online training courses to keep your employees up-to-date with the current cyber threats.
Adobe just released a security bulletin addressing a zero-day vulnerability, CVE-2021-28550, affecting Adobe Acrobat Reader in both Windows and macOS systems. The affected products include Adobe Acrobat DC, Adobe Acrobat Reader DC, Adobe Acrobat 2020, Adobe Acrobat Reader 2020, Adobe Acrobat 2017, and Adobe Acrobat Reader 2017. The attack exploiting this vulnerability is generally through a malicious PDF attachment to a phishing email. If you receive an unexpected email from an unknown sender with a PDF attachment, verify it is legitimate before opening the attachment!
If you are using an Adobe product, update it as soon as possible. Adobe recommends users update their software to the latest versions.
The latest product versions are available to end users via one of the following methods:
Review Adobe’s latest security updates.
New backdoor malware targeting Linux operating systems has been discovered, hiding as a polkit daemon. It is has been named RedXOR for its network data encoding scheme based on XOR.
Analysing the Tactics, Techniques, and Procedures (TTPs), RedXOR is thought to be developed by Chinese threat actors. The malware samples have low detection rates in VirusTotal, and is used in targeting attacks against legacy Linux systems.
There are also many similarities between RedXOR and the reported malware associated with Winnti umbrella threat group known as the PWNLNX backdoor, as well as to XOR.DDOS and Groundhog, two botnets attributed to Winnti by BlackBerry. The below samples can be used for reference:
The samples are both unstripped 64-bit ELF files called po1kitd-update-k. Similarities between the samples includes the use of old open-source kernel rootkits, both use the CheckLKM function, and both provide the attacker with a pseudo-terminal using Python pty shells and many other similarities.
The malware makes a remote connection to the command and control server over a TCP socket. The traffic is made to look like HTTP traffic. The command and control server instructs the malware to execute different commands returned in the JSESSIONID cookie. The malware can also be updated by the attacker by sending commands to the malware. The malware can also create new remote shells to get a pseudo-terminal (pty) interface and can perform network tunnelling.
How to Detect and Respond
Use the information below to detect and respond this threat. We suggest using the following indicators of compromise to ensure the RedXOR and the files it creates do not exist in your environment:
Indicators of Compromise
RedXOR Hashes
0a76c55fa88d4c134012a5136c09fb938b4be88a382f88bf2804043253b0559f
0423258b94e8a9af58ad63ea493818618de2d8c60cf75ec7980edcaa34dcc919
Network
update[.]cloudjscdn[.]com
158[.]247[.]208[.]230
34[.]92[.]228[].216
Process name
po1kitd-update-k
File and directories created on disk
.po1kitd-update-k
.po1kitd.thumb
.po1kitd-2a4D53
.po1kitd-k3i86dfv
.po1kitd-nrkSh7d6
.po1kitd-2sAq14
.2sAq14
.2a4D53
po1kitd.ko
po1kitd-update.desktop
S99po1kitd-update.sh
Follow these steps if you are a victim of this malware:
Node Prevent
When you purchase one of our cyber insurance policies you’ll receive vital cybersecurity updates such as this and online training courses to keep your employees up-to-date with the current cyber threats.
The U.S. National Security Agency (NSA) recently discovered additional security vulnerabilities in Microsoft Exchange Server 2013 through 2019.
In response, Microsoft released yesterday more security updates for these systems. It is critical that you patch these systems immediately because Microsoft expects threat actors will exploit these vulnerabilities soon. Exchange Online customers are already protected and do not need to act.
Patch Now!
To protect your organization, update your Exchange Server.
You can get the Microsoft updates here.
Interested to learn more? Read our article from the beginning of March which explained what happened.
Identity management is focused on protecting the identities of employees and clients. Compromised employees’ identities can be used by hackers to gain access and wreak havoc on unexpecting companies.
Cybersecurity insurance can help protect businesses from the negative impact of exposed identities.
One way we may protect our insured’s clients from identity theft after a data breach is by activating credit monitoring. If criminals try to use their leaked data to commit financial fraud this will be flagged and prevented.
5 stats that highlight the growing importance of identity security.
Attackers have developed two new business email compromise (BEC) phishing techniques that evade email security filters by manipulating Microsoft 365’s automated email responses.
Both were seen being used in the United States in December 2020 during the holidays.
Step 1 – “Disposition-Notification-To” Read-Receipt Notification
With the read-receipts attack, the attacker creates an email and changes the “Disposition-Notification-To” email header to create a read-receipt notification from Microsoft 365 to the recipient.
The email should get caught by email security filters, but since it is created from the internal system, the read receipt is sent to the target, bypassing traditional security filters and is sent to the employee’s inbox,
Step 2 – Out-of-Office (OOO) Attack
With the OOO attack, a the attacker creates a BEC email impersonating someone inside the company. The attacker changes the “Reply-To” email header so that if the target has an OOO message turned on, that OOO notification (that includes the original text) is directed to someone else within the organisation.
Again, the message most likely will not be caught by email security filters, because it originates from the original target’s account, not externally.
Business Email Compromise (BEC) is Still a Serious Email Threat
BEC emails are used to steal money from companies, often by impersonating an employee, vendor or customer in an email or mobile message. It often involves the attacker asking to pay a fake invoice, recurring payment or wire transfer.
The amount of BEC attacks continues to grow. According to Abnormal Security’s Quarterly BEC Report, BEC attacks rose by 15 percent quarter-over-quarter in Q3 of 2020.
BEC attacks rose by 15% quarter-over-quarter in Q3 of 2020.
Abnormal Security’s Quarterly BEC Report,
The average BEC attack volume per week during that time increased in six out of eight industries. The largest increase in BEC attacks was 93 percent in the energy/infrastructure sector. The highest number of weekly BEC attacks were in retail/consumer goods and manufacturing and technology. The study found these BEC campaigns used mostly invoice and payment fraud, with a 155 percent Quarter on Quarter.
The study found these BEC campaigns used mostly invoice and payment fraud, with a 155 percent Quarter on Quarter.
ABNORMAL SECURITY’S QUARTERLY BEC REPORT,
As email-security gets better, so do cybercriminals. For example, in early January a campaign was launched that leveraged Google’s Forms survey tool to create an ongoing conversation between the email recipient and the attacker which set up victims for future BEC attacks.
Microsoft and Office 365 are Big Targets
The Microsoft Office 365 cloud environment is a big target for BEC compromise as well.
Once hackers compromise an Office 365 environment, these BEC scammers can leverage trusted communications. For example, attackers can send an illegitimate email from the CEO’s official account to socially engineer employees, customers, or partners.
Attackers can also search through emails, chat histories and files to steal passwords or other important data. They can also set up forwarding rules to get access to emails without needing to sign in again. Furthermore, they could plant malware or malicious links into commonly used and trusted documents. The goal here is to manipulate something everyone trusts to bypass prevention controls that could trigger alerts to ultimately steal or hold files and data for ransom.
Protecting Against BEC Attacks
BEC attacks are hard to detect with typical tools and methods because they do not use malware or malicious URLs that can be detected by antivirus, so mitigating this threat can be difficult. Traditionally, the best defence for these kinds of attacks is end-user training and awareness so end-users can verify a request is indeed legitimate. It is also always a good idea to implement 2FA for email, configure your email to filter out suspicious looking phishing emails, and use updated end-point protection and antivirus.
An advanced Microsoft Office 365 phishing campaign is being launched at C-level executives, executive assistants, and financial departments.
Some of these attacks see newly-appointed, unannounced CEO’s as victims. In these cases, attackers try to take advantage of the executives during their transition period to gain unauthorized access to the account.
Attackers try to compromise any company account or a 3rd party partner and then use collected sensitive information to create more sophisticated attacks to phish C-level executives.
This campaign began in early December 2020 and is still ongoing as of March 2021. The attackers are leveraging phishing toolkits and many sophisticated methods.
Most of the phishing emails are sent from addresses with Microsoft-themed sender domains, with properly configured SPF records and are made to look like messages from the company, carrying fake alerts about “Important Service Changes”, “Important Security Policy Update”, etc.
The majority of the targeted email accounts used the format first name.last name@company domain, making full names in the attachments easy to automate. But even in cases where only initials appeared in the email address, the attackers still included the victim’s full name in the PDF attachment. This suggests the threat actors conducted additional prior research to carefully carry out spear phishing attacks.
Through malicious attachments, the victim is sent to a spoofed Microsoft-looking themed webpage with a fake Office 365 login page. If the victim enters their account credentials into the phishing portal, the attacker can then verify it was a valid Office 365 address. If after the victim enters their credentials, the victim may simply be redirected to the legitimate sign-in website like nothing ever happened.
How to Protect Yourself
Sophisticated phishing attacks are hard to detect with typical tools and methods because they do not use malware or malicious URLs that can be detected by antivirus. While it is important that you always use updated end-point protection and antivirus, mitigating this threat is hard. Here are some best practices:
Node Prevent
When you purchase one of our cyber insurance policies we include Node Prevent, a free service with employee training, how to implement best practices and threat alerts such as these.
Copyright © 2021 Node International
All Rights Reserved
One Minster Court
Mincing Lane
London
EC3R 7AA
Recent Comments