Security Awareness Newsletter June 2024

Getting this out a little late. This is a newsletter that I put together for our internal security awareness program. Feel free to grab and use within your own security awareness program. Created with help from ChatGPT.

Rising Threat of Business Email Compromise (BEC) Scams 

The FBI’s Internet Crime Complaint Center (IC3) has warned about the growing threat of Business Email Compromise (BEC) scams targeting businesses and individuals to steal money through fraudulent emails. 

Key Points: 

• What is BEC? Cybercriminals hack or spoof business emails to trick victims into transferring funds or revealing sensitive information. 

• Scam Tactics: 

• Phishing: Fake emails to access business accounts. 

• Spoofing: Deceptive email addresses mimicking legitimate ones. 

• Impersonation: Pretending to be executives or trusted partners. 

• Recent Trends: Increased targeting of real estate, legal, and financial services with sophisticated AI-generated emails and deepfake audio. 

• Impact: BEC scams have caused billions in financial losses annually. 

• Prevention Tips: 

• Verify any fund transfer requests through separate communication channels. 

• Educate employees on phishing and suspicious activities. 

• Use multi-factor authentication (MFA). 

• Monitor accounts for unusual activities. 

• Report suspected scams to the IC3 at www.ic3.gov. 

Stay vigilant and protect your organization from BEC scams. For more details, visit the full PSA on the IC3 website: FBI IC3 PSA. 

Arrests Made in Smishing Text Scam 

The City of London Police has announced the arrest of two individuals connected to a sophisticated smishing campaign using a homemade mobile antenna. This operation involved sending thousands of fraudulent text messages to the public, aiming to steal personal and financial information. 

Key Details: 

• Smishing Explained: Smishing (SMS phishing) involves sending text messages that appear to be from reputable sources, urging recipients to provide personal information, click on malicious links, or download harmful software. 

• How the Scam Worked: The arrested individuals used a homemade mobile antenna to send out mass smishing texts, tricking victims into sharing sensitive data. 

• Impact: Thousands of people received these fraudulent messages, potentially leading to significant personal and financial losses. 

Protect Yourself: 

• Be Skeptical of Unexpected Texts: Do not click on links or provide personal information in response to unsolicited text messages. 

• Verify Sources: If you receive a suspicious message claiming to be from a legitimate organization, contact the organization directly using official contact information. 

• Report Suspicious Messages: Forward suspicious texts to your mobile carrier’s spam reporting service or report them to relevant authorities. 

Stay Informed and Safe: For more details on this case and tips to protect yourself from smishing attacks, visit the City of London Police website: City of London Police Smishing Arrests. 

Stay vigilant and keep your personal information secure! 

Phishing Tactics Targeting Two-Factor Authentication (2FA) 

Recent reports from Kaspersky highlight an emerging phishing technique targeting Two-Factor Authentication (2FA) mechanisms, increasing the risk of account compromise even for those using this added layer of security. 

Key Findings: 

• Phishing Techniques: Cybercriminals are evolving their tactics to bypass 2FA, employing sophisticated methods such as phishing bots and transparent phishing pages to deceive users. 

• OTP Bots: Attackers use bots to automate the process of extracting One-Time Passwords (OTPs) from victims. These bots can mimic legitimate institutions and request OTPs under false pretenses, subsequently allowing attackers to access secured accounts. 

How It Works: 

1. Phishing Bots: These bots send automated calls or messages posing as legitimate services, tricking users into revealing their OTPs. 

1. Transparent Phishing: Attackers create fake login pages that appear identical to the real ones. When users enter their credentials and OTPs, the information is captured and used by the attackers to gain unauthorized access. 

Prevention Tips: 

• Verify Requests: Always verify the legitimacy of any request for personal information or OTPs by contacting the organization directly using known contact details. 

• Educate Employees: Regularly train employees to recognize phishing attempts and the latest tactics used by cybercriminals. 

• Use Advanced Security Measures: Implement multi-factor authentication (MFA) methods that are resistant to phishing, such as hardware security keys. 

Stay Vigilant: Phishing attacks continue to grow in sophistication, posing significant risks even to those who use advanced security measures like 2FA. By staying informed and implementing robust security practices, you can protect yourself and your organization from these evolving threats. 

For more detailed information, visit the full article on Kaspersky's blog: Phishing with Cloudflare Workers: Transparent Phishing and HTML Smuggling. 

FTC’s Spring Scam Roundup 

The FTC’s latest report highlights prevalent scams and their impact on consumers this spring. 

Key Findings: 

Most Impersonated Companies: 

• Best Buy’s Geek Squad 

• Amazon 

• PayPal 

• Microsoft (highest reported losses) 

• Publishers Clearing House 

Common Contact Methods: 

• Email and phone calls dominate. 

• Social media scams, especially on Facebook and Instagram, result in the highest losses. 

Payment Methods: 

• Investment scams use cryptocurrency and bank transfers. 

• Gift cards are common in romance, tech support, and government impersonation scams. 

Protection Tips: 

• Verify Requests: Always verify unexpected requests for money or personal information by contacting the source directly. 

• Avoid Clicking Suspicious Links: Do not respond to unsolicited messages. 

• Use Secure Payment Methods: Avoid using gift cards, cryptocurrency, or payment apps for urgent payments. 

Stay Vigilant: Scams continue to evolve, posing significant risks. By staying informed and following these security tips, you can better protect yourself and your organization. 

For more details, visit the FTC’s Spring Scam Roundup. 

Stay safe and secure! 

Beware of New Phishing Campaign Targeting Job Seekers 

A recent phishing campaign has been discovered deploying the WARMCOOKIE backdoor, specifically targeting job seekers. Cybercriminals are using fake job offers to lure victims into opening malicious attachments or clicking on harmful links. Once activated, the WARMCOOKIE backdoor allows attackers to gain unauthorized access to the victim's system, compromising sensitive information. 

Key Points: 

• Be cautious of unsolicited job offers. 

• Avoid opening attachments or clicking links from unknown sources. 

• Verify the legitimacy of job offers through official company channels. 

Stay vigilant and protect your personal information! 

For more details, visit the Hacker News article. 

CISA Warns of Criminals Impersonating Its Employees 

The Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning about criminals impersonating its employees in phone calls. These scammers attempt to deceive victims into transferring money by posing as CISA representatives. 

Key Points: 

• CISA employees will never request money transfers, cryptocurrencies, or gift cards. 

• Do not comply with demands for secrecy. 

• Report suspicious calls to CISA at 844-729-2472 or to law enforcement. 

Impersonation Scams on the Rise: Last year, impersonation scams resulted in losses of $1.1 billion, highlighting the growing threat and the need for increased vigilance. Scammers posed as FTC staff as part of the scams. 

“The FBI's 2023 Internet Crime Report revealed a 22% increase in reported losses to online crime compared to 2022, totaling a record $12.5 billion.” 

Tips to Protect Yourself: 

• Verify the caller's identity through official channels. 

• Never share personal or financial information over the phone. 

For more details, visit the Bleeping Computer article. 

Beware of Fraudulent Olympics Ticketing Websites 

Recently, Proofpoint uncovered fraudulent websites claiming to sell tickets for the Paris 2024 Summer Olympics. Notably, “paris24tickets[.]com” appeared as a top search result on Google. This site, designed to mimic legitimate ticketing platforms, aimed to steal money and personal information. 

Key Findings 

• Multiple Fraudulent Sites: Over 338 fake Olympics ticketing websites identified, with 51 shut down. 

• Phishing Tactics: Some sites used search ads, while others used email campaigns offering “discounts.” 

• Safety Tips: Only purchase tickets through the official Paris 2024 ticketing website. 

Stay Safe 

• Verify URLs before purchasing. 

• Be cautious of unsolicited emails offering deals on tickets. 

• Report suspicious websites to authorities. 

Stay vigilant and share this information to help others avoid scams. For more details, visit the full article. 

Social Engineering Scams via Mail 

Social engineering scams aren't limited to digital channels; they can come through the mail too. KnowBe4 highlights a recent case where scammers sent fake refund checks via mail, tricking recipients into depositing them and sending a portion of the funds back. These checks appear realistic, but banks eventually discover they're fake, leaving the victim responsible for the amount. 

Protection Tips: 

• Be skeptical of unexpected checks and financial requests. 

• Verify the legitimacy of any communication by contacting the company directly. 

• Educate yourself and others about recognizing various social engineering tactics. 

For more details, visit KnowBe4's blog. 

Beware of More_eggs Malware Targeting Hiring Managers 

Attention Hiring Managers: 

A new phishing campaign is using fake resume submissions to distribute the More_eggs malware. Cybercriminals target job listings on platforms like LinkedIn, directing recruiters to malicious websites that trigger a malware infection upon downloading a resume. This backdoor malware can steal sensitive data, deliver additional malicious payloads, and grant remote access to attackers. 

Key Recommendations: 

• Always verify the source of resumes and job applications. 

• Scan all downloads with reliable antivirus software. 

• Provide regular security awareness training to all staff, including HR personnel. 

Stay vigilant and protect your organization from these sophisticated attacks. 

For more details, visit the KnowBe4 blog. 

Beware of Fraudulent Olympics Ticketing Websites 

As the excitement for the Paris 2024 Summer Olympics builds, so do the efforts of scammers looking to exploit unsuspecting fans. Proofpoint recently discovered multiple fraudulent websites claiming to sell Olympics tickets, with one notably appearing as a top search result on Google. These sites mimic legitimate ticketing platforms, luring users into providing personal and payment information. 

Key Points: 

1. Fake Websites: Scammers create realistic-looking websites to steal money and personal data. 

1. Search Ads: Fraudulent sites often appear as sponsored search results. 

1. Official Source: Always purchase tickets through the official Olympics website. 

Stay Safe: 

• Verify the URL: Ensure you are on the official Olympics ticketing site. 

• Avoid Clicking Ads: Navigate directly to trusted sources. 

• Be Skeptical: Offers that seem too good to be true likely are. 

For more detailed information, read the full article on Proofpoint's blog here. 

New Threat: "Paste and Run" Phishing 

Overview A new phishing campaign exploits a unique user interaction by tricking users into pasting and executing malicious commands from their clipboard. This technique can install malware such as DarkGate on the victim’s system, bypassing conventional security measures. 

Key Takeaways: 

• Method: Users are instructed to paste clipboard contents into the Windows Run dialog box, executing a malicious PowerShell command. 

• Impact: This method can lead to significant security breaches, installing malware and compromising systems. 

• Prevention: Continuous security awareness training can help users recognize and avoid such phishing attempts. 

Stay vigilant and regularly update your security protocols. For more details, visit the KnowBe4 Blog. 

AI-Driven Travel Scams on the Rise 

Overview Booking.com warns that the rise of artificial intelligence (AI) is driving a significant increase in travel scams. According to Marnie Wilking, the firm's internet safety boss, there has been a 500 to 900% surge in scams over the past 18 months, particularly phishing attacks. 

Key Takeaways: 

• Increase in Phishing: Generative AI tools like ChatGPT are being used to create highly convincing phishing emails, tricking people into handing over their financial details through fake booking links. 

• Targeted Platforms: Scammers often target popular sites like Booking.com and Airbnb, listing fake accommodations to scam users out of money. 

• Detection Challenges: AI-generated content makes scams harder to detect due to realistic images and accurate text in multiple languages. 

For further details, refer to the BBC News Article. 

Protect Yourself from Summer Vacation Scams 

Overview As summer approaches, the excitement of planning vacations is in full swing. However, cybercriminals are also gearing up, exploiting this time to launch scams targeting travelers. Check Point Research (CPR) has observed a significant rise in phishing scams and malicious websites related to summer vacations. 

Key Takeaways: 

• Rise in Malicious Domains: In May 2024, CPR identified that 1 in every 33 new vacation-related domains were malicious or suspicious. 

• Phishing Emails: Scammers are using realistic phishing emails to trick users into revealing personal information. One campaign mimicked Booking.com invoices to lure victims. 

• Malicious Websites: Fraudulent websites like booking-secure928[.]com and hotel-housekeeper[.]com imitate legitimate travel sites to steal login credentials. 

Stay informed and vigilant to protect yourself from these evolving cyber threats. For more detailed information, visit Check Point’s blog on staying safe during summer vacations. 

Phishing Threat Intelligence June 2024

Little behind getting this out but still wanted to get it out. This is a newsletter of articles I thought might be valuable for our security team and helped me plan this months simulated phish. Created with help from ChatGPT

New Execution Technique in ClearFake Campaign 

ReliaQuest has identified a new execution technique used in the ClearFake campaign, a variant of the SocGholish malware family. This sophisticated method involves using JavaScript to trick users into executing malicious PowerShell commands, representing a significant evolution in attack tactics. 

Key Findings: 

• Malicious JavaScript Files: The campaign leverages malicious JavaScript files named “update.js,” tricking users into copying and executing encoded PowerShell commands. 

• Obfuscation and Execution: The PowerShell code is obfuscated using base64 encoding. Once decoded and executed, it performs various actions, including DNS cache clearing, displaying deceptive messages, and downloading additional payloads from malicious URLs. 

• Persistence via Python: In a novel approach, the campaign uses Python scripts for establishing persistence, signaling an evolution in tactics to evade detection. 

Infection Chain: 

1. Ingress: The malicious JavaScript downloads and extracts Python, then sets up a scheduled task for persistence. 

1. Execution: The extracted Python script connects to command-and-control (C2) servers, facilitating further malicious activities. 

1. Persistence: The scheduled task ensures the malware remains active on the infected system, making it harder to detect and remove. 

Conclusion: The ClearFake campaign exemplifies the increasing sophistication of cyber threats, highlighting the need for robust security measures and continuous vigilance. By understanding and implementing the recommended defensive measures, organizations can better protect against these evolving threats. 

For detailed information and technical analysis, visit ReliaQuest's blog on the ClearFake campaign. Stay informed and secure! 

Phishing Campaigns Exploiting Cloudflare Workers 

Netskope has identified sophisticated phishing campaigns leveraging Cloudflare Workers to deploy malicious content through two main techniques: HTML smuggling and transparent phishing. These methods are designed to evade detection and compromise user credentials. 

Key Findings: 

• HTML Smuggling: This technique bypasses network controls by assembling the phishing page on the client side. Attackers embed the phishing page as a blob within a benign webpage, using JavaScript to decode and display the malicious content. 

• Transparent Phishing: In this approach, attackers use Cloudflare Workers as reverse proxies for legitimate login pages, intercepting credentials, cookies, and tokens as users attempt to log in. 

Campaign Details: 

• Targeted Regions: Recent phishing campaigns have primarily targeted victims in Asia, North America, and Southern Europe, focusing on sectors such as technology, financial services, and banking. 

• Credential Theft: Most phishing pages aim to steal Microsoft login credentials, with other targets including Gmail, Yahoo Mail, and cPanel Webmail. 

For detailed technical analysis and more information, visit Netskope's blog on the ClearFake campaign. 

New Phishing Campaign Uses Malicious LNK Files 

A sophisticated phishing campaign has been discovered, leveraging malicious LNK files to deliver malware. This technique bypasses traditional email security filters and lures victims into executing harmful payloads. 

Phishing Lure: 

• Email Content: Cybercriminals craft emails that appear to come from legitimate sources, often including urgent or enticing messages. 

• Attachment: The email includes a seemingly harmless LNK file. When clicked, this file triggers the download and installation of malware. 

For more details, visit The Hacker News. 

New Phishing Campaign Deploys WARMCOOKIE Backdoor Targeting Job Seekers 

A sophisticated phishing campaign has been identified, deploying the WARMCOOKIE backdoor to exploit job seekers. The attack involves sending fake job offers with malicious attachments or links, which, when executed, install the WARMCOOKIE backdoor. This malware provides attackers with remote access to compromised systems, allowing data exfiltration and further exploitation. 

Attack Chain: 

1. Initial Phishing Email: Victims receive fake job offer emails. 

1. Malicious Attachment: The email contains a malicious attachment (e.g., .doc or .pdf). 

1. Execution: Opening the attachment installs the WARMCOOKIE backdoor. 

1. Backdoor Access: Attackers gain unauthorized access to the victim's system. 

1. Data Exfiltration: Sensitive information is extracted and used for further attacks. 

Key Indicators: 

• Fake job offer emails with .doc or .pdf attachments. 

• Unusual email addresses and domains. 

• Links redirecting to suspicious websites. 

For further details, visit the Hacker News article. 

RansomHub Strengthens Its Ransomware Arsenal with Scattered Spider Tactics 

A recent alliance between RansomHub and Scattered Spider has significantly boosted RansomHub’s capabilities, making it one of the largest active Ransomware-as-a-Service (RaaS) operations. 

Key Developments: 

• Evolution from Knight Ransomware: RansomHub emerged from the Knight ransomware group, using similar codebases and recruiting affiliates from other disbanded ransomware operations like LockBit and BlackCat (ALPHV). 

• Integration of Scattered Spider Techniques: Known for its sophisticated phishing campaigns, Scattered Spider has provided RansomHub with advanced phishing kits and data exfiltration techniques. 

Indicators of Compromise (IOCs): 

• Use of .doc and .pdf attachments in phishing emails. 

• Deployment of remote access tools such as Atera and Splashtop. 

• Exploitation of the ZeroLogon vulnerability. 

Recommendations: 

• Regularly update software and systems. 

• Implement advanced email filtering solutions. 

• Conduct security awareness training for employees. 

• Segment networks to limit ransomware spread. 

• Develop and test incident response plans. 

For more details, visit Security Boulevard and Dark Reading. 

Phorpiex Botnet and LockBit3 Ransomware Surge 

In May 2024, the cybersecurity landscape was significantly impacted by two major threats: the Phorpiex botnet and the LockBit3 ransomware group. 

Phorpiex Botnet's Phishing Campaign 

Researchers identified a large-scale phishing campaign involving the Phorpiex botnet, which sent millions of emails containing ransomware. The Phorpiex botnet, which resurfaced as a variant called "Twizt" in December 2021, used deceptive .doc.scr files in ZIP attachments to trigger ransomware encryption. This campaign employed over 1,500 unique IP addresses, primarily from regions such as Kazakhstan, Uzbekistan, Iran, Russia, and China. 

LockBit3 Ransomware Dominance 

LockBit3, operating as a Ransomware-as-a-Service (RaaS), accounted for 33% of published ransomware attacks in May. Despite previous law enforcement actions that disrupted their operations, LockBit3 quickly rebounded. This group continues to target large enterprises and government entities, particularly in regions excluding Russia and the Commonwealth of Independent States (CIS). 

Top Malware Families: 

1. FakeUpdates (SocGholish): Downloader leading to further compromises. 

1. Androxgh0st: Botnet targeting multiple platforms, stealing sensitive information. 

1. Qbot (Qakbot): Multipurpose malware stealing credentials and deploying additional malware. 

Top Exploited Vulnerabilities: 

1. Command Injection Over HTTP (CVE-2021-43936, CVE-2022-24086): Allows remote code execution. 

1. Web Servers Malicious URL Directory Traversal: Permits unauthorized file access on vulnerable servers. 

1. Apache Log4j Remote Code Execution (CVE-2021-44228): Enables attackers to execute arbitrary code. 

Top Mobile Malware: 

1. Anubis: Android banking Trojan with ransomware capabilities. 

1. AhMyth: Remote Access Trojan (RAT) stealing sensitive information. 

1. Hydra: Banking Trojan stealing credentials through manipulated permissions. 

Most Attacked Industries: 

1. Education/Research 

1. Government/Military 

1. Communications 

Top Ransomware Groups: 

1. LockBit3: Responsible for 33% of attacks, targeting large enterprises. 

1. Inc. Ransom: Emerging ransomware group targeting multiple sectors. 

1. Play: A ransomware impacting businesses and critical infrastructure. 

Organizations must stay vigilant and implement robust cybersecurity measures to defend against these evolving threats. For more detailed information, visit Check Point. 

SmokeLoader Evolution and Impact 

Zscaler's ThreatLabz provides an in-depth historical analysis of SmokeLoader, a modular malware family first advertised in 2011. Initially serving as a downloader, SmokeLoader has evolved to include functionalities for data theft, DDoS attacks, and cryptocurrency mining. Key features include advanced anti-analysis techniques, modular capabilities, and encrypted C2 communications. Notable developments include the introduction of a stager component in 2014 and sophisticated obfuscation methods. SmokeLoader remains a persistent threat due to its continuous evolution and adaptability. 

Key Takeaways: 

• Modular Design: Allows for flexible and varied attack strategies. 

• Advanced Evasion: Sophisticated anti-analysis and obfuscation techniques. 

• Persistent Threat: Continuous updates keep it relevant and dangerous. 

For detailed insights, visit the Zscaler Blog. 

DarkGate Malware's Evolving Tactics 

Cisco Talos has identified a significant increase in DarkGate malware activity through malicious email campaigns since March 2024. These campaigns use Remote Template Injection to bypass email security controls, deploying Excel attachments that trigger malware execution when opened. Notably, DarkGate has transitioned from using AutoIT to AutoHotKey scripts for its infection process, with the payload executing in-memory without being written to disk. 

Key Takeaways: 

• Remote Template Injection: Bypasses security controls using Excel files. 

• In-Memory Execution: Enhances evasion by avoiding disk writes. 

• AutoHotKey Scripts: Replaces AutoIT for advanced automation. 

For detailed insights, visit the Cisco Talos Blog. 

Active Phishing Campaign: Yousign HR Lure 

Agari has identified an active phishing campaign using the Yousign platform to distribute malicious emails posing as HR notifications. These emails prompt recipients to review an updated employee handbook, leading to credential harvesting. By leveraging the legitimacy of Yousign's domain, attackers bypass email security filters. The campaign employs Remote Template Injection and unique URLs to evade detection. 

Key Takeaways: 

• Legitimate Domains: Used to bypass security controls. 

• Credential Harvesting: Malicious forms disguised as HR documents. 

• Unique URLs: Hinders detection by security tools. 

For detailed insights, visit the Agari Blog. 

FBI Alert: Healthcare Industry Phishing Campaign 

The FBI and HHS have issued a warning about a sophisticated phishing campaign targeting the healthcare sector. Threat actors are using social engineering tactics to steal login credentials and redirect Automated Clearing House (ACH) payments to accounts they control. These attackers manipulate help desk staff to gain access and then use stealth techniques to divert payments. Healthcare organizations, due to their size and access to sensitive data, are prime targets. Enhance employee training to recognize and thwart social engineering attacks. 

Key Takeaways: 

1. Sophisticated Tactics: Attackers use social engineering to exploit help desk staff. 

1. ACH Payment Redirection: Stolen credentials are used to divert ACH payments. 

1. Targeted Sector: Healthcare organizations are primary targets due to their sensitive data. 

1. Employee Training: Essential to enhance awareness and ability to recognize phishing attempts. 

For detailed information, visit the KnowBe4 blog. 

New Threat: ASCII-Based QR Codes 

QR code phishing, or "quishing," is evolving with attackers now using ASCII characters to create QR codes within HTML, bypassing traditional OCR-based security measures. These codes appear as legitimate QR codes to users but evade detection by security systems, leading to credential theft and malware deployment. 

Key Takeaways: 

• Evolution of Technique: ASCII-based QR codes embedded in HTML are the latest in phishing tactics, making it harder for security systems to detect them (Avanan) (Techzine Europe) . 

• Real-World Impact: Over 600 instances detected, with significant disruptions including a recent healthcare provider attack (Sechub) (Coalition) . 

• Mitigation Strategies: 

• Implement security that decodes and analyzes QR codes in emails. 

• Use solutions that rewrite embedded QR codes with safe links. 

• Employ advanced AI-based tools to detect phishing indicators. 

Stay informed and update your security measures to guard against these sophisticated threats. 

For more details, visit the Checkpoint Blog or read more on Techzine. 

New Threat: Exploitation of Microsoft SmartScreen 

Overview Hackers are actively exploiting a vulnerability in Microsoft SmartScreen (CVE-2024-21412) to deploy stealer malware such as Lumma and Meduza Stealer. Despite a patch released in February 2024, attackers continue to bypass SmartScreen using malicious internet shortcuts distributed via spam emails. 

Key Takeaways: 

• Method: Bypassing SmartScreen through WebDAV-hosted shortcuts and executing multi-step attacks using PowerShell and JavaScript. 

• Impact: Significant breaches leading to information theft and potential system compromise. 

• Recommendations: Verify emails, use advanced filtering, avoid suspicious links, keep software updated, limit scripting languages, and segment networks. 

For more details, visit the Cyber Security News. 

New Threat: Volcano Demon Ransomware 

Overview A new ransomware group named Volcano Demon is using phone calls to pressure victims into paying ransoms. This group deploys LukaLocker ransomware to encrypt files and uses double extortion tactics by exfiltrating data before encryption. Victims receive threatening phone calls from unidentified numbers, increasing the pressure to comply with ransom demands. 

Key Takeaways: 

• Method: Phone calls combined with data exfiltration and encryption. 

• Impact: Significant disruption, with threats to leak data and continued attacks. 

• Recommendations: Strengthen network security, train employees on phishing tactics, and prepare for potential ransomware attacks. 

For more details, visit the The Record. 

Understanding the July 2024 AT&T Data Breach Incident

This was written for security awareness and to be distributed to all of our employees. Feel free to grab and use as part of your own security awareness program. Created with help from ChatGPT.

Introduction 

In an era where data breaches have become increasingly common, it is crucial to stay informed about the latest incidents and understand their implications. On July 12, 2024, AT&T disclosed a significant data breach that affected a vast number of its cellular customers. This blog post aims to break down the incident, its impact, and the steps being taken to enhance security measures. 

What Happened? 

On July 12, 2024, AT&T announced that a breach had occurred, involving the illegal download of customer data from a third-party cloud platform. The breach affected phone call and text message records of nearly all AT&T cellular customers from May to October 2022 and January 2023. The stolen data included phone numbers and call durations, detailing who contacted whom by phone or text. Importantly, no content of the calls or texts, nor personally identifiable information, was compromised. 

How Did the Breach Occur? 

Between April 14 and April 25, 2024, attackers exploited a vulnerability in a third-party cloud service used by AT&T. This vulnerability allowed unauthorized access to customer data over two distinct periods: May to October 2022 and January 2023. The breach was only discovered and disclosed in July 2024, highlighting the sophisticated methods used by the attackers and the ongoing challenges in detecting such breaches promptly. 

AT&T's Response 

Upon discovering the breach, AT&T took immediate action to secure the compromised access point and began notifying affected customers. The company is cooperating with law enforcement to investigate the incident and bring the perpetrators to justice. Additionally, AT&T is implementing enhanced security measures to prevent future breaches. These measures include strengthening the security of third-party services and conducting comprehensive security audits. 

Timeline of Events 

• April 14 and April 25, 2024: Initial breach period where customer data From May 1, 2022, October 31, 2022, and January 2, 2023, was illegally accessed. 

• July 12, 2024: AT&T publicly disclosed the breach and began notifying affected customers. 

• Ongoing: AT&T is cooperating with law enforcement and implementing enhanced security measures to prevent future incidents. 

What Should Customers Do? 

AT&T has set up a dedicated webpage to address questions and provide steps for customers to check if their information was compromised. Customers are advised to: 

1. Visit the AT&T support page for detailed information on the breach. 

1. Monitor their accounts for any unusual activity. 

1. Be vigilant against phishing attempts that may exploit the breach. 

1. Consider changing passwords and enabling two-factor authentication for added security. 

Conclusion 

The July 2024 AT&T data breach serves as a reminder of the persistent threats to our personal information in the digital age. While AT&T is taking steps to enhance its security measures, customers must also remain vigilant and proactive in protecting their data. By staying informed and adopting best practices for data security, we can collectively reduce the risk and impact of such incidents. 

References 

• NPR Article on AT&T Data Breach 

• TechCrunch Report on AT&T Phone Records Theft 

• SEC Filing on AT&T Data Breach 

• AT&T Press Release on Customer Data Breach 

By staying informed and understanding the nuances of such breaches, we can better prepare and protect ourselves against the ever-evolving landscape of cyber threats. 

Executive Summary: July 2024 AT&T Data Breach Incident

I pulled some information on the recently announced AT&T Data Breach, 12 July 2024, for leadership at my company. Feel free to take and use for your own reports or security awareness programs.

Summary

On July 12, 2024, AT&T disclosed a significant data breach involving the illegal download of customer data from a third-party cloud platform. Attackers accessed a third-party cloud platform between April 14 and April 25, 2024. The breach affected phone call and text message records of nearly all AT&T cellular customers from May 1 to October 31, 2022, and January 2, 2023. The data included phone numbers and call durations, such as who contacted who by phone or text.  

Per AT&T, no content of the calls or texts, nor personally identifiable information, was compromised. Attackers exploited a vulnerability in a third-party cloud service. AT&T has secured the access point, notified affected customers, and is cooperating with law enforcement. They are enhancing security measures to prevent future incidents. 

Timeline of Events 

• April 14 and April 25, 2024: Initial breach period where customer data From May 1, 2022, October 31, 2022, and January 2, 2023, was illegally accessed. 

• July 12, 2024: AT&T publicly disclosed the breach and began notifying affected customers. 

• Ongoing: AT&T is cooperating with law enforcement and implementing enhanced security measures to prevent future incidents. 

AT&T has set up a webpage to address questions and provide steps for checking if customer information is compromised.   

This summary was written with help from the links below: 

• https://www.npr.org/2024/07/12/nx-s1-5037736/att-data-breach-call-text-records  

• https://techcrunch.com/2024/07/12/att-phone-records-stolen-data-breach/  

• https://www.sec.gov/ix?doc=/Archives/edgar/data/0000732717/000073271724000046/t-20240506.htm 

• https://www.prnewswire.com/news-releases/att-addresses-illegal-download-of-customer-data-302195733.html 

Security Awareness Newsletter May 2024

This is a security awareness newsletter meant for internal distribution. Feel free to grab and share with your company internally.

Steer Clear of Job Scams: Tips for New Graduates 

Be cautious of job scams targeting new graduates. Here are some key takeaways to protect new graduates: 

• Be skeptical of unsolicited offers, especially those coming out of the blue. Legitimate companies typically have established recruitment channels. 

• Guard your personal information. Don't share sensitive details like bank accounts or Social Security numbers in initial communications. 

• High starting salaries with minimal experience requirements are often red flags. Scammers lure victims with unrealistic promises. 

• Do your research! Verify the legitimacy of companies by checking their websites and contacting them directly through listed channels. 

• Don't hesitate to leverage school resources. Career centers can offer guidance and help spot scams. 

• Trust your gut. If something feels off about a job offer, it probably is. Don't be pressured into rushing forward.

By following these tips, graduates can navigate a job search with confidence and avoid falling victim to scams. Remember, protecting your personal information and conducting thorough research are crucial steps towards landing a safe and rewarding job opportunity. 

Love on the Rocks? Watch Out for Verification Scams! 

Looking for love online? While dating apps can be a great way to meet someone special, be on the lookout for scammers trying to exploit your emotions. The FBI recently issued a warning about verification scams targeting dating app users. 

Here's the lowdown: 

• The Scam: Scammers lure you in with the promise of a secure dating experience through a "verification process." 

• The Hook: They'll often move the conversation to a private platform and then send a link to a fake website offering a "free" verification service. 

• The Bait and Switch: This website is designed to trick you into signing up for a fraudulent monthly subscription . 

Don't let love blind you! Here are some tips to stay safe: 

• Be wary of requests to move conversations off the dating platform. Legitimate dating apps have robust security features. 

• Don't click on suspicious links, especially those promising verification. Verify information directly through the dating app's support channels. 

• If something sounds too good to be true, it probably is. Don't fall for promises of guaranteed love matches or enhanced security behind a paywall. 

Remember, online dating requires a healthy dose of skepticism. Trust your instincts, and prioritize your safety! 

Shein Phishing Alert: Protect Your Fashion Finds and Login Info! 

Calling all fashionistas! Watch out for phishing emails spoofing popular online retailer Shein. These emails aim to steal your login credentials and compromise your online shopping accounts. 

Here's the Scheme: 

• The Lure: The email might claim you have an unclaimed order, exclusive discounts, or a problem with your account. 

• The Trap: Clicking a link in the email takes you to a fake Shein login page designed to steal your username and password. 

Don't Fall for Fake Fashion Frenzy! 

• Beware of unsolicited emails, even if they look official. Shein won't contact you about account issues through unexpected emails. 

• Inspect sender addresses carefully. Legitimate Shein emails will come from a Shein domain address, not a random one. 

• Hover over links before clicking. See if the link's destination matches the displayed text. Don't enter your login details on suspicious websites. 

• Always access your Shein account directly through the official website or app. Don't rely on links in emails. 

By staying vigilant, you can protect your hard-earned cash and sensitive information. Happy (and secure) shopping! 

North Korean Threat Actors Targeting Developers with Fake Job Interviews 

A new social engineering attack campaign is targeting software developers. This campaign is likely associated with North Korean threat actors. The attackers are sending fake job interviews that contain malicious software. 

How the Attack Works 

The attackers will send a seemingly legitimate job offer email to a software developer. The email will contain a link to a malicious website or a document that, when opened, will download malware onto the victim's computer. The malware is a Python-based RAT (Remote Access Trojan) that can steal information from the victim's computer, such as files, keystrokes, and browsing history. 

How to Protect Yourself 

• Be cautious of unsolicited job offers, even if they seem to come from a legitimate company. 

• Do not click on links or open attachments in emails from unknown senders. 

• Verify the legitimacy of a job offer by contacting the company directly. 

• Maintain a security-focused mindset during job interviews. If something seems too good to be true, it probably is. 

• Monitor your computer for suspicious activity, such as unknown programs running or unusual network traffic. 

Don't Let Ransomware Hit You Where It Hurts: Protecting Your Family From SIM Swapping 

Cybercriminals are getting more personal in their attacks. A recent report from Mandiant highlights a disturbing trend: ransomware attackers targeting executives by SIM swapping their children's phones. 

What is SIM Swapping? 

SIM swapping is when a scammer takes control of your phone number by transferring it to a new SIM card. This allows them to receive your calls, texts, and potentially even two-factor authentication codes. 

How Can You Protect Yourself? 

• Be Wary of Unusual Activity: Monitor your phone bill for any suspicious changes, like increased data usage or new charges. 

• Enable Two-factor Authentication (2FA): But not with SMS verification! Use a dedicated authentication app instead. 

• Don't Share Personal Information Online: This includes your birthday, address, and even your child's school name. 

• Talk to Your Family: Educate them about SIM swapping and the importance of online safety. 

• Contact Your Carrier: Ask about SIM swapping security measures and how to add additional protections to your account. 

For More Information: 

• How to Protect Yourself from SIM Swapping: https://consumer.ftc.gov/consumer-alerts/2019/10/sim-swap-scams-how-protect-yourself 

Alert: Cybercriminals Exploiting Docusign with Sophisticated Phishing Scams 

Summary: Cybercriminals are increasingly targeting Docusign users by distributing customizable phishing templates on cybercrime forums. These templates closely mimic legitimate Docusign emails, luring recipients into providing sensitive information or clicking malicious links. These attacks facilitate various malicious activities, including credential theft and business email compromise (BEC) scams. 

Key Indicators of Docusign Phishing Emails: 

• Sender's Email: Ensure it originates from the docusign.net domain. 

• Greetings: Genuine emails use your name, not generic salutations. 

• Security Codes: Authentic codes are long and complex. 

• Links: Hover over links to check if they lead to docusign.net. 

• Direct Access: Use Docusign's secure document access instead of clicking links. 

Prevention Tips: 

• Always verify the sender's email address. 

• Avoid clicking on suspicious links and attachments. 

• Contact the sender through trusted channels if in doubt. 

Growing Confidence Among CISOs Despite Rising Cyber Threats 

Overview: According to Proofpoint's 2024 Voice of the CISO report, 70% of CISOs feel at risk of a cyber attack, yet only 43% feel unprepared—a significant improvement from previous years. Despite this growing confidence, human error remains a critical vulnerability, with 74% of CISOs identifying it as a top concern. Encouragingly, the adoption of AI-powered solutions and enhanced employee education are seen as key strategies to mitigate these risks. However, challenges such as ransomware, malware, and employee turnover continue to test cybersecurity resilience. 

Key Points: 

• Rising Confidence: 43% of CISOs feel unprepared for attacks, down from 61% last year. 

• Human Error: 74% of CISOs see human error as the biggest vulnerability. 

• AI Solutions: 87% are deploying AI to combat human-centric threats. 

• Top Threats: Ransomware, malware, and email fraud are major concerns. 

Takeaway: Continuous improvement in AI adoption and employee training is vital for bolstering cybersecurity defenses. 

New Social Engineering Scheme by Black Basta Ransomware Group 

Overview: The Black Basta ransomware group has launched a new mass spam and social engineering campaign, targeting various industries. The attackers flood users' emails with spam and then pose as IT support, convincing victims to download remote access tools like Quick Assist or AnyDesk. This grants the attackers initial access to deploy ransomware and steal credentials. 

Key Points: 

• Spam Overload: Victims receive thousands of spam emails. 

• Impersonation: Attackers pose as IT support to gain trust. 

• Remote Access: Tools like Quick Assist and AnyDesk are used to gain access. 

• Prevention: Block newly registered domains and restrict remote management tools. 

Takeaway: Stay vigilant against unsolicited IT support offers and ensure employees are aware of this tactic. 

From Phish to Phish Phishing: How Email Scams Got Smart

Phishing scams have evolved dramatically over the years, becoming more sophisticated and harder to detect. Here are key points from Check Point's recent article on how email scams have become smarter:

1. Evolution of Phishing Tactics:

   • Old vs. New: Early phishing attempts were often easy to spot due to obvious mistakes like all-caps subject lines, poor grammar, and bad spoofing. Modern phishing emails, however, are much more convincing, using official-looking logos and professional language.

   • Advanced Spoofing: Attackers now use advanced techniques to spoof emails, making them appear as if they come from trusted sources such as banks, government agencies, or company executives. This creates a sense of urgency and legitimacy.

2. Techniques and Vectors:

   • Email and Attachments: Phishing emails often include links to fake websites or attachments that require personal information. These can lead to data theft or malware infections.

   • Vishing and SMiShing: Phishing is not limited to emails. Attackers use voice phishing (vishing) and SMS phishing (SMiShing) to trick victims into revealing sensitive information over the phone or through text messages.

3. Common Scams:

   • Ransomware Delivery: A significant number of phishing emails now deliver ransomware, locking victims' files and demanding a ransom for their release.

   • Fake Alerts: Emails claiming to be from PayPal, Wells Fargo, or even the FBI often contain urgent messages about account issues, prompting victims to click on malicious links or provide personal information.

4. Preventive Measures:

   • Stay Vigilant: Always verify the sender’s email address and look for signs of phishing, such as generic greetings and urgent requests for personal information.

   • Check Links and Attachments: Hover over links to see their true destination and avoid clicking on suspicious attachments.

   • Use Security Tools: Employ email filtering and antivirus software to help detect and block phishing attempts.

By staying informed and cautious, you can protect yourself and your organization from falling victim to these increasingly sophisticated email scams.

Beware the Piano Scam 

Cybercriminals are exploiting unsuspecting individuals with a new scheme known as the "Piano Scam." Victims receive emails offering a free piano due to a family death, but they are asked to pay shipping fees through fake shipping companies. These scammers also collect personal information. Protect yourself by verifying the sender, avoiding clicking on unknown links, and reporting suspicious emails. 

 Key Points:

• Advance Fee Fraud (AFF): The scam involves requesting a small upfront fee for a larger promised reward, in this case, a free piano.

• Payment Methods: Scammers request payment via Zelle, Cash App, PayPal, Apple Pay, or cryptocurrency.

• Personally Identifiable Information (PII): Scammers collect names, addresses, and phone numbers.

• Indicators of Compromise: Emails from unknown senders, requests for upfront payments, and varied sender addresses.

Beware Advance Fee Fraud (AFF): The Piano Scam

This is a short blog post I wrote for our security awareness internal communication. Feel free to grab and use for your own program. Created with the help of ChatGPT.

Beware Advance Fee Fraud (AFF): The Piano Scam 

Cyber threats are constantly evolving, and one of the latest scams targets unsuspecting individuals with a piano-themed fraud. This scheme, dubbed the "Piano Scam," preys on the goodwill of victims by offering a "free" piano, only to defraud them through advance fee payments for shipping. 

This type of scam is targeting people in the education sector but other scams like this will target other industries such as healthcare or the food industry. Understanding these types of scams will help identify when similar scams are used against our company.  

How the Scam Works 

1. Initial Contact: Victims receive an email claiming a free piano is available due to a family death. 

1. Shipping Fraud: The scammer directs victims to a fake shipping company, which requests payment for delivery fees via various methods, including Zelle, PayPal, and cryptocurrency. 

1. Data Harvesting: Personal information such as names, addresses, and phone numbers are also solicited. 

Recognizing the Scam 

• Too Good to Be True: Be cautious of unsolicited offers that seem excessively generous. 

• Unverified Senders: Emails from unfamiliar addresses or free email services should raise suspicion. 

• Payment Requests: Legitimate giveaways do not require upfront fees for shipping or handling. 

Prevention Tips 

• Verify Sources: Independently verify the sender and the legitimacy of the offer. 

• Avoid Clicking Links: Do not click on links or download attachments from unknown emails. 

• Report Suspicious Activity: Inform your IT department or local authorities if you encounter such scams. 

Understanding the tactics used in the Piano Scam can help you avoid becoming a victim. Stay vigilant and informed to protect yourself from these and other cyber threats. 

For more detailed information on this scam, visit Proofpoint's Security Brief. 

Phishing Threat Intelligence May 2024

These are the articles and blogs I’ve read over the last month with a lean towards phishing and healthcare. I share this internally with the security team. Feel free to take and use for your own programs.

Unprecedented Surge in Proxy-Driven Credential Stuffing Attacks 

Okta identified a substantial rise in credential stuffing attacks targeting online services in the past month. These attacks exploit widely available resources like stolen login credentials, residential proxies, and scripting tools to gain unauthorized access to user accounts. The attacks appear to originate from anonymizing services like Tor and leverage proxies to bypass security measures. 

Key Takeaways: 

• Identity and access management (IAM) provider Okta has observed a significant increase in credential stuffing attacks over the past month. 

• These attacks leverage readily available resources like residential proxy services, stolen credential lists, and scripting tools. 

• The attacks target online services and seem to originate from anonymizing tools like Tor exit nodes and various proxies. 

Indicators of Compromise (IOCs): 

• The timeframe for this attack surge is noted to be between April 19th and April 26th, 2024. 

• Okta's Identity Threat Research detected the activity. 

• While specific IoCs aren't listed, the report mentions attacks targeting VPN appliances and routers from various vendors. 

Black Hat SEO Techniques Used to Distribute Malware 

This report details a malware distribution campaign that leverages black hat SEO techniques. Attackers create malicious websites designed to look legitimate and rank high in search results. These websites are then used to trick users into clicking on them and downloading malware. 

Technical Details: 

• The malware payloads are delivered through multi-level zipped files. 

• Once downloaded and executed, the malware can steal sensitive information such as browsing history and user credentials. 

Phishing Remains a Top Threat Despite Decline in Q4 

Phishing attacks continue to be a major threat to organizations of all sizes. According to a recent report by the Anti-Phishing Working Group (APWG), 2023 saw a significant increase in phishing activity, making it the worst year on record. Over 5 million phishing attacks were detected in 2023, highlighting the prevalence of this cyber threat. 

The report also details a decrease in phishing attacks during the fourth quarter of 2023. This decline is attributed to the takedown of Freenom, a service frequently abused by attackers to register domains that spoofed legitimate companies. While this is a positive development, it serves as a reminder that threat actors are constantly evolving their tactics. 

Key Takeaways 

• 2023 was the worst year on record for phishing attacks, with over 5 million attempts detected. 

• While there was a decline in Q4 2023 due to the takedown of Freenom, phishing remains a significant threat. 

• Security awareness training is crucial for educating employees on how to identify and avoid phishing attempts. 

• Organizations should implement a layered security approach that includes email filtering, employee training, and staying informed about the latest phishing tactics. 

New Technique for Detecting Malware Stealing Browser Data 

A recent blog post by Google Security Blog details a new technique for detecting malware that steals browser data. The technique involves monitoring Windows Event Logs for signs of unauthorized access to browser data. 

How Browser Data Theft Works 

Many malware programs target browser data, such as cookies and saved credentials. This data can be valuable to attackers, as it can be used to gain access to online accounts, steal financial information, or launch other attacks. 

Traditional Detection Methods 

Traditional methods for detecting malware that steals browser data often rely on behavioral analysis or signature-based detection. However, these methods can be ineffective against new or sophisticated malware. 

Detecting Browser Data Theft with Windows Event Logs 

The new technique described by Google Security Blog involves monitoring Windows Event Logs for DPAPI events. DPAPI (Data Protection API) is a Windows API that is used to protect sensitive data. When an application attempts to decrypt data protected by DPAPI, a DPAPI event is generated in the Windows Event Log. 

By monitoring DPAPI events, it is possible to identify unauthorized attempts to access browser data. This is because legitimate applications should not need to decrypt browser data unless the user is actively using the browser. 

Benefits of This Technique 

This technique has several benefits over traditional methods for detecting browser data theft. First, it is less reliant on signatures, making it more effective against new and unknown malware. Second, it can provide valuable forensic information, such as the time and process that attempted to access the data. 

Security Implications 

This technique highlights the importance of monitoring Windows Event Logs for security threats. By monitoring these logs, security professionals can gain valuable insights into the activities of applications running on their systems. 

Recommendations 

• Enable logging of DPAPI events in Windows Event Logs. 

• Monitor Windows Event Logs for suspicious DPAPI events. 

• Investigate any unauthorized attempts to access browser data. 

• Regularly update your security software and operating system. 

By following these recommendations, organizations can improve their ability to detect and prevent browser data theft. 

Healthcare Organizations Targeted in Social Engineering Campaign with Deceptive Tactics 

High Importance 

A recent report by ReliaQuest exposes a cunning social engineering campaign targeting healthcare organizations' revenue cycle management (RCM) departments. Then attackers employed deceptive tactics to manipulate help desk staff into resetting multifactor authentication (MFA) credentials. This allowed them to infiltrate the system and steal funds by altering bank routing information for fraudulent money transfers. 

Social Engineering Techniques Used: 

The report details how attackers impersonated legitimate users, often healthcare staff, by leveraging readily available personal information. This information might have been obtained through various means, including phishing emails, data breaches, or even social media. Once impersonating a staff member, attackers would contact the help desk, feigning an issue with their MFA and requesting a reset. To heighten their legitimacy, they might provide seemingly valid personal details associated with the target user, such as the last four digits of their Social Security number, date of birth, or home address. By exploiting trust and creating a sense of urgency, attackers could potentially trick help desk personnel into resetting the MFA, compromising the account's security. 

LockBit Black Ransomware Delivered via Phorpiex Botnet Spam Campaign 

High Importance 

A recent phishing campaign leveraged the Phorpiex botnet to distribute LockBit Black ransomware. Millions of malicious emails were sent, targeting a widespread audience. 

Campaign Details: 

• Phishing emails with malicious ZIP attachments 

• LockBit Black ransomware deployed upon opening the attachment 

• Ransomware likely based on leaked LockBit 3.0 source code 

LockBit Black Ransomware: 

LockBit Black is a ransomware variant known for encrypting victim files and demanding a ransom payment for decryption. This iteration is likely derived from a leaked version of LockBit 3.0, raising concerns about potential widespread attacks. 

Alert: Threat Actors Expand Malicious Use of DNS Tunneling 

High Importance 

Security researchers warn of a growing trend: threat actors are increasingly exploiting DNS tunneling for malicious purposes. DNS tunneling involves encoding data within legitimate DNS requests, creating covert communication channels that bypass traditional security measures. 

Why is this concerning? 

• Evasion Capabilities: DNS tunneling allows attackers to fly under the radar of firewalls and security tools, making detection difficult. 

• Operational Flexibility: This technique offers attackers a versatile tool for various malicious activities, including: 

• Phishing Email Monitoring: Attackers can use DNS tunneling to monitor how users interact with phishing emails, allowing them to refine their tactics. 

• Network Vulnerability Scanning: Malicious actors can leverage DNS tunneling to scan networks for vulnerabilities without raising red flags. 

• Security Measure Bypassing: This technique can be used to bypass security controls and establish persistence within a compromised network. 

Cybercriminals Exploit Docusign Phishing Templates 

Summary: Cybercriminals are increasingly targeting Docusign users by distributing customizable phishing templates on cybercrime forums. These templates closely mimic legitimate Docusign emails, luring recipients into providing sensitive information or clicking malicious links. These attacks facilitate various malicious activities, including credential theft and business email compromise (BEC) scams. 

Rising Shadow AI Accounts Elevate Corporate Data Risks 

Summary: Recent research by Cyberhaven Labs reveals a 485% surge in AI tool usage among workers, with 90% occurring through personal "shadow AI" accounts. This trend exposes sensitive corporate data to public AI models, posing significant security risks. Key findings highlight that tech workers are the highest contributors, with substantial portions of sensitive data like legal documents, source code, and HR records being inputted into non-corporate accounts. Companies must address these vulnerabilities to safeguard their data. 

Action Points: 

• Implement strict AI usage policies. 

• Educate employees on the risks of shadow AI. 

• Monitor AI tool usage within the organization. 

Security Awareness Newsletter April 2024

These are the stories I’ve been tracking that are of interest to people outside of security. Feel free to take this and use it as part of your own security awareness program. The items were created with the help of ChatGPT

Confirmed: AT&T Data Breach Exposes Millions

A large data leak containing personal information of millions of AT&T customers is being investigated. While AT&T denies the breach originated from their systems, this incident highlights the importance of protecting your personal information.

Here are some steps you can take to stay safe:

• Be mindful of the information you share online and over the phone.

• Use strong passwords and change them regularly.

• Monitor your bank statements and credit reports for suspicious activity.

AI in Elections: Beware the Deepfakes!

AI is shaking up elections! Check Point Research warns of deepfakes and voice cloning being used to mislead voters. They found evidence in 10 out of 36 recent elections. Stay informed - the future of voting might depend on it!

Heads Up, Gamers! Malware Lurks in YouTube Video Game Cracks

Phishing for free games can land you in hot water!

A recent report by Proofpoint discovered threat actors using YouTube to distribute malware disguised as popular video game cracks.

Here's the breakdown:

• Compromised Accounts: Hackers are targeting both legitimate and newly created YouTube accounts.

• Deceptive Content: Videos promise free software or game upgrades, but descriptions contain malicious links.

• Targeting Young Gamers: The campaigns exploit younger audiences' interest in bypassing paid features.

Alert on Privacy Risks in Dating Apps: Spotlight on Hornet

Recent investigations by Check Point Research have exposed critical privacy vulnerabilities in the popular dating app Hornet, affecting its 10+ million users. Despite Hornet's attempts to safeguard user locations by randomizing displayed distances, researchers found ways to determine users' exact locations within 10 meters using trilateration techniques. This finding poses a significant privacy risk, particularly in dating apps that rely on geolocation features to connect users.

Highlights:

• Hornet's geolocation vulnerabilities could allow attackers to pinpoint users' precise locations.

• Even after implementing new safety measures, locations could still be determined within 50 meters.

• Check Point Research advises users to be cautious about app permissions and consider disabling location services to protect their privacy.

The study illustrates the ongoing challenges and potential dangers of balancing app functionality with user privacy, urging both developers and users to remain vigilant.

Ransomware Scams Can Get Creative

Ransomware gangs are constantly looking for new ways to pressure companies into paying up. A recent article on TechCrunch describes a hilarious (but ultimately unsuccessful) attempt by a hacker to extort a company through their front desk Ransomware gang's new extortion trick? Calling the front desk.

While this specific incident might be lighthearted, it serves as a reminder that ransomware attackers are always adapting their tactics. Here's what you should be aware of:

• Be cautious of any unsolicited calls or emails claiming a security breach. Don't engage with the sender and report them to the IT department immediately.

• Never click on suspicious links or attachments. These could contain malware that gives attackers access to our systems.

• Be mindful of what information you share over the phone. Hackers may try to sound legitimate to gather details about our company's network.

• Stay informed about cybersecurity best practices. The IT department may send out phishing simulations or training materials – take advantage of these resources.

By staying vigilant and following these tips, we can all play a part in protecting our company from ransomware attacks. Remember, if you see something suspicious, report it!

 

FBI Alert: Increase in Social Engineering Attacks

The FBI has issued a warning about the rise in social engineering attacks targeting personal and corporate accounts. These attacks employ methods like impersonating employees, SIM swap attacks, call forwarding, simultaneous ringing, and phishing, which are designed to steal sensitive information.

Key Techniques:

• Employee Impersonation: Fraudsters trick IT or helpdesk staff into providing network access.

• SIM Swapping: Attackers take control of victims' phone numbers to bypass security measures like multi-factor authentication.

• Call Forwarding and Simultaneous Ring: Calls are redirected to the attackers' numbers, potentially overcoming security protocols.

• Phishing: Cybercriminals use fake emails from trusted entities to collect personal and financial data.

How to Protect Yourself:

• Ignore unsolicited requests for personal information.

• Ensure unique, strong passwords for all accounts.

• Contact mobile carriers to restrict SIM changes and call forwarding.

• Regularly monitor account activity for signs of unauthorized access.

If Compromised:

• Immediately secure accounts by changing passwords and contacting service providers.

• Report the incident to the FBI’s Internet Crime Complaint Center at www.ic3.gov.

Stay vigilant and implement these protective measures to defend against these sophisticated social engineering threats.

Smishing Scam Hits the Road!

Beware of texts claiming unpaid tolls! Scammers are targeting drivers with smishing attacks. The texts claim that the recipient has unpaid tolls. Don't click links or give out info. Report scams to the FBI: https://www.ic3.gov/Home/ComplaintChoice. Stay safe!

Data Breach at Hospital: Ex-Employee Admits to Sharing Patient Records

Patients at Jordan Valley Community Health Center in Missouri are being notified of a data breach involving over 2,500 individuals. The culprit? A former employee, Chante Falcon, who admitted to accessing and sharing patient records.

Facing federal charges for wrongful disclosure of patient information, Ms. Falcon pleaded guilty and awaits sentencing. The potential penalty? Up to 10 years in prison.

Tax Time Trouble: Don't Fall Victim to Tax Scams!

It's tax season again! While you're busy gathering documents and filing your return, scammers are out in force trying to steal your money and personal information.

This year, security experts are seeing a rise in Artificial Intelligence (AI)-powered tax scams. These scams can look and feel more sophisticated than ever before, making them even trickier to spot.

Here are some red flags to watch out for:

• Urgency and Threats: Scammers often try to pressure you into acting quickly by claiming you owe overdue taxes or face penalties.

• Suspicious Emails and Texts: Be wary of emails or texts claiming to be from the IRS or tax software companies. Don't click on links or attachments unless you're sure they're legitimate.

• Phishing for Information: Scammers may ask for your Social Security number, bank account details, or other personal information you wouldn't normally share via email or text.

Stay Safe This Tax Season:

• Go Directly to the Source: If you receive a message about your taxes, contact the IRS directly using a phone number you know is correct (don't use the one provided in the message).

• Don't Share Personal Information Unsolicited: The IRS will never ask for sensitive information through email or text message.

By following these tips and staying vigilant, you can protect yourself from tax scams and ensure a smooth tax season!

 

Tracking AI's Influence in Global Elections

Rest of World, a news organization, has launched a new initiative to monitor and document the impact of artificial intelligence (AI) on global elections. This effort comes as generative AI tools become increasingly accessible, presenting both innovative uses and potential risks in political contexts.

Scope and Objective: The project tracks AI incidents across the globe, particularly focusing on regions outside the Western hemisphere. From the general elections in Bangladesh to those in Ghana, the tracker will compile AI-generated content related to elections, encompassing both positive applications and problematic issues like misinformation.

Noteworthy Incidents:

• In Belarus, a ChatGPT-powered virtual candidate is providing voter information while circumventing censorship.

• AI-generated videos have enabled Pakistan’s former Prime Minister Imran Khan to address the public from imprisonment.

• A spam campaign against Taiwan’s president has been linked to a Chinese Communist Party actor.

• Deepfake videos falsely depicted Bangladeshi candidates withdrawing on election day.

Comprehensive ChatGPT Risk Assessment

Walter Haydock from StackAware has conducted an exhaustive risk assessment of OpenAI's ChatGPT. This summary encapsulates the critical findings and documentation from the assessment, aiming to enhance your understanding and governance of AI tools.

Key Findings from the Assessment:

• Purpose and Criticality: ChatGPT serves multiple functions, from generating marketing content to converting unstructured data into structured formats. Its operational importance is significant, with potential major business impacts in case of system failure.

• System Complexity and Reliability: Despite its complex nature, ChatGPT has shown reliable performance, although occasional performance and availability issues have been documented on OpenAI’s status page.

• Environmental and Economic Impacts: ChatGPT's operation is energy-intensive, with considerable carbon emissions and water usage. However, it also offers potential economic benefits, potentially contributing significantly to global productivity and economic output.

• Societal and Cultural Impacts: The system’s ability to automate repetitive tasks could liberate millions from mundane work but also poses risks to employment and misinformation, particularly during sensitive periods like elections.

• Legal and Human Rights Considerations: The system's deployment must carefully navigate potential impacts on employment and privacy, with strict adherence to legal and human rights norms.

Deepfake Phishing Attempt Targets LastPass Employee: Audio Social Engineering on the Rise

A recent incident reported by LastPass sheds light on a concerning trend: the use of audio deepfakes in social engineering attacks.

What Happened?

• A LastPass employee received a series of calls, text messages, and voicemails supposedly from the company's CEO.

• The voice messages utilized deepfake technology to convincingly mimic the CEO's voice.

• The attacker attempted to pressure the employee into performing actions outside of normal business communication channels and exhibiting characteristics of a social engineering attempt.

Why This Matters:

• This incident marks a potential turning point in social engineering tactics. Deepfakes can bypass traditional email-based phishing attempts and create a more believable scenario for the target.

• Audio deepfakes pose a significant threat because they exploit the inherent trust we place in familiar voices.

How LastPass Responded:

• The targeted employee, recognizing the red flags of the situation, did not respond to the messages and reported the incident to internal security.

• LastPass highlights the importance of employee awareness training in identifying and reporting social engineering attempts.

Change Healthcare Cyberattack: A Costly Reminder for Physicians

A recent cyberattack on Change Healthcare, a major healthcare IT provider, has had a significant impact on physicians across the country. According to a KnowBe4 article, a staggering 80% of physicians reported financial losses due to the attack. United Health announced the attack cost them $1.6 billion alone.

The High Cost of the Breach

The article details the financial strain placed on physician practices:

• Revenue Loss: Disruptions caused by the attack made it difficult to submit claims and verify benefits, leading to lost revenue.

• Increased Costs: Extra staff time and resources were required to complete revenue cycle tasks.

• Personal Expenses: Some practices were forced to use personal funds to cover business expenses.

USPS Now the Most Impersonated Brand in Phishing Attacks

Phishing attacks are one of the most common cyber threats. Criminals impersonate well-known brands to trick people into giving up personal information. According to a recent report, the United States Postal Service (USPS) has surged to the top spot on the list of most impersonated brands.

Here are some tips to avoid falling victim to a USPS phishing attack:

• Be wary of emails or text messages that claim to be from USPS about a delivery issue or package requiring additional fees.

• Do not click on any links or attachments in suspicious emails or text messages.

• If you are unsure about the legitimacy of an email or text message, contact USPS directly.

• Be mindful of the sender's email address and look for typos or inconsistencies.

By following these tips, you can help protect yourself from phishing attacks.

Phishing Threat Intelligence April 2024

These are the phishing related stories I paid attention to in April 2024. Feel free to use these and share them with your own security teams.

 The NaurLegal Campaign Unveiled 

BlueVoyant's Threat Fusion Cell has exposed a new cyber attack campaign, dubbed ‘NaurLegal’, led by the notorious eCrime group Narwhal Spider. This campaign ingeniously exploits the trust in legal transactions by distributing malicious PDF files posing as invoices from reputable law firms. With filenames like "Invoice_[number]from[law firm name].pdf," these documents are crafted to bypass casual scrutiny and initiate malware infections. 

Key Insights: 

• Tactic Exploitation: NaurLegal leverages the routine nature of legal document exchanges, using this as a vector to deploy malware, including sophisticated threats like WikiLoader and potentially IcedID. 

• Infrastructure: The campaign operates through compromised WordPress sites for command and control (C2), a hallmark of Narwhal Spider’s modus operandi. 

• Evolving Threat: Unlike previous attacks primarily targeting Italian entities, NaurLegal broadens its focus, indicating a strategic shift towards exploiting a wider array of organizational vulnerabilities. 

Google Ads Malware Alert for Security Professionals 

In a recent discovery by AhnLab Security Intelligence Center (ASEC), a sophisticated malware distribution campaign has been identified exploiting Google Ads' tracking feature. Dubbed by ASEC, this campaign cleverly disguises malware as popular groupware installers like Notion, Slack, and Trello, leveraging Google Ads to reach a broad audience. The exploitation of the Ads platform's vast user base and complex targeting options presents a notable security concern, highlighting the innovative strategies of cybercriminals to breach defenses. 

Key Campaign Insights: 

• Malware Distribution: Attackers create or hijack Google Ads to distribute malware through tracking URLs hidden in legitimate-looking ads, leading unsuspecting users to download harmful executables. 

• Targeted Malware: The campaign specifically uses malware-laden files with names mimicking reputable software installers to trick users into initiating downloads. 

• Sophisticated Evasion Techniques: Upon execution, the malware contacts attacker-controlled servers to fetch additional malicious payloads, utilizing compromised domains and text-sharing sites for hosting. 

• Payloads and Execution: The Rhadamanthys infostealer malware, fetched from these links, is then injected into legitimate Windows system files, enabling it to steal private data while avoiding detection. 

Security Alert: New Loader and Agent Tesla Campaign Detected 

SpiderLabs has identified a phishing campaign deploying Agent Tesla via a sophisticated new loader. Initiated via email attachments disguised as bank payment receipts, this campaign utilizes advanced obfuscation and encryption to deliver its malicious payload while evading detection. 

Key Insights:

• Attack Vector: Phishing emails with attachments that trigger a complex infection chain to deploy Agent Tesla. 

• Evasion Tactics: The loader showcases advanced evasion, including polymorphism and AMSI bypass techniques, to execute the payload stealthily. 

• Agent Tesla Execution: Executes entirely in memory, focusing on data theft and utilizing SMTP for data exfiltration through compromised accounts. 

AI-Powered Malware Spreads Through Social Media Malvertising Campaigns 

This article from Bitdefender highlights a recent surge in information-stealing malware campaigns targeting social media users. 

Key Points: 

• Attackers Exploit Popularity of AI Software: Cybercriminals are leveraging the rising interest in AI-powered image and video generators to distribute malware. 

• Malicious Ads Impersonate Legitimate Software: Fake social media pages and sponsored ads mimic popular AI tools like Midjourney, Sora, and CapCut. 

• Ads Trick Users into Downloading Malware: Clicking on these ads leads users to download malicious software disguised as official installers. 

• Malware Steals Sensitive Information: The malware steals login credentials, browsing history, cookies, and even crypto wallet information. 

• Rilide V4, Vidar, IceRAT, and Nova Stealer Used: The report identifies various information stealers used in these campaigns, including Rilide V4, Vidar, IceRAT, and Nova Stealer. 

• Midjourney Most Targeted Platform: Midjourney, a popular AI image generation tool, was the most impersonated platform in this campaign. 

Attention Security Teams: Malware Spreads Through YouTube Video Game Cracks 

Threat actors are leveraging compromised YouTube accounts to distribute information stealers disguised as popular video game cracks. This campaign, detailed in a recent Proofpoint report, targets unsuspecting gamers, particularly younger audiences. 

• Compromised Accounts: Legitimate and newly created YouTube accounts are being used to upload malicious videos. 

• Deceptive Content: Videos advertise access to pirated software or game upgrades. Descriptions contain links that download malware upon clicking. 

• Targeted Audience: The campaign exploits the desire to bypass paid features, likely appealing to younger gamers. 

Security Implications: 

• Information stealers like Vidar, StealC, and Lumma Stealer can compromise user credentials and other sensitive data. 

• Compromised accounts can be used to further distribute malware or host phishing attacks. 

• Younger audiences may be less familiar with online safety best practices, increasing susceptibility. 

For further investigation: The Proofpoint report provides Indicators of Compromise (IOCs) to assist in identifying these malicious videos. 

ReliaQuest’s Annual Cyber-Threat Report: 2024 

According to the report: 

• Phishing links or attachments were involved in 71% of all initial access phases of cyber attacks 

• The top three MITRE ATT&CK techniques in attacks involved phishing or spear phishing 

• Drive-by-compromise was used in 29% of attack 

• QR code phishing saw a 51% increase in just one month – September – over the previous 8 months combined 

Android Malware Vultur Expands Its Capabilities 

A recent report by Fox-IT details the evolving capabilities of the Android malware Vultur. Key takeaways: 

• New Functionality: Vultur now possesses features that enable remote interaction with a device's screen through Accessibility Services. 

• Enhanced File Management: The malware can now download, upload, delete, install, and locate files on infected devices. 

• Evasion Techniques: Vultur employs app impersonation and communication encryption to evade detection. 

These expanded capabilities pose a significant threat to Android users, as Vultur can now perform a wider range of malicious activities. 

Agent Tesla Targets US and AU Organizations: A Newsletter for Security Professionals 

A recent campaign by cyberespionage actors, nicknamed "Bignosa" and "Gods", has been targeting organizations in the United States and Australia. The attackers use phishing emails with topics related to purchasing goods and order delivery to distribute the Agent Tesla malware. Once installed, Agent Tesla can steal keystrokes and login credentials. 

Key takeaways: 

• Malicious Mails: Phishing emails with seemingly legitimate topics are being used to lure unsuspecting victims. 

• Agent Tesla: This malware steals keystrokes and login credentials, posing a significant threat to compromised systems. 

• Stay Vigilant: Keeping software updated and exercising caution regarding unexpected emails are crucial for mitigating such attacks. 

New Download Threat: Latrodectus Emerges 

A new downloader malware called Latrodectus has emerged, posing a threat to system security. Two threat actors, TA577 and TA578, have been distributing Latrodectus, raising concerns about its potential reach. 

This malware functions as a downloader, capable of not only information theft but also installing additional malware, potentially escalating the attack. Security experts believe Latrodectus might be linked to the creators of IcedID, another malicious software. Key takeaways: 

• Latrodectus's Reach: The involvement of multiple threat actors (TA577 and TA578) indicates a wider distribution network, increasing the potential for encountering this malware. 

• Multi-faceted Threat: Latrodectus goes beyond information theft; its ability to install additional malware poses a serious risk of system compromise. 

• Possible Connection to IcedID: The link to IcedID suggests a potentially sophisticated threat actor behind Latrodectus. 

New Malware Delivery Techniques on the Rise 

New research from Check Point reveals that cybercriminals are developing new methods to deliver malware. These techniques involve novel infection chains designed to bypass common security measures and deliver Remcos, a powerful Remote Access Trojan (RAT). 

The report also highlights the evolving tactics employed by attackers to exploit vulnerabilities. While Lockbit3 remains the most prevalent ransomware, Blackbasta has worryingly climbed the ranks, entering the top three. 

Key takeaways: 

• Cybercriminals are developing new methods to deliver malware, employing novel infection chains to bypass common security measures. 

• Remcos, a powerful Remote Access Trojan (RAT), is being delivered through these new techniques. 

• Lockbit3 remains the most prevalent ransomware, but Blackbasta has risen in prominence. 

• FakeUpdates is the most common malware encountered. 

Tycoon 2FA: Phishing As A Service Evolving to Bypass MFA 

MFA Fatigue? Tycoon 2FA Raises Concerns 

A new variant of the Tycoon 2FA phishing kit is making waves for its effectiveness in bypassing multi-factor authentication (MFA). This phishing-as-a-service (PhishingaaS) tool targets Microsoft 365 credentials and utilizes a technique known as adversary-in-the-middle (AiTM) to steal session cookies, granting access even with MFA enabled. 

Key Points for Security Teams: 

• Active Threat: First observed in August 2023, Tycoon 2FA has become a prevalent threat due to its ease of use and affordability. 

• MFA Bypass: The phishing kit steals Microsoft 365 session cookies, allowing attackers to bypass MFA and gain access to compromised accounts. 

• Stealthier Than Ever: Recent updates enhance the kit's stealth capabilities, potentially reducing detection by security products. 

• Widespread Impact: Sekoia has identified over 1200 domain names associated with Tycoon 2FA infrastructure since its release. 

Alert: Cisco Duo's Multifactor Authentication Service Compromised 

Cisco Duo has issued a warning to its customers following a breach involving a third-party telephony service provider. This incident, which unfolded on April 1, 2024, involved the unauthorized access of SMS logs due to a social engineering cyberattack. 

Key Details: 

• Breach Dynamics: Threat actors gained access by using compromised employee credentials at a third-party provider that handles SMS and VOIP services for Cisco Duo's multifactor authentication (MFA). 

• Data Compromised: The breach resulted in the unauthorized download of message logs for SMS messages sent between March 1, 2024, and March 31, 2024. These logs included phone numbers, carriers, country and state data, and other metadata like the date, time, and type of messages. 

• No Message Content Exposed: It's important to note that the content of the messages was not exposed in the breach. 

Customer Advisory: Cisco Duo has advised all impacted users to notify individuals whose information was compromised and to stay alert for potential phishing attacks leveraging the stolen data. 

Tech Giants Lead Phishing Charge: Microsoft, Google Top Q1 Brand Impersonation 

Phishing remains a top threat, with technology brands the most impersonated. 

A recent report by Check Point Research (CPR) paints a concerning picture of the evolving phishing landscape. Their analysis of brand phishing attempts in Q1 2024 reveals a worrying trend: technology giants are the most targeted sectors. 

Key Findings: 

• Microsoft Maintains Top Spot: Microsoft continues to be the most impersonated brand in phishing attacks, accounting for a staggering 38% of all attempts in Q1 2024. 

• Google Makes Gains: Google rose to the second-place position, capturing 11% of phishing attempts – a significant increase from its previous third-place ranking. 

• Tech Sector Dominates: Technology remains the most impersonated industry, likely due to its prevalence in corporate environments and the potential for lucrative access to company assets through stolen credentials. 

Why Tech Brands? 

Cybercriminals often target technology brands for several reasons: 

• Widespread Use: These brands are familiar and widely used, making them a believable target for phishing attempts. 

• Access to Sensitive Data: Gaining access to compromised accounts in these platforms can grant attackers access to sensitive corporate data or financial information. 

• Remote Work Reliance: The increased use of cloud-based services and remote work environments expands the potential attack surface for tech-focused phishing campaigns. 

Beware of Sophisticated Phishing Attacks Targeting Help Desks! 

Alert! A recent report from the Department of Health and Human Services (HHS) warns of a rise in sophisticated social engineering attacks targeting IT help desks within the healthcare sector. 

Here's what you need to know: 

• Impersonation Tactics: Attackers are making phone calls to help desks, impersonating employees (often in financial roles) and claiming they require urgent assistance. 

• Credentials at Risk: These imposters are armed with convincing details about the targeted employee, including the last four digits of their Social Security number and corporate ID. This information allows them to bypass initial security checks. 

• Potential for Data Breaches: The ultimate goal of these attacks is to steal login credentials or trick help desk personnel into granting access to sensitive systems and data. 

Malvertising Campaign Targets IT Teams with "MadMxShell" Backdoor 

Threat actors are leveraging malvertising campaigns to distribute a previously unseen backdoor dubbed "MadMxShell." This campaign targets IT security and network administration teams by spoofing legitimate IP scanner software websites. 

Key Details: 

• Attack Chain: The threat actors register typosquatted domain names resembling popular IP scanner software. 

• Google Ads Abuse: They then exploit Google Ads to push these malicious websites to the top of search engine results pages (SERPs) for relevant keywords used by IT professionals searching for IP scanner tools. 

• Delivery of Backdoor: Unsuspecting victims who visit the spoofed websites are redirected to download links that deliver the MadMxShell backdoor. 

Technical Analysis: 

• MadMxShell Backdoor: This backdoor offers remote access capabilities, allowing attackers to gain unauthorized control over compromised systems. 

• Limited Information: While details about MadMxShell's functionalities are scarce, the report suggests it possesses file system manipulation and process execution abilities. 

Shift in Attack Tactics: Vulnerability Exploitation on the Rise 

Phishing Declines, Zero-Days Soar 

A recent report by Mandiant indicates a significant shift in cyberattacker tactics. Vulnerability exploitation has overtaken phishing as the primary method for gaining initial network access. Researchers found that in 2023, vulnerabilities were exploited in 38% of intrusions, a 6% increase over 2022. Phishing attempts, while still the second most common initial infection vector, dropped from 22% to 17% over the same period. 

The report also highlights a sharp rise in the exploitation of zero-day vulnerabilities, previously unknown flaws in software, by 56% year-over-year. Chinese cyber espionage groups were found to be the most active users of zero-days, while financially motivated attackers continue to leverage these vulnerabilities to steal financial data. 

Key Takeaways 

• Patching vulnerabilities promptly is crucial to preventing initial network access by attackers. 

• Organizations should prioritize vulnerability management and invest in threat detection solutions capable of identifying zero-day exploits. 

• While phishing remains a threat, user awareness training should be supplemented with additional security measures to mitigate the evolving tactics of cybercriminals. 

Ransomware on the Rise: More Groups, More Victims 

Ransomware is back with a vengeance. A GRIT report shows a worrying 20% increase in victims in Q1 2024 compared to the same period last year. This coincides with a surge in active ransomware groups, jumping from 29 to 45 (a 55% increase). BlackBasta and Play are new major players, joining the persistent LockBit. 

Brutality and Distribution Mark New Era 

These groups are targeting critical infrastructure like hospitals, highlighting a ruthless shift in tactics. Additionally, RaaS groups are recruiting affiliates, creating a more distributed threat landscape. 

Key Takeaways: 

• Patching and Detection are Critical: Shore up defenses by patching vulnerabilities and implementing security solutions. 

• Beyond Phishing: Non-phishing attacks are the new norm, so vulnerability management is key. 

• Backups are Essential: Regular backups ensure a swift recovery from an attack. 

• Stay Ahead of the Curve: Keeping informed about the evolving threat landscape allows for proactive defense. 

Phishing Attacks on the Rise: AI-powered Threat Landscape 

A recent report by AI-ThreatLabz highlights a significant increase in phishing attacks, with a staggering 58% rise observed in 2024 compared to the previous year. This surge is attributed to the growing adoption of Artificial Intelligence (AI) by attackers, enabling them to craft highly personalized and believable phishing campaigns. 

Key Takeaways 

• Phishing Attacks are Soaring: Phishing remains a major threat, with a sharp increase in incidents this year. 

• AI-powered Attacks: Attackers are leveraging AI to create more believable and personalized phishing emails, making them harder to detect. 

• Zero Trust Security is Key: Traditional security approaches may not be sufficient. Zero trust security principles can help mitigate the risk of phishing attacks by continuously verifying access requests. 

FBI Warning: Rising Social Engineering Threats Targeting Personal and Corporate Accounts

This is a timely article I put together for internal distribution as part of a Security Awareness program. Feel free to grab and use as part of your Security Awareness program.

Link: https://www.ic3.gov/Media/Y2024/PSA240411  

The Federal Bureau of Investigation (FBI) has issued an alert regarding an increase in social engineering attacks that cybercriminals are using to compromise personal and corporate accounts. The techniques identified include impersonating employees, SIM swap attacks, call forwarding, simultaneous ringing, and phishing—each designed to manipulate victims into divulging sensitive information. 

Social Engineering Techniques: 

• Employee Impersonation: Cybercriminals pose as company employees to trick IT or helpdesk staff into granting them network access. 

• SIM Swapping: Attackers deceive mobile carriers to transfer a victim’s phone number to a device they control, potentially bypassing multi-factor authentication to access financial and other secure accounts. 

• Call Forwarding and Simultaneous Ring: This method involves forwarding a victim’s calls to the attacker’s number, again potentially circumventing multi-factor authentication. 

• Phishing: Phishing emails mimic legitimate institutions to solicit sensitive information, such as login credentials and personal identification numbers. 

Protection Recommendations: 

• Personal Security Measures: 

• Avoid responding to unsolicited requests for personal information. 

• Set unique passwords for voicemail and mobile accounts. 

• Contact your mobile carrier to block unauthorized SIM changes and call forwarding. 

• Regularly check your account activity for any unauthorized changes. 

• Use complex passwords and avoid posting personal data online. 

• Corporate Security Measures: 

• Pay attention to email banners for messages coming from external sources. 

• Use non-email based multi-factor authentication. 

• Report any phishing and social engineering attempts. 

Reporting and Additional Actions:

If you believe you are a victim of a social engineering attack: 

• Contact your service providers to secure your accounts. 

• Report the incident to the FBI’s Internet Crime Complaint Center at www.ic3.gov for further investigation. 

• Reach out to [INSERT SECURITY INBOX] if you suspect any of these social engineering techniques are being used at work. 

This alert underscores the need for heightened vigilance and proactive measures to safeguard against sophisticated social engineering tactics that are increasingly prevalent in today’s digital landscape. We thank you for helping keep [COMPANY] secure.  

Phishing Threat Intelligence March 2024

Tax Season Phishing Campaigns - Targeting New Tactics 

Microsoft Threat Intelligence (MSTI) has uncovered a rise in phishing campaigns targeting taxpayers during the tax season. These campaigns leverage social engineering tactics to trick victims into revealing sensitive information or clicking on malicious links. 

Targets and Techniques: 

• High-Risk Groups: New taxpayers, small business owners, and older adults are identified as the most vulnerable demographics. 

• Phishing Methods: Emails disguised as legitimate tax documents or communications from employers are common methods. The emails may contain urgency or use scare tactics to pressure recipients into clicking malicious links or opening attachments containing malware. 

Iranian Threat Actor TA450 Shifts Tactics in Latest Campaign 

Summary: A recent campaign by Iranian threat actor TA450 has been detected leveraging a new technique. 

Previous Tactics: Historically, TA450 has targeted Israeli users via email campaigns containing malicious links directly embedded within the email body. These links typically led to file-sharing sites that, when clicked, downloaded remote access trojans (RATs). 

New Development: Proofpoint researchers observed a shift in TA450's tactics. The latest campaign utilizes PDF attachments containing malicious links. The social engineering lure involves emails disguised as pay slips, likely designed to trick victims into opening the attachments. 

Security Implications: This new delivery method makes TA450's emails appear more legitimate, potentially increasing the success rate of these phishing attacks. Security professionals should be aware of this evolving technique and update email security filters accordingly. 

New Trojan: VCURMS Discovered by Fortinet 

Fortinet researchers have uncovered a new trojan named VCURMS. This trojan leverages obfuscation techniques to bypass traditional antivirus detection and establish persistence on compromised systems. 

VCURMS Capabilities: 

• Information Theft: VCURMS can steal sensitive information from infected devices. 

• Remote Access: The trojan grants remote access to attackers, enabling them to control the compromised system. 

Delivery Method: 

VCURMS primarily spreads through phishing campaigns. Attackers target victims with emails containing malicious attachments. Once a user opens the attachment, the trojan infects the system. 

Zscaler ThreatLabz Releases New Report on AI Security Trends and Risks 

A recent Zscaler report, "New AI Insights: Exploring Key AI Trends and Risks ThreatLabz 2024 AI Security Report," delves into the evolving landscape of AI security. Key takeaways for security professionals include: 

• Soaring Enterprise AI Adoption: The report highlights a significant increase (595%) in enterprise adoption of AI technologies. This presents both opportunities and challenges for security teams. 

• Balancing Benefits and Risks: While AI offers significant advantages, it also introduces new security risks. The report emphasizes the need for a well-defined security posture to mitigate these risks. 

• Heightened AI-Driven Threats: Zscaler ThreatLabz observed an 18.5% rise in blocked AI traffic, indicating a rise in malicious actors leveraging AI. 

• Security Best Practices: The report outlines essential security practices for securing AI deployments. These include data loss prevention (DLP) controls and granular access controls to safeguard sensitive data and prevent unauthorized access. 

Security Awareness Newsletter March 2024

This is a security newsletter I’ve put together as part of our security awareness program. This leans more towards healthcare and news items that are more general in nature. I’ll have a more technical focused newsletter later this week that’s targeted at security teams. Feel free to take this newsletter and use it internally as part of your security awareness program.

The Great Zoom-Skype-Google Masquerade: Beware of digital doppelgängers. Fake Zoom, Skype, and Google Meet sites are the latest traps set by cyber tricksters.  These spoofed meetings can trick users into downloading harmful software that compromises their computer. Ensure you’re clicking on the real deal to keep those malware masqueraders at bay. Beware of QR codes that will try to steal credentials as part of this type of attack. 

Beware of fake websites mimicking popular brands!: Typosquatting attacks are surging, and cybercriminals are exploiting user mistakes to steal login credentials and spread malware. Typosquatting is where an attacker registers a similar domain to one a person is familiar with. This increases the chance a malicious link will be clicked. 

Small Businesses Hit Hard by Cybercrime: Some social engineering techniques highlighted in the article include: malicious ads; attackers starting a conversation before trying to get the person to take an action; and the move to PDF attachments. These types of attacks help launch ransomware against small businesses. 

Beware of AI-Driven Voice Cloning in Vishing Scams: The Better Business Bureau (BBB) has issued a warning about the rise of voice phishing (vishing) scams utilizing AI-driven voice cloning technology. Scammers can now mimic voices convincingly with just a small audio sample, leading to fraudulent requests for money transfers or sensitive information. Tips to Stay Safe: 

• Pause Before Acting: Resist the urge to act immediately on unexpected requests, even if they seem to come from a familiar voice. 

• Verify Directly: Contact the supposed caller using a known, saved number—not the one provided in the suspicious call. 

• Question the Caller: Ask specific questions that an impostor would struggle to answer correctly. 

• Secure Your Accounts: Implement multi-factor authentication and verify any changes in information or payment requests. 

Update on Change Healthcare Cyberattack Recovery: Change Healthcare is on track to bring its systems back online by mid-March following a cyberattack that has caused widespread disruption since February 21. The cyberattack has significantly affected healthcare operations nationwide, with providers facing difficulties in payment processing, insurance verification, and clinical data exchange. This highlights why security awareness is so important. Identifying and reporting security threats to the organization is the responsibility of everyone. 

Beware of Tax Season Scams Targeting SMBs and Self-Employed Individuals: As tax season unfolds, a new scam has surfaced targeting small business owners and self-employed individuals. Scammers are using emails to lure victims to a fraudulent site, claiming to offer IRS EIN/Federal tax ID number applications. However, this service is free through the IRS, and the scam site is designed to steal personal information, including social security numbers, creating a significant risk for identity theft and fraud. A Microsoft report identifies green card holders, small business owners, new taxpayers under 25, and older taxpayers over 60 as prime targets for these scams. Check Point has some example phishes in their tax scam article. 

Apple Users Beware: "MFA Bombing" Phishing Attacks on the Rise: Leveraging Apple's password reset system attackers can bombard users with password reset prompts. If a person clicks "allow" on one of the prompts, the attackers can gain access to the user's account. The attackers may also call the person pretending to be Apple support. Some ways to protect yourself from this attack include not clicking on any of the prompts and contacting Apple directly if you receive a suspicious call. 

Microsoft on the Midnight Blizzard Incident

One of the things I enjoy doing is digging into reports on high profile security breaches. I’ve presented on the supply-chain attack of SolarWinds and HAFNIUM’s breach of Microsoft Exchange for ColaSec. We’ve got a new one with Microsoft releasing some details on their incident with Midnight Blizzard. There are some details but it’s more of spin article on how to defend yourself against nation-state actors. Alex Stamos has provided some scathing commentary on the piece.

What we do know is that initial access is due to a password spray attack on a legacy non-production test tenant the account compromised did not have multifactor authentication enabled (MFA). The attackers then used an OAuth application in the test environment that had access to the corporate environment. A new user account with elevated permissions was created and used to get into the O365 Exchange Online. From there they compromised a variety of email accounts looking for information on their own group.

The rest of the piece is meant to be a guide on how to proactively secure and identify this type of attack. There isn’t any detail on how the discovered Midnight Blizzard or any indicators of compromise (IoC). They did provide some generic hunting queries to be run in Microsoft Defender XDR.

I would expect to get more details later as we’re probably getting more information now than we would have in the past due to the new SEC rules requiring earlier reporting of security incidents. We also may have never heard of this incident without the rules. One thing is certain, we’ll see more of these types of breaches in the news cycle this year with a similar level of detail.

This post first appeared on Exploring Information Security.