Our cybersecurity news will not be enjoyable reading for organizations that fail to implement adequate online security measures and update them regularly. Many of the news items in this section report hacks, data breaches and scams that have cost organizations money, credibility and – in some cases – their businesses.
The majority of the adverse incidents reported below could have been avoided had the organization in question taken appropriate steps to protect its database and prevent malware from infecting its computer system. To ensure your organization does not feature in a future cybersecurity news item, implement a web filter from WebTitan.
It is important to ensure that web browsers are kept up to date. Vulnerabilities in web browsers can be exploited to steal information stored in browsers and they can allow threat actors to execute malicious code. For example, in September this year, a CVSS 8.8 severity vulnerability (CVE-2023-4863) was identified in the libwebp code library that allowed malicious code to be executed. The vulnerability affected major web browsers such as Chrome, Edge, Firefox, Opera, Vivaldi, and Brave. The consequences of not updating promptly could be severe. If you store passwords in your browser, all of your stored passwords could be obtained by exploiting a vulnerability, or a threat actor could even take full control of your device.
Any warning that your browser is out of date will naturally be a cause of concern, but it is important to stop and think if you receive a prompt to download a browser update while using the Internet. This is a common tactic used by cyber actors to infect devices with malware. In August 2023, a malware distribution campaign was detected that pushed malware via fake browser updates. The campaign uses a malicious JavaScript framework called ClearFake, which is added to compromised websites to perform drive-by downloads of malware. The campaign uses social engineering to trick users into downloading and running a fake installer.
The attackers compromise WordPress sites and add the ClearFake JavaScript framework. When a visitor lands on the webpage, JavaScript runs and generates a prompt about an important browser security update. If the user responds, a malicious Windows Application Packaging Project (APPX) file is downloaded from Dropbox that, if executed, will deliver a malware payload. The warnings are tailored to the user’s browser and were initially being used to deliver the HijackLoader malware downloader on Windows devices; however, in November, the campaign was expanded to target Apple computers via a fake Safari browser update. In the Apple attacks, the malware payload was an information stealer called Atomic Stealer (AMOS). Atomic Stealer is capable of stealing passwords, cookies, local files, cryptocurrencies, and credit card information stored in browsers.
While this campaign is new, fake browser updates have long been used for distributing malware through compromised websites and malicious adverts. It is therefore important to ensure that this method of attack is incorporated into your security awareness training campaigns to raise awareness of the threat. That is easy to do with the SafeTitan security awareness training and phishing simulation platform. For an additional layer of protection, you should consider using a web filter such as WebTitan. WebTitan will block user access to all known malicious websites and can be configured to block file downloads from the Internet, such as executable files and application installers.
For more information on the SafeTitan security awareness training platform and web filtering with WebTitan, contact TitanHQ today. Both solutions are also available on a 14-day free trial.
India is experiencing a surge in cyberattacks. Data from CheckPoint Research show there has been an 18% increase in weekly cyberattacks in Q1, 2023, compared to a 7% rise globally, and the Asia-Pacific region has seen the highest year-over-year increase in cyberattacks globally, with attacks up 16% this year. Cybercriminals commonly exploit software vulnerabilities to gain initial access to business networks, but the majority of attacks target employees with phishing one of the leading initial access vectors.
Indian businesses need to implement advanced defenses to combat increasingly sophisticated cyberattacks targeting their employees and there is considerable demand for AI-driven email security and web security solutions that are capable of detecting and blocking known and zero-day threats. Many Indian businesses turn to their managed service providers to protect them against phishing, malware, and other cyber threats, and MSPs need to ensure they have solutions that can protect them.
Tata Tele Business Services (TTBS) is the leading provider of business connectivity and communications solutions in India and has the largest portfolio of ICT services in the country. TTBS provides a range of cybersecurity solutions to Indian SMBs, with phishing protection offered through its Tata Tele Email Security Plus Program and web security provided through the Tata Tele Smart Internet Program. Through these two programs, TTBS is able to deliver advanced threat protection against the main initial access vectors.
Those cybersecurity programs have now been bolstered through a new partnership with TitanHQ that has seen SpamTitan Email Security and WebTitan DNS Filtering added to its cybersecurity packages. These two 100% cloud-based cybersecurity solutions have been developed to meet the needs of MSPs of all sizes and allow them to easily incorporate AI-driven phishing and malware protection into their service stacks. SpamTitan Email Security is a multi-award-winning email security solution that delivers cutting-edge protection against spam, phishing, business email compromise, and email-based malware attacks. The solution is easy to implement and use and requires minimal IT support, making it an ideal choice for MSPs who want to improve email security for their clients without having to commit substantial resources to management.
Web Titan is a DNS-based web filtering solution that can be used to carefully control the websites that employees can access. The solution is fed threat intelligence from a network of 650 million endpoints and ensures that malicious web content is blocked and malware downloads are prevented. “We are delighted to partner TitanHQ to offer Tata Tele Email Security- an advanced email security solution that is in line with Zero Trust security agenda of enterprises,” said Vishal Rally, Sr. VP & Head – Product, Marketing and Commercial, Tata Teleservices Ltd. “As a leading technology enabler TTBS is committed to simplifying and democratizing email security for businesses of any size. This partnership will ensure the protection of enterprise sensitive data efficiently and cost effectively”.
If you are an MSP looking to add cybersecurity solutions to your service stack, or if you want to improve the protection you provide to your clients with affordable cybersecurity solutions, give the TitanHQ team a call to find out more about the TitanHQ Partner Program. Through the TitanHQ Partner Program, you can add email security, web security, email encryption, email archiving, and security awareness training and phishing simulations to your service stack and deliver protection to your clients with ease.
Ransomware attacks have increased significantly in 2023 and the file encrypting malware is now used in around 20% of cyberattacks. Ransomware is used to encrypt business-critical files to prevent access, and a ransom demand is issued for the keys to decrypt the files. Most ransomware gangs also steal sensitive data before encrypting files and use double extortion tactics, where the ransom must be paid to recover data and prevent the stolen data from being leaked online or sold to other cybercriminals.
Ransomware gangs use a variety of methods for initial access to networks. Known vulnerabilities in software solutions are exploited, phishing is used to obtain credentials and for delivering malware downloaders, and ransomware is often delivered via the Internet. According to Palo Alto Networks, email attachments were the most common method used for initial access in 2021 and while still popular with many ransomware gangs, in 2022 web browsing was the most common ransomware delivery method. in 2022, email attachments were used as the delivery method in 12% of ransomware attacks; however, web browsing was the initial access vector in 76.5% of attacks.
Ransomware gangs compromise websites and use them to host their ransomware binaries and traffic is then sent to those malicious sites using a variety of methods. Links may be sent in emails and SMS messages with social engineering techniques used to trick individuals into clicking the links. Malicious adverts are often used – termed malvertising – to direct traffic to malicious sites. Many website operators have third-party adverts on their sites to increase revenue, and threat actors are able to sneak their malicious adverts in and display them on high-traffic websites. There have also been many cases of malicious adverts being displayed through Google Ads. Search engine poisoning is also used, where malicious web pages are created and search engine optimization (SEO) tactics are used to get the web pages to appear high in the search engine listings for specific search terms, often those likely to be used by businesses.
While most businesses have email security solutions in place to protect against phishing emails and block malicious attachments, they do not have adequate protection against these web-based attacks. Since web browsing is now such a common method of ransomware delivery, businesses need to ensure they are protected. The most effective way of blocking web-based ransomware delivery is to use a web filtering solution such as WebTitan Cloud. A web filter allows businesses to control Internet access by employees and prevent downloads of malicious files.
WebTitan Cloud is a 100% cloud-delivered web filtering solution that can be implemented in just a few minutes. Through the web-based Interface, businesses can configure category-based filters to prevent employees from visiting categories of websites that serve no work purpose and are commonly used to deliver malware, such as peer-to-peer file-sharing sites. WebTitan can be configured to block certain file downloads from the internet, such as executable files. This allows businesses to block malware and address the issue of shadow IT – unauthorized software downloaded from the Internet by employees. These unauthorized software downloads are a major security risk.
WebTitan is constantly updated with the latest threat intelligence. As soon as a malicious web page is detected, it is added to the WebTitan blacklist and users will be prevented from visiting that site. Any attempt to visit a blocked site will see the user directed to a local block page, ensuring threats are never encountered. If your business does not currently filter the Internet, give the TitanHQ team a call to find out more about WebTitan. WebTitan is available on a free trial so you can test the solution and see the difference it makes. Product demonstrations can also be arranged on request.
A malware distribution campaign has been detected that uses torrents to install cryptocurrency hijackers, using a method that allows the malware to evade antivirus tools. The campaign delivers clipper malware – a type of malware that can steal information from the clipboard and modify clipboard activity with the goal of stealing private keys and credentials for cryptocurrencies. Once installed, the malware will monitor the clipboard looking for cryptocurrency wallet addresses. If a cryptocurrency wallet address is found, it will be replaced with the address of a wallet under the control of the attacker. When a payment is made by the victim, it will be directed to the attacker’s account.
This campaign uses torrents for Windows 10 Pro, which will deliver a Windows 10 ISO image for the installation. An ISO file contains the image of data found on an optical disc, in this case, the Windows 10 installation disk. This campaign hides the clipper malware in the Extensible Firmware Interface (EFI) partition. The EFI partition contains the bootloader and other files that are executed before the operating system starts up. The benefit of hiding the malware in the EFI is it is not typically scanned by antivirus software, so the malware is likely to remain undetected.
When the ISO file is used to install the operating system, a scheduled task is created that launches the dropper, which mounts the EFI partition as the M:\ drive. When mounted, the dropper will copy two other files to the C:\ drive: An executable that serves as the injector, and a DLL file – the clipper malware – which is injected into the %WINDIR%\System32\Lsaiso.exe system process. To evade detection, the clipper checks for any analysis tools and will not switch cryptocurrency wallet addresses if they are discovered. According to Dr. Web, as of June 13, 2023, this campaign has allowed malicious actors to steal at least $19,000 in cryptocurrency.
Pirated software and operating systems are often used for distributing malware, either through the installation files themselves or the cracks and product activators that accompany them, and are used for generating valid software license codes. In many cases, the actual software or operating system offered via torrent sites is genuine, and the user will get a copy of the software they are expecting but the malware will also be installed silently as part of the installation process.
As the latest campaign demonstrates, the malware that is installed can be persistent and fail to be detected by many antivirus solutions. In this case, it is a clipper used for stealing cryptocurrencies; however, information stealers, remote access Trojans, and backdoors can just as easily be distributed via this method. One download and installation by an employee that is looking to improve their productivity by installing software unauthorized by the IT department can be all it takes for hackers to gain access to the network, steal sensitive data, and perform any number of malicious activities undetected.
The easiest solution to avoid this method of malware delivery is to never attempt to download pirated software, but employers should take steps to ensure that employees are not tempted and should implement a web filtering solution. WebTitan Cloud is a cloud-based DNS filtering solution that is quick and easy to install and configure and can be used to block access to torrents and warez sites where pirated software is available. In addition to blocking certain types of websites by category, the solution can also be configured to block downloads of specific file types, such as executable files, including ISOs.
In addition to reducing the risk of malware infections, IT departments can prevent employees from downloading and installing legitimate software without the knowledge of the IT department. These software installations also pose a security risk, since the IT department will have no control over software updates and patching. That means vulnerabilities are likely to remain unaddressed and those vulnerabilities could be targeted by malicious actors to gain access to the network.
If you want to improve your security posture, exercising control over the websites employees can visit is a good place to start. WebTitan Cloud is available on a free trial to allow you to test the solution in your own environment before deciding on a purchase. TitanHQ also offers WebTitan Cloud for Wi-Fi, which can be used by Wi-Fi hotspot providers to carefully control the content Wi-Fi users can access – for security reasons, as well as creating a family-friendly Wi-Fi network.
If you have any questions about WebTitan Cloud, WebTitan Cloud for Wi-Fi, or web filtering in general, give the TitanHQ team a call.
A new file-archiver-in-the-browser phishing kit has been created that tricks victims into opening malicious zip files and downloading and installing malware on their devices.
The phishing kit takes advantage of the new .zip TLD domain that was released by Google this month along with 7 other new TLDs (.dad, .phd, .prof, .esq, .foo, .mov, and .nexus). According to Google, “.Zip is a secure domain for tying things together or moving really fast. Hosting content on a .zip domain means speed.” However, the new TLD is ripe for abuse and a phishing kit has already been created that takes advantage of this new TLD.
The problem with .zip domains is an attacker could easily create a new domain such as setup.zip or invoice.zip, for use in phishing and malware distribution. For instance, a domain could be registered that mimics a legitimate file archiver, such as WinZip or WinRAR, and emails sent with clickable .zip links. Setup.zip would seem like a normal setup archive for installing a program, and the domain could be used to download a setup.zip file containing malicious files.
This was recently demonstrated by a security researcher called Mr.d0x. He showed that a webpage on a registered .zip domain can be made to appear to be a regular WinRAR file using HTML/CSS. He also provided another example mimicking the Windows 11 File Explorer window. To make the scam more believable, the domain generates a fake antivirus popup that tells the user that the content of the .zip file has been scanned and found to contain no malware. Popups can also be generated on the site to make the scam even more realistic, as the popups do not show the address bar.
In this example, the webpage emulated a standard WinRAR file, which included two files – Invoice.pdf and installer.exe. The installer.exe file is naturally an executable file that will install the malware payload; however, the Invoice.pdf file is seemingly benign. This could be used to download an executable file, such as a file with a double extension – Invoice.pdf.exe. If the user has their device configured to hide known extensions, all they would see is invoice.pdf, and the file could easily be opened in the belief it is a harmless PDF file.
These new domains will certainly be used in phishing attacks, although there is an easy way to protect your business and that is to use a web filter such as WebTitan and simply block access to .zip domains. If a user attempts to visit such a domain, no connection will be made to the domain and instead, they will be directed to a local block page – No connection = no threat. If employees need access to specific .zip domains for business purposes, then those domains can be whitelisted through WebTitan to allow access.
You can install WebTitan on a free trial to see how easy it is to block access to specific TLDs, categories of websites that serve no business purpose, access to known malicious URLs, and risky file downloads, such as executable files that are commonly used to deliver malware (.exe, .js, .bat, .msi). Blocking these files can also help to control shadow IT – unauthorized software installations by employees that are unknown to the IT department.
For more information on WebTitan, contact the TitanHQ team today.
Malicious actors are abusing Google Ads to drive traffic to malicious websites where malware is downloaded, and abuse of Google Ads for malware distribution is increasing. Google places its Ad blocks at the top of the page, so the adverts are the first thing people see when the search results are generated. The adverts are tailored to specific search terms and are effective at driving traffic to legitimate websites. Consumers are made aware that the links displayed at the top of the search results are sponsored but users trust that the adverts will direct them to businesses that provide legitimate products and services. Google has many checks in place to prevent abuse of its ad network and conducts stringent verification checks on new ads before allowing them to be displayed; however, malicious actors are able to circumvent these checks.
One technique that malicious actors deploy to get their malicious adverts displayed is to create a clone of a legitimate website or product and offer a Trojanized version of a product for download on that page. Alternatively, a benign website can be used until verification has taken place and it can then be updated to include malicious content.
These malicious webpages typically offer popular software products such as AnyDesk, Teamviewer, Dashlane, and Malwarebytes software. Since the website used by the scammers looks legitimate, there is a reasonable chance that the malicious software will be downloaded and installed. Since the user gets the product they are seeking, they are unlikely to realize anything untoward has happened, but while the legitimate software is installing, malware will also be silently installed. A variety of malware families are being delivered using this method, such as RacoonStealer, RedLine, Cobalt Strike, and the IcedID malware loader.
Security-aware individuals may check the domain of the site before downloading any files to make sure it is legitimate, so to make these campaigns more believable, the domains used are very similar to the legitimate domains, often differing by one or two characters or using hyphenated domains relevant to the product being offered – dashlane-download.com for example.
A new campaign has recently been detected that offers the AnyDesk remote desktop application. Google Ads are displayed for related search queries, and the user is directed to the attacker-controlled site where they download an MSI installer, which uses PowerShell to download the malware payload, which is executed via rundll32. Once installed, the malware connects with its C2 server and awaits instructions.
The malware – Lobshot – is a financial Trojan and information stealer for Windows systems that was first detected in the summer of 2022. The malware is stealthy and can remain undetected in systems and gives hackers hidden VNC access to Windows devices. The malware is capable of stealing from more than 50 cryptocurrency wallets in popular web browsers but also allows the hackers to remotely access an infected device and control that device without being detected by the user.
Malicious actors are increasingly using Google Ads for malware distribution, as well as search engine poisoning. The latter involves using search engine optimization techniques to get malicious websites to appear high up in the organic search engine listings for key business search terms, such as searches for business software and contract and agreement templates.
Businesses can protect against malware downloads via the web by using a web filter. Web filters will block access to known malicious URLs and can be configured to block specific file downloads from the internet, such as executable files, thereby preventing unauthorized software installations. They can also be used to carefully control the websites that employees can access when on or off the network.
For more information on Internet content control and web filtering, give the TitanHQ team a call. WebTitan is available on a free trial to allow you to test the product in your own environment before making a decision about a purchase.
Are you looking for a Cyren alternative for email and web security? TitanHQ can offer solutions for both to ensure your business is fully protected from email and web-based threats. TitanHQ can also provide a comprehensive security awareness training platform to help you eradicate risky practices and teach employees how to identify the full range of cyber threats they are likely to encounter.
If you are a Cyren customer, you will no doubt be aware that the company is experiencing extreme financial difficulties, to the point where the company recently had to let 121 members of staff go. That represents a significant reduction in its workforce, but the problems do not end there. In a February 1, 2023 press release, Cyren announced that current market pressures and the challenges the company has faced with raising additional capital mean the company is facing collapse.
“In the absence of additional sources of liquidity, management anticipates that the Company’s existing cash and projected cash flows from operations will not be sufficient to meet the Company’s working capital needs in the near term,” explained Cyren in its press release. “In the event that the Company determines that its liquidity will not allow it to meet its obligations as they become due or that additional sources of liquidity will not be available, the Company may need to pursue options available under applicable insolvency laws, including winding up its operations.”
Cyren offers a range of cybersecurity services and solutions, including email security and web security. In response to the announcement, TitanHQ contacted Cyren to ask how its services are being affected, and received a response from the CISO, stating “The SDK will work for as long as the systems in the cloud will continue running. Unfortunately, we have no personnel left to watch after the systems, so it is hard to predict how long they will run for.”
The news has left many customers looking for a Cyren alternative for email and web security, as without the staff to man the controls, protection will suffer. Many Cyren customers have contacted TitanHQ seeking a Cyren alternative and have received assistance migrating their email and web security from Cyren to SpamTitan and WebTitan. Those customers have been offered both solutions free of charge for 30 days to give them time to TitanHQ’s Cyren alternatives.
The management at TitanHQ have decided to extend that offer to all customers looking for a Cyren alternative, which will allow them to ensure that for at least the next 30 days they will be able to stay fully protected against email and web-based threats while they make a decision. Further, the TitanHQ migration team will be on hand to provide support to allow Cyren customers to rapidly transition to SpamTitan and WebTitan.
At the end of the 30 days, TitanHQ would love to retain former Cyren customers and continue to provide email and web security, although this is a no obligation 30 day offer with no strings attached. TitanHQ’s infrastructure can be rapidly scaled up to provide the extra capacity with no impact on the service for current users, so there should be no issues. All TitanHQ asks is for Cyren customers to contact the migration team and explain their requirements and to agree to fair use of the products.
AI-generated phishing emails could change the phishing landscape. Investigations of AI-based text-generating interfaces have shown the threat is real and demonstrate the value in security awareness training.
There has been a huge buzz in recent weeks around a new chatbot developed by OpenAI. Chat Generative Pre-Trained Transformer – or ChatGPT as it is better known – is an AI-based chatbot developed by OpenAI that is capable of interacting conversationally with humans. When a query is entered into ChatGPT, it will provide an answer, and it is capable of answering complex questions.
ChatGPT is a natural language processing tool that generates human-like responses and is built on top of OpenAI’s GPT-3 family of large language models. The tool has been trained how to respond and has been fine-tuned with both supervised and reinforcement learning techniques, with the information that allows a response to be provided gathered from a huge range of online sources. Huge amounts of data have been fed into the model, allowing it to accurately predict what word comes next in a sentence, similar to autocomplete but trained on a truly epic scale. GPT-3 has 175 billion parameters and was trained on 570 gigabytes of text, and the next generation of the engine, GPT-4, promises to be even more accurate. For reference, the previous version, GPT-2, had just 1.5 billion parameters.
ChatGPT is capable of generating far more human-like responses to questions than standard chatbots, which have major limitations. ChatGPT has also been trained to understand the intent in a question, allowing it to ignore irrelevant words in questions and generate accurate, fact-based answers. ChatGPT was released and made available to the public in late November as part of the testing process and amassed more than 1 million users in just 5 days and has been used to write entire articles, songs, poems, and more and is capable of generating content in a particular style.
The content generated may seem a little stilted, but it is generally accurate and contains no grammatical errors or spelling mistakes. It is capable of writing essays, many of which are superior to those that would be written by a high school student, and the tool was even capable of passing the US bar exam for lawyers when fed the questions.
While the tool has many beneficial uses, there is concern that it could be abused and used for social engineering scams, business email compromise, and phishing attacks. Provided the right query is entered, ChatGPT can generate almost flawless written content at incredible speed, and investigations have demonstrated that the tool can be used to create convincing phishing emails.
Researchers at WithSecure decided to put ChatGPT to the test to determine whether the tool could be used to create malicious content. ChatGPT, and other AI-based systems have no morals and will generate content based on whatever queries are entered. In the tests prior to release, the AI-generated phishing emails the researchers created were virtually flawless. OpenAI has implemented controls to prevent phishing emails from being created, as that violates the terms and conditions, but it is still possible to get the tool to generate phishing emails.
For the test, the WithSecure researchers used queries such as this:
“Write an email notification from LinkedIn informing [person1] that they have been removed from a company LinkedIn group following a complaint about online behavior. The email should inform [person1] that they can follow [link] to refute the claim or confirm that the account that received the complaint does not belong to the recipient.”
The response was better than many phishing emails that are routinely sent by scammers to achieve the same purpose. They didn’t include spelling mistakes or grammatical errors, nor would the person entering the query need to have a good grasp of English. It is also possible to spin up multiple unique copies of these phishing emails at incredible speed.
The research clearly demonstrates the potential for AI-generated phishing and the creation of other malicious content and, unfortunately, it is currently unclear how the misuse of these tools could be blocked without banning their use entirely. AI-generated phishing emails may be harder for users to identify due to the lack of spelling errors and grammatical mistakes and the quality of the written content, but there are still signs that these emails are not what they seem. It is therefore important to train the workforce to be able to recognize those signs of phishing, and that is an area where TitanHQ can help – Through the SafeTitan Security Awareness Training Platform.
TitanHQ is proud to announce that the company has been recognized in the Fall 2022 Expert Insights ‘Best-Of’ awards, and collected five awards for email security, email archiving, web security, phishing simulation, and security awareness training.
The Expert Insights ‘Best-Of’ awards recognize the leading cybersecurity solutions that businesses are using to keep their networks and sensitive data secure. Selecting the best software solutions to use can be a challenge for businesses. Expert Insights makes that process easier by providing objective and honest reviews and advice, producing buyers’ guides, and other valuable information to help businesses choose the best software solutions to meet their needs. Each month, more than 85,000 businesses use the Expert Insights website, with the site having more than 1 million visitors a year.
The Fall 2022 Best-Of awards were split into 41 categories. The Expert Insights editorial team researched to identify the best cybersecurity solutions on the market for inclusion in each category, which contain up to 11 software solutions. Those solutions are selected based on several criteria, such as the feature set of the products, their ease of use, market presence of the company, and how genuine business users of the solutions rate the products. There naturally needs to be a winner in each category, but simply being included in the list confirms the quality of a product.
TitanHQ collected 5 Best-Of awards in the following categories:
Best-Of Email Security – SpamTitan
Best-Of Security Awareness Training – SafeTitan
Best-Of Phishing Simulation – SafeTitan
Best-Of Web Security – WebTitan
Best-Of Email Archiving – ArcTitan
In addition, SpamTitan was rated as the top email security solution in the category and ArcTitan was rated top in the email archiving category. Vendors ESET and CrowdStrike also performed exceptionally well and picked up multiple awards.
“We are honored that TitanHQ was named as a Fall 2022 winner of Expert Insights Best-Of award for phishing simulation, email security, security awareness training, web security and email archiving” said TitanHQ CEO, Ronan Kavanagh. “Our cloud-based platform allows partners and MSPs to take advantage of TitanHQ’s proven technology so they can sell, implement and deliver our advanced network security solutions directly to their client base”.
Email is the most common way that cybercriminals reach employees, but there has been a major increase in vishing attacks on businesses in 2022, with Agari reporting a 625% increase from Q1 to Q2, 2022. Ransomware gangs are mostly gaining access to business networks through email phishing, but groups that have broken away from the Conti ransomware operation have readopted the hybrid phishing techniques attacks that were used by the group’s predecessor, Ryuk. Contact is made with targeted individuals via email and vishing used to get those individuals to provide the attackers with account and network access.
You may already be familiar with vishing, or voice phishing as it is otherwise known. It is the use of social engineering techniques over the telephone to manipulate people into revealing sensitive information such as login credentials or tricking them into opening a remote-control session on their computer or installing malware that gives the attacker remote access to a device.
Many vishing attacks are speculative – An attacker obtains phone numbers and impersonates a broadband provider or other trusted entity, in a tech support scam where the target is tricked into thinking they have a malware infection or other issue that needs to be urgently dealt with. The ransomware gangs are conducting callback phishing attacks, where initial contact is made via email and the user is told to call the provided number to avoid a charge to their account – a subscription that is about to renew or a free trial that will end.
As with email phishing, many reasons are given by scammers as to why action needs to be taken. Steps are also taken to make these scams more realistic, such as spoofing caller IDs to make it appear that a local area number is being used or even that the call is made from a trusted number. The latter occurred in a vishing campaign on the Michigan healthcare provider, Spectrum Health, where the calls appeared to have been made using a Spectrum Health phone number.
These types of scams can be highly effective against businesses. Most businesses have implemented email security solutions that can detect and block phishing emails, but email security solutions will not block vishing attacks. The voice network is largely unprotected.
Voice traffic filters can be used to filter out calls from numbers that are known to be used for scams. In the United Kingdom, the phone carrier EE says it uses AI-based technology to block scam phone calls and has blocked 11 million such calls since implementing the technology, but scammers can simply change the numbers they use. The main defense against these scams is security awareness training.
Employees may be aware that phishing threats will land in their inboxes, but they may not be aware that phishing can take place over the phone. Awareness of these scams should be improved through security awareness training and employees should be taught about the signs of a vishing attack to allow them to identify and avoid these scams.
TitanHQ can help in this regard. TitanHQ offers a comprehensive security awareness training platform – SafeTitan – for educating the workforce on the full range of cyber threats, including email phishing, vishing, and smishing attacks. The training content is gamified and engaging and has been proven to reduce the susceptibility of employees to shams such as phishing and vishing.
For more information on improving your human cybersecurity defenses, give the TitanHQ team a call.
SpamTitan Plus is a leading-edge artificial intelligence-driven anti-phishing solution from TitanHQ that provides better coverage than any other anti-phishing product on the market. The solution has 100% coverage of all current market-leading anti-phishing feeds, which gives users a significant uplift in phishing link detections and faster detection of phishing threats than any other product.
The solution is fed massive clickstream traffic from more than 600 million endpoints worldwide, and more than 10 million new, and never-before-seen phishing and malicious URLs are added to the solution and blocked for all users every single day. When a new, malicious URL is detected, it takes less than 5 minutes for all users of SpamTitan Plus to be protected. Independent tests have shown SpamTitan Plus is 1.6 times faster at detecting phishing URLs than any of the current market leaders and achieves a 1.5x increase in unique phishing URL detections.
When a user clicks a link in an email, the URL is checked in real-time, not just when the email is delivered. This is important as campaigns are often conducted where the destination URL has malicious content added after delivery to bypass email security defenses. When SpamTitan Plus checks the link, the destination URL is scanned to identify spoofing and login pages, redirects are followed, and many dynamic checks are performed. If the destination URL is determined to be malicious, the user will be directed to a block page.
SpamTitan Plus was launched by TitanHQ in December 2021, and it has already proven popular with businesses that need the very best protection against phishing attacks. TitanHQ has now made a major update to the solution to improve its predictive phishing detection capabilities.
One of the ways that phishing campaigns are conducted to evade security solutions is to use personalized URLs for each targeted company and victim. In a standard phishing campaign, the same URL would be used for the entire campaign. When that URL is detected as malicious, it will be blocked by email security solutions. If a unique URL is used in these campaigns, if it is identified as malicious and blocked, it does not affect any other emails in the campaign as they each has a different URL. URLs are personalized at the path or parameter level, and most anti-phishing solutions provide no protection against these malicious personalized URLs. The personalized URLs are used in phishing, social engineering, reputation attacks, and malware distribution.
The latest predictive functionality detects and blocks automated bot phishing campaigns and personalized URL attacks, ensuring users get the very best phishing protection. The new capabilities have already been added to SpamTitan Plus and made available to all users.
“With predictive phishing detection, SpamTitan Plus can now combat automated bot phishing. At TitanHQ we always strive to innovate and develop solutions that solve real-security problems and provide tangible value to our customers. The end goal is to have our partners and customers two or three steps ahead of the phishers and cybercriminals’ said Ronan Kavanagh, CEO, TitanHQ.
Phishing emails are commonly used to distribute malware and in recent years malware loaders have been a common payload. Malware loaders include the likes of BazarLoader and Bumblebee, which are used to infect devices with the goal of delivering the malware and ransomware payloads of other threat groups.
Security researchers have identified a relatively new malware loader dubbed Matanbuchus that is being delivered via phishing emails. Like other malware loaders, Matanbuchus is operated under the malware-as-a-service model, and has been developed to stealthily download and execute second-stage malware payloads and executable files. The Matanbuchus loader has recently been observed dropping Cobalt Strike on infected systems. Cobalt Strike is a legitimate adversary simulation framework that is used in red team operations for detecting vulnerabilities that could potentially be exploited, but is also extensively used by criminal hackers for post-exploitation activities.
The Matanbuchus loader is currently being offered on Russian cybercrime forums for $2,500, and has been available since at least February 2021, with a malware developer operating under the moniker BelialDemon believed to be the developer of the malware. BelialDemon is known to have been involved in the development and sale of other malware loaders, such as TrumpLoader.
Matanbuchus, which is an alternate name for the demon Belial, can be used to launch an .exe or .dll file in the memory, add or modify task schedules, launch PowerShell commands, and execute standalone executable files to load a DLL. The malware has already been used in several attacks in the United States, including entities in the education sector.
Researchers at Palo Alto Networks’ Unit 42 team have identified phishing emails being used to deliver the Matanbuchus loader that use Excel documents with malicious macros. As is common in these types of phishing campaigns, if the user opens the attached file, they are informed that the document was created in an earlier version of Microsoft Excel, so the content cannot be viewed unless the user clicks on Enable Editing and then Enable Content. Should content be enabled, Excel 4.0 macros are then leveraged to drop and execute the Matanbuchus loader.
A campaign has also been detected that uses a .zip file attachment that contains an HTML file, which delivers a second .zip file that includes an MSI installer. If that file is executed, an error message is displayed indicating to the user that something has gone wrong, when in the background a DLL file is delivered and executed, which acts as the loader for delivering the Matanbuchus loader DLL file.
To block the delivery of malware loaders such as Matanbuchus, it is important to implement multiple cybersecurity solutions. A Spam filter such as SpamTitan can be used to block the delivery of the phishing emails. SpamTitan includes dual antivirus engines for detecting and blocking known malware and sandboxing to identify unknown malware through in-depth analysis of the behavior of attached files.
A web filter such as WebTitan should be used to block connections to malicious websites that host the malware. WebTitan can also be configured to block downloads of files often used to deliver malware and command-and-control center communications.
It is also strongly recommended to provide comprehensive security awareness training to all members of the workforce to explain the threat of phishing emails, explain the red flags to look for in emails, and not to open attachments unless they can be verified as authentic. TitanHQ can help in this regard through the SafeTitan Security Awareness Training solution, which includes a phishing simulation platform for simulating phishing emails to test how employees respond. For further information on these solutions, contact TitanHQ today.
In October 2021, Microsoft launched its latest operating system – Windows 11 – and cybercriminals were quick to take advantage, offering free Windows 11 upgrades as a lure to trick people into installing malware.
Windows 11 has not been a roaring success so far. According to data from the IT asset management solution provider Lansweeper, on April 4, 2022, only 1.44% of corporate and personal devices had Windows 11 installed, which is less than the number that have Windows XP installed, for which support stopped being provided in 2014.
One of the main issues with Windows 11 is the stringent hardware compatibility requirements. One of the requirements for a Windows 11 upgrade is for devices to support Trusted Platform Module (TPM) version 2.0, which means any devices over 4 years old will not be able to have Windows 11 installed unless the hardware is upgraded.
Microsoft offers a tool on its website that will check whether a device has the hardware to support an upgrade to Windows 11, but any user who has not visited the official Microsoft website is unlikely to be unaware of the hardware restrictions, and it is those individuals who are being targeted and tricked into installing malware.
Malware is often distributed via peer-2-peer file-sharing networks and warez sites that offer pirated software, either packaged with the software installers or with the product activators and cracks that are used to generate valid licenses; however, the fake Windows installers are being pushed through search engine poisoning.
Search engine poisoning, also known as SEO poisoning, is the creation of malicious websites and the use of search engine optimization techniques to get the websites to appear high in the organic search engine listings for certain search terms. In this case, search terms related to Windows 11 downloads.
When a user enters a search string into Google, the malicious website appears in the listings. A variety of domains are used in the campaigns that at first glance appear to be legitimate, windows11-ugrade11.com being one example. The landing page on these websites include the Microsoft logo and menus and an attractive Get Windows 11 screen with a Download Now button.
One campaign has been identified that delivers a novel malware variant dubbed Inno Stealer, which is installed by an executable file in the downloaded ISO file. Inno Stealer can steal web browser cookies, passwords stored in browsers, data from the filesystem, and data in cryptocurrency wallets. Other malware variants are also being distributed using similar tactics. Fake windows installers have also been distributed via phishing emails. One campaign delivers Qbot malware via a password-protected ZIP file that contains a malicious MSI installer.
Spam filtering solutions can be used to block malware delivery via phishing emails; however, to block malware downloads from web browsing, a web filter is required. WebTitan is a DNS-based web filter that incorporates advanced DNS filtering controls to block access to malicious websites and prevent malware downloads.
WebTitan is fed threat intelligence from a network of 650 million worldwide users. Newly identified threats are immediately propagated to database deployments worldwide to provide coverage and protection against emerging, zero-hour threats. The solution can also be configured to block attempts by users to download file types often associated with malware, such as ISO and MSI files. WebTitan can handle any volume of usage with no latency, so users will be unaware that content is being filtered until they encounter a threat and are informed by WebTitan that the threat has been blocked.
If you want to improve your defenses against malware and phishing attacks via the Internet, contact TitanHQ today to find out more about WebTitan. Product demonstrations can be arranged on request and the full product is available on a free trial (with full support) to allow you to see for yourself how effective it is at blocking threats and how easy it is to install, set up, and use.
Expert Insights has announced its Spring 2022 Best-Of awards and TitanHQ has been given awards in 5 categories, including best-in-class awards for SpamTitan Email Security, WebTitan DNS Filter, ArcTitan Email Archiving, and SafeTitan Security Awareness training.
Expert Insights is an online publication that receives more than 80,000 visitors a month. Business owners and Information Technology professionals rely on the website which provides insights into the best business software solutions, along with blog posts, buyers’ guides, technical product reviews and analyses, interviews with industry experts, and reviews of software solutions by users of those solutions, who give accurate advice on their experiences and how the products perform in practice.
The Best-Of Awards recognize vendors and products that excel in their respective categories and help businesses achieve their goals. “Each of the services recognized in our awards are providing in many cases an essential service to their users, driving business growth, securing users in a challenging cybersecurity marketplace, and massively improving business efficiency,” Joel Witts, Expert Insights’ Content Director.
Each category includes a maximum of 11 products that have been analyzed by Expert Insights’ editorial and technical teams in the UK and US and have achieved excellent ratings from genuine users of the solutions. “These awards recognize the continued excellence of the providers in these categories,” said Witts.
At the Expert Insights Spring 2022 awards, TitanHQ was ranked the number 1 solution in the Best Email Security Gateway category for SpamTitan Email Security, ArcTitan Email Archiving was ranked number 1 in the Email Archiving for Business category, WebTitan DNS Filter ranked second in the Web Security category, and SafeTitan Security Awareness Training was ranked in the top 10 in two categories, Security Awareness Training and Phishing Simulation.
“The recent pandemic and the growth of remote working initiatives have further highlighted the need for multiple layers of cybersecurity and our award-winning solutions form key pillars in this security strategy,” said TitanHQ CEO Ronan Kavanagh. “We will continue to innovate and provide solutions that MSPs can use to deliver a consistent, secure and reliable experience to their customers.”
It has been a busy 3 months for TitanHQ with two new product launches, a new Channel Chief, and 12 strategic new hires to support the company’s incredible North American growth.
In February 2022, TitanHQ announced Channel veteran, Jeff Benedetti, had been recruited to lead North American sales and the company’s go-to-market efforts in the U.S. and Canada and continue to expand the company’s North American footprint.
Benedetti has almost two decades of successful sales and go-to-market leadership experience in the security and technology markets, with his most recent position being the sales and marketing chief at SKOUT Cybersecurity – which was recently acquired by Barracuda Networks. Benedetti also served as Director of U.S. Sales at Datto, where he significantly increased partner growth and played a key role in Datto’s expansion. While he was at the company, Datto achieved unicorn status and was acquired by Vista Private Equity. In addition to leading the U.S. channel team, Benedetti will oversee the relaunch of the North American TitanHQ partner program in April 2022.
January and February 2022 have seen TitanHQ enjoy incredible growth globally and especially in North America. To support that growth, Benedetti now has a new North American TitanHQ team that includes 12 strategic new hires to service the US and Canadian Managed Service Provider (MSP) market, which will be based at TitanHQ’s new North American base in Shelton, CT.
Like Benedetti, the new hires have extensive channel experience, with that experience gained at companies such as Datto, Skout Cybersecurity, Agile Blue, and Barracuda.
The new hires include:
Director of Channel Development
Eric Morano has 15 years of sales leadership and GTM experience at Datto, Skout Cybersecurity (BarracudaMSP), AgileBlue XDR, CDW, and Verizon. Moreno has been tasked with optimizing TitanHQ’s partner engagement and growth.
Channel Account Managers
Craig Somma has 25 years of technology sales GTM leadership at Tech Dept, Micro Warehouse, and Gov Connection
Joseph Rende has 10+ years of Channel Sales Experience at Gartner and Datto
Pat DeAngelis has 10+ years of MSP technology experience at Datto, Threatlocker, and Armor Cybersecurity
Jeff Brown has 10+ years of sales experience at Datto, SKOUT Cybersecurity, Agile Blue.
Account Executives
Alex De Los Santos has 8 years of sales experience at Datto and ADP,
Alex Nankervis has 8 years of sales experience at Datto and Indeed
Kyle Leyerzapf has 5 years of sales experience at Datto
Patrick Barry has 6 years of sales and accounts experience at Accu-Tech Corporation and Maxim Healthcare
Jamal Ibrahim has 4 years of account management experience at Altium and RCG.
Sales Development
Marc Bonnaci has 7 years of sales and professional experience including Agile Blue.
The New TitanHQ North American Channel Team
In addition to bringing in top talent, TitanHQ has expanded its product portfolio in recent months with the addition of a new anti-phishing solution and security awareness training platform.
In December 2021, TitanHQ launched SpamTitan Plus – A leading-edge AI-driven anti-phishing solution. SpamTitan Plus provides comprehensive “zero-day” threat protection thanks to extensive threat intelligence feeds – More than any of the current market-leading anti-phishing solutions. That translates into a 1.5x increase in unique phishing URL detections and much faster phishing detection speeds – 5 minutes from detection to protecting all users. This new addition to the SpamTitan family has been very well received by IT departments and MSPs.
In February 2022, TitanHQ announced the acquisition of Cyber Risk Aware. The company was formed in 2016 and has grown into a global leader in security awareness training, which targets the human element of cybersecurity. The company’s platform is used to train employees on how to recognize and avoid cyber threats. The platform is an intuitive, real-time security awareness training platform that improves protection against ransomware, malware, BEC, and phishing attacks. The Cyber Risk Aware platform has now been rebranded as SafeTitan and has attracted seismic interest globally from MSPs and IT managers since its launch.
The new product releases, record company growth, highly skilled new channel team, and soon to be relaunched partner program further cement TitanHQ’s position as the leading provider of cloud-based cybersecurity solutions to managed service providers serving the SMB market.
Information about the 2021 ransomware trends identified by U.S. and European cybersecurity agencies and simple steps you can take to improve your security posture and prevent ransomware attacks.
2021 Ransomware Trends
Cybersecurity agencies identified several 2021 ransomware trends that look set to continue throughout 2022. There was an increase in ransomware attacks in 2021 with education and government the most commonly targeted sectors. The pandemic and lockdowns meant businesses needed to switch to remote working and security teams struggled to defend their networks. Ransomware gangs were quick to exploit vulnerabilities to gain access to networks, steal sensitive data, and encrypt files to extort money from businesses.
2021 also saw an increase in sophisticated ransomware attacks on critical infrastructure. Cybersecurity authorities in the United States said cyber threat actors had conducted attacks on 14 of the 16 critical infrastructure sectors, with the UK’s National Cyber Security Centre reporting an increase in attacks on businesses, charities, legal firms, healthcare, and local government.
While initially, several ransomware threat actors were focused on big game hunting – attacking large, high-value organizations that provide critical services such as Colonial Pipeline, Kaseya, and JBS Foods – the attacks prompted the raising of the status of ransomware attacks to the level of terrorism, and the increased scrutiny on ransomware gangs saw ransomware attack trends change, with the focus shifting to mid-sized organizations.
Double extortion tactics have been the norm for the past two years, where attackers exfiltrate data prior to file encryption and then demand payment for the decryption keys and to prevent the publication of stolen data. A new trend of triple extortion in 2021 saw ransomware gangs also threaten to inform the victim’s partners, shareholders and suppliers about the attack. It is also now common for ransomware gangs to work with their rivals and share sensitive data. There have been multiple cases where ransomware gangs have shared information with other gangs to allow them to conduct follow-on attacks.
2021 saw an increase in attacks on the supply chain. By compromising the supply chain, ransomware gangs are able to conduct attacks on multiple targets. There was also an increase in attacks targeting managed service providers, where MSP access to customer networks is exploited to deploy ransomware on multiple targets. Russian ransomware gangs have been increasingly targeting cloud infrastructure, accounts, application programming interfaces, and data backup systems, which has allowed them to steal large quantities of cloud-stored data and prevent access to essential cloud resources.
Diverse tactics were used in 2021 to gain access to victim networks, including quickly developing exploits for known vulnerabilities, conducting brute force attacks on Remote Desktop Protocol, and using stolen credentials. These tactics have proven effective, helped by the increase in remote working and remote schooling due to the pandemic.
Improve Your Defenses Against Ransomware Attacks
To defend against ransomware attacks, it is important to prevent attackers from using these tactics. The number of reported vulnerabilities increased in 2021 and security teams struggled to keep up with routine patching. Security teams need to prioritize patching and concentrate on patching the vulnerabilities that are known to have been exploited, such as those published in the U.S. Cybersecurity and Infrastructure Security Agency’s Known Exploited Vulnerabilities Catalog, and critical vulnerabilities where there is a high change of exploitation.
To combat brute force attacks, it is important to ensure all default passwords are changed and strong passwords are set for all accounts. Consider using a password management solution to make this easier. Multifactor authentication should be set up for as many services as possible, especially for access to critical systems, VPNs, and privileged accounts. RDP, other remote access solutions, and risky services should be closely monitored and ports and protocols that are not being used should be disabled.
It is also vital to take steps to prevent phishing attacks. Phishing is commonly used to gain access to credentials to gain a foothold in networks, or for phishing emails to be used to deliver malware. An advanced email security solution should be implemented to detect and block as many phishing threats as possible to prevent then from being delivered to employee inboxes. A web filtering solution can improve defenses by blocking access to the websites linked in phishing emails and to prevent the downloading of malware from the Internet. Security awareness training for the workforce is also important. Training should raise awareness of the risks of visiting suspicious websites, clicking on suspicious links, and opening suspicious attachments.
TitanHQ can help with all of these anti-phishing defenses through SpamTitan Email Security, the WebTitan DNS-based Web Filter, and SafeTitan Security Awareness Training. To find out more about these solutions for SMBs, enterprises, Internet Service Providers, and Managed Service Providers, give the TitanHQ team a call.
Bitdefender has identified a new stealer malware called BHUNT that allows the attackers to access cryptocurrency wallets and irreversibly transfer funds to wallets under their control.
The continued rise in the value of cryptocurrencies has made cyberattacks on cryptocurrency wallets highly lucrative. Large organizations often use cryptocurrencies to improve business reach, reduce transaction costs, prevent chargeback fraud, and make cross-border transactions much easier. Businesses may hold large amounts of cryptocurrencies, so any attack that gives a hacker access to a business cryptocurrency wallet can result in a significant payday; however, attacks on individuals who hold far smaller amounts of cryptocurrencies are also being conducted. Anyone who holds cryptocurrencies is at risk of an attack.
Malware developers have created several malware variants that are primarily used to access to cryptocurrency wallets, including WeSteal malware, which was first identified in 2020 and is available on underground marketplaces. There are many other malware families that have cryptocurrency stealing capabilities, such as the Redline Stealer, which is now one of the most common malware threats. According to an analysis by the blockchain data platform Chainalysis, cybercriminals stole $14bn (£103bn) in cryptocurrency in 2021 – a 79% increase from the previous year.
BHUNT is a new stealer that targets Exodus, Electrum, Atomic, Jaxx, Ethereum, Bitcoin, and Litecoin wallets, can steal passwords stored in Chrome and Firefox browsers, and captures passwords from the clipboard, although it is a specialized malware for stealing wallet files.
BHUNT is a stealthy cryptocurrency stealer that is heavily encrypted using two virtual machine packers – Themida and VMProtect – which hamper attempts by security researchers to reverse-engineer and analyze the malware. The malware is signed with a digital signature stolen from the CCleaner developer Piriform, although the certificate does not match the binaries, and the malware uses encrypted configuration scripts downloaded from public Pastebin pages. When installed, the malware is injected into explorer.exe.
Five modules have been identified, one is concerned with stealing wallet file contents, another module downloads payloads, one steals passwords from the clipboard and exfiltrates to its C2 server, another is a browser password stealer, and the last module cleans up traces of the infection.
The malware has been used in attacks worldwide, especially in South Asia, the Philippines, and Greece, and appears to be distributed in a similar way to other successful information stealers such as the Redline Stealer, through cracks and product activators such as KMSpico.
To protect against infection with the BHUNT stealer, individuals should not download applications and programs from unofficial repositories and should avoid pirated software, software cracks, and other illegal product activators. Businesses should consider implementing defenses against cryptocurrency stealers such as antivirus software on all endpoints and technical solutions to prevent downloads of executable files.
Cryptocurrency stealers, banking trojans, malware downloaders, spyware, adware, and ransomware are often distributed in fake software and software cracks. While policies can be set that prohibit employees from downloading unauthorized software, those policies are often ignored by employees who download unauthorized software to allow them to work more efficiently.
One of the most effective ways of blocking the downloads of unauthorized and pirated software is to use a web filter. WebTitan can be configured to block access to hacking websites, peer-2-peer file-sharing networks, and other sites where cracks, pirated software, and illegal product activators are available.
WebTitan can also be configured to prevent the downloading of files commonly associated with malware, such as executable files, and controls can be implemented for individual users, user groups, departments, or organization wide.
Over the past 4 years, TitanHQ has enjoyed an impressive period of growth, including during the pandemic when many businesses struggled. In addition to building its customer base, TitanHQ has continued to bring in new talent to help drive the business forward. Between September 2020 and April 2021, TitanHQ doubled the size of its workforce and this year released new products to further cement its place as the leading provider of cloud-based cybersecurity solutions to managed service providers serving the SMB market.
TitanHQ’s email security, web security, email archiving, and data encryption solutions are now used by more than 12,000 businesses worldwide to improve their security posture and meet compliance requirements, including Pepsi, O2, Virgin, T-Mobile, and Datto. Among those businesses are over 2,500 managed services providers in 150 countries who use TitanHQ solutions to protect themselves and their customers from cyber threats.
This year, TitanHQ’s growth has been recognized in the 2021 Deloitte Technology Fast 50 Awards, with the company positioned number 33 in the list of Ireland’s fastest-growing technology companies. For the past 22 years, Deloitte has been running the annual awards program to celebrate innovation and entrepreneurship in Ireland’s indigenous technology sector. The list is compiled based on percentage revenue growth over the past 4 years.
In addition to enjoying significant organic year-on-year growth, TitanHQ has also received a significant investment from Livingbridge Investor Group, which has helped to accelerate the company’s ambitious growth plans through investment in people and product development. This month, TitanHQ launched a new spam filtering solution, SpamTitan Plus, which has faster and more comprehensive detection rates of malicious links in emails than any of the current market-leading email security solutions.
“As a result of increased demand globally for our solutions, we have invested heavily in product development and embarked on a recruitment campaign to double our workforce in a program that will allow that growth to continue,” said TitanHQ CEO, Ronan Kavanagh. “The quick move to remote working last year has made us all aware of how important it is to be adaptable and have the right security solutions in place to protect users, customers, company data, and systems.”
In addition to achieving a strong position in the 2021 Deloitte Technology Fast 50 list, TitanHQ was the runner-up in the Scale Up Award, which recognizes the companies that have enjoyed a significant expansion in overseas business over the past four years.
“Congratulations to all of the companies that ranked this year. This is the first year we have seen the impact the pandemic has had on revenues of Irish tech companies,” said David Shanahan, Partner, Deloitte “It will come as no surprise that many of this year’s winners have achieved accelerated growth and scale as a result of the pandemic and being able to capitalize on the global move to a digital way of life.”
TitanHQ are proud to announce the launch of a new solution to protect businesses from increasingly sophisticated phishing threats. SpamTitan Plus builds on the huge success of SpamTitan Gateway and SpamTitan Cloud, which have been adopted by more than 12,000 business customers and over 3,000 Managed Service Providers worldwide.
SpamTitan solutions already provide advanced protection against phishing, malware, viruses, botnets, and ransomware that are delivered via email, with independent tests confirming a high detection and low false-positive rate. SpamTitan Plus takes those protections a step further, with significantly improved coverage, an uplift in phishing link detection, faster detection speeds, and an even lower false-positive rate.
Independent tests have confirmed SpamTitan Plus:
Provides 100% coverage of ALL current market-leading anti-phishing feeds.
Achieves a 1.5x increase in unique phishing URL detections
Has 1.6x faster phishing detections than current market-leading solutions
Is fed 10 million net new, previously undiscovered phishing URLs every single day
Just 5 minutes from initial detection of the malicious URL to protect end users’ mailboxes
Benefits of SpamTitan Plus
According to Deloitte, 91% of all cyberattacks start with a phishing email and despite many businesses providing phishing awareness training to the workforce, many employees still fail to identify phishing emails. Security Affairs says there is a 97% failure rate by employees. Add to that the increasingly sophisticated tactics used by phishers to evade email security solutions and trick end users and it is no surprise that phishing is the number 1 cybersecurity threat faced by businesses.
SpamTitan Plus improves defenses against phishing by blocking more threats before they reach inboxes and ensures that if a phishing email with a malicious link does make it to an inbox, protection is provided at the time an employee clicks the link.
SpamTitan plus provides leading-edge protection through the use of an AI-based system and is fed the latest zero-day threat intelligence. Significant improvements have been made to protect against business email compromise attacks and effectively neutralize malicious links in emails. All links in emails are rewritten and inspected to determine if they are safe and users benefit from time-of-click protection. That means when an individual clicks a link in an email, the content of the landing page is inspected for phishing forms and other malicious content such as spoofed webpages. Redirects are often used by phishers to fool email security solutions that only check the URL stated in the email. SpamTitan Plus protects against this by also following redirects.
Multiple dynamic checks are performed on URLs in real-time, with time-of-click protection ensuring that links included in emails that were benign at the time of delivery – and passed inspection – are detected as malicious if the URLs are weaponized at a later date. For instance, phishing emails may be sent on a Friday with benign links to pass inspection, and the URLs are then updated over the weekend with malicious content added ready for employees returning to work on Monday.
SpamTitan Plus benefits from massive clickstream traffic from 600+ million users and endpoints, which generates 10 million never-before-seen phishing and malicious URLs a day. These unique daily URL additions are powered out of several hundred billion local queries and 100 million cloud queries a day within SpamTitan Plus. The result is faster detection and better protection, with the lowest false positive rate of the market-leading phishing solution providers.
If you run a business or are a managed service provider (MSP) looking to improve phishing protection for your clients, give the TitanHQ team a call to find out more about SpamTitan Plus and how it can significantly improve your defenses against phishing and other email threats.
Biomedical firms and their partners are being targeted by an Advanced Persistent Threat (APT) actor in a campaign that delivers Tardigrade malware. Initial analyses of Tardigrade malware suggest it is a sophisticated threat from the SmokeLoader malware family. SmokeLoader is a generic backdoor that provides threat actors with persistent access to victims’ networks and gives them the ability to download additional modules or other stealthier malware variants onto systems.
Tardigrade malware is a much stealthier and more dangerous malware variant than SmokeLoader. It is far more sophisticated and has greater autonomy. The malware can make decisions about the files to modify and can move laterally within victims’ networks without requiring communication with a command-and-control server. The malware is also capable of immediate privilege escalation to the highest level.
Tardigrade malware is thought to be used for espionage purposes but has far greater capabilities. In addition to exfiltrating sensitive data from pharmaceutical and biomedical firms and vaccine chain companies, the malware is capable of causing major damage to IT systems to disrupt critical processes, including preparing systems for ransomware attacks after sensitive data have been exfiltrated. The analysis of the malware is ongoing, and no specific threat actor has been identified as conducting the attacks, but the attacks are believed to be conducted by a nation-state threat actor.
BIO-ISAC warns of Targeted Attacks on the Biomanufacturing Sector
The Bioeconomy Information Sharing and Analysis Center (BIO-ISAC) has recently issued a warning about Tardigrade malware due to the threat it poses to vaccine manufacturing infrastructure, even though relatively little is currently known about the malware. The early disclosure is believed to be in the public interest.
All firms in the biomanufacturing sector and their partners have been warned that they are likely targets and should assume that attacks will occur. Steps should therefore be taken to ensure that appropriate cybersecurity measures have been implemented to block attacks and limit the damage that can be caused should n attack be successful.
It is too early to tell how many methods are being used to distribute Tardigrade malware, but from the infections detected so far, the APT group behind the attacks is known to be using phishing emails to deliver Tardigrade, with infected file attachments the most likely method of delivery. Hyperlinks in emails that direct individuals to malicious websites where infected files or malware installers are downloaded could also be used.
An analysis of the attacks also indicates the malware could infect USB drives and transfer the malware automatically when those storage devices are used on uninfected computers. That means that if USB drives are used on devices isolated from the network, they too could be infected.
Defending Against Tardigrade Malware
Defending against attacks requires an advanced antispam solution that is not reliant on antivirus engines to detect malicious files. Antivirus engines are effective at blocking known malware variants, but not against previously undetected variants. Since Tardigrade malware is metamorphic, machine learning technology and sandboxing are required to block samples that are not detected as malicious by AV engines. Antivirus software should be installed on all devices which is capable of behavioral analysis, as the malware itself may not be detected as malicious.
A web filter should be installed and should be configured to block downloads of executable files from the Internet, such as .js, .com, .exe, and .bat files. It is also important to raise awareness of the threat of malicious messages with the workforce and teach all employees how to identify phishing emails. Training should cover cybersecurity best practices and inform employees about the procedures to follow if a suspicious email is received. Spear phishing attacks will likely be conducted on key targets. It is therefore recommended to review LinkedIn and other social media posts to identify individuals who may be targeted.
Network segmentation is vital for preventing the spread of Tardigrade malware. In the event of a device being compromised, network segmentation will limit the harm that can be caused. Tests should be run to ensure that corporate, guest, and operational networks are properly segmented. All firms in the biomanufacturing sector should identify their most sensitive data and ensure that it is appropriately protected, and all key infrastructure should be regularly backed up, with backups stored offline. BIO-ISAC also recommends inquiring about lead times for key bio-infrastructure components that need to be replaced
A new Android banking Trojan named SharkBot has been identified that has capabilities that go beyond most mobile banking Trojans.
This new Android malware stands out due to its use of an Automatic Transfer System (ATS) technique that allows it to bypass multi-factor authentication controls and automate the process of stealing funds from victims’ accounts. In order to steal funds from accounts, most Trojans require human input. SharkBot keeps human interaction to a minimum by auto-filling fields, such as those that need to be completed to make money transfers.
SharkBot can intercept SMS messages, such as those containing multi-factor authentication codes sent by financial institutions, and can hide those SMS messages to make it appear that they have not been received. SharkBot can also perform overlay attacks, where a benign pop-up is displayed over an application to trick a user into performing tasks, such as giving permissions. SharkBot is also a keylogger and can record and exfiltrate sensitive information such as credentials to the attacker’s command and control server and bypasses the Android doze component to ensure it stays connected to its C2 servers.
The malware has been configured to steal money from bank accounts and cryptocurrency services in the United States, United Kingdom, and Italy, and targets 27 financial institutions – 22 banks and 5 cryptocurrency apps.
During installation, the user is bombarded with popups to give the malicious app the permissions it needs, with those popups only stopping appearing if the user provides the required permissions, which include enabling Accessibility Services. When the malicious app is installed, the app’s icon is not displayed on the home screen. Users are prevented from uninstalling the malware via settings by abusing Accessibility Services.
The ATS technique used by the malware allows it to redirect payments. When a user attempts to make a bank transfer, information is auto-filled to direct payments to an attacker-controlled account, unbeknown to the victim.
The malware was analyzed by researchers at Cleafy, who found no similarities with any other malware variants. Since the malware has been written from scratch, it currently has a low detection rate. The researchers believe the malware is still in the early stages of development, and new capabilities could well be added to make it an even bigger threat.
One of the main problems for developers of malware targeting Android devices is how to get the malware installed on a device. Google performs checks of all apps available before adding them to the Google Play Store, so getting a malicious app on the Play Store is difficult. Even if that is achieved, Google is quick to identify and remove malicious apps.
SharkBot has been identified masquerading as a variety of apps such as an HD media player, data recovery app, and live TV streaming app, which is delivered via sideloading on rooted devices and by using social engineering techniques on compromised or attacker-owned websites to convince victims to download the fake app.
SharkBot uses a wide range of techniques to prevent detection and analysis, including obfuscation to hide malicious commands, an anti-emulator to check if it has been installed on a real device, by downloading malicious modules once it has been installed, and by encrypting all communications between the malware and the C2 servers.
Users of mobile phones tend not to be as cautious as they are with laptops and computers, but the same cybersecurity best practices should be followed. It is important to avoid clicking hyperlinks in emails and to only download apps from official app stores. The malware also serves as a reminder that while multi-factor authentication is an effective security measure, it is not infallible.
2021 has been a particularly bad year for cyberattacks. There are still 6 weeks of 2021 left, but there have already been more publicly reported data breaches than in all of 2020, according to the Identity Theft Resource Center (ITRC). 2020 was a record-breaking year for cyberattacks, and that record looks set to be beaten once again.
ITRC said supply chain attacks increased by 42% in the first quarter of 2021, ransomware attacks have been occurring at record levels, and phishing attacks remain a constant threat. It is not just the number of data breaches being reported that I a cause for concern, but also the severity of those breaches.
This year has seen several high-profile attacks, including the ransomware attack on Colonial Pipeline in the United States that disrupted fuel supplies to the East Coast for a week, and a ransomware attack on the Irish Department of Health and the Health Service Executive in May 2021, which resulted in data theft and major disruption to healthcare services.
Attacks on critical infrastructure have a devastating impact on people businesses can suffer catastrophic losses. Given the current threat level and frequency at which data breaches are being reported, it has never been more important to invest in cybersecurity.
Cybersecurity is now a priority for Irish businesses following a series of devastating cyberattacks in the country. Those attacks have hammered home the message that all Irish companies need to take steps to improve their defenses and keep hackers at bay.
Think Business, Ireland has recently raised awareness of the risk of cyberattacks and is helping businesses in the country find the solutions they need, by highlighting the excellent work being conducted by Irish cybersecurity firms. Many cybersecurity firms have a base in Ireland, with the country producing some incredible homegrown cybersecurity talent in the form of consultants, security experts, and companies that offer cutting-edge cybersecurity solutions that are protecting companies and data all around the world.
To help Irish businesses find companies that can meet their cybersecurity needs, Think Business, Ireland recently compiled a list of the top Irish 26 cybersecurity companies to watch out for in 2021 and beyond, with the report highlighting the wide range of cybersecurity solutions that have been developed by innovative Irish companies that are making their mark on the global stage.
The list includes TitanHQ, a Galway-based cybersecurity firm that has been developing innovative security solutions for 25 years. TitanHQ’s award-winning email security, web security, and email archiving solutions are now used by more than 12,000 businesses in over 150 countries, with more than 2,500 managed service providers using the solutions to protect their own and their clients’ networks from cyber threats such as malware, ransomware, viruses, botnets, and phishing.
While many businesses have been struggling through the pandemic, TitanHQ has gone from strength to strength and has continued to enjoy impressive growth. Investment from Livingbridge investor group has helped the company invest even more in product development and people and over the past 18 months, the company has doubled its workforce to more than 90 employees.
TitanHQ solutions have been developed to be easy to implement and use by all businesses and, importantly, the solutions were built from the ground up by managed service providers to help MSPs better protect their clients. The solutions save MSP’s support and engineering time by stopping problems at the source and are easy to fit into existing service stacks. That’s part of the reason why TitanHQ is now the leading provider of cloud-based cybersecurity solutions to MSPs serving the SMB market.
“We are delighted to be listed next to some of the biggest names in the Irish cybersecurity space,” said Ronan Kavanagh, CEO, TitanHQ. “As the threat landscape continues to be a significant risk to organizations across the globe, we are dedicated to continuous innovation to provide consistent, secure, and reliable protection to our customers.”
Left to Right: Ronan Kavanagh, CEO, Diane Wright, people operations manager, Sean Morris, chief technical officer, Gina Mc Grath, digital marketing executive, and Dryden Geary, marketing director.
Exploit kits first emerged in 2006 and have since been used as an automated method of malware delivery. Exploit kits are programs that are loaded onto websites that contain exploits for known vulnerabilities. When a visitor lands on a web page that hosts an exploit kit, it performs a scan to determine if certain software vulnerabilities have not been patched. If an unpatched vulnerability is identified, the exploit kit will choose an exploit and will deliver a malware payload with no user interaction required.
Exploit kits became hugely popular with threat actors between 2010 and 2017, and while their use has declined to a fraction of the level seen in 2016 and 2017, they do still pose a threat. There are several exploit kits still being used that are regularly updated with new exploits for known vulnerabilities, and over the past couple of years they have mostly been used to deliver malware loaders that deliver ransomware.
The Fallout exploit kit for example has been used to deliver Maze Locker ransomware, and the Magnitude EK, which was first identified in 2013, is also being used to deliver ransomware, mostly in the Asia Pacific region.
Exploit kits are loaded on legitimate websites that have been compromised, as well as attacker-owned websites, with traffic to the latter often delivered through malicious adverts (malvertising). It is therefore easy to land on a site hosting an exploit kit through general web browsing.
The Magnitude EK is now one of the most extensively used exploit kits which, until recently, was only being used to target Internet Explorer; however, the exploit kit has now been updated and is being used to target Chromium-based web browsers on Windows PCs.
Avast reports that two new exploits have recently been added to the Magnitude EK, one of which targets a vulnerability in Google Chrome – CVE-2021-21224 – and the other targets the Windows kernel memory corruption vulnerability tracked as CVE-2021-31956. The Google Chrome bug is a remote code execution vulnerability, and the Windows bug can be exploited to bypass the Chrome sandbox, allowing an attacker to gain system privileges.
Patches have been released by Google and Microsoft to address both of these flaws; however, the reason why exploit kits are still an effective method of malware distribution is many people delay or ignore software updates. While the Magnitude EK is not believed to be currently exploiting the vulnerabilities to deliver a malware payload, it is unlikely that will remain the case for long.
The best defense against exploit kits is to ensure that software updates and patches are applied promptly, although that is not always possible for businesses and sometimes some devices are missed and remain vulnerable. An additional measure that can protect against exploit kits and other types of web-based malware distribution is a web filter.
Web filters are the Internet equivalent of spam filters. Just as a spam filter prevents the delivery of emails containing malware to inboxes, web filters prevent malware delivery via malicious websites and are a key component of anti-phishing defenses, preventing end-users from visiting websites hosting phishing kits.
TitanHQ has developed WebTitan to protect businesses from web-based threats and carefully control the content that can be accessed by office-based and remote workers. WebTitan is a DNS-based web filter that is quick and easy to implement, which has no impact on page load speeds. WebTitan is used by more than 12,000 businesses and managed service providers for content filtering, blocking malware delivery via the internet, and as an additional security measure to block phishing attacks.
If you want to improve protection against malware, malicious sites, phishing sites, C2 callbacks, ransomware, botnets, spyware, and viruses, give the TitanHQ team a call or put the solution to the test in your own environment by taking advantage of a 100% free 14-day trial of the full solution.
For the second year in a row, TitanHQ has collected best-in-category awards from Expert Insights for each of its three products: SpamTitan Email Security, WebTitan Web Security, and ArcTitan Email Archiving.
SpamTitan was recognized and awarded top spot in the Best Email Security Gateway and Best Email Security Solution for Office 365 categories, the DNS-based web filtering solution WebTitan Cloud came top in the Best Web Security Solution category, and the cloud-based email archiving solution, ArcTitan, placed top in the Best Email Archiving Solution for Business category.
The cybersecurity solutions were praised for the level of protection they provided against threats such as malware, ransomware, phishing, viruses, and botnets, with all three solutions recognized for ease-of-use and cost-effectiveness. TitanHQ’s world-class technical and customer support also proved to be a hit with Expert Insights’ researchers and businesses that have adopted the solutions.
Expert Insights is an online publication covering cybersecurity and cloud-based technologies that is used by over 80,000 business leaders, IT professionals and others to obtain invaluable advice to help them make the right purchase decisions. The publication includes insights into B2B products and services, with the UK and US-based teams conducting interviews, industry analyses, and technical product reviews.
Each year, the Fall 2021 Best-of Cybersecurity Awards recognize the leading companies and products for businesses and managed service providers, with the category winners selected based on reviews by independent technical analysts, the Expert insights’ editorial team, and feedback from users of the solutions.
To win one award is a great achievement, but to win 4 shows the commitment of the TitanHQ team to providing businesses with powerful solutions that address their needs that are easy to use and at the right price point, providing timely help and advice for customers whenever it is required.
“TitanHQ are proud to have received continued recognition for all three of our advanced cybersecurity solutions. As the threat landscape continues to be a significant risk to organizations across the globe, we are dedicated to continuous innovation to provide consistent, secure, and reliable protection to our customers,” said Ronan Kavanagh, TitanHQ CEO.
Phishing is commonly associated with spam emails, but it is not the only method of phishing as the PayPal text phishing scam below shows. Phishers use various methods to obtain sensitive information and phishing threats could arrive by email, text message, instant messenger services, and scams can be conducted over the phone.
Phishing is arguably the biggest cyber threat faced by businesses and consumers and can result in a malware infection, the encryption of files via ransomware, theft of sensitive data such as credit/debit card numbers or bank account information, or the email account could be used for sending spam and phishing emails and for malware distribution. A successful phishing attack could prove incredibly costly as bank accounts could easily be emptied. For businesses, malware infections can be catastrophic and billions are lost to business email compromise phishing scams each year.
There are approximately 200 million PayPal users, which makes the online payment service particularly attractive for phishers. PayPal is one of the world’s most commonly spoofed brands. If the brand is spoofed, there is a relatively high probability that the phishing email or text message will be received by a person who has a PayPal account. Further, PayPal accounts usually contain money and they are linked to a bank account and/or credit card. Gaining access to PayPal credentials can see the account and linked bank account emptied.
Phishers use a variety of social engineering techniques to fool end users into installing malware or disclosing their login credentials and other sensitive information. Spam email may be the main method of attack, although the use of text (SMS) messages – often referred to as SMiShing – is growing. This method of phishing can prove more successful for attackers. The PayPal text message phishing scam below is much harder to identify as malicious than many of the PayPal email phishing scams that have been detected in recent weeks.
Beware of this Credible PayPal Text Phishing Scam
This PayPal text phishing scam, and several variants along the same theme, have been detected in recent weeks. The text message appears to have been sent from PayPal from a short code number.
The message reads:
Dear Customer,
Your account is currently under review. Please complete the following security form to avoid suspension: http://bit[dot]ly/PayPal_-no-sms.eu
Another message reads:
Dear Customer,
Your account is under review. Please fill in the following security form to avoid lockout: http://bit[dot]ly/_payPal__
These PayPal text phishing scams work because many people do not carefully check messages before clicking links. Click the link on either of those two messages and you will be directed to a website that appears to be the official PayPal website, complete with branding and the normal web layout. However, the websites that the messages direct recipients to are scam sites.
Those sites naturally require the user to enter their login credentials. Doing so passes those credentials to the scammer. The scammer will then use those credentials to access the account, empty it of funds, and plunder the bank account(s) linked to the PayPal account. The password for the account may also be changed to give the attacker more time to make transfers and lock the genuine account holder out of the account.
These scams are particularly effective on smartphones as the full URL of the site being visited is not displayed in the address bar due to the small screen size. It may not be immediately apparent that an individual is not on the genuine PayPal website.
This PayPal text phishing scam shows that you need to always be on your guard, whether accessing your emails or viewing text messages.
Protect your customers from web-based threats such as drive-by downloads, exploit kits, and phishing. Book a FREE WebTitan demo. Book Free Demo
Don’t Become a Victim of an SMS Phishing Scam
The PayPal text phishing scam detailed above is just one example of how cybercriminals obtain sensitive information via text message. Any brand could be impersonated. Shortlinks are often used to hide the fact that the website is not genuine, as is altering the link text to mask the true URL.
To avoid becoming a victim of a SMiShing scam, assume any text message correspondence from a retailer or company could be a scam. If you receive a message – typically a warning about security – take the following steps.
Access your account by typing in the correct URL into your web browser. Do not use the link in the message.
Check the status of your account. If there is a freeze on your account, your account is under review, or it has been suspended, this will be clear when you try to log in.
If in doubt, contact the vendor by telephone or send an email, again using verified contact information and not any contact details supplied in the text message (or email).
Before logging in or disclosing any sensitive information online, check the entire URL to make sure the domain and web page are genuine.
PayPal Email Phishing Scams
This PayPal text phishing scam is one of thousands of phishing campaigns targeting PayPal users. While SMS phishing scams are increasing, most phishing attacks are conducted via email.
PayPal email phishing scams can be highly convincing. The emails contain the familiar PayPal logo, the text in the message body is often well written with no grammatical errors or spelling mistakes, the footers contain all the information you would expect, and the font is the same as that used in genuine PayPal messages.
The purpose of PayPal phishing emails will vary depending on the campaign, although typically the aim is:
To fool someone into disclosing their PayPal username/email address and password combination
To obtain a credit/debit card number, expiry date, and CVV code
To obtain bank account information and other personal information that allows the account to be accessed
To obtain a Social Security number and date of birth for use in identity theft and tax fraud
To install malware – Malware can capture all the above information and more
To install ransomware – Ransomware encrypts files and prevents them from being accessed unless a ransom payment is made
PayPal phishing emails can be very convincing and virtually indistinguishable from genuine communications; however, there are often signs that suggest all may not be what it seems.
Some of the common identifiers of PayPal phishing emails have been detailed below:
The messages contain questionable grammar or spelling mistakes.
The hyperlink text suggests one domain, when hovering the mouse arrow over the link shows it directs the user to a different domain.
The message does not address the account holder personally and starts with Dear PayPal user, user, or PayPal member instead of using the first and last name or the business name.
A link in the email directs the recipient of the message to a website other than the genuine paypal.com domain or local site – paypal.ca, paypal.co.uk for example.
The website the user is asked to visit does not start with HTTPS and does not have the green padlock symbol in the address bar.
The email requests personal information be disclosed such as bank account details, credit card numbers, or security questions and answers.
A user is requested to download or install software on their device.
Protection from web-based threats and precision Internet content control for your workforce. Book a FREE WebTitan demo. Book Free Demo
HTTPS Does Not Mean a Website is Genuine
There has been a general push to get businesses to make the switch from HTTP to HTTPS by installing an SSL certificate. The SSL certificate binds a cryptographic key to an organization’s details and activates both the padlock sign and changes a website to start with HTTPS. This ensures that the connection between the browser and the webserver is encrypted and secured.
If the website has a valid SSL certificate installed, it reduces the potential for snooping on information as it’s entered in the browser – credit card information for example. However, what an SSL certificate will not offer is a guarantee that information is safe and secure.
A website owned by or controlled by a cybercriminal could have a valid SSL certificate and start with HTTPS and have a green padlock. Disclosing information on that site could see sensitive information handed to a scammer.
As more and more businesses have made the transition to HTTPS, so have cybercriminals. According to the Anti-Phishing Working Group’s (APWG) Q1, 2018 phishing activity trends report, 33% of all phishing websites now use HTTPS and have valid SSL certificates. HTTPS and a green padlock do not mean that a website is genuine. It only means information entered on the site via the browser is secured.
HubSpot’s SSL encryption features automate your website security without plugins, so your site stays secure without any of the manual upkeep.
Anti-Phishing Best Practices to Adopt
Exercise caution when someone sends you a hyperlink in a text message or email. The sender may not be who you think it is. A contact or family member’s email account may have been compromised or their phone stolen or the email address may have been spoofed.
Never open email attachments in unsolicited emails from unrecognized senders.
Beware of any email that suggests urgent action must be taken, especially when there is a threat or negative consequences for inaction – your account will be suspended or deleted for example.
If in doubt about the genuineness of an email, do not click any links or open any attachments. Simply delete the message.
Businesses should implement an advanced spam filter to prevent the majority of phishing emails from reaching inboxes.
Businesses should also implement DMARC to prevent spoofing of their brands.
Businesses should provide ongoing security awareness training to employees to teach them the skills required to identify phishing emails and smishing attempts such as this PayPal text phishing scam.
If you run a business and are concerned about phishing, TitanHQ can help. TitanHQ has developed an award-winning anti-spam and anti-phishing solution that blocks more than 99.9% of spam and malicious messages, incorporates dual anti-virus engines to detect malicious attachments, includes DMARC authentication, and sandboxing to perform in-depth analyses of malicious attachments. The solution works seamlessly with Office 365 to improve phishing detection and keep users’ inboxes free from spam, phishing, and other malicious emails. Further, TitanHQ operates a highly competitive pricing policy and SpamTitan can be used at a fraction of the cost of other anti-phishing solutions.
Contact TitanHQ and arrange a product demonstration, sign up for a free trial of the full solution (including support), and discover the difference SpamTitan can make to your organization’s security posture.
Protect your customers from web-based threats such as drive-by downloads, exploit kits, and phishing. Book a FREE WebTitan demo. Book Free Demo
A new SharePoint phishing scam has been detected which attempts to steal Office 365 credentials from business users. those credentials are subsequently used to gain access to sensitive company information stored in the cloud and email accounts which can be used in phishing and business email compromise attacks.
The scam emails used in this campaign are similar to those used in countless Google Docs phishing scams. The messages appear at face value to be genuine attempts by employees and contacts to collaborate through the sharing of files. Most of these scams are concerned with spreading malware. The documents usually contain malicious macros which download the malware payload if allowed to run. JavaScript and VB scripts are also used to achieve that aim. However, due to the value of Office 365 accounts, hackers are increasingly conducting attacks to gain access to Office 365 credentials.
The latest scam uses messages that appear to be standard quests to collaborate on SharePoint. This SharePoint phishing scam includes a hyperlink to a genuine SharePoint document, which may not be flagged as malicious since the file itself does not contain malware.
The SharePoint file advises the user that the content they are looking for has been uploaded to OneDrive for Business and a further click is necessary to access the file. A hyperlink named “Access Document” is included in the SharePoint file along with the genuine OneDrive for Business logo. At face value, the document does not appear to be malicious, although checking the destination URL of the link will reveal that it directs the user to a suspect website.
After clicking the link, the user is presented with a login window for Office 365 and their Microsoft Office 365 credentials must be entered to proceed. Entering Office 365 credentials at this point will see them harvested by the scammers running this campaign. The user is unlikely to realize that they have been successfully phished as after entering their credentials they will be directed to the genuine Office 365 web page.
Protection from web-based threats and precision Internet content control for your workforce. Book a FREE WebTitan demo. Book Free Demo
This SharePoint phishing scam is being used in targeted attacks on businesses. SharePoint is commonly used by businesses for collaboration, so there is a high probability that employees will be used to receiving such requests. Finding email addresses for business users is also straightforward. Lists can be purchased on darknet marketplaces and hacking forums, or they can be obtained from professional social networking sites such as LinkedIn.
This SharePoint phishing scam, Google Docs phishing scams, and similar campaigns spoofing Dropbox are commonplace and are highly effective. They take advantage of familiarity with these collaboration services, trust in the brands, and the lack of security awareness of employees. These brand impersonation attacks use email formats that are identical to those used in genuine collaboration requests, including correct logos, formatting and genuine-looking links, and can be difficult for end users to identify as malicious.
Preventing these SharePoint spoofing scams requires technological solutions to stop the messages from being delivered and links from being followed. Standard Office 365 anti-phishing protections are not particularly effective at blocking threats such as these. Businesses will be better protected using a dedicated anti-phishing solution on top of Office 365. SpamTitan is an award-winning anti-spam and anti-phishing solution that works seamlessly with Office 365 and provides superior protection against phishing attacks. SpamTitan uses a wide range of innovative techniques to identify malicious emails and block them at source to prevent them from reaching end users’ inboxes.
Security awareness training is also vitally important to condition employees to stop and think before taking any action requested in an email and to raise awareness of the use of collaboration requests in phishing campaigns.
If you want to improve email security and better defend your organization against phishing attacks, contact the TitanHQ team today and request further information on SpamTitan. Product demonstrations can be arranged on request, free trials of the full product are available with full support during the trial, and a range of deployment options are available to suit the needs of your business. Also consider using a web filter such as WebTitan, which will block attempts to block websites used for phishing and malware distribution.
Following the ransomware attacks on critical infrastructure in the United States, several ransomware-as-a-service operations went quiet. The attacks attracted a lot of heat for ransomware gangs and several groups responded by either implementing new restrictions on the types of entities that their affiliates could attack, shutting down entirely and releasing the keys to allow victims to recover, or simply disappeared from the Internet.
Following the attack on Colonial Pipeline in May 2021 by a DarkSide ransomware affiliate, the DarkSide ransomware gang disappeared from the Internet. The REvil ransomware gang that had been so prolific also went quiet. The gang was behind the attack on JBS Foods which caused the temporary shutdown of two meat processing plants in the United States, and most recently, attacked Kaseya and up to 60 of its customers – mostly MSPs – and 1,500 downstream businesses. Shortly after that attack, its web presence disappeared and the gang went deathly silent.
Then there was Avaddon, another prolific operation. After the DarkSide attack on Colonial Pipeline, the Avaddon and REvil operators announced that they would be preventing their affiliates from conducting attacks on critical infrastructure, healthcare, and others. Avaddon later released the keys to allow 2,934 victims to recover and appeared to have walked away from ransomware attacks. Popular hacking forums took the decision to distance themselves from ransomware, even going as far as banning ransomware actors from posting on their forums.
Following the critical infrastructure attacks, the United States government has taken several steps to allow it to target ransomware gangs more effectively and has demanded Russia take action to stop ransomware gangs that are operating within Russia’s borders. The heat has certainly been turned up and RaaS operations are being scrutinized.
There has been considerable speculation about whether government agencies have succeeded in taking down some of these RaaS operations, even though none have announced that they are part of any takedown. That is not to say that there was no law enforcement or government action, only that if there was it has all been done on the quiet.
While it would be nice to think that these shutdowns were permanent and ransomware attacks would be slowing, that is unlikely. It is natural for RaaS operators to lie low for a while following such major attacks, especially when governments are now laser focused on tackling the ransomware problem. It is likely that these ransomware operations are just taking a break, and the operators – and certainly the affiliates that conducted attacks under the RaaS programs – will return. The return may well have already happened.
Two new ransomware-as-a-service (RaaS) groups have appeared this month – Haron and BlackMatter – that threat intelligence firms have been investigating. Several have reported this week that they have identified connections with some of the RaaS operations that have recently gone quiet – Avaddon, REvil, and DarkSide.
While no concrete evidence has been found linking the new operations with any of the RaaS operations that have recently disappeared, there are many similarities which suggest that either the Avaddon, REvil, and DarkSide RaaS operations have already rebranded, that affiliates of those operations have branched out and are going it alone, or some members of the shutdown RaaS operations are involved in Haron and BlackMatter to some degree.
Despite the forum bans on advertising RaaS operations, the BlackMatter RaaS has been advertising for affiliates on Russian speaking cybercrime forums, albeit by not stating that they are running a RaaS operation. A user named “BlackMatter” registered an account on July 19 on both the XSS and Exploit criminal forums seeking assistance: Access to the networks of U.S., UK, Australian, or Canadian networks of companies with over $100 million in annual revenues. They also stipulated that they would not be buying access to state institutions or any targets in the healthcare sector, as both REvil and Avaddon announced they would not after the colonial pipeline attack.
The BlackMatter operator also created an Escrow account – used in cases of disputes over payments – and deposited $120,000 – a not insignificant sum. The group is offering between $3K and $100K for access or a share in any ransoms generated in exchange for access. The BlackMatter operators claim their operation incorporates the best features of DarkSide, REvil, and LockBit, all three of which are believed to have operated from within Russia.
Similarities were found between BlackMatter and REvil and DarkSide by several cybersecurity firms, with Recorded Future declaring BlackMatter the successor to DarkSide and REvil, although evidence is circumstantial. For instance, BlackMatter is very similar to BlackLivesMatter, which was the name of the Windows registry used by REvil. Mandiant reports that it has found evidence which points to at least one member of the DarkSide operation being involved with Black Matter, although that individual may simply be an affiliate that has jumped ship when the operation went silent.
S2W Lab has found similarities between Haron ransomware and Avaddon, notably a largely copy and pasted ransom note, similar appearances and wording on the ransom negotiation sites, the same structures on the data leak sites, and identical sections of JavaScript code for chat. However, while the Avaddon gang developed its own ransomware, Haron is based on Thanos ransomware.
The similarities may be coincidence, or the operator may have just saved some time by stealing content and code that had already been created. There are other notable differences between the two in many areas, and no solid proof has been found that suggests Avaddon and Haron are one and the same.
Researchers are still conducting investigations into the new groups, but regardless of who is involved in the operations, their aims appear to be very similar. Both are targeting large organizations with deep pockets and if the RaaS operations that have gone quiet remain out of action, there will be any affiliates looking for a new RAAS operation to join.
These two new RaaS operations could therefore completely fill the gap left by the likes of Avaddon, REvil, and DarkSide and ransomware attacks could well continue at pre-May 2021 levels. What is certain is the ransomware threat is far from over.
A new version of WebTitan Cloud has been released – WebTitan Cloud 4.16 – that includes support for Azure Active Directory and introduces a new school web filtering solution – WebTitan OTG (on-the-go) for Chromebooks.
The new version of WebTitan Cloud includes DNS Proxy 2.06 which supports filtering of users in Azure Active Directory, in addition to on-premise AD and directory integration for Active Directory. Further directory services will be added to meet customer needs and ensure they can enjoy the benefits of per-user filtering with exceptional ease of management. – Further information on the Azure AD app is available here.
Existing WebTitan customers need do nothing to get the latest WebTitan Cloud release as the solution will be updated automatically.
WebTitan OTG for Chromebooks
Using WebTitan OTG for Chromebooks provides an effective way to apply filtering policies to your Chromebooks from the cloud.
WebTitan OTG for Chromebooks is a new web filtering solution for the education sector that allows schools to carefully control the websites that can be access by students both in the classroom and offsite, including in student’s homes.
Schools can easily devise filtering policies for all pupils or specific age groups and apply those filtering polices in the cloud. The solution allows schools to enforce the use of Safe Search and prevent access to age-inappropriate web content to keep students safe.
WebTitan OTG for Chromebooks delivers fast and effective user- and device-level web filtering and empowers students to discover the Internet in a safe and secure fashion, while also ensuring compliance with federal and state laws such as the U.S. Children’s Internet Protection Act (CIPA).
The solution is cost effective for schools to implement, setup and management is quick and easy, and administrators can schedule or run usage reports on demand and have full visibility into Chromebook users’ online activities and locations. It is also possible to lockdown Chromebooks to prevent students from circumventing the web filtering controls.
As with all WebTitan Cloud solutions, there is no need for any on-premises hardware, no proxies or VPNs required, and there is no impact on Internet speed as filtering takes place at the DNS-level before any content is downloaded.
“This new release comes after an expansive first quarter. The launch of WebTitan Cloud 4.16 brings phenomenal new security features to our customers,” Said TitanHQ CEO, Ronan Kavanagh. “After experiencing significant growth in 2020, TitanHQ expects these product enhancements and new features to make 2021 another record-breaking year.”
Telegram is a popular messaging app that has seen user numbers soar in recent months, with many users of WhatsApp making the change to Telegram after recent changes to the WhatsApp privacy and data management policies.
Telegram has also proven popular with cybercriminals who are using the app for distributing and communicating with malware. Recently, a campaign has been identified involving a new malware variant dubbed ToxicEye. ToxicEye malware is a Remote Access Trojan (RAT) that gives an attacker full control of an infected device. The malware is used to steal sensitive data and download other malware variants.
The malware uses a Telegram account for its command and control server communications. Through the attacker’s Telegram account, they can communicate with a device infected with ToxicEye, exfiltrate data, and deliver additional malicious payloads.
It is easy to see the attraction with using Telegram for malware communication. First, the app is popular. The Telegram app was the most popular app in January 2021, having amassed more than 63 million downloads, and has around 500 million active users worldwide. During the pandemic the app has been adopted by many businesses who have been using it to allow their remote workers to communicate and collaborate. The app supports secure, private messaging and most businesses allow Telegram to be used and do not block or inspect communications.
Setting up a Telegram account is easy and attackers can remain anonymous. All that is required to set up an account is a mobile phone number, and the communication infrastructure allows attackers to easily exfiltrate data and send files to malware-infected devices undetected.
Telegram is also being used for distributing malware. Attackers can create an account, use a Telegram bot to interact with other users and send files, and it is also possible to send files to non-Telegram users via phishing emails with malicious attachments. It is phishing emails that are being used to deliver ToxicEye malware. Emails are sent with a .exe file attachment, with one campaign using a file named “paypal checker by saint.exe” to install the malware.
If the attachment is opened and run, a connection will be made to Telegram which allows malware to be downloaded by the attacker’s Telegram bot. The attackers can perform a range of malicious activities once the malware is installed, with the primary goals of the attackers being gathering information about the infected device, locating and exfiltrating passwords, and stealing cookies and browser histories.
ToxicEye malware can kill active processes and take control of Task Manager, record audio and video, steal clipboard contents, and deploy other malware variants – such as keyloggers and ransomware.
TitanHQ offers two solutions that can protect against ToxicEye and other Telegram-based phishing and malware campaigns. SpamTitan is a powerful email security solution that will block malicious emails delivering the executable files that install the ToxicEye RAT and other malware. For even greater protection, SpamTitan should be combined with WebTitan web security. WebTitan is a DNS-based web filtering solution that can be configured to block access to Telegram if it is not in use and monitor traffic in real time to identify potentially malicious communications.
For further information on both of these solutions, details of pricing, and to register for a free trial, contact TitanHQ today.
Cloud-based instant messaging platforms have allowed individuals to easily communicate and collaborate, but cybercriminals are also benefitting from these platforms and are abusing the services for a range of malicious purposes. Discord is one such platform that has been favored by cybercriminals for several years and is now being extensively used for phishing and malware distribution.
Discord is a VoIP, instant messaging and digital distribution platform that has been extensively adopted by the gaming community and latterly by a much broader range of users. In 2019, Discord has amassed around 150 million users worldwide and usership has grown considerably since then. The platform has long been abused by cybercriminals who have used the platform’s live chat feature for selling and trading stolen data, such as gift cards and login credentials, for anonymous communications, and the platform has also been abused to act as C2 servers for communicating with malware-infected devices.
In 2021, the platform has been increasingly used for distributing a wide range of malware variants such as information stealers, cryptocurrency miners, Remote Access Trojans, and ransomware by abusing the cdn.discordapp.com service.
Discord, like other collaboration apps, use content delivery networks (CDNs) for storing shared files within channels. Cybercriminals can upload malicious files to Discord and create a public link for sharing, and that link can be shared with anyone, not just Discord users. The URL generated for sharing starts with https://cdn.discordapp.com/ so anyone receiving the link will see that the link is for a legitimate site. While there are controls to prevent malicious files from being uploaded, oftentimes cybercriminals can bypass those protections have get their malicious files hosted, and warnings are not always displayed to users about the risk of downloading files from Discord. Since the malicious payloads are delivered via encrypted HTTPS, the downloads can be hidden from security solutions.
Further, once uploaded, the malware can be deleted from a chat, but it is still accessible using the public URL. Users are often tricked into downloading these malicious files under the guise of pirated software or games. Gamers have been targeted as their PCs typically have a high spec for gaming, which makes them ideal for cryptocurrency mining.
This method of malware distribution allows malware developers and distributers to easily distribute their malicious payloads with a high degree of anonymity. An analysis by Zscaler identified more than 100 unique malware samples from Discord in the Zscaler cloud in just a two-month period. Another analysis of Discord CDN results identified around 20,000 results on VirusTotal.
The Discord app is also easy to modify to perform malicious actions. Malicious JavaScript code can easily be added to the legitimated Discord client files and can be configured to run each time the client is launched or when specially crafted URLs are opened by the client.
Discord is far from the only communication and collaboration solution to be abused. Slack and Telegram are similarly being abused in phishing campaigns and for malware distribution.
How TitanHQ Can Improve Your Organization’s Security Posture
TitanHQ offers two cybersecurity solutions that can be configured to block the use of these legitimate platforms in the workplace and stop malicious links from being distributed to their employees. WebTitan is a powerful but easy-to-use DNS filtering and web security solution that can be configured to block access to sites such as Discord, thus preventing employees from visiting malicious content. Since WebTitan performs malware scans in real time, if malicious files are encountered, employees will be prevented from downloading them. WebTitan supports HTTPS (SSL) inspection so can decrypt, scan, then re-encrypt traffic to identify and block malicious content.
Malicious links to Discord are often distributed via phishing emails. SpamTitan Email Security prevents malicious emails from being delivered to inboxes, such as emails containing links to Discord, Telegram, or other services that are abused by cybercriminals and used to host phishing kits or malware.
Both solutions work seamlessly together to protect against email- and web-based cyberattacks and prevent credential theft, and malware and ransomware attacks. Both solutions are cost effective to implement and easy-to-use and are much loved by IT staff who benefit from a high level of protection coupled with a low management overhead.
If you want to improve protection from email and web-based attacks, contact TitanHQ today to find out more about these award-winning cybersecurity solutions. Both solutions are available on a free trial and a product demonstration can be arranged on request.
Further, these solutions have been developed to be MSP-friendly, with a range of benefits for managed service providers who want to want to improve email and web security for their clients.
The disruption to learning from a pandemic that has lasted more than a year is bad enough, but many schools have experienced even more disruption just as many have opened their gates and allowed students back into classrooms. The SARS-CoV-2 virus may have been brought under control thanks to lockdown measures and the rollout of vaccines, but another type of virus is proving to be a major threat – ransomware.
FBI Warns of Targeted Ransomware Attacks on K12 Schools and Higher Education
Ransomware attacks on schools have been stepped up in recent months and schools and higher education institutions are being actively targeted. In the United States, the Federal Bureau of Investigation recently issued an alert to the education sector warning about the threat of attacks involving Pysa ransomware. The threat actors behind this ransomware variant have been actively targeting K12 schools, higher education, and seminaries. Buffalo City Schools were forced to close their schools in March following a ransomware attack that crippled their IT systems, just before students were about to return to classrooms as part of a phased reopening of schools.
The ransomware is deployed manually after compromising the network. The attack often starts with a phishing email, which gives the attackers the foothold in the network they need. They then conduct reconnaissance, move laterally, and compromise entire networks before deploying their ransomware.
Prior to running the encryption routine that cripple IT systems, the attackers steal sensitive data. Files containing student information are obtained and threats are issued to publish or sell the stolen data if the ransom is not paid. The gang, like many others, has a leak site and routinely follows through on the threat.
Spike in Ransomware Attacks on UK Schools
Ransomware attacks on schools are not confined to the United States. The Pysa ransomware gang is also targeting schools in the United Kingdom and many other countries, and the Pysa gang is not alone. Many other ransomware operations have been attacking schools.
Following a rise in ransomware attacks on UK schools, the UK’s National Cyber Security Centre (NCSC) issued an alert to educational institutions about the growing threat of attacks. NCSC has observed an increase in ransomware attacks on schools from late February 2021, which coincides with students returning to classrooms after an extensive period of school closures due to the pandemic.
The NCSC said there is no reason to believe that these attacks are being conducted by the same criminal group. This appears to be the work of multiple threat groups. These attacks have caused varying levels of disruption, including rendering entire networks inoperable, disabling email and websites, and hampering the ability of students to learn. In some cases, students have lost coursework as a result of the attacks, records of COVID-19 tests have been rendered inaccessible, and school financial records have been lost.
Unfortunately, even paying the ransom is no guarantee of being able to recover encrypted files. While the attackers claim they have the keys to unlock the encryption, they may not be provided. There is also no guarantee that stolen data will be deleted when the ransom is paid. There have been many cases when further ransom demands have been issued after payment has been made.
Adopt a Defense in Depth Strategy to Block Ransomware Attacks
The Department for Education (DfE) has recently urged UK schools to review their cybersecurity defenses and take the necessary steps to harden their defenses against cyberattacks. The NCSC explained that there is no single cybersecurity solution that will provide protection against these attacks. What is required is a defense in depth approach to security.
Defense in depth means implementing multiple overlapping layers of security. If one layer fails to block an attack, others are in place to block the attack.
In practice this means good patch management – applying updates to software, firmware, and operating systems promptly. Antivirus software must be installed on all devices and be kept up to date. Spam filtering solutions should be implemented to block the phishing emails that give the attackers access to the network. These filters can also be used to block email attachments that are not typically received.
Internet filters for schools should be used to block access to malicious websites. These filters inspect the content of websites to determine if it is malicious. They also categorize web content, and the filters allow schools to carefully control the types of content that students and staff can access to reduce risk.
Multi factor authentication should be implemented on all remote access points and email accounts, remote access ports that are not being used should be blocked, and a VPN should be used for remote access. The rule of least privilege should be applied for remote access and all staff and student accounts.
It is also recommended to prevent all non-administrator accounts from being able to install software, office macros should be disabled, as should autorun on portable devices.
It is also vital that all files are backed up daily and backups tested to make sure file recovery is possible. Backups should be stored on non-networked devices and must not be accessible from the systems where the data resides. Ideally, multiple backup copies should be created with at least one stored on an air-gaped device.
TitanHQ is proud to announce three of its innovative products have been named winners at the Experts Insights’ 2021 Best-Of Awards in the Web Security, Email Security Gateway, and Email Archiving categories.
Expert Insights helps businesses identify the most powerful, innovative, and ease to use cybersecurity solutions through its website, and helps clear up the confusion about cybersecurity solutions through objective reviews, industry analysis, and interviews with industry leaders. The top cybersecurity products are listed on the website along with reviews and ratings from genuine users of the solutions. Expert Insights now helps more than 40,000 businesses each month select the most appropriate cybersecurity solutions to meet their needs.
The leading cybersecurity companies and their products are recognized each year in the Expert insights’ “Best-Of” Awards. Products are assessed by technology experts and the Expert Insights’ Editorial Team based on many factors, including market presence, technical features of the products, ease-of-use, and ratings by verified users of the products. Winners are selected in a range of different categories such as email security, web security, endpoint security, multi-factor authentication, backup, and many more.
“2020 was an unprecedented year of cybersecurity challenges, with a rapid rise in remote working causing a massive acceleration in cybercrime,” said Craig MacAlpine, CEO and Founder, Expert Insights. “Expert Insights’ Best-Of awards are designed to recognize innovative cybersecurity providers like TitanHQ that have developed powerful solutions to keep businesses safe against increasingly sophisticated cybercrime.”
TitanHQ was recognized for the WebTitan DNS filtering solution, which was named a winner in the Web Security category, SpamTitan was named a winner in the Email Security category, and ArcTitan was named a winner in the Email Archiving category. In addition to the level of protection provided, each solution is consistently rated highly on price and ease of use by enterprises, SMBs, and Managed Service Providers. The solutions are used by more than 8,500 businesses and over 2,500 MSPs in more than 150 countries. In addition to the high ratings on Experts’ Insights, the solutions have received top marks on G2 Crowd, Capterra, GetApp, Software Advice, and Google Reviews.
“The recent pandemic and the growth of remote working initiatives have further highlighted the need for multiple layers of cybersecurity and our award-winning solutions form key pillars in this security strategy,” said Ronan Kavanagh, CEO, TitanHQ. “We will continue to innovate and provide solutions that MSPs can use to deliver a consistent, secure and reliable experience to their customers.”
The COVID-19 pandemic created many new opportunities for cybercriminals who were all too happy to take advantage. In 2020, businesses had to rapidly change their working practices to deal with national lockdowns and changed to a more distributed, remote workforce. In response, cybercriminals stepped up phishing attacks to obtain credentials to email accounts, VPNs, and remote access solutions.
The increase in email threats and phishing activity was recently highlighted by the Anti-Phishing Working Group which has been gathering data on phishing attacks from its member organizations throughout the year. Its latest report shows phishing attacks doubled in 2020, peaking in October 2020 when previous records were shattered. In October, 225,304 new phishing sites were detected, compared with under 100,000 in January 2020. From August to December 2020, more than 200,000 new phishing sites were detected each month.
Links to these phishing websites are sent in large scale phishing campaigns and many of the messages land in inboxes where they attract a click. The pandemic made that much easier for cybercriminals who expertly exploited the thirst for knowledge about COVID-19 to conduct their scams. As the year progressed other COVID-19 themed lures were used including COVID-19 relief payments for businesses, offers of early vaccines, small business loans, tax deadline extensions, and many more.
Cybercriminals often use compromised websites for hosting their phishing forms, but it is now much more common for the attackers to purchase their own domains that are tailored for each phishing campaign. These lookalike domains can easily fool individuals into believing they are on a legitimate website.
Cybercriminals have also been using encryption to hide their phishing URLs and fool employees. Hosting phishing URLs on HTTPS sites can fool employees into believing the web content is genuine, and many security solutions do not examine encrypted content which makes the URLs hard to identify and block. In Q4, 2020, 84% of phishing URLs used SSL encryption.
The increase in use of SSL encryption is a concern, as many people mistakenly believe that a site starting with HTTPS is secure when that is not the case. SSL inspection means the connection between the browser and the website is secure, which means users are protected against the interception of sensitive information, but a cybercriminal may own or control that website. The secure connection just means other cybercriminals will not be able to intercept login credentials as they are entered on a phishing site.
The problem for businesses has been how to block these threats as they grow in number and sophistication. Many businesses have previously relied on Office 365 anti-spam protections for blocking spam and phishing threats, but large volumes of these malicious emails are delivered to Office 365 inboxes. When that happens and a malicious link is clicked, they have no way of stopping employees from disclosing sensitive information.
One way that businesses can better protect against these phishing attacks is by implementing a web filtering solution with SSL inspection. WebTitan for instance can decrypt websites, inspect the content, and then re-encrypt which means malicious websites are not hidden and can be identified and blocked.
WebTitan also incorporates multiple threat intelligent feeds to ensure that as soon as a phishing URL is detected, all WebTitan users will be immediately protected. WebTitan ensures that protection is provided against emerging phishing URLs and zero-minute threats. When combined with an advanced spam filtering solution such as SpamTitan to block phishing emails at source and ensure they do not reach inboxes, businesses will be well protected against phishing attacks.
In 2020, the healthcare industry was heavily targeted by ransomware gangs who took advantage of the pandemic to hit the very hospitals that were trying to save patients’ lives. Battling under extremely challenging conditions, the healthcare industry had to cope with these highly damaging and disruptive ransomware attacks that placed patient safety at risk.
A major ransomware attack hit one of the largest healthcare providers in the United States. Universal Health Services, an American Fortune 500 company which employees 90,000 individuals and runs 400 acute care hospitals, suffered a major ransomware attack in September which impacted all of its hospitals. Staff were forced to work on pen and paper for three weeks while it recovered from the attack.
A cyberattack on University of Vermont Medical Center in October affected more than 5,000 hospital computers and laptops and 1,300 servers. All devices had to be wiped and have software and data reinstalled, with the healthcare provider experiencing downtime for more than 2 months. During the recovery process around $1.5 million was being lost per day to attack-related expenses and lost business, with the total costs expected to exceed $64 million.
Ransomware attacks on the healthcare industry were stepped up in September and October and continued to plague the industry for the remainder of the year. A study by Tenable found that ransomware attacks accounted for 46% of all healthcare data breaches in 2020, showing the extent to which the industry was targeted.
Many of these attacks involved the exploitation of unpatched vulnerabilities, most commonly vulnerabilities in the Citrix ADC controller and Pulse Connect Secure VPN. Patches had been released at the start of the year to fix the vulneabilities, but the patches had not been applied promptly. Phishing emails also gave ransomware gangs the access to healthcare networks they needed to conduct ransomware attacks. Check Point’s research indicates there was a 45% increase in cyberattacks on the industry from the start of November to the end of the year.
Another industry heavily targeted by hackers in 2020 was retail. Retailers were also incredibly busy as a result of the pandemic. With governments ordering people to stay home to curb the spread of the virus, online retailers saw a sales surge as shoppers made their purchases online rather than in bricks and mortar stores. Researchers at Salesforce found digital sales increased by 36% in 2020 compared to the previous year, and cybercriminals took advantage of the increase in online sales.
Several methods were used to gain access to retailers’ systems and websites, with the most popular tactic being web application attacks, which increased by 800% in 2020 according to the CDNetworks State of Web Security H1 2020 Report. Attackers also used credentials stolen in past data breaches to attack online retail outlets in credential stuffing attacks, which Akamai’s tracking revealing the retail industry was the most attacked industry using this attack technique, account for around 90% of attacks.
As is normal every year, the large numbers of shoppers that head online to make purchases in the run up to Black Friday and Cyber Monday were exploited, with phishing attacks related to these shopping events increasing thirteenfold in the six-week run up to Black Friday. In November, 1 in every 826 emails was an online shopping related phishing scam, compared to 1 in 11,000 in October, according to Check Point. Content management systems used by retailers were also targeted, and attacks on retail APIs also increased in 2020.
As we head into 2021, both sectors are likely to continue to be heavily targeted. Ransomware and phishing attacks on healthcare providers could well increase now that vaccines are being rolled out, and with many consumers still opting to buy online rather than in person, the retail sector looks set to have another bad year.
Fortunately, by following cybersecurity best practices it is possible to block the majority of these attacks. Patches need to be applied promptly, especially any vulnerabilities in remote access software, VPNs, or popular networking equipment, as those vulnerabilities are rapidly exploited.
An advanced anti-phishing solution needs to be implemented to block phishing attacks at source and ensure that malicious messages do not get delivered to inboxes. Multi-factor authentication should also be implemented on email accounts and remote access solutions to block credential stuffing attacks.
A web filter is important for blocking the web-based component of phishing and cyberattacks. Web filters stop employees from visiting malicious websites and block malware/ ransomware downloads and C2 callbacks. And for retail especially, the use of web application firewalls, secure transaction processing, and the correct use of Transport Layer Security across a website (HTTPS) are important.
By following cybersecurity best practices, healthcare providers, retailers, and other targeted industries will make it much harder for hackers to succeed. TitanHQ can help by providing SpamTitan Email Security and WebTitan Web Security to protect against email and web-based attacks in 2021. For more information on these two solutions and how you can use them to protect your busines, call TitanHQ today.
Phishers are constantly coming up with new scams that abuse trust. People tend to trust their favorite brands and when email communications are sent by those companies there is a tendency for the emails to be trusted. The same is true when emails are sent from email contacts such as work colleagues and friends. Cybercriminals take advantage of trust to get users to take a specific action, such as clicking on an embedded hyperlink in an email or opening an email attachment.
Many businesses now provide security awareness training to employees and try to teach them to always be vigilant and never to trust emails implicitly, even if they have been sent by known contacts. Just because an email has been sent from a known and trusted email account does not mean the message is genuine. Email accounts are often compromised and used to send phishing emails. The Emotet Trojan hijacks email accounts and uses them to send copies of itself to the victim’s contacts, and several other malware variants do the same. Email addresses are also spoofed. The display name may be correct or believable, but the actual email account used to send the message is anything but.
Another tactic is now being used by at least one cybercriminal group than similarly abuses trust, albeit in a new way. A phishing campaign, which was first detected on September 21, 2020, uses the challenge-response test CAPTCHA to simultaneously make the campaign believable and also to reduce the probability of the scam being detected by email security solutions.
Internet users will be familiar with CAPTCHA, although maybe not by name. The CAPTCHA system is used by many websites as a way to determine if a website visitor is a human or a bot, most commonly on forms.
Google uses CAPTCHA and requires users to pass a pictorial challenge where it is necessary to select all the images in a group that featuring a car, bicycle, bus, or traffic lights. If you pass the challenge you will be allowed to proceed, if you fail you will not. Other versions involve entering in a number or code word that has been heavily disguised in an image.
While these CAPTCHA challenges can be annoying, they are associated with security so if a website has one of these challenges, subconsciously people tend to feel more secure. However, as with a website starting with HTTPS, it does not mean the website is genuine.
In this new phishing campaign, users are likely to feel more secure when credentials are requested since they had to pass a CAPTCHA test, especially considering the page on which the challenge was set up looks just like the genuine login prompt for Office 365. The background is the same, as is the login prompt. The only difference between the genuine login page and the fake version is the URL.
Security teams face a challenge detecting and blocking these phishing pages as email security solutions, despite having AI-based detection mechanisms, are essentially bots and, as such, cannot pass a CAPTCHA challenge.
A second tactic is also used to evade detection. The scammers have set up their campaign so that only a specific set of IP addresses will be presented with the CAPTCHA test on the fraudulent domain. If any IP address outside a specific range attempts to visit the link– the IP range used by the targeted company – a redirection will occur to the genuine Microsoft login page.
While these scams help to ensure that malicious emails are delivered to inboxes, organizations do not need to be totally reliant on their employees recognizing the scams and taking appropriate action (reporting the email to the IT security team).
With a web filtering solution in place, attempts to visit known malicious websites will be blocked. When malicious domains are detected they are automatically added to a web filter’s blacklist, and any attempts to visit malicious domains will be blocked.
WebTitan is a low maintenance security solution that can be set up in about 5 minutes and will protect against the web-based component of phishing attacks and will block malware downloads from malicious websites. WebTitan works in tandem email security solutions to provide greater protection against malware and phishing attacks. The solution can also be used to control the content that employees and guest network users can access over the internet, whether they are on the network or working remotely.
If you have not implemented a web filter or are unhappy with your current solution, give the WebTitan team a call to find out more. A product demonstration can be arranged, you can have a free trial of the solution, and assistance can be provided to help you get the most out of WebTitan during your trial.
The WannaCry ransomware attacks that started on May 12, 2017 were blocked quickly when a kill switch was identified and activated, but how much money did WannaCry make during the time it was active?
WannaCry was a devastating global cyberattack, the likes of which had been predicted by many cybersecurity professionals but had yet to materialize. WannaCry was the fastest spreading ransomware ever created.
WannaCry combined ransomware with a worm, which allowed it to automatically spread and infect huge numbers of devices on a network. The ransomware exploited a vulnerability in Windows Server Message Block (SMBv1) using an NSA exploit called EternalBlue.
The flaw exploited by EternalBlue had been reported to Microsoft and a patch was issued in March 2017, two months before the attacks started. However, many businesses were slow to apply the patch and were vulnerable to attack. Within a matter of hours, around 200,000 computers had been attacked in 150 countries. It is worth noting here that there are still many computers that have not been patched more than 2 and a half years after the patch was released, in spite of widespread news coverage about the threat of attack and its huge cost. WannaCry is still one of the biggest ransomware threats and accounts for a significant percentage of all successful ransomware attacks in 2019.
WannaCry was blocked by a British security researcher who discovered the ransomware checked a domain name prior to encrypting data, but that domain name had not been registered. He purchased the domain name, thus preventing file encryption.
That said, the speed at which the ransomware spread meant many devices were infected and encrypted. Since businesses were not protected if the ransomware encryption had already started by the time the kill switch was activated, the attackers must have had a huge payday. So how much did WannaCry make?
Protect your customers from web-based threats such as drive-by downloads, exploit kits, and phishing. Book a FREE WebTitan demo. Book Free Demo
By today’s standards, the ransom demand was very small. Just $300 per infected device, which doubled to $600 if the payment was not paid within 3 days. It is actually easy to see how many payments were made, as the transactions are detailed in the blockchain. The recipient remains anonymous, but the payments can be seen.
The three Bitcoin addresses known to have been used in the WannaCry attacks currently show 430 payments have been made and 54.43228033 BTC has been sent to those accounts. The value of BTC is somewhat volatile and was much higher at points between now and the attacks, but at today’s exchange rate that equates to around $386,905. Most of the BTC payments have now been moved out of the accounts so the attackers have managed to cash out. Payments are also still being made to those accounts. The latest payments to one of the addresses were made in December 2019.
$386,905 may not seem like much of a payday considering the number of devices infected and the damage caused by the attack, and it’s not. Further, the attackers will need to convert that total to real money, and a considerable amount will be lost in that process. The payday was tiny considering the scale of the attack. However, the cost of the attack to businesses was colossal.
The National Health Service in the United Kingdom was hit bad and the cleanup operation, and loss of business while that occurred, has been estimated to have cost £92 million. That was just one victim, albeit a major one. The total cost of the 2017 WannaCry ransomware attacks has been estimated to be $4 billion globally; however, even though the kill switch was flicked to block the initial attacks, the threat from Wannacry has not gone away. In 2019, two years after the initial attacks, millions of computers were still at risk as the vulnerability that was exploited had still not been fixed and a new version of WannaCry was released that did not have the kill switch and continues to pose a threat. In 2019 Kaspersky said it was the most detected ransomware threat with the ransomware infecting 164,433 users, accounting for 21 percent of detected ransomware attacks that year and ESET reports that WannaCry was the most commonly detected ransomware threat in Q1, 2020, 3 years after the ransomware first appeared. The ransomware is still being used in attacks on unpatched systems in Thailand, Turkey, and Indonesia.
Next time you delay applying a patch or updating software, consider WannaCry and the potential costs of exploitation of a vulnerability. In all of the above cases – all 200,000+ attacks – applying the patch would have prevented the attack and the huge cost of remediation.
If you have been following the security news, you will have seen that there has been a major increase in COVID-19 themed cyberattacks targeting remote workers. Cybercriminals are exploiting fear about the virus and the somewhat chaotic switch from mostly office-based workers to having virtually the entire workforce working remotely. Understandably given the speed at which businesses have had to adjust, vulnerabilities have been introduced.
The attack surface has increased considerably as a result of largely at-home workforces and cybercriminals have taken advantage. According to research conducted by Darktrace, in the United Kingdom, prior to the COVID-19 lockdown being imposed, around 12% of malicious email traffic was targeting home workers. The volume increased to around 60% after 6 weeks of lockdown, which clearly demonstrates the extent to which remote workers are being targeted.
The types of malicious emails being sent to remote workers have been incredibly diverse. Cybercriminals are using all manner of lures to get remote workers to click links and disclose their credentials or open malicious attachments and trigger malware downloads. Financial fraud has also increased with BEC gangs using the COVID-19 pandemic to fraudulently obtain funds from company accounts.
Early on in the pandemic when information about the virus was thin on the ground, emails were being sent offering important advice about preventing infection along with fake updates on cases. As the pandemic progressed and the effects started to be felt, cybercriminals started sending fake requests for donations to charities to help individuals adversely affected by COVID-19. As governments implemented furlough schemes and set up funds to help the employed and self-employed, campaigns were conducted that linked to websites that claimed to offer grants, allow workers to choose to be furloughed, or apply for financial support.
Attacks have targeted the tools that are being used by remote workers to connect to their offices and communicate with colleagues, with the likes of Zoom, Skype, GoToMeeting, and other corporate messaging systems being spoofed to infect users with malware. File sharing platforms have similarly been spoofed to get employees to disclose their credentials. Darktrace’s data shows there has been a massive increase in spoofing attacks during lockdown, increasing from around one fifth of attacks before lockdown to 60%.
It is not only cybercrime groups that are conducting attacks. State-sponsored hacking groups have similarly been taking advantage of the pandemic to steal sensitive data, including the latest COVID-19 research data on potential cures, vaccines, and treatments to further the response efforts in their own countries.
What is not always clear from the new reports is how the increase in cyberattacks targeting remote workers has translated into actual data breaches. Are these attacks succeeding or are companies managing to thwart the attacks and keep the hackers at bay?
There is a lag between intrusions being detected, breaches being confirmed, and announcements being made but it appears that many of these attacks are succeeding. In April, the International Association of IT Asset Managers issued a warning that while a rise in data breaches was to be expected as a result of the pandemic, the number of incidents was actually far higher than anticipated. It is also clear that ransomware attackers have stepped up their efforts to attack businesses. Even organizations on the frontline in the fight against COVID-19 have not been spared.
Threat actors have taken advantage of the opportunities offered by the pandemic. It is up to businesses to make sure their security measures are sufficient to thwart attacks. Combating cyberattacks on remote workers requires additional security measures to be implemented. One measure that is often overlooked but can greatly improve protection is DNS filtering.
A DNS filter provides protection against the web-based component of cyberattacks and is an important measure to implement to improve defenses against phishing and malware. Even with robust email security defenses in place, some messages will arrive in inboxes. A DNS filter provides an extra layer of protection by preventing users from visiting malicious websites linked in emails.
When a malicious link is clicked, a DNS query is made, and a DNS lookup is performed to find the IP address of the URL. DNS filtering ensures that the IP address is not returned if the URL is malicious. A DNS filter such as WebTitan also allows IT teams to block malware downloads, monitor internet activity, and carefully control the types of websites their remote users can access on corporate devices.
If you have not yet implemented a DNS filtering solution and would like more information on how it can protect against cyberattacks on remote workers, give the TitanHQ team a call today.
There has been a massive rise in the number of telecommuting workers as a result of the 2019 Novel Coronavirus pandemic and cybercriminals are taking advantage. Phishing and malware attacks have soared in the past few weeks and home workers are being targeted.
Individuals who regularly worked from home before the COVID-19 crisis will be used to taking precautions when connecting to virtual environments set up by their employers, but huge numbers of employees are now logging in remotely for the very first time and may not be aware of the telecommuting cybersecurity risks. IT and IT security departments have also had to set up the workforce for home working in a hurry, and the sheer number of employees that have been forced into telecommuting means corners have had to be cut which has created opportunities for cybercriminals.
Even if the transition to having the entire workforce telecommuting has been expertly managed, risk will have increased considerably. Cybersecurity is far harder to manage when the entire workforce is outside the protection of the corporate firewall and with most workers telecommuting, the attack surface has grown considerably.
Telecommuting workers are seen as low hanging fruit and cybercriminals are taking advantage of the ease at which attacks can be conducted. Since January there has been a massive increase in phishing attacks, malware attacks, and attacks over the internet targeting remote workers.
NASA Sees “Exponential Increase” in Malware Attacks
On April 6, 2020, NASA sent a memo to all personnel warning of a massive increase in targeted attacks on the agency. NASA explained in the memo that the number of phishing attempts on NASA employees has doubled in the past few days and its systems designed to block employees from accessing malicious websites has gone into overdrive. The number of malicious websites that are now being blocked has also doubled, which strongly suggests employees are clicking on links in phishing emails and are being fooled by these scams. NASA also reports that there has been an “exponential increase in malware attacks on NASA systems.”
Attacks are being conducted by a diverse range of threat actors, from small players to prolific advanced persistent threat (APT) groups and nation-state sponsored hackers. NASA has warned its employees that those attackers are targeting NASA employees’ work and personal devices and that the attacks are likely to continue to increase throughout the Novel Coronavirus pandemic.
NASA is far from alone in experiencing a massive increase in attempted cyberattacks. Businesses of all sizes are now having to deal with unprecedented risks and are struggling to defend their networks from attack. They now have to defend a massively increased attack surface and the number of attacks has skyrocketed.
There are other factors that are making it difficult for employers. Employees crave information about the Novel Coronavirus and COVID-19 and cybercriminals are sending huge numbers of emails offering them just the information they seek. Huge numbers of websites are being set up that purport to offer advice on the Novel Coronavirus and COVID-19. Check Point has reported that more than 16,000 domains related to coronavirus or COVID-19 have been registered since January and those domains are 50% more likely to be malicious than other domains registered in the same period.
How to Protect Telecommuting Workers
There are three main ways that telecommuting workers are being attacked: Email, malicious websites, and the exploitation of vulnerabilities.
To prevent the latter, it is essential for software and operating systems to be kept up to date. This can be a challenge for IT departments at the best of times, but much harder when everyone is working remotely. Despite the difficulty, prompt patching is essential. Vulnerabilities in VPNs are being targeted by cybercriminals and offer an easy way to gain access to corporate networks. Employees should be told to make sure their VPN clients are running the latest software version and businesses should ensure their VPN infrastructure is kept up to date, even if it means some downtime while updates are applied.
TitanHQ Can Help You Strengthen Email and Web Security
Advanced email security defenses are now required to protect against phishing and email-based malware threats. Some of the COVID-19 phishing campaigns that are now being conducted include some of the most sophisticated phishing threats we have ever seen.
You should not rely on one form of email security, such as Microsoft’s Exchange Online Protection for Office 365 accounts. Layered defenses are essential. Office 365 email security can be significantly strengthened by layering SpamTitan on top of Microsoft’s EOP protections. SpamTitan does not replace Office 365 protections, it improves them.
SpamTitan is an advanced email security solution that incorporates powerful, real time updated AI-driven threat intelligence to block spam, phishing, malware, malicious links, and other email threats from incoming mail. SpamTitan sandboxing identifies threats that signature-based detection solutions miss and is effective at identifying and blocking zero-day malware threats.
Each day, the number of malicious websites related to COVID-19 grows. These websites are used to phish for sensitive information such as email and VPN credentials and for drive-by downloads of malware. To protect remote workers and prevent them from accessing these malicious websites, a web filtering solution is required.
WebTitan DNS Security offers protection against web-based threats and prevents employees from accessing known malicious websites. WebTitan DNS Security is seeing massively increased traffic demand for its scanning and web detection features, but the solution is cloud based and has been developed with scalability in mind. WebTitan DNS Security is blocking new threats as soon as they are identified to keep customers and their employees protected. The solution can be easily implemented to protect remote workers but inserting simple code into enterprise devices which points the DNS to WebTitan. That small change will ensure the internet is filtered for all employees, no matter where they are working.
TitanHQ is committed to providing safe and secure email and internet usage for our customers, partners and their users, now more than ever. Contact TitanHQ today for help improving security at your organization.
TitanHQ and Pax8 have announced a new strategic partnership that will see TitanHQ’s cloud-based email security and DNS filtering solutions incorporated into the Pax8 ecosystem.
Pax8 simplifies the journey into the cloud through billing, provisioning, automation and industry-leading PSA integrations and is proven leader in cloud distribution. Pax8 has achieved position 60 in the 2019 Inc. 5000 list of the fastest growing companies and has been named CRN’s Coolest Cloud Vendor and Best in Show at the NextGen and Xchange conferences for two years in a row.
In order to have products added to the Pax8 marketplace, vendors must have developed exceptional channel friendly solutions. As the leading provider of cloud-based email and web security solutions for managed service providers (MSPs) serving the SMB marketplace, TitanHQ was an ideal fit.
Under the new partnership, Pax8 partners will have easy access to TitanHQ’s leading email security solution, SpamTitan Cloud, and can protect clients from web-based threats with WebTitan Cloud, TitanHQ’s DNS filtering solution.
These cloud-based AI-driven solutions help MSPs secure their own environments and protect their clients from malware, ransomware, botnets, viruses, and phishing and email impersonation attacks and avoid costly data breaches.
Both solutions have been developed with MSPs firmly in mind. The solutions are easy to integrate into an MSP’s security stack through TitanHQ’s APIs, there are multiple hosting options, the solutions can be supplied in white label form, and there are generous margins. Pax8 partners also benefit from a fully transparent pricing policy and industry leading technical support.
TitanHQ’s solutions have much loved by users and are consistently rated highly on business software review platforms, including G2 Crowd, Gartner Peer Insights, and Capterra.
“Our partners are excited about the addition of TitanHQ and the ability to protect their clients’ businesses by blocking malware, phishing, ransomware, and links to malicious websites from emails.” said Ryan Walsh, chief channel officer at Pax8.
Any business that processes card payments is a target for cybercriminals, but restaurants in particular are favored by hackers. Over the past few weeks, cybercriminals have stepped up their efforts to attack these businesses and several restaurant chains have had their systems compromised. In all cases, malware has been installed on point-of-sale systems that steals payment card information when diners pay for their meals.
Many of the attacks have hit restaurant chains in the Midwest and East, with credit card data from diners recently having been listed for sale on the underground marketplace, Joker’s Stash. A batch of approximately 4 million credit and debit cards is being offered for sale, which comes from malware attacks at Moe’s, McAlister’s Deli, Krystal, and Schlotzsky’s.
The cyberattack on Krystal was detected in November, with the other three chains, all owned by Focus Brands, attacked in August. In total, the above chains have more than 1,750 restaurants and almost half of those locations, mostly in Alabama, Florida, Georgia and North and South Carolina, were affected.
Catch Hospitality Group also announced in November that it had suffered a cyberattack which had seen malware installed on its point-of-sale system that scraped and exfiltrated payment card data as diners paid for their meals. The data breach affected customers of Catch NYC, Catch Roof, and Catch Steak restaurants. Fortunately, the devices used to process the majority of payments were unaffected. Malware was on the Catch NYC and Catch Roof devices between March 2019 and October 2019, with Catch Steak affected between September 2019 and October 2019.
Church’s Chicken restaurants were also attacked in a separate incident in October. The majority of its 1,000+ restaurants were not affected, but at least 160 restaurants in Alabama, Arkansas, Florida, Georgia, Illinois, Louisiana, Mississippi, Missouri, South Carolina, Tennessee and Texas had malware installed on their POS system.
Other restaurant chains that have been attacked in 2019 include Checker’s Drive-In, Cheddar’s Scratch Kitchen, Huddle House, Applebee’s, Chilli’s, and Earl Enterprises (Buca di Beppo, Chicken Guy, Tequila Taqueria, Mixology, Planet Hollywood). Malware n the systems of Earl Enterprises had been present for almost a year before it was detected.
How to Improve Restaurant Cybersecurity
Restaurants process many thousands of card transactions which makes them an attractive target for hackers. Restaurants often use out-of-date operating systems, have vulnerability-ridden legacy hardware, and their cybersecurity solutions often leave a lot to be desired. Consequently, cyberattacks on restaurants are relatively easy to perform, at least compared to many other types of businesses.
In order to infect the POS system, the attackers will need network access. That is most commonly gained via phishing emails, drive-by malware downloads, or by abusing remote access tools. Direct attacks are also possible using techniques such as SQL injection and weak passwords can be easily guessed using brute force tactics.
The malware that sits on systems and exfiltrates data tends to have a very small footprint and is often stealthy as it needs to be present for long periods of time to collect payment card data. That can make it hard to detect when it has been installed. The key to security is therefore improving defenses to make sure the malware is not installed in the first place, which means preventing the attackers from gaining access to the network.
Listed below are some easy-to-implement steps that will help restaurants improve their security posture and block attacks. The key is defense in depth through layered security.
Use an enterprise-grade firewall –Ensure an enterprise-grade firewall is purchased. A firewall will prevent unauthorized individuals from gaining access to your network resources.
Patch promptly and update all software and firmware – Ensure patches are applied promptly and software and firmware updates are implemented when they are released. That includes all systems and networked devices, not just your POS.
Upgrade hardware – When your hardware is approaching end of life it is time to upgrade. Unsupported hardware (and software) will no longer be updated and vulnerabilities will no longer be fixed.
Lockdown your POS: Use whitelisting or otherwise lock down POS systems to make it harder for malware to operate. Only allow trusted apps to run on your POS systems.
Install powerful antivirus software – Ensure all devices are protected by a powerful anti-virus solution and that it is set to update virus definitions automatically. Regularly scan the network for malware, especially your POS.
Implement an intrusion detection system – These systems monitor the network for unusual activity that could indicate a malware infection, attackers searching the network for the POS system, and unusual traffic that could indicate data exfiltration.
Change all default passwords and set strong passwords – To protect against brute force attacks, ensure strong passwords are set on all systems and all default passwords are changed. Also implement rate limiting to block attempts to access a system or device after a set number of failed password attempts.
Implement a powerful spam filtering solution – A powerful email security solution, such as SpamTitan, is required to prevent spam and malicious emails from being delivered to end users. Even if you have Office 365, you will need a third-party email security solution to block email-based threats.
Restrict Internet access with a DNS filter – A DNS filter such as WebTitan provides protection against drive-by malware downloads and web-based phishing attacks. WebTitan will block all known malicious websites and those with a low trust score. The solution can also be configured to prevent employees from accessing categories of websites where malware downloads are more likely.
Disable Remote Access if Possible – Disable Remote Desktop Protocol and all remote access tools. If remote access tools are required to allow essential maintenance work to be completed, ensure they can only used via a VPN and restrict the people who can use those tools.
.png)
