Cybersecurity News

Our cybersecurity news will not be enjoyable reading for organizations that fail to implement adequate online security measures and update them regularly. Many of the news items in this section report hacks, data breaches and scams that have cost organizations money, credibility and – in some cases – their businesses.

The majority of the adverse incidents reported below could have been avoided had the organization in question taken appropriate steps to protect its database and prevent malware from infecting its computer system. To ensure your organization does not feature in a future cybersecurity news item, implement a web filter from WebTitan.

Two New Ransomware-as-a-Service Operations Emerge: BlackMatter and Haron

Following the ransomware attacks on critical infrastructure in the United States, several ransomware-as-a-service operations went quiet. The attacks attracted a lot of heat for ransomware gangs and several groups responded by either implementing new restrictions on the types of entities that their affiliates could attack, shutting down entirely and releasing the keys to allow victims to recover, or simply disappeared from the Internet.

Following the attack on Colonial Pipeline in May 2021 by a DarkSide ransomware affiliate, the DarkSide ransomware gang disappeared from the Internet. The REvil ransomware gang that had been so prolific also went quiet. The gang was behind the attack on JBS Foods which caused the temporary shutdown of two meat processing plants in the United States, and most recently, attacked Kaseya and up to 60 of its customers – mostly MSPs – and 1,500 downstream businesses. Shortly after that attack, its web presence disappeared and the gang went deathly silent.

Then there was Avaddon, another prolific operation. After the DarkSide attack on Colonial Pipeline, the Avaddon and REvil operators announced that they would be preventing their affiliates from conducting attacks on critical infrastructure, healthcare, and others. Avaddon later released the keys to allow 2,934 victims to recover and appeared to have walked away from ransomware attacks. Popular hacking forums took the decision to distance themselves from ransomware, even going as far as banning ransomware actors from posting on their forums.

Following the critical infrastructure attacks, the United States government has taken several steps to allow it to target ransomware gangs more effectively and has demanded Russia take action to stop ransomware gangs that are operating within Russia’s borders. The heat has certainly been turned up and RaaS operations are being scrutinized.

There has been considerable speculation about whether government agencies have succeeded in taking down some of these RaaS operations, even though none have announced that they are part of any takedown. That is not to say that there was no law enforcement or government action, only that if there was it has all been done on the quiet.

While it would be nice to think that these shutdowns were permanent and ransomware attacks would be slowing, that is unlikely. It is natural for RaaS operators to lie low for a while following such major attacks, especially when governments are now laser focused on tackling the ransomware problem. It is likely that these ransomware operations are just taking a break, and the operators – and certainly the affiliates that conducted attacks under the RaaS programs – will return. The return may well have already happened.

Two new ransomware-as-a-service (RaaS) groups have appeared this month – Haron and BlackMatter – that threat intelligence firms have been investigating. Several have reported this week that they have identified connections with some of the RaaS operations that have recently gone quiet – Avaddon, REvil, and DarkSide.

While no concrete evidence has been found linking the new operations with any of the RaaS operations that have recently disappeared, there are many similarities which suggest that either the Avaddon, REvil, and DarkSide RaaS operations have already rebranded, that affiliates of those operations have branched out and are going it alone, or some members of the shutdown RaaS operations are involved in Haron and BlackMatter to some degree.

Despite the forum bans on advertising RaaS operations, the BlackMatter RaaS has been advertising for affiliates on Russian speaking cybercrime forums, albeit by not stating that they are running a RaaS operation. A user named “BlackMatter” registered an account on July 19 on both the XSS and Exploit criminal forums seeking assistance: Access to the networks of U.S., UK, Australian, or Canadian networks of companies with over $100 million in annual revenues. They also stipulated that they would not be buying access to state institutions or any targets in the healthcare sector, as both REvil and Avaddon announced they would not after the colonial pipeline attack.

The BlackMatter operator also created an Escrow account – used in cases of disputes over payments – and deposited $120,000 – a not insignificant sum. The group is offering between $3K and $100K for access or a share in any ransoms generated in exchange for access. The BlackMatter operators claim their operation incorporates the best features of DarkSide, REvil, and LockBit, all three of which are believed to have operated from within Russia.

Similarities were found between BlackMatter and REvil and DarkSide by several cybersecurity firms, with Recorded Future declaring BlackMatter the successor to DarkSide and REvil, although evidence is circumstantial.  For instance, BlackMatter is very similar to BlackLivesMatter, which was the name of the Windows registry used by REvil. Mandiant reports that it has found evidence which points to at least one member of the DarkSide operation being involved with Black Matter, although that individual may simply be an affiliate that has jumped ship when the operation went silent.

S2W Lab has found similarities between Haron ransomware and Avaddon, notably a largely copy and pasted ransom note, similar appearances and wording on the ransom negotiation sites, the same structures on the data leak sites, and identical sections of JavaScript code for chat. However, while the Avaddon gang developed its own ransomware, Haron is based on Thanos ransomware.

The similarities may be coincidence, or the operator may have just saved some time by stealing content and code that had already been created. There are other notable differences between the two in many areas, and no solid proof has been found that suggests Avaddon and Haron are one and the same.

Researchers are still conducting investigations into the new groups, but regardless of who is involved in the operations, their aims appear to be very similar. Both are targeting large organizations with deep pockets and if the RaaS operations that have gone quiet remain out of action, there will be any affiliates looking for a new RAAS operation to join.

These two new RaaS operations could therefore completely fill the gap left by the likes of Avaddon, REvil, and DarkSide and ransomware attacks could well continue at pre-May 2021 levels. What is certain is the ransomware threat is far from over.

New WebTitan Cloud Release Includes Support for Azure Active Directory and Filtering for Chromebooks

A new version of WebTitan Cloud has been released – WebTitan Cloud 4.16 – that includes support for Azure Active Directory and introduces a new school web filtering solution – WebTitan OTG (on-the-go) for Chromebooks.

The new version of WebTitan Cloud includes DNS Proxy 2.06 which supports filtering of users in Azure Active Directory, in addition to on-premise AD and directory integration for Active Directory. Further directory services will be added to meet customer needs and ensure they can enjoy the benefits of per-user filtering with exceptional ease of management. – Further information on the Azure AD app is available here.

Existing WebTitan customers need do nothing to get the latest WebTitan Cloud release as the solution will be updated automatically.

WebTitan OTG for Chromebooks

Using WebTitan OTG for Chromebooks provides an effective way to apply filtering policies to your Chromebooks from the cloud.

WebTitan OTG for Chromebooks is a new web filtering solution for the education sector that allows schools to carefully control the websites that can be access by students both in the classroom and offsite, including in student’s homes.

Schools can easily devise filtering policies for all pupils or specific age groups and apply those filtering polices in the cloud. The solution allows schools to enforce the use of Safe Search and prevent access to age-inappropriate web content to keep students safe.

WebTitan OTG for Chromebooks delivers fast and effective user- and device-level web filtering and empowers students to discover the Internet in a safe and secure fashion, while also ensuring compliance with federal and state laws such as the U.S. Children’s Internet Protection Act (CIPA).

The solution is cost effective for schools to implement, setup and management is quick and easy, and administrators can schedule or run usage reports on demand and have full visibility into Chromebook users’ online activities and locations. It is also possible to lockdown Chromebooks to prevent students from circumventing the web filtering controls.

As with all WebTitan Cloud solutions, there is no need for any on-premises hardware, no proxies or VPNs required, and there is no impact on Internet speed as filtering takes place at the DNS-level before any content is downloaded.

“This new release comes after an expansive first quarter. The launch of WebTitan Cloud 4.16 brings phenomenal new security features to our customers,” Said TitanHQ CEO, Ronan Kavanagh. “After experiencing significant growth in 2020, TitanHQ expects these product enhancements and new features to make 2021 another record-breaking year.”

Telegram Platform Being Abused and Used to Distribute and Communicate with Malware

Telegram is a popular messaging app that has seen user numbers soar in recent months, with many users of WhatsApp making the change to Telegram after recent changes to the WhatsApp privacy and data management policies.

Telegram has also proven popular with cybercriminals who are using the app for distributing and communicating with malware. Recently, a campaign has been identified involving a new malware variant dubbed ToxicEye. ToxicEye malware is a Remote Access Trojan (RAT) that gives an attacker full control of an infected device. The malware is used to steal sensitive data and download other malware variants.

The malware uses a Telegram account for its command and control server communications. Through the attacker’s Telegram account, they can communicate with a device infected with ToxicEye, exfiltrate data, and deliver additional malicious payloads.

It is easy to see the attraction with using Telegram for malware communication. First, the app is popular. The Telegram app was the most popular app in January 2021, having amassed more than 63 million downloads, and has around 500 million active users worldwide. During the pandemic the app has been adopted by many businesses who have been using it to allow their remote workers to communicate and collaborate. The app supports secure, private messaging and most businesses allow Telegram to be used and do not block or inspect communications.

Setting up a Telegram account is easy and attackers can remain anonymous. All that is required to set up an account is a mobile phone number, and the communication infrastructure allows attackers to easily exfiltrate data and send files to malware-infected devices undetected.

Telegram is also being used for distributing malware. Attackers can create an account, use a Telegram bot to interact with other users and send files, and it is also possible to send files to non-Telegram users via phishing emails with malicious attachments. It is phishing emails that are being used to deliver ToxicEye malware. Emails are sent with a .exe file attachment, with one campaign using a file named “paypal checker by saint.exe” to install the malware.

If the attachment is opened and run, a connection will be made to Telegram which allows malware to be downloaded by the attacker’s Telegram bot. The attackers can perform a range of malicious activities once the malware is installed, with the primary goals of the attackers being gathering information about the infected device, locating and exfiltrating passwords, and stealing cookies and browser histories.

ToxicEye malware can kill active processes and take control of Task Manager, record audio and video, steal clipboard contents, and deploy other malware variants – such as keyloggers and ransomware.

TitanHQ offers two solutions that can protect against ToxicEye and other Telegram-based phishing and malware campaigns. SpamTitan is a powerful email security solution that will block malicious emails delivering the executable files that install the ToxicEye RAT and other malware. For even greater protection, SpamTitan should be combined with WebTitan web security. WebTitan is a DNS-based web filtering solution that can be configured to block access to Telegram if it is not in use and monitor traffic in real time to identify potentially malicious communications.

For further information on both of these solutions, details of pricing, and to register for a free trial, contact TitanHQ today.

Discord Extensively Abused in Phishing and Malware Distribution Campaigns

Cloud-based instant messaging platforms have allowed individuals to easily communicate and collaborate, but cybercriminals are also benefitting from these platforms and are abusing the services for a range of malicious purposes. Discord is one such platform that has been favored by cybercriminals for several years and is now being extensively used for phishing and malware distribution.

Discord is a VoIP, instant messaging and digital distribution platform that has been extensively adopted by the gaming community and latterly by a much broader range of users. In 2019, Discord has amassed around 150 million users worldwide and usership has grown considerably since then. The platform has long been abused by cybercriminals who have used the platform’s live chat feature for selling and trading stolen data, such as gift cards and login credentials, for anonymous communications, and the platform has also been abused to act as C2 servers for communicating with malware-infected devices.

In 2021, the platform has been increasingly used for distributing a wide range of malware variants such as information stealers, cryptocurrency miners, Remote Access Trojans, and ransomware by abusing the cdn.discordapp.com service.

Discord, like other collaboration apps, use content delivery networks (CDNs) for storing shared files within channels. Cybercriminals can upload malicious files to Discord and create a public link for sharing, and that link can be shared with anyone, not just Discord users. The URL generated for sharing starts with https://cdn.discordapp.com/ so anyone receiving the link will see that the link is for a legitimate site. While there are controls to prevent malicious files from being uploaded, oftentimes cybercriminals can bypass those protections have get their malicious files hosted, and warnings are not always displayed to users about the risk of downloading files from Discord.  Since the malicious payloads are delivered via encrypted HTTPS, the downloads can be hidden from security solutions.

Further, once uploaded, the malware can be deleted from a chat, but it is still accessible using the public URL. Users are often tricked into downloading these malicious files under the guise of pirated software or games. Gamers have been targeted as their PCs typically have a high spec for gaming, which makes them ideal for cryptocurrency mining.

This method of malware distribution allows malware developers and distributers to easily distribute their malicious payloads with a high degree of anonymity. An analysis by Zscaler identified more than 100 unique malware samples from Discord in the Zscaler cloud in just a two-month period. Another analysis of Discord CDN results identified around 20,000 results on VirusTotal.

The Discord app is also easy to modify to perform malicious actions. Malicious JavaScript code can easily be added to the legitimated Discord client files and can be configured to run each time the client is launched or when specially crafted URLs are opened by the client.

Discord is far from the only communication and collaboration solution to be abused. Slack and Telegram are similarly being abused in phishing campaigns and for malware distribution.

How TitanHQ Can Improve Your Organization’s Security Posture

TitanHQ offers two cybersecurity solutions that can be configured to block the use of these legitimate platforms in the workplace and stop malicious links from being distributed to their employees. WebTitan is a powerful but easy-to-use DNS filtering and web security solution that can be configured to block access to sites such as Discord, thus preventing employees from visiting malicious content. Since WebTitan performs malware scans in real time, if malicious files are encountered, employees will be prevented from downloading them. WebTitan supports HTTPS (SSL) inspection so can decrypt, scan, then re-encrypt traffic to identify and block malicious content.

Malicious links to Discord are often distributed via phishing emails. SpamTitan Email Security prevents malicious emails from being delivered to inboxes, such as emails containing links to Discord, Telegram, or other services that are abused by cybercriminals and used to host phishing kits or malware.

Both solutions work seamlessly together to protect against email- and web-based cyberattacks and prevent credential theft, and malware and ransomware attacks. Both solutions are cost effective to implement and easy-to-use and are much loved by IT staff who benefit from a high level of protection coupled with a low management overhead.

If you want to improve protection from email and web-based attacks, contact TitanHQ today to find out more about these award-winning cybersecurity solutions. Both solutions are available on a free trial and a product demonstration can be arranged on request.

Further, these solutions have been developed to be MSP-friendly, with a range of benefits for managed service providers who want to want to improve email and web security for their clients.

Warnings Issued Following Spike in Ransomware Attacks on Schools

The disruption to learning from a pandemic that has lasted more than a year is bad enough, but many schools have experienced even more disruption just as many have opened their gates and allowed students back into classrooms.  The SARS-CoV-2 virus may have been brought under control thanks to lockdown measures and the rollout of vaccines, but another type of virus is proving to be a major threat – ransomware.

FBI Warns of Targeted Ransomware Attacks on K12 Schools and Higher Education

Ransomware attacks on schools have been stepped up in recent months and schools and higher education institutions are being actively targeted. In the United States, the Federal Bureau of Investigation recently issued an alert to the education sector warning about the threat of attacks involving Pysa ransomware. The threat actors behind this ransomware variant have been actively targeting K12 schools, higher education, and seminaries. Buffalo City Schools were forced to close their schools in March following a ransomware attack that crippled their IT systems, just before students were about to return to classrooms as part of a phased reopening of schools.

The ransomware is deployed manually after compromising the network. The attack often starts with a phishing email, which gives the attackers the foothold in the network they need. They then conduct reconnaissance, move laterally, and compromise entire networks before deploying their ransomware.

Prior to running the encryption routine that cripple IT systems, the attackers steal sensitive data. Files containing student information are obtained and threats are issued to publish or sell the stolen data if the ransom is not paid. The gang, like many others, has a leak site and routinely follows through on the threat.

Spike in Ransomware Attacks on UK Schools

Ransomware attacks on schools are not confined to the United States. The Pysa ransomware gang is also targeting schools in the United Kingdom and many other countries, and the Pysa gang is not alone. Many other ransomware operations have been attacking schools.

Following a rise in ransomware attacks on UK schools, the UK’s National Cyber Security Centre (NCSC) issued an alert to educational institutions about the growing threat of attacks. NCSC has observed an increase in ransomware attacks on schools from late February 2021, which coincides with students returning to classrooms after an extensive period of school closures due to the pandemic.

The NCSC said there is no reason to believe that these attacks are being conducted by the same criminal group. This appears to be the work of multiple threat groups. These attacks have caused varying levels of disruption, including rendering entire networks inoperable, disabling email and websites, and hampering the ability of students to learn. In some cases, students have lost coursework as a result of the attacks, records of COVID-19 tests have been rendered inaccessible, and school financial records have been lost.

Unfortunately, even paying the ransom is no guarantee of being able to recover encrypted files. While the attackers claim they have the keys to unlock the encryption, they may not be provided. There is also no guarantee that stolen data will be deleted when the ransom is paid. There have been many cases when further ransom demands have been issued after payment has been made.

Adopt a Defense in Depth Strategy to Block Ransomware Attacks

The Department for Education (DfE) has recently urged UK schools to review their cybersecurity defenses and take the necessary steps to harden their defenses against cyberattacks. The NCSC explained that there is no single cybersecurity solution that will provide protection against these attacks. What is required is a defense in depth approach to security.

Defense in depth means implementing multiple overlapping layers of security. If one layer fails to block an attack, others are in place to block the attack.

In practice this means good patch management – applying updates to software, firmware, and operating systems promptly. Antivirus software must be installed on all devices and be kept up to date. Spam filtering solutions should be implemented to block the phishing emails that give the attackers access to the network. These filters can also be used to block email attachments that are not typically received.

Web filters should be used to block access to malicious websites. These filters inspect the content of websites to determine if it is malicious. They also categorize web content, and the filters allow schools to carefully control the types of content that students and staff can access to reduce risk.

Multi factor authentication should be implemented on all remote access points and email accounts, remote access ports that are not being used should be blocked, and a VPN should be used for remote access. The rule of least privilege should be applied for remote access and all staff and student accounts.

It is also recommended to prevent all non-administrator accounts from being able to install software, office macros should be disabled, as should autorun on portable devices.

It is also vital that all files are backed up daily and backups tested to make sure file recovery is possible. Backups should be stored on non-networked devices and must not be accessible from the systems where the data resides. Ideally, multiple backup copies should be created with at least one stored on an air-gaped device.

TitanHQ Wins Big at Expert Insights’ 2021 Best-Of Awards

TitanHQ is proud to announce three of its innovative products have been named winners at the Experts Insights’ 2021 Best-Of Awards in the Web Security, Email Security Gateway, and Email Archiving categories.

Expert Insights helps businesses identify the most powerful, innovative, and ease to use cybersecurity solutions through its website, and helps clear up the confusion about cybersecurity solutions through objective reviews, industry analysis, and interviews with industry leaders. The top cybersecurity products are listed on the website along with reviews and ratings from genuine users of the solutions. Expert Insights now helps more than 40,000 businesses each month select the most appropriate cybersecurity solutions to meet their needs.

The leading cybersecurity companies and their products are recognized each year in the Expert insights’ “Best-Of” Awards. Products are assessed by technology experts and the Expert Insights’ Editorial Team based on many factors, including market presence, technical features of the products, ease-of-use, and ratings by verified users of the products. Winners are selected in a range of different categories such as email security, web security, endpoint security, multi-factor authentication, backup, and many more.

“2020 was an unprecedented year of cybersecurity challenges, with a rapid rise in remote working causing a massive acceleration in cybercrime,” said Craig MacAlpine, CEO and Founder, Expert Insights. “Expert Insights’ Best-Of awards are designed to recognize innovative cybersecurity providers like TitanHQ that have developed powerful solutions to keep businesses safe against increasingly sophisticated cybercrime.”

TitanHQ was recognized for the WebTitan DNS filtering solution, which was named a winner in the Web Security category, SpamTitan was named a winner in the Email Security category, and ArcTitan was named a winner in the Email Archiving category. In addition to the level of protection provided, each solution is consistently rated highly on price and ease of use by enterprises, SMBs, and Managed Service Providers. The solutions are used by more than 8,500 businesses and over 2,500 MSPs in more than 150 countries. In addition to the high ratings on Experts’ Insights, the solutions have received top marks on G2 Crowd, Capterra, GetApp, Software Advice, and Google Reviews.

“The recent pandemic and the growth of remote working initiatives have further highlighted the need for multiple layers of cybersecurity and our award-winning solutions form key pillars in this security strategy,” said Ronan Kavanagh, CEO, TitanHQ. “We will continue to innovate and provide solutions that MSPs can use to deliver a consistent, secure and reliable experience to their customers.”

Phishing Attacks on Businesses Doubled in 2020 and SSL Encryption is Now the Norm

The COVID-19 pandemic created many new opportunities for cybercriminals who were all too happy to take advantage. In 2020, businesses had to rapidly change their working practices to deal with national lockdowns and changed to a more distributed, remote workforce. In response, cybercriminals stepped up phishing attacks to obtain credentials to email accounts, VPNs, and remote access solutions.

The increase in email threats and phishing activity was recently highlighted by the Anti-Phishing Working Group which has been gathering data on phishing attacks from its member organizations throughout the year. Its latest report shows phishing attacks doubled in 2020, peaking in October 2020 when previous records were shattered. In October, 225,304 new phishing sites were detected, compared with under 100,000 in January 2020. From August to December 2020, more than 200,000 new phishing sites were detected each month.

Links to these phishing websites are sent in large scale phishing campaigns and many of the messages land in inboxes where they attract a click. The pandemic made that much easier for cybercriminals who expertly exploited the thirst for knowledge about COVID-19 to conduct their scams. As the year progressed other COVID-19 themed lures were used including COVID-19 relief payments for businesses, offers of early vaccines, small business loans, tax deadline extensions, and many more.

Cybercriminals often use compromised websites for hosting their phishing forms, but it is now much more common for the attackers to purchase their own domains that are tailored for each phishing campaign. These lookalike domains can easily fool individuals into believing they are on a legitimate website.

Cybercriminals have also been using encryption to hide their phishing URLs and fool employees. Hosting phishing URLs on HTTPS sites can fool employees into believing the web content is genuine, and many security solutions do not examine encrypted content which makes the URLs hard to identify and block. In Q4, 2020, 84% of phishing URLs used SSL encryption.

The increase in use of SSL encryption is a concern, as many people mistakenly believe that a site starting with HTTPS is secure when that is not the case. SSL inspection means the connection between the browser and the website is secure, which means users are protected against the interception of sensitive information, but a cybercriminal may own or control that website. The secure connection just means other cybercriminals will not be able to intercept login credentials as they are entered on a phishing site.

The problem for businesses has been how to block these threats as they grow in number and sophistication. Many businesses have previously relied on Office 365 anti-spam protections for blocking spam and phishing threats, but large volumes of these malicious emails are delivered to Office 365 inboxes. When that happens and a malicious link is clicked, they have no way of stopping employees from disclosing sensitive information.

One way that businesses can better protect against these phishing attacks is by implementing a web filtering solution with SSL inspection. WebTitan for instance can decrypt websites, inspect the content, and then re-encrypt which means malicious websites are not hidden and can be identified and blocked.

WebTitan also incorporates multiple threat intelligent feeds to ensure that as soon as a phishing URL is detected, all WebTitan users will be immediately protected. WebTitan ensures that protection is provided against emerging phishing URLs and zero-minute threats. When combined with an advanced spam filtering solution such as SpamTitan to block phishing emails at source and ensure they do not reach inboxes, businesses will be well protected against phishing attacks.

Cybercriminals Hit the Healthcare and Retail Industries Hard in 2020

In 2020, the healthcare industry was heavily targeted by ransomware gangs who took advantage of the pandemic to hit the very hospitals that were trying to save patients’ lives. Battling under extremely challenging conditions, the healthcare industry had to cope with these highly damaging and disruptive ransomware attacks that placed patient safety at risk.

A major ransomware attack hit one of the largest healthcare providers in the United States. Universal Health Services, an American Fortune 500 company which employees 90,000 individuals and runs 400 acute care hospitals, suffered a major ransomware attack in September which impacted all of its hospitals. Staff were forced to work on pen and paper for three weeks while it recovered from the attack.

A cyberattack on University of Vermont Medical Center in October affected more than 5,000 hospital computers and laptops and 1,300 servers. All devices had to be wiped and have software and data reinstalled, with the healthcare provider experiencing downtime for more than 2 months. During the recovery process around $1.5 million was being lost per day to attack-related expenses and lost business, with the total costs expected to exceed $64 million.

Ransomware attacks on the healthcare industry were stepped up in September and October and continued to plague the industry for the remainder of the year. A study by Tenable found that ransomware attacks accounted for 46% of all healthcare data breaches in 2020, showing the extent to which the industry was targeted.

Many of these attacks involved the exploitation of unpatched vulnerabilities, most commonly vulnerabilities in the Citrix ADC controller and Pulse Connect Secure VPN. Patches had been released at the start of the year to fix the vulneabilities, but the patches had not been applied promptly. Phishing emails also gave ransomware gangs the access to healthcare networks they needed to conduct ransomware attacks. Check Point’s research indicates there was a 45% increase in cyberattacks on the industry from the start of November to the end of the year.

Another industry heavily targeted by hackers in 2020 was retail. Retailers were also incredibly busy as a result of the pandemic. With governments ordering people to stay home to curb the spread of the virus, online retailers saw a sales surge as shoppers made their purchases online rather than in bricks and mortar stores. Researchers at Salesforce found digital sales increased by 36% in 2020 compared to the previous year, and cybercriminals took advantage of the increase in online sales.

Several methods were used to gain access to retailers’ systems and websites, with the most popular tactic being web application attacks, which increased by 800% in 2020 according to the CDNetworks State of Web Security H1 2020 Report. Attackers also used credentials stolen in past data breaches to attack online retail outlets in credential stuffing attacks, which Akamai’s tracking revealing the retail industry was the most attacked industry using this attack technique, account for around 90% of attacks.

As is normal every year, the large numbers of shoppers that head online to make purchases in the run up to Black Friday and Cyber Monday were exploited, with phishing attacks related to these shopping events increasing thirteenfold in the six-week run up to Black Friday. In November, 1 in every 826 emails was an online shopping related phishing scam, compared to 1 in 11,000 in October, according to Check Point. Content management systems used by retailers were also targeted, and attacks on retail APIs also increased in 2020.

As we head into 2021, both sectors are likely to continue to be heavily targeted. Ransomware and phishing attacks on healthcare providers could well increase now that vaccines are being rolled out, and with many consumers still opting to buy online rather than in person, the retail sector looks set to have another bad year.

Fortunately, by following cybersecurity best practices it is possible to block the majority of these attacks. Patches need to be applied promptly, especially any vulnerabilities in remote access software, VPNs, or popular networking equipment, as those vulnerabilities are rapidly exploited.

An advanced anti-phishing solution needs to be implemented to block phishing attacks at source and ensure that malicious messages do not get delivered to inboxes. Multi-factor authentication should also be implemented on email accounts and remote access solutions to block credential stuffing attacks.

A web filter is important for blocking the web-based component of phishing and cyberattacks. Web filters stop employees from visiting malicious websites and block malware/ ransomware downloads and C2 callbacks. And for retail especially, the use of web application firewalls, secure transaction processing, and the correct use of Transport Layer Security across a website (HTTPS) are important.

By following cybersecurity best practices, healthcare providers, retailers, and other targeted industries will make it much harder for hackers to succeed. TitanHQ can help by providing SpamTitan Email Security and WebTitan Web Security to protect against email and web-based attacks in 2021. For more information on these two solutions and how you can use them to protect your busines, call TitanHQ today.

Phishing Campaign Uses CAPTCHA to Fool Users and Email Security Solutions

Phishers are constantly coming up with new scams that abuse trust. People tend to trust their favorite brands and when email communications are sent by those companies there is a tendency for the emails to be trusted. The same is true when emails are sent from email contacts such as work colleagues and friends. Cybercriminals take advantage of trust to get users to take a specific action, such as clicking on an embedded hyperlink in an email or opening an email attachment.

Many businesses now provide security awareness training to employees and try to teach them to always be vigilant and never to trust emails implicitly, even if they have been sent by known contacts. Just because an email has been sent from a known and trusted email account does not mean the message is genuine. Email accounts are often compromised and used to send phishing emails. The Emotet Trojan hijacks email accounts and uses them to send copies of itself to the victim’s contacts, and several other malware variants do the same. Email addresses are also spoofed. The display name may be correct or believable, but the actual email account used to send the message is anything but.

Another tactic is now being used by at least one cybercriminal group than similarly abuses trust, albeit in a new way. A phishing campaign, which was first detected on September 21, 2020, uses the challenge-response test CAPTCHA to simultaneously make the campaign believable and also to reduce the probability of the scam being detected by email security solutions.

Internet users will be familiar with CAPTCHA, although maybe not by name. The CAPTCHA system is used by many websites as a way to determine if a website visitor is a human or a bot, most commonly on forms.

Google uses CAPTCHA and requires users to pass a pictorial challenge where it is necessary to select all the images in a group that featuring a car, bicycle, bus, or traffic lights. If you pass the challenge you will be allowed to proceed, if you fail you will not. Other versions involve entering in a number or code word that has been heavily disguised in an image.

While these CAPTCHA challenges can be annoying, they are associated with security so if a website has one of these challenges, subconsciously people tend to feel more secure. However, as with a website starting with HTTPS, it does not mean the website is genuine.

In this new phishing campaign, users are likely to feel more secure when credentials are requested since they had to pass a CAPTCHA test, especially considering the page on which the challenge was set up looks just like the genuine login prompt for Office 365.  The background is the same, as is the login prompt. The only difference between the genuine login page and the fake version is the URL.

Security teams face a challenge detecting and blocking these phishing pages as email security solutions, despite having AI-based detection mechanisms, are essentially bots and, as such, cannot pass a CAPTCHA challenge.

A second tactic is also used to evade detection. The scammers have set up their campaign so that only a specific set of IP addresses will be presented with the CAPTCHA test on the fraudulent domain. If any IP address outside a specific range attempts to visit the link– the IP range used by the targeted company – a redirection will occur to the genuine Microsoft login page.

While these scams help to ensure that malicious emails are delivered to inboxes, organizations do not need to be totally reliant on their employees recognizing the scams and taking appropriate action (reporting the email to the IT security team).

With a web filtering solution in place, attempts to visit known malicious websites will be blocked. When malicious domains are detected they are automatically added to a web filter’s blacklist, and any attempts to visit malicious domains will be blocked.

WebTitan is a low maintenance security solution that can be set up in about 5 minutes and will protect against the web-based component of phishing attacks and will block malware downloads from malicious websites. WebTitan works in tandem email security solutions to provide greater protection against malware and phishing attacks. The solution can also be used to control the content that employees and guest network users can access over the internet, whether they are on the network or working remotely.

If you have not implemented a web filter or are unhappy with your current solution, give the WebTitan team a call to find out more. A product demonstration can be arranged, you can have a free trial of the solution, and assistance can be provided to help you get the most out of WebTitan during your trial.

Cyberattacks on Remote Workers Have Increased Dramatically During the COVID-19 Lockdown

If you have been following the security news, you will have seen that there has been a major increase in COVID-19 themed cyberattacks targeting remote workers. Cybercriminals are exploiting fear about the virus and the somewhat chaotic switch from mostly office-based workers to having virtually the entire workforce working remotely. Understandably given the speed at which businesses have had to adjust, vulnerabilities have been introduced.

The attack surface has increased considerably as a result of largely at-home workforces and cybercriminals have taken advantage. According to research conducted by Darktrace, in the United Kingdom, prior to the COVID-19 lockdown being imposed, around 12% of malicious email traffic was targeting home workers. The volume increased to around 60% after 6 weeks of lockdown, which clearly demonstrates the extent to which remote workers are being targeted.

The types of malicious emails being sent to remote workers have been incredibly diverse. Cybercriminals are using all manner of lures to get remote workers to click links and disclose their credentials or open malicious attachments and trigger malware downloads. Financial fraud has also increased with BEC gangs using the COVID-19 pandemic to fraudulently obtain funds from company accounts.

Early on in the pandemic when information about the virus was thin on the ground, emails were being sent offering important advice about preventing infection along with fake updates on cases. As the pandemic progressed and the effects started to be felt, cybercriminals started sending fake requests for donations to charities to help individuals adversely affected by COVID-19. As governments implemented furlough schemes and set up funds to help the employed and self-employed, campaigns were conducted that linked to websites that claimed to offer grants, allow workers to choose to be furloughed, or apply for financial support.

Attacks have targeted the tools that are being used by remote workers to connect to their offices and communicate with colleagues, with the likes of Zoom, Skype, GoToMeeting, and other corporate messaging systems being spoofed to infect users with malware. File sharing platforms have similarly been spoofed to get employees to disclose their credentials. Darktrace’s data shows there has been a massive increase in spoofing attacks during lockdown, increasing from around one fifth of attacks before lockdown to 60%.

It is not only cybercrime groups that are conducting attacks. State-sponsored hacking groups have similarly been taking advantage of the pandemic to steal sensitive data, including the latest COVID-19 research data on potential cures, vaccines, and treatments to further the response efforts in their own countries.

What is not always clear from the new reports is how the increase in cyberattacks targeting remote workers has translated into actual data breaches. Are these attacks succeeding or are companies managing to thwart the attacks and keep the hackers at bay?

There is a lag between intrusions being detected, breaches being confirmed, and announcements being made but it appears that many of these attacks are succeeding. In April, the International Association of IT Asset Managers issued a warning that while a rise in data breaches was to be expected as a result of the pandemic, the number of incidents was actually far higher than anticipated. It is also clear that ransomware attackers have stepped up their efforts to attack businesses. Even organizations on the frontline in the fight against COVID-19 have not been spared.

Threat actors have taken advantage of the opportunities offered by the pandemic. It is up to businesses to make sure their security measures are sufficient to thwart attacks. Combating cyberattacks on remote workers requires additional security measures to be implemented. One measure that is often overlooked but can greatly improve protection is DNS filtering.

A DNS filter provides protection against the web-based component of cyberattacks and is an important measure to implement to improve defenses against phishing and malware. Even with robust email security defenses in place, some messages will arrive in inboxes. A DNS filter provides an extra layer of protection by preventing users from visiting malicious websites linked in emails.

When a malicious link is clicked, a DNS query is made, and a DNS lookup is performed to find the IP address of the URL. DNS filtering ensures that the IP address is not returned if the URL is malicious. A DNS filter such as WebTitan also allows IT teams to block malware downloads, monitor internet activity, and carefully control the types of websites their remote users can access on corporate devices.

If you have not yet implemented a DNS filtering solution and would like more information on how it can protect against cyberattacks on remote workers, give the TitanHQ team a call today.

Meteoric Rise in Phishing and Web Attacks Targeting NASA’s Telecommuting Workers

There has been a massive rise in the number of telecommuting workers as a result of the 2019 Novel Coronavirus pandemic and cybercriminals are taking advantage. Phishing and malware attacks have soared in the past few weeks and home workers are being targeted.

Individuals who regularly worked from home before the COVID-19 crisis will be used to taking precautions when connecting to virtual environments set up by their employers, but huge numbers of employees are now logging in remotely for the very first time and may not be aware of the telecommuting cybersecurity risks. IT and IT security departments have also had to set up the workforce for home working in a hurry, and the sheer number of employees that have been forced into telecommuting means corners have had to be cut which has created opportunities for cybercriminals.

Even if the transition to having the entire workforce telecommuting has been expertly managed, risk will have increased considerably.  Cybersecurity is far harder to manage when the entire workforce is outside the protection of the corporate firewall and with most workers telecommuting, the attack surface has grown considerably.

Telecommuting workers are seen as low hanging fruit and cybercriminals are taking advantage of the ease at which attacks can be conducted. Since January there has been a massive increase in phishing attacks, malware attacks, and attacks over the internet targeting remote workers.

NASA Sees “Exponential Increase” in Malware Attacks

On April 6, 2020, NASA sent a memo to all personnel warning of a massive increase in targeted attacks on the agency.  NASA explained in the memo that the number of phishing attempts on NASA employees has doubled in the past few days and its systems designed to block employees from accessing malicious websites has gone into overdrive. The number of malicious websites that are now being blocked has also doubled, which strongly suggests employees are clicking on links in phishing emails and are being fooled by these scams. NASA also reports that there has been an “exponential increase in malware attacks on NASA systems.”

Attacks are being conducted by a diverse range of threat actors, from small players to prolific advanced persistent threat (APT) groups and nation-state sponsored hackers. NASA has warned its employees that those attackers are targeting NASA employees’ work and personal devices and that the attacks are likely to continue to increase throughout the Novel Coronavirus pandemic.

NASA is far from alone in experiencing a massive increase in attempted cyberattacks. Businesses of all sizes are now having to deal with unprecedented risks and are struggling to defend their networks from attack. They now have to defend a massively increased attack surface and the number of attacks has skyrocketed.

There are other factors that are making it difficult for employers. Employees crave information about the Novel Coronavirus and COVID-19 and cybercriminals are sending huge numbers of emails offering them just the information they seek. Huge numbers of websites are being set up that purport to offer advice on the Novel Coronavirus and COVID-19. Check Point has reported that more than 16,000 domains related to coronavirus or COVID-19 have been registered since January and those domains are 50% more likely to be malicious than other domains registered in the same period.

How to Protect Telecommuting Workers

There are three main ways that telecommuting workers are being attacked: Email, malicious websites, and the exploitation of vulnerabilities.

To prevent the latter, it is essential for software and operating systems to be kept up to date. This can be a challenge for IT departments at the best of times, but much harder when everyone is working remotely. Despite the difficulty, prompt patching is essential. Vulnerabilities in VPNs are being targeted by cybercriminals and offer an easy way to gain access to corporate networks. Employees should be told to make sure their VPN clients are running the latest software version and businesses should ensure their VPN infrastructure is kept up to date, even if it means some downtime while updates are applied.

TitanHQ Can Help You Strengthen Email and Web Security

Advanced email security defenses are now required to protect against phishing and email-based malware threats. Some of the COVID-19 phishing campaigns that are now being conducted include some of the most sophisticated phishing threats we have ever seen.

You should not rely on one form of email security, such as Microsoft’s Exchange Online Protection for Office 365 accounts. Layered defenses are essential. Office 365 email security can be significantly strengthened by layering SpamTitan on top of Microsoft’s EOP protections. SpamTitan does not replace Office 365 protections, it improves them.

SpamTitan is an advanced email security solution that incorporates powerful, real time updated AI-driven threat intelligence to block spam, phishing, malware, malicious links, and other email threats from incoming mail. SpamTitan sandboxing identifies threats that signature-based detection solutions miss and is effective at identifying and blocking zero-day malware threats.

Each day, the number of malicious websites related to COVID-19 grows. These websites are used to phish for sensitive information such as email and VPN credentials and for drive-by downloads of malware. To protect remote workers and prevent them from accessing these malicious websites, a web filtering solution is required.

WebTitan DNS Security offers protection against web-based threats and prevents employees from accessing known malicious websites. WebTitan DNS Security is seeing massively increased traffic demand for its scanning and web detection features, but the solution is cloud based and has been developed with scalability in mind. WebTitan DNS Security is blocking new threats as soon as they are identified to keep customers and their employees protected. The solution can be easily implemented to protect remote workers but inserting simple code into enterprise devices which points the DNS to WebTitan. That small change will ensure the internet is filtered for all employees, no matter where they are working.

TitanHQ is committed to providing safe and secure email and internet usage for our customers, partners and their users, now more than ever. Contact TitanHQ today for help improving security at your organization.

TitanHQ and Pax8 Form New Strategic Partnership

TitanHQ and Pax8 have announced a new strategic partnership that will see TitanHQ’s cloud-based email security and DNS filtering solutions incorporated into the Pax8 ecosystem.

Pax8 simplifies the journey into the cloud through billing, provisioning, automation and industry-leading PSA integrations and is proven leader in cloud distribution. Pax8 has achieved position 60 in the 2019 Inc. 5000 list of the fastest growing companies and has been named CRN’s Coolest Cloud Vendor and Best in Show at the NextGen and Xchange conferences for two years in a row.

In order to have products added to the Pax8 marketplace, vendors must have developed exceptional channel friendly solutions. As the leading provider of cloud-based email and web security solutions for managed service providers (MSPs) serving the SMB marketplace, TitanHQ was an ideal fit.

Under the new partnership, Pax8 partners will have easy access to TitanHQ’s leading email security solution, SpamTitan Cloud, and can protect clients from web-based threats with WebTitan Cloud, TitanHQ’s DNS filtering solution.

These cloud-based AI-driven solutions help MSPs secure their own environments and protect their clients from malware, ransomware, botnets, viruses, and phishing and email impersonation attacks and avoid costly data breaches.

Both solutions have been developed with MSPs firmly in mind. The solutions are easy to integrate into an MSP’s security stack through TitanHQ’s APIs, there are multiple hosting options, the solutions can be supplied in white label form, and there are generous margins. Pax8 partners also benefit from a fully transparent pricing policy and industry leading technical support.

TitanHQ’s solutions have much loved by users and are consistently rated highly on business software review platforms, including G2 Crowd, Gartner Peer Insights, and Capterra.

“Our partners are excited about the addition of TitanHQ and the ability to protect their clients’ businesses by blocking malware, phishing, ransomware, and links to malicious websites from emails.” said Ryan Walsh, chief channel officer at Pax8.

How to Improve Restaurant Cybersecurity and Thwart Hackers

Any business that processes card payments is a target for cybercriminals, but restaurants in particular are favored by hackers. Over the past few weeks, cybercriminals have stepped up their efforts to attack these businesses and several restaurant chains have had their systems compromised. In all cases, malware has been installed on point-of-sale systems that steals payment card information when diners pay for their meals.

Many of the attacks have hit restaurant chains in the Midwest and East, with credit card data from diners recently having been listed for sale on the underground marketplace, Joker’s Stash. A batch of approximately 4 million credit and debit cards is being offered for sale, which comes from malware attacks at Moe’s, McAlister’s Deli, Krystal, and Schlotzsky’s.

The cyberattack on Krystal was detected in November, with the other three chains, all owned by Focus Brands, attacked in August. In total, the above chains have more than 1,750 restaurants and almost half of those locations, mostly in Alabama, Florida, Georgia and North and South Carolina, were affected.

Catch Hospitality Group also announced in November that it had suffered a cyberattack which had seen malware installed on its point-of-sale system that scraped and exfiltrated payment card data as diners paid for their meals. The data breach affected customers of Catch NYC, Catch Roof, and Catch Steak restaurants. Fortunately, the devices used to process the majority of payments were unaffected. Malware was on the Catch NYC and Catch Roof devices between March 2019 and October 2019, with Catch Steak affected between September 2019 and October 2019.

Church’s Chicken restaurants were also attacked in a separate incident in October. The majority of its 1,000+ restaurants were not affected, but at least 160 restaurants in Alabama, Arkansas, Florida, Georgia, Illinois, Louisiana, Mississippi, Missouri, South Carolina, Tennessee and Texas had malware installed on their POS system.

Other restaurant chains that have been attacked in 2019 include Checker’s Drive-In, Cheddar’s Scratch Kitchen, Huddle House, Applebee’s, Chilli’s, and Earl Enterprises (Buca di Beppo, Chicken Guy, Tequila Taqueria, Mixology, Planet Hollywood). Malware n the systems of Earl Enterprises had been present for almost a year before it was detected.

How to Improve Restaurant Cybersecurity

Restaurants process many thousands of card transactions which makes them an attractive target for hackers. Restaurants often use out-of-date operating systems, have vulnerability-ridden legacy hardware, and their cybersecurity solutions often leave a lot to be desired. Consequently, cyberattacks on restaurants are relatively easy to perform, at least compared to many other types of businesses.

In order to infect the POS system, the attackers will need network access. That is most commonly gained via phishing emails, drive-by malware downloads, or by abusing remote access tools. Direct attacks are also possible using techniques such as SQL injection and weak passwords can be easily guessed using brute force tactics.

The malware that sits on systems and exfiltrates data tends to have a very small footprint and is often stealthy as it needs to be present for long periods of time to collect payment card data. That can make it hard to detect when it has been installed. The key to security is therefore improving defenses to make sure the malware is not installed in the first place, which means preventing the attackers from gaining access to the network.

Listed below are some easy-to-implement steps that will help restaurants improve their security posture and block attacks. The key is defense in depth through layered security.

  • Use an enterprise-grade firewall –Ensure an enterprise-grade firewall is purchased. A firewall will prevent unauthorized individuals from gaining access to your network resources.
  • Patch promptly and update all software and firmware – Ensure patches are applied promptly and software and firmware updates are implemented when they are released. That includes all systems and networked devices, not just your POS.
  • Upgrade hardware – When your hardware is approaching end of life it is time to upgrade. Unsupported hardware (and software) will no longer be updated and vulnerabilities will no longer be fixed.
  • Lockdown your POS: Use whitelisting or otherwise lock down POS systems to make it harder for malware to operate. Only allow trusted apps to run on your POS systems.
  • Install powerful antivirus software – Ensure all devices are protected by a powerful anti-virus solution and that it is set to update virus definitions automatically. Regularly scan the network for malware, especially your POS.
  • Implement an intrusion detection system – These systems monitor the network for unusual activity that could indicate a malware infection, attackers searching the network for the POS system, and unusual traffic that could indicate data exfiltration.
  • Change all default passwords and set strong passwords – To protect against brute force attacks, ensure strong passwords are set on all systems and all default passwords are changed. Also implement rate limiting to block attempts to access a system or device after a set number of failed password attempts.
  • Implement a powerful spam filtering solution – A powerful email security solution, such as SpamTitan, is required to prevent spam and malicious emails from being delivered to end users. Even if you have Office 365, you will need a third-party email security solution to block email-based threats.
  • Restrict Internet access with a DNS filter – A DNS filter such as WebTitan provides protection against drive-by malware downloads and web-based phishing attacks. WebTitan will block all known malicious websites and those with a low trust score. The solution can also be configured to prevent employees from accessing categories of websites where malware downloads are more likely.
  • Disable Remote Access if Possible – Disable Remote Desktop Protocol and all remote access tools. If remote access tools are required to allow essential maintenance work to be completed, ensure they can only used via a VPN and restrict the people who can use those tools.

How Much Money Did WannaCry Make?

The WannaCry ransomware attacks that started on May 12, 2017 were blocked quickly when a kill switch was identified and activated, but how much money did WannaCry make during the time it was active?

WannaCry was a devastating global cyberattack, the likes of which had been predicted by many cybersecurity professionals but had yet to materialize. WannaCry was the fastest spreading ransomware ever created.

WannaCry combined ransomware with a worm, which allowed it to automatically spread and infect huge numbers of devices on a network. The ransomware exploited a vulnerability in Windows Server Message Block (SMBv1) using an NSA exploit called EternalBlue.

The flaw exploited by EternalBlue had been reported to Microsoft and a patch was issued in March 2017, two months before the attacks started. However, many businesses were slow to apply the patch and were vulnerable to attack. Within a matter of hours, around 200,000 computers had been attacked in 150 countries. It is worth noting here that there are still many computers that have not been patched more than 2 and a half years after the patch was released, in spite of widespread news coverage about the threat of attack and its huge cost. WannaCry is still one of the biggest ransomware threats and accounts for a significant percentage of all successful ransomware attacks in 2019.

WannaCry was blocked by a British security researcher who discovered the ransomware checked a domain name prior to encrypting data, but that domain name had not been registered. He purchased the domain name, thus preventing file encryption.

That said, the speed at which the ransomware spread meant many devices were infected and encrypted. Since businesses were not protected if the ransomware encryption had already started by the time the kill switch was activated, the attackers must have had a huge payday. So how much did WannaCry make?

By today’s standards, the ransom demand was very small. Just $300 per infected device, which doubled to $600 if the payment was not paid within 3 days. It is actually easy to see how many payments were made, as the transactions are detailed in the blockchain. The recipient remains anonymous, but the payments can be seen.

The three Bitcoin addresses known to have been used in the WannaCry attacks currently show 430 payments have been made and 54.43228033 BTC has been sent to those accounts. The value of BTC is somewhat volatile and was much higher at points between now and the attacks, but at today’s exchange rate that equates to around $386,905. Most of the BTC payments have now been moved out of the accounts so they attackers have managed to cash out. Payments are also still being made to those accounts. The latest payments to one of the addresses were made in December 2019.

$386,905 may not seem like much of a payday considering the number of devices infected and the damage caused by the attack, and it’s not. Further the attackers will need to convert that total to real money, and a considerable amount will be lost in that process. The payday was tiny considering the scale of the attack. However the cost of the attack to businesses was colossal.

The National Health Service in the United Kingdom was hit bad and the cleanup operation, and loss of business while that occurred, has been estimated to have cost £92 million. That was just one victim, albeit a major one. Estimates on the total cost of WannaCry range from hundreds of millions to $4 billion globally.

Next time you delay applying a patch or updating software, consider WannaCry and the potential costs of exploitation of a vulnerability. In all of the above cases – all 200,000+ attacks – applying the patch would have prevented the attack and the huge cost of remediation.

TitanHQ Heads to Paris for DattoCon19 to Help MSPs Succeed

TitanHQ is proud to be a platinum sponsor of DattCon19, Paris – The leading event for MSPs looking to keep up to date on the latest industry trends, learn best practices, form new and profitable partnerships, and obtain invaluable advice that will help them grow their business and become more successful.

The event gives the TitanHQ team an opportunity to meet with leading MSPs, MSSPs, and ISPs and explain why TitanHQ is the global leader in cloud-based email and web security solutions for the MSP that services the SMB market.

The team will be available to explain the benefits of the TitanShield MSP program and show just how easy it is to integrate TitanHQ products into your service stacks and start rolling out spam filtering, web filtering, and email archiving to your customers… and the best way to sell those services, reduce the time you spend on providing support, and improve the profitability of your business.

The event will be attended by Rocco Donnino, TitanHQ VP of Strategic Partnerships, Marc Ludden, TitanHQ Strategic Alliance Manager, and Eddie Monaghan. Alliances/MSP Partner Manager.

On Tuesday October 22 between 11:15am and 11:35am, Rocco Donnino will be explaining Email & Web Security for the SMB Market. Rocco will talk about the trends TitanHQ are seeing in the email and web security for SMB markets globally, drawing on the experience from working with over 2,200 MSP customers worldwide.

Marc Ludden and Eddie Monaghan will be on hand to meet with MSPs and ISPs to explain the benefits of joining the TitanShield MSP Program and how best to take advantage of TitanHQ’s proven technology and deliver our advanced network security solutions directly to their client base.  The pair will be helping MSP partners push TitanHQ products downstream to their customers and grow their businesses.

The event will be attended by more than 1000 MSPs, ITSPs, and industry leaders. Over the three days of the conference, attendees will get to hear from the most successful MSPs and MSSPs and discover what they are doing differently and how they are driving growth.

The sessions, keynotes, and networking opportunities will help you get better at running your business with Datto Solutions and discover how the addition of key products such as SpamTitan email security, WebTitan DNS filtering, and ArcTitan email archiving can improve profitability and add greater value.

The keynotes will be bigger and better than ever before and will be taken by 80 of the best and brightest business tycoons, MSPs, and Datto executives, who will share valuable real-world insights and best practices.

The Peer Forums are more intimate small-group roundtable sessions that provide high-value networking on key topics. These sessions are driven by attendees who will share pain points, success stories, and best practices that have been proven to help MSPs grow their business. This year’s Peer Forums are on the following topics:

  • Business Strategy
  • Service Delivery: Driving Efficiency & Automation
  • Selling Networking as a Managed Service
  • Women in Tech
  • French Language Peer Forum: Business Strategy
  • Service Delivery: Service Desk & Professional Services
  • M&A: How Do I Acquire or Be Acquired?
  • Security: Securing Your MSP First
  • German Language Peer Forum: Business Strategy
  • Service Delivery: Client Engagement & vCIO

Add to that the networking opportunities and the stunning location and you have an invaluable event that is not to be missed.

DattoCon19 Paris will be taking place on October 21st, 22nd and 23rd at the Palais des congrès de Paris, 2 Place de la Porte Maillot, 75017 Paris, France.

Further Information on DattoCon19 Paris.

Ransomware Attacks on Businesses Have Doubled in 2019

The year 2018 saw a reduction in ransomware attacks on businesses as cybercriminals opted for alternative means to make money. Major ransomware attacks were still occurring, just at a slightly lower rate than in 2017.

Some reports were released that suggested ransomware was no longer such a massive threat as it was in 2016 and 2017, but the number of reported attacks in 2019 have shown that is definitely not the case. Any business that has not implemented defenses to protect against ransomware attacks could well be the next victim and have to pay millions to recover from an attack.

Make no mistake. Ransomware is one of the most dangerous threats faced by businesses. If ransomware is installed on the network, all files, including backups, could be encrypted. That could prove catastrophic, as one small Michigan medical practice discovered.

The two-doctor practice in Battle Creek, MI suffered an attack that resulted in the encryption of all patient data. A ransom demand was issued by the attackers, but as there was no guarantee that files could be recovered after the ransom was paid, the decision was taken not to pay up. The hackers then deleted all the encrypted files. Faced with having to rebuild the practice from scratch, the doctors decided to call it quits and took early retirement.

Ransomware attacks on healthcare providers are now being reported at an alarming rate and government entities, cities, and municipalities are being extensively targeted. The city of Baltimore suffered a major attack in May involving a ransomware variant called RobbinHood. The attack brought down the city’s servers and systems, causing major disruption across the city. A ransom of $6 million was paid for the keys to regain access to the encrypted files.

Two small cities in Florida also suffered major attacks. Lake City was forced to pay a ransom of $460,000 and Riviera Beach paid a ransom of $600,000, while Jackson County in Georgia paid $400,000 after its court system was attacked.

As the year has progressed, the attacks have increased. A report from Malwarebytes indicates there was a 195% increase in ransomware attacks in Q1, 2019. Figures from Kaspersky Lab show ransomware attacks almost doubled in Q2, 2019, with 46% more attacks reported than the corresponding period in 2018.

The increase in attacks means businesses need to be prepared and have the necessary security tools in place to make it difficult for the attacks to succeed.

There is no one cybersecurity solution that can be implemented to eliminate the threat of attack, as hackers are using a variety of methods to gain access to networks and download their malicious payloads. Layered defenses are key to repelling an attack.

Email is the primary method of delivering ransomware. All it takes if for a malicious email to arrive in an inbox and for an employee to be fooled into opening a malicious attachment or clicking on a hyperlink for ransomware to be installed. An advanced email filtering solution such as SpamTitan Cloud is therefore needed to block malicious emails and ensure they do not reach employees’ inboxes.

SpamTItan includes Domain-based Message Authentication, Reporting, and Conformance (DMARC) to block email impersonation attacks and a sandbox where suspicious attachments can be executed in safety and studied for malicious activity. Sandboxing is essential as it allows zero-day ransomware threats to be identified and blocked.

Not all attacks occur via email. Attacks over the Internet are also common. A web filtering solution should therefore be implemented to block these web-based attacks. A web filter will prevent employees from accessing known malicious sites where ransomware is automatically downloaded. With these two technical measures in place, businesses will be well protected from attacks. Along with security awareness training for staff and the adoption of good data backup practices, businesses can mount a strong defense against ransomware attacks.

Tax Professionals Targeted in IRS Tax Return Phishing Scam

Taxpayers and tax professionals are being targeted by scammers posing as the Internal Revenue Service (IRS). The goal of this new IRS tax return phishing scam is to deliver information-stealing malware. The malware harvests credentials that are used to gain access to and empty financial accounts.

The campaign uses at least two subject lines for the emails – “Electronic Tax Return Reminder” and “Automatic Income Tax Reminder.” The emails contain a hyperlink that directs the user to a website that closely resembles the IRS.gov website. The emails include a one-time password to use to login in to submit a claim for a tax refund.

When the user logs in to the site, they are told that they need to download a file in order to submit their refund. The file is actually keylogging malware which records keystrokes on an infected computer and sends a range of sensitive information to the attackers.

The IRS warning was issued after several taxpayers and tax professionals reported the phishing emails to the IRS. Efforts are ongoing to disrupt the campaign, but the IRS notes that dozens of compromised websites and malicious URLs are being used by the scammers. The IRS is contacting hosting companies to get the websites shut down, but the number of URLs being used makes this a major challenge. As soon as one URL is shut down, there are others to take its place.

The offer of a tax refund or a threat of legal action over tax issues prompts many people to click without first assessing the content of the message and the legitimacy of the request, which is what the scammers are banking on.

The advice of the IRS is never to click on any link in an unsolicited email claiming to be from the IRS. The IRS does not initiate contact with taxpayers by email, text message or social media channels, and no requests are sent for personal information.

The latest warning comes just a couple of months after the IRS and Security Summit partners issued a reminder that all professional tax preparers are required by law – The FTC Safeguards Rule – to implement a written information security plan to ensure the tax information of their clients is properly protected.

The reminder was issued as it had become clear that many tax professionals were unaware of their obligations to implement a security plan to protect client tax data.

There are several required elements of the information security plan:

  • Designate an employee or employees to coordinate the information security plan
  • Conduct a risk analysis to identify risks to the confidentiality of client data
  • Assess the effectiveness of current safeguards
  • Implement, monitor, and test the safeguards program
  • Only use service providers that can maintain appropriate safeguards and oversee the handling of client data
  • Evaluate and update the security program, as appropriate, in response to changes to business practices and operations

The requirements for the information security plan are flexible. For instance, tax preparers can choose the safeguards to implement based on their own circumstances and the findings of their risk analyses.

Two important safeguards that protect businesses from phishing and malware attacks are a spam filter and a web filter. The spam filter protects the email system by identifying and blocking malicious messages such as phishing emails and malspam (malicious spam email), while a web filter blocks web-based attacks and malware downloads. Both of these solutions are highly effective at blocking phishing and malware attacks yet are cheap to implement.

To find out more about how spam filters and web filters can protect your business and help you meet your legal responsibilities contact TitanHQ today.

U.S. Mayors Vow Not to Give in to Ransom Demands

Ransomware attacks have been increasing since late December 2018 and attacks have been reported with increasing frequency as 2019 has progressed. Ransomware may have fallen out of favor with cybercriminals in 2018, but it is once again a firm favorite as it was in 2016 and 2017.

In recent months there has been an extensive ransomware campaign targeting local government offices, cities, and municipalities. These attacks have caused massive disruption, and many have resulted in ransoms being paid.

In the past few days alone, three ransomware attacks have been reported that have seen more than $1,200,000 in ransoms paid. Riviera Beach in Florida paid a ransom of $600,000 for the keys to unlock its encrypted files and Lake City in Florida paid around $460,000. Most recently, La Porte County in Indiana paid a ransom demand of $130,000.

These are just three of many. According to the United States Conference of Mayors, in the past 6 years, more than 170 city, county, or state government systems have been taken out of action as a result of ransomware attacks and there have been 22 attacks so far in 2019.

Cybercriminals will continue to conduct attacks as long as it is profitable to do so. When ransoms are paid, it simply encourages further attacks. The United States Conference of Mayors has decided to take a stand. The organization represents more than 1,400 majors across the United States and has vowed that in the event of attack, ransom demands will not be paid.

That is a necessary step to take to de-incentivize attacks but it could potentially be very costly. In 2018, the City of Atlanta was attacked with ransomware and refused to pay the $50,000 ransom demand. The city has ended up spending tens of millions of dollars on recovery.

The high cost of recovery without paying the ransom could prove too much for small cities, which is why several have been advised by their insurers to pay the ransoms.

In such cases, help is required from the federal government. The majors have urged Congress to pass the State Cyber Resiliency Act, which would give state and local governments the support needed to help them implement their cyber resiliency plans

What is also needed is greater investment in cybersecurity defenses. Attacks are being conducted because there are security holes that can be easily exploited. Until those holes are plugged, the attacks will continue.

TitanHQ can help plug those holes and thwart ransomware attacks by blocking the main attack vectors. SpamTitan is a powerful email security solution that blocks email-threats at source and keeps inboxes threat free. WebTitan protects users while online and blocks malicious websites and malware downloads. With both of these powerful, but low-cost solutions in place, you will be well protected against ransomware attacks.

La Porte County Latest Victim in String of Ransomware Attacks on Municipalities

There has been a spate of ransomware attacks on cities, municipalities, mayor’s offices, and local government facilities in recent weeks.

The latest attack was on La Porte County in Indiana. The attack started on July 6, 2019, but prompt action by the IT department allowed the ransomware to be contained. That rapid response meant only 7% of the laptops used by the county were affected. However, two domain controllers were also affected and that rendered the network unavailable.

Experts were brought in to try to restore files from backups and bring the network back online, but those attempts failed as the backup servers had also been infected with the ransomware. La Porte County was left with no alternative other than to pay the ransom demand. The Bitcoin ransom equated to around $130,000, $100,000 of which was covered by an insurance policy.

This attack involved Ryuk ransomware – The same ransomware variant that was used in the attack on Lake City in Florida on June 10, 2019.  For Lake City, Ryuk ransomware was delivered by the Trickbot Trojan, which was in turn deployed by the Emotet Trojan. Lake City paid approximately $500,000 to the attackers to obtain the keys to unlock the encryption. Riviera Beach in Florida was also attacked and paid a ransom of around $600,000.

These are just three cases out of several recent attacks. Those three attacks alone have resulted in more than $1,200,000 being paid to cybercriminals. That sends a very clear message to other cybercriminals that these attacks can be extremely profitable. That is the reason the FBI advice is never to pay.

2018 saw a decline in ransomware attacks as cybercriminals pursued other strategies for attacking businesses, but ransomware is now certainly back in favor and is being used in an increasing number of attacks.

Something that several of the targets in the recent ransomware campaigns have in common is they are relatively small cities that have limited resources to devote to cybersecurity. They have hardware and software that has reached end of life and, due to limited funds, security gaps have started to appear.

Riviera Beach, for instance, is a city of 35,000 people with limited resources. It had recently undergone a period of turmoil in management, had suffered scandals, and during the upheaval its cybersecurity contract had been allowed to lapse. That left the door wide open to attack.

These attacks have proven incredibly costly, yet they could have been prevented with a very small spend on a select number of security solutions. The attacks on Rivera Beach and Lake City could have been prevented with an advanced email security solution such as SpamTitan. The ransomware was installed in both of these attacks as a result of employees opening malware-infected email attachments.

SpamTitan incorporates dual anti-virus engines to detect malicious software and a Bitdefender-powered sandbox for deep analysis of suspicious email attachments. SpamTitan incorporates DMARC email authentication to counter email impersonation attacks and a host of other anti-spam and anti-phishing controls.

SpamTitan can be deployed as a gateway solution on existing hardware or as a cloud-based solution, and can be easily layered on top of Office 365 to improve protection against phishing and ransomware attacks.

Further, the cost of protection against ransomware and phishing attacks is likely to be much lower than you think. For more information, contact TitanHQ today.


 

Monroe College Ransomware Attack: $2 Million Ransom Demand Issued

There has been a spate of ransomware attacks on cities and government agencies in recent months and the healthcare industry sees more than its fair share of attacks, but they are not the only industries being targeted.

Schools, colleges, and universities are prime targets for hackers and ransomware attacks are common. One recent attack stands out due to its scale and the massive ransom demand that was issued. The attackers demanded $2 million (170 BTC) for the keys to unlock the encryption.

Monroe College in New York City was attacked at 6:45am on Wednesday, July 10, 2019. The ransomware quickly spread throughout the network, shutting down the computer systems at its campuses in Manhattan, New Rochelle and St. Lucia and taking down the college website.

The college has switched to pen and paper and is finding workarounds to ensure students taking online courses receive their assignments. No mention has been made about whether files will be recovered from backups or if the ransom will need to be paid.

This is one of many recent ransomware attacks in the United States. Ransomware may have fallen out of favor with cybercriminals in 2018, but it now appears to be back in vogue and attacks are rising sharply. So too have the ransom demands.

$2 million is particularly high, but there have been several recent attacks involving ransom demands for hundreds of thousands of dollars. In several cases, the ransom has been paid.

Riviera Beach City in Florida was attacked and was forced to pay a $600,000 ransom to regain access to its files and bring its computer systems back online. Lake City in Florida also paid a sizeable ransom – $500,000. Jackson County was also attacked and paid a $400,000 ransom.

There have been several cases where ransoms have not been paid. The City of Atlanta was attacked and around $51,000 in Bitcoin was demanded. Atlanta refused to pay. Its cleanup bill has already reached $3 million. With such high costs it is clear to see why many choose to pay up.

In all of the above cases, the cost of implementing cybersecurity solutions to protect against the main attack vectors would have cost a tiny fraction of the cost of the ransom payment or the mitigation costs after an attack.

For less than $2 per employee, you can ensure that the email network is secured and you are well protected against web-based attacks. To find out more, call TitanHQ today.

New Spelevo Exploit Kit Pushes Banking Trojans via IE and Flash Exploits

Sodinokibi and Buran ransomware are being pushed via the RIG exploit kit and now another exploit kit has joined the ranks, although its payload is currently banking Trojans.

Exploit kits are utility programs on websites that conduct automated attacks on visitors. When a visitor lands on a page hosting the exploit kit, the user’s browser and browser-based applications are probed to determine whether vulnerabilities exist.

Exploit kits contain exploits for several vulnerabilities, only one of which is required to silently download and execute a malicious payload on a visitor’s device. Traffic to these malicious pages is generated through malvertising/malicious redirects. The exploit kit code is also commonly added to compromised high-traffic websites.

Exploit kits were once the malware delivery mechanism of choice, but they fell out following a law enforcement crackdown. The threat from exploit kits has never disappeared, but activity has been at a much-reduced level. In recent months however, exploit activity has been at an elevated level.

The new exploit kit is called Spelevo and its purpose is to deliver two banking Trojans – Dridex and IceD – via a business to business website. The exploit kit was discovered by a security researcher named Kafeine in March 2019.

The exploit kit currently hosts multiple exploits for Adobe Flash and one for Internet Explorer. A user visiting a web page hosting the Spelevo exploit kit would unlikely tell that anything untoward was occurring. A tab would be opened to the gate and the browser would appear to go through a series of redirects before landing on Google.com. The entire process from the user landing on a page hosting the exploit kit, to a vulnerably being identified, exploited, and the user redirected to Google.com takes just a few seconds.

The exploit kit could be hosted on an attacker-owned domain, but it is easy to add the exploit kit to any website. All that is required is the addition of four lines of code once a website has been compromised.

Exploit kits are an efficient, automated way of delivering a malware payload, but they are reliant on users that have not patched their browsers and plugins. If browsers and plugins are kept up to date, there are no vulnerabilities to exploit.

The Spelevo exploit kit appears to be used in a campaign targeting businesses. IT teams often struggle to keep on top of patching and have poor visibility into the devices that connect to the network. As a result, it is easy for devices to be missed and remain unpatched. If one device is compromised, an attacker can use a variety of tools to spread laterally and infect other devices and servers.

The primary defense against exploit kits is patching, but additional protections are required. To protect against attacks while patching takes place, to prevent attacks from succeeding using zero-day exploits, and to stop users from visiting websites hosting exploit kits, a web filter is required.

WebTitan is a DNS filter that provides real-time, automated threat detection and blocking and protects against exploit kits and web-based phishing attacks. The WebTitan database contains three million malicious URLs that are blocked to protect end users. More than 300,000 malware and ransomware websites are blocked every day.

If you want to improve protection against web-based threats, exercise control over the content that your employees can access, and gain visibility into what your employees are doing online, WebTitan Cloud is the answer and it can be set up in minutes.

For further information, contact TitanHQ today.

Sodinokibi Ransomware Poised to Become New GandCrab

As one ransomware-as-a-service operation shuts down, another is vying to take its place.  Sodinokibi ransomware attacks are increasing and affiliates are trying to carve out their own niche in the ransomware-as-a-service operation.

Developing ransomware and staying one step ahead of security researchers is important, but what made the GandCrab operation so successful were the affiliates conducting the campaigns that generated the ransom payments. The GandCrab developers have now shut down their operation and that has left many affiliates looking for an alternative ransomware variant to push.

Sodinokibi ransomware could well fill the gap. Like GandCrab, the developers are offering their creation under the ransomware-as-a-service model. They already have a network of affiliates conducting campaigns, and attacks are on the increase.

As is the case with most ransomware-as-a-service operations, spam email is one of the most common methods of ransomware delivery. One Sodinokibi ransomware campaign has been detected that uses spoofed Booking.com notifications to lure recipients into opening a Word document and enabling macros. Doing so triggers the download and execution of the Sodinokibi payload.

Download websites are also being targeted. Access is gained the websites and legitimate software installers are replaced with ransomware installers. Managed Service Providers (MSPs) have also been targeted. The MSP attacks have exploited vulnerabilities in RDP to gain access to MSP management consoles.

Two cases have been reported where an MSP was compromised and malicious software was pushed to its clients through the client management console. In one case, the Webroot Management Console and the Kaseya VSA console in the other.

Recently, another attack method has been detected. Sodinokibi ransomware is being distributed through the RIG exploit kit. Malvertising campaigns are directing traffic to domains hosting RIG, which is loaded with exploits for several vulnerabilities.

With so many affiliates pushing Sodinokibi ransomware and the wide range of tactics being used, no single cybersecurity solution will provide full protection against attacks. The key to preventing attacks is defense in depth.

TitanHQ can help SMBs and MSPs secure the email and web channels and block the main attack vectors. Along with security awareness training and good cybersecurity best practices, it is possible to mount a formidable defense against ransomware, malware, and phishing attacks.

Find out About Web and Email Security for MSPs at DattoCon2019

The excitement is building as DattoCon19 draws ever closer. Starting on June 17, 2019 in San Diego and running for three days, DattoCon19 is an unmissable event for managed service providers (MSPs).

At the conference, attendees benefit from practical advice and best practices to grow their businesses, increase sales, and boost monthly recurring revenue (MRR). A huge range of vendors will be on hand to offer information on exciting products and attendees will have the opportunity to learn strategies to increase business impact growth, boost profitability, and broaden their service stacks.

Sessions will be taken by industry experts and leading MSPs who will share tips and tricks to take back home and apply at the office. On average, attendees at DattoCon achieve 41% sales growth year-over-year as a result of attending the conference.

TitanHQ is sponsoring DattoCon19 and is excited about having the opportunity to meet new MSPs and help them grow their businesses. As a Datto Select Vendor, TitanHQ offers MSPs three cloud-based solutions that can be easily integrated into existing MSPs service stacks: Anti-phishing and anti-spam protection, DNS-based web filtering, and email archiving. All three solutions are available through the TitanShield program for MSPs.

MSPs can meet the TitanHQ team at booth 23 at DattoCon19 to find out more about the TitanShield program and the exciting opportunities for MSPs that work with TitanHQ. TitanHQ will be on hand to help MSPs that support Office 365 to improve protection against phishing attacks and malware. MSPs can also find out more about the TitanHQ threat intelligence that protects Datto DNA and D200 boxes, and how TitanHQ’s DNS filter is a direct swap out for Cisco Umbrella and the cost advantages of doing so.

TitanHQ Executive Vice President-Strategic Alliances, Rocco Donnino, is one of the panel members for the Datto Select Avendors event on Monday. The event brings together experts from different fields to help come up with solutions for some of the major problems faced by MSPs in today’s marketplace.

TitanHQ at DattoCon19

  • TitanHQ will be at booth 23
  • Special Show Pricing available
  • Daily TitanHQ vintage Irish whiskey raffle
  • TitanHQ and BVOIP are sponsoring a GasLamp District Takeover Party on Monday 6/17 and Wed, 6/19.

DattoCon19 will be taking place in San Diego, California on June 17-19, 2019. If you are not yet registered for the event you can do so here

Contact the TitanHQ team in advance:

  • Rocco Donnino, Executive Vice President-Strategic Alliances, LinkedIn
  • Eddie Monaghan, MSP Alliance Manager, LinkedIn
  • Marc Ludden, MSP Alliance Manager, LinkedIn


 

TitanHQ Claims Top Spot in 2019 G2 Best Software in EMEA List

The leading review website, G2, has published its 2019 Best Software Companies in EMEA list. This is the first time that the company has produced the list, which ranks the best software companies doing business in EMEA based on the feedback provided by users of those products.

G2 is one of the most well-respected business software review websites. Software solutions may appear to tick all the right boxes, but in practice the solutions can be time consuming and difficult to use and fail to live up to expectations. Since the G2 reviews are from registered users of the products, businesses can not only rely on the reviews but can also use them to make smarter buying decisions.

To compile the list, G2 compiled the reviews of over 66,000 users in the software category. More than 900 companies were represented, but only those that performed best in the reviews have made the cut in their respective categories.

TitanHQ has been awarded top spot in the list of the best software companies of 2019 in EMEA.

TitanHQ has developed powerful cybersecurity solutions to meet the needs of businesses and MSPs, but the solutions have also been developed to be easy to use. The solutions are versatile, flexible,and scalable, and can be managed via an intuitive web-based management console with a full reporting suite. A full range of APIs are supplied to allow the solutions to be integrated into existing management software and industry-leading customer support ensures that help is always available to resolve any customer issues.

“TitanHQ is delighted to have been included in the 2019 Best Software Companies in EMEA list. The inclusion shows the value our customers place on the uncompromised security and real-time threat detection we provide,” said Ronan Kavanagh, CEO, TitanHQ. “The overwhelmingly positive feedback from on G2 Crowd is indicative of our commitment to ensuring the highest levels of customer success.”

“With 750,000+ user reviews, 80,000+ products and 1,600+ tech and service categories on G2, TitanHQ’s recognition on the prestigious Best Software Companies in EMEA list is an exceptional achievement: One that can only be earned through the endorsement of its users,” said CEO Godard Abel.

MSPs Targeted as Hackers Realize Potential for Profit in Supply Chain Attacks

Supply chain attacks allow cybercriminals to attack businesses through weak links in the supply network. Smaller companies are attacked, which gives hackers access to larger and better secured businesses: Businesses that would be harder to attack directly.

This attack method was used to spread NotPetya malware in Ukraine. A software supply company was breached which allowed the malware to be spread to the software supplier’s clients. The massive data breach at Target in 2014 was made possible by first attacking an HVAC system provider. The attack allowed hackers to install malware on the Target’s POS system and obtain the credit card numbers of millions of its customers. According to Symantec, supply chain attacks doubled in 2018.

There are many different types of supply chain attacks, but all serve a similar purpose. By attacking one company it is then possible to attack a bigger fish, or in the case of attacks on cloud service providers and managed service providers, a single attack will give a hacker access to the networks of all MSP clients.

Large businesses often have the budgets to hire their own IT and security staff and can implement robust defenses to prevent attacks. Smaller businesses often struggle to recruit security professionals as they are in high demand. With the shortage of skilled cybersecurity staff and an inability to pay the large salaries that skilled cybersecurity professionals demand, SMBs often turn to MSPs to provide those services.

In order to be able to provide those services, managed service providers are given remote access to their client’s networks. Many of the tasks that need to be performed by MSPs require administrative privileges. Managed service providers also hold login credentials to their clients’ routers and cloud accounts. All of those credentials are extremely valuable to hackers.

Given the typical number of clients each MSP has, a successful attack on an MSP could prove very profitable for a hacker. It is therefore no surprise that there has been an increase in cyberattacks on MSPs and CSPs.

While MSPs are usually good at securing their clients’ networks and ensuring they are well protected, they also need to ensure their own house is in order. Patches must be applied promptly, vulnerabilities must be addressed, and security solutions must be put in place to protect MSPs systems.

MSP staff should be security aware, but when they are busy resolving their clients’ problems, mistakes can easily be made such as responding to a well-crafted spear phishing email. All it takes is for one MSP employee to respond to such an email for a hacker to gain a foothold in the network.

Naturally, security awareness training should be provided to all MSP employees and security solutions need to be deployed to protect against email and web-based attacks. This is an area where TitanHQ can help.

TitanHQ Cybersecurity Solutions for MSPs

TitanHQ’s offers a suite of cybersecurity solutions for managed service providers that have been developed from the ground up with MSPs in mind. TitanHQ has an in depth understanding of what MSPs need, having been working closely with them for more than two decades. TitanHQ solutions provide everything MSPs could reasonably ask for to meet the demands of their clients.

Our multi-tenanted solutions are full of features to help MSPs save time and money. The solutions work on any operating system, client accounts can be up and running within 20 minutes, and fully automated updates minimize the management overhead while ensuring maximum protection from threats. Furthermore, all TitanHQ solutions are available in white label format ready to receive an MSPs logos and there is a choice of hosting options, including the option of hosting the solution within an MSPs own infrastructure.

SpamTitan is an easy to implement and easy to manage cloud-based spam filtering solution that provides excellent protection against the full range of email threats. Email attachments are scanned using dual antivirus engines that block 100% of known malware threats. Suspicious attachments that pass the AV scans are sent to a Bitdefender-powered sandbox where they are subjected to an in-depth, sophisticated analysis to identify previously unknown malware threats and malicious scripts. SpamTitan also uses a defense-in-depth approach to protect against phishing threats, including machine learning predictive techniques to identify zero-day phishing threats. SpamTitan scans inbound and outbound emails and includes a data loss prevention feature to prevent attempts to use email accounts to send sensitive data outside the organization.

TitanHQ has developed WebTitan to provide protection against web-based threats. WebTitan is a DNS-based web filtering solution that prevents employees and guest network users from visiting malicious websites used for phishing and malware distribution. Stopping malicious requests at the DNS layer, which is better than waiting for the payload to be delivered onto the machine and then removed. By stopping it at the DNS layer you’re reducing not only malware infections, but containing machines already infected by preventing them from communicating out to their C&C servers. SpamTitan and WebTitan are fed threat intelligence in real time from an active database of 650 million users, which provides zero-minute protection against cyber threats.

Benefits of TitanHQ Cybersecurity Solutions for MSPs

  • Easy client account administration via a central control panel
  • One control panel to manage all clients
  • Intuitive controls with low management overhead
  • Eliminates the need for site visits, with no local support required
  • No end user software installations needed
  • Incorporate new clients in minutes
  • Competitive usage-based pricing with monthly billing
  • Three hosting options: Our servers, a private cloud, or within an MSP’s infrastructure
  • Generous margins for MSPs
  • Industry-leading technical support and customer service
  • Solutions available in a white label version ready to take MSP logos

If you want to improve your defenses against cyber threats and better protect your clients, contact TitanHQ today for further information about SpamTitan Email Security and WebTitan Web Security.

The TitanHQ MSP Program – TitanSHIELD

The TitanSHIELD MSP Program allows MSPs to take advantage of TitanHQ’s proven technology so that they can sell, implement and deliver our advanced network security solutions directly to their client base. Benefits include partner support, a dedicated account manager, assigned sales engineer support, access to the Global Partner Program Hotline, access to the Partner Knowledge Base, 24/7 priority technical support, online technical training and FAQs, access to the Partner Technical Knowledge Base, and full access to an extensive range of marketing materials and sales tools.

Contact the MSP team at TitanHQ today for more information and to apply to join more than 1,500 MSP members of the TitanSHIELD program.

Webinar: New SpamTitan DMARC and Sandboxing Features Explained

Traditional email security solutions are effective at keeping inboxes free from spam email, but many fall short when it comes to blocking phishing and spear phishing attacks. Cybercriminals are conducting ever more sophisticated campaigns that manage to bypass traditional email security defenses by impersonating legitimate companies and spoofing their domains.

In addition to phishing attacks that attempt to obtain sensitive information, email is often used to spread malware, ransomware and botnets. Traditional anti-virus solutions are effective at blocking known malware threats, but signature-based AV solutions are not effective at blocking never-before-seen malware variants.

Today, new malware variants are being released at record pace. To block these zero-day malware attacks, an advanced email security solution is required which does not rely on signatures to identify malicious file attachments.

SpamTitan was already a powerful email security solution for SMBs and MSPs serving the SMB market and was capable of blocking sophisticated phishing emails and new malware threats. However, new features have now been added that improve detection rates further still and provide superior protection against zero-day malware and phishing attacks that spoof legitimate domains.

TitanHQ has updated SpamTitan to include a DMARC email authentication feature which is capable of detecting and blocking spoofed emails to better protect users from sophisticated phishing attacks.

To better protect against malware, ransomware, botnets, and zero-day attacks, TitanHQ has incorporated a new Bitdefender-powered sandboxing feature into SpamTitan. Email attachments that pass standard checks are safely detonated in the sandbox and are analyzed for malicious activity. The sandboxing feature provides an additional layer of security and greatly enhances protection against malicious attachments. This feature also helps to ensure that more legitimate emails and attachments are delivered to end users.

To explain how these new features work and the benefits to users, TitanHQ is running a webinar. In the webinar, TitanHQ will cover the new features in detail and will explain how SpamTitan can protect against the full range of email-based threats.

Webinar Information:

 Date:     Thursday, April 4, 2019

Time:    12pm, EST

The webinar will last 30 minutes and advance registration is necessary.

You register for the webinar here

Cybersecurity Protections for SMBs Found to Be Lacking

A new report has confirmed the need for robust, multi-layered cybersecurity protections for SMBs to prevent successful cyberattacks. SMBs are increasingly being targeted by cybercriminals as security is often weak and attacks are easy to pull off.

While large corporations are an attractive target for cybercriminals, large corporations tend to have mature cybersecurity programs and they are usually very well protected. A successful attack could prove extremely profitable but breaking through the cybersecurity defenses of large corporations is difficult and attacks can be extremely time consuming and labor intensive.

Cybercriminals often choose the path of least resistance, even though the potential for profit may not be so high. Cyberattacks on SMBs are much easier and hackers are concentrating their efforts on SMB targets. This was clearly demonstrated in the latest cybersecurity report from Beazley Breach Response (BBR) Services.

BBR Services analyzed all of the data breaches that it investigated in 2018. 9% of the successful attacks involved ransomware and 71% of those ransomware attacks were on SMBs. The healthcare industry suffered the highest number of ransomware attacks, and accounted for one third of successful attacks. Companies in the professional and financial services sectors accounted for 12% of ransomware attacks each, followed by the retail industry with 8% of attacks.

The costs of those ransomware attacks can be considerable. If companies are unable to recover data from backups, a sizable ransom must be paid to recover encrypted data. In 2018, the average ransom demand was $116,400 and the median ransom demand was $10,310. One client was issued a ransom demand of $8.5 million. The highest ransom demand paid was $935,000.

Massive demands for payment for the keys to unlock encrypted files may not be the norm, but even at the lower end of the spectrum SMBs may struggle to find the money to pay. The ransom demand is also likely to be considerably higher than the cost of cybersecurity protections for SMBs to prevent ransomware attacks.

One of the main ways that hackers gain access to the networks of SMBs is by exploiting flaws in Remote Desktop Protocol. SMBs that leave RDP ports open are at a much higher risk of being attacked. RDP is required by many SMBs because they outsource IT to managed service providers, which need to use RDP to access their systems. In such cases it is essential for default RDP ports to be changed and for very strong passwords to be implemented to reduce the risk of brute force attacks succeeding.

There was also an increase in sextortion scams in 2018. These scams attempt to extort money by threatening to expose victims’ use of adult websites. While these scams usually contain empty threats, they are often successful. In addition to attempting to extort money, the scams are used to install malware or ransomware.  Email attachments are sent which claim to contain videos of the victim accessing adult websites, which the scammers claim to have been recorded using the computer’s webcam. When the files are opened to be checked, malware or ransomware is installed.

2018 also saw a 133% increase in Business Email Compromise attacks. These attacks spoof the email address of a senior executive to make the emails and requests seem more plausible. These scams are usually conducted to obtain sensitive information or to get employees to make fraudulent wire transfers. BEC attacks accounted for 24% of all breaches investigated by BBR Services in 2018.

One of the most important cybersecurity protections for SMBs to implement to prevent these attacks is an advanced email filtering solution – One that is capable of detecting spoofed emails. SpamTitan, TitanHQ’s cloud-based spam filtering solution, has recently been updated to include DMARC authentication to detect email impersonation attacks such as BEC scams. The solution also now includes a new sandboxing feature that allows potentially malicious attachments to be analyzed in detail in the sandbox where no harm can be caused. This helps to identify more malicious attachments and better protect SMBs from zero-day malware and other malicious files.

TitanHQ’s powerful cybersecurity protections for SMBs can greatly improve email security and block a wide range of web-based attacks. For further information on effective cybersecurity protections for SMBs to deploy to improve security posture and block costly attacks, contact TitanHQ today.

SpamTitan Email Security Now Includes Sandboxing and DMARC Authentication

TitanHQ has announced its award-winning anti-spam solution, SpamTitan, has been updated and now has two powerful new features to better protect users from phishing, spear phishing, malware, ransomware, botnets, and APT threats.

SpamTitan has long been the go-to solution for SMBs to improve email security and the solution is popular with managed service providers serving the SMB market. SpamTitan is quick and easy to install, simple to use, and provides excellent protection against a wide range of email threats.

As email threats have become more sophisticated and zero-day attacks and new malware variants have skyrocketed, new features are needed to keep end users protected.

To maintain pace and better protect SpamTitan users, two important new features have now been rolled out with the latest release of SpamTitan: Sandboxing and DMARC authentication.

Sandboxing Feature Added to SpamTitan Product Suite

Blocking known threats is one thing, but detecting and blocking brand new threats that evade AV solutions is another matter, yet businesses need protection from these zero-day threats as well. SpamTitan already incorporates a range of mechanisms to detect these new threats but the latest feature takes protection to the next level.

SpamTitan now incorporates a new next-gen sandboxing feature. The Bitfedender-powered sandbox is a virtual environment that is totally separate from other systems. When an email is sent to a SpamTitan user, the message will be subjected to a range of checks to determine whether it is genuine, benign, and should be delivered or if it is malicious and needs to be rejected. If the message contains a suspicious attachment that is not picked up as a threat from those checks, it is sent to the sandbox.

The SpamTitan sandbox service has been designed to appear as a normal endpoint. Malicious files are opened or executed in the sandbox and any malicious code is run as it would on a standard machine. Its actions are logged and subjected to an in-depth analysis, including its self-protection mechanisms and attempts to evade detection. All actions are then assessed by advanced machine learning algorithms and the results of the analysis are then checked against a wide range of online repositories.

Opening potentially malicious files on an endpoint is dangerous, but in the isolated sandbox all risks are eliminated. Once the analysis is complete, which takes just a few minutes, if the file is determined to be benign it will be released and can be delivered to the end user. If it is malicious, the sandbox solution will automatically report the file to Bitdefender’s cloud threat intelligence service. That threat will then be blocked for all SpamTitan users, so the file will not need to be analyzed again.

This new feature greatly increases detection of elusive threats, provides end users with even greater protection, and it also helps to ensure that more genuine messages are delivered.

Businesses that want sandboxing technology usually need to purchase a separate solution. With SpamTitan, advanced emulation-based malware analysis is provided free of charge.

DMARC Email Authentication Now Included in SpamTitan

Email impersonation attacks are a major threat. They abuse trust in a known contact, company, or government organization to fool end users into taking a specific action – disclosing sensitive information, installing malware, or visiting a phishing webpage, for instance.

While SpamTitan already incorporates several mechanisms to identify email impersonation attacks, DMARC authentication has now been added to block even more threats. DMARC is a powerful tool for identifying the true sender of an email to determine if that individual is authorized to use a particular domain.

Detailed checks of the email header are performed and the sender is checked against DMARC records. If the checks are passed, the message can be delivered. If DMARC authentication fails, the message is rejected.

The new anti-spoofing feature protects SMBs and MSPs against data loss, date breaches, zero-day threats, and highly sophisticated email threats, while the sandboxing feature protects against malware, advanced persistent threats (APTs), malicious URLs, and offers insight into new threats to help mitigate risks.

Both of these features have been made available to current and new TitanHQ customers at no extra charge.

Risk of Phishing Attacks and Malware Downloads from Visiting Adult Websites

The threat of malware downloads from visiting adult websites has long been thought to be a major risk; however, not all studies on the subject have demonstrated that the risk is any higher than visiting other types of websites. The owners of adult websites, as legitimate business owners, have a vested interest in keeping their sites malware free.

However, new research from Kaspersky suggests the threat of malware downloads from visiting adult websites is real, and adult-themed phishing attacks increased in 2018.

Is There a High Risk of Malware Downloads from Visiting Adult Websites?

According to its latest report, there is a real risk of malware downloads from visiting adult websites. Naturally for consumers who visits adult websites, the risk is theirs to take. For businesses however, risks taken by employees can prove incredibly costly.

One of the major stories to be covered in the media on this theme in 2018 involved a government employee with a prolific thirst for such content. He was discovered to have accessed more than 9,000 adult websites and had inadvertently downloaded malware onto his work computer and the network. After visiting so many sites, that is perhaps understandable, but there have been many such malware downloads from far less prolific surfing of adult sites.

Kaspersky Lab’s research indicates that most malware downloads from malicious websites involves malware disguised as videos. Oftentimes, users are required to download a supposedly benign but malicious file in order to access the video.

Cybercriminals are also using black-hat techniques to poison the search results and get malicious sites appearing high up in the listings. The top 20% of porn-related search terms accounted for 80% of malware disguised as porn. Kaspersky’s tracking indicated 87,227 users had downloaded malware-disguised as porn and 8% of those did so via their work network.

The use of these porn tags is also common to get users to download non-malware threats such as adware and downloaders, although the latter are often capable of downloading much more malicious files.  While the number of these attacks decreased by 36% year-over-year, attacking people searching for adult content is still common.

The most common threats associated with adult content were Trojan downloaders (45%) and Trojans (20%), followed by adware (9%) and worms (8%).

Adult-Themed Phishing Attacks Increased by 1,000% in Q4, 2018

While it was previously uncommon for phishing scams to use porn as a lure, that changed in 2018. It is still common for cybercriminals to use impersonate or create fake hookup sites to lure people into divulging credentials but there was also a 1,000% increase in phishing attacks using websites that masquerade as porn websites. Most commonly these were spoofed versions of the top 10 adult sites on the web. The rise in these types of phishing scams could be indicative of a trend that will grow in 2019.

The research shows that malware downloads from visiting adult websites is still a risk and the threat from adult-themed phishing attacks has grown at an alarming rate. Businesses should take note and take steps to limit risk.

The easiest way to do that is with a DNS web filter – A solution that allows businesses to carefully control the web content that can be accessed on work devices and via their wireless networks. With a DNS web filtering solution in place, businesses can block access to adult websites, commonly spoofed hookup and dating sites, and web-based phishing threats.

Not only will a DNS web filter provide protection against phishing, ransomware, and malware downloads, by blocking access to these adult sites, legal liability can be reduced and staff issues can be avoided.

If you have yet to start filtering the internet and preventing your users from accessing adult websites, other NSFW web content, and sites that are a drain on productivity, TitanHQ can help.

For a very low cost, businesses can protect all users of their wired and wireless networks and block a wide range of web-based threats. MSPs can also start providing filtered internet service to better protect their clients.

For further information, contact TitanHQ today and ask about WebTitan Cloud and WebTitan Cloud for WiFi – TitanHQ’s award winning web filtering solution for businesses.

Innovative Phishing Campaign Uses Google Translate to Serve Phishing Web Pages

A phishing campaign has been detected that uses Google Translate to make phishing web pages appear legitimate when visited through mobile browsers. The novel tactic makes it harder for end users to see that the website they have been directed to is not an official website.

The phishing attack starts with an email that indicates the user’s password has been used to access their Google account from an unfamiliar device. Many users will be familiar with these messages. They are generated when a user logs into their own account using a different device or from an unfamiliar location. The messages are also triggered when a user attempts to login to their account using a VPN that has previously not been used to access the account.

In this campaign, the standard Google Security Alert has been copied exactly and includes the Google logo, standard formatting, and text that users will be familiar with. The message tells the user to click on a link – A button below the warning message – to visit their account to review the activity and take action to secure their account.

If the user is on a desktop or laptop, they will be directed to a standard phishing page which has a copy of the Google login window. It should be apparent that the user is not on the legitimate Google site as the URL clearly nothing to do with Google although end users do not always check the URLs carefully, especially when there is an urgent reason for visiting a website such as a security alert.

If the user has opened the email on a mobile device and clicks the hyperlink button, the URL displayed in the browser will be different and they are much ore likely to be fooled. The phishing webpage uses Google Translate to display a URL containing a random string of characters, but crucially, the visible part of the URL displayed in the browser starts with translate.googleusercontent.com/translate_

The URL does contain the web page which the user is on, which is a page on mediacity.co.in that clearly has nothing to do with Google, but it is detailed much later in the URL so will not be displayed to the user unless they click the address bar to check the web page. Many users will not do that since the visible part of the URL appears to be a genuine Google page.

The Google login portal that is served is an old version, but it is likely to fool many users. If Google credentials are entered in the login box, JavaScript on the web page generates an email containing the user’s login credentials and sends them to the scammer.  The user is then redirected to a further phishing web page where their Facebook login credentials are requested. This login box is a clone of the login box used by Facebook on the mobile login portal and is similarly an old version. If login credentials are entered, they are sent to the scammer via email as well. The user is then directed to a Facebook page set up by the attacker.

While the phishing campaign is unlikely to work on desktops or laptops, many mobile users will likely be fooled by the scam and will provide their Google credentials. They may not fall for the Facebook login request, as being redirected to Facebook from Google is odd, but by that time the attacker will have full access to the user’s Google account. Google accounts can contain a wealth of sensitive data and can be used for further phishing attacks on the user’s contacts.

Security awareness training will help to prevent employees from falling for phishing scams such as this. By conditioning employees to always check the sender of a message before taking any action, and to always take the time to carefully check the full URL of a website before disclosing any sensitive information, scams like this can be easily identified. Even with security awareness training, employees make mistakes. To improve protection against phishing attacks, businesses should deploy an advanced spam filter to prevent malicious messages from being delivered to corporate inboxes. A web filter is also strongly recommended. A cloud-based web filter can prevent users from accessing phishing web pages, even when they are not onsite and are using mobile devices remotely.

For further information on spam filtering and web filtering for businesses, contact the TitanHQ team today and ask about SpamTitan and WebTitan: TitanHQ’s leading spam filtering and web filtering solutions for businesses.

Anatova Ransomware: A Serious New Malware Threat for 2019

Anatova ransomware is a new cryptoransomware variant that appears to have been released on January 1, 2019. It is stealthy, can infect network shares, has already been used in attacks in many countries around the world. It could well prove to become a major ransomware threat in 2019.

Ransomware has somewhat fallen out of favor with cybercriminals as cryptocurrency mining malware offers greater potential for profit. The development of new ransomware variants has slowed, but new variants are still emerging and the threat from ransomware is not going away any time soon. Ransomware attacks are still profitable for cybercriminals and as long as that remains the case the attacks will continue.

Anatova ransomware was identified and named by security researchers at McAfee. The name was taken from the name on the ransomware note. The previously unknown ransomware variant has been used in at least 10 countries, with over 100 Anatova ransomware attacks identified in the United States, more than 65 in Belgium, and over 40 in France and Germany.

Not only does the ransomware variant employ a range of techniques to avoid detection, infection can cause major damage and widespread file encryption. Further, the modular design allows the developers to easily add new functionality in the future.

Most of the strings in Anatova ransomware have been encrypted and different keys are required to decrypt them. Those keys have been embedded in the executable. 90% of calls are dynamic and use non-suspicious Windows APIs and standard C-programming language.

Once downloaded and executed, the ransomware performs a check of the name of the logged in user against a list of encrypted names and will exit if there is a match. Names that prompt an exit include tester, lab, malware, and analyst. These names are commonly used on virtual machines and sandboxes. A check will also be performed to determine the country in which the device is located. The ransomware will exit if the device is in any CIS country, Egypt, Syria, Morocco, Iraq, or India.

Anatova ransomware scans for files smaller than 1MB and checks for network shares, although care is taken not to disrupt the operating system during this process and raise a flag before files are encrypted. Once files have been identified, the encryption routine starts. The ransomware uses its own key, so each victim requires a separate key to unlock the encryption.

Once the encryption process has run, the ransom note is dropped on the desktop, the memory is cleaned, and volume shadow copies are overwritten 10 times to ensure files cannot be recovered from local backup files.

The ransom demand is relatively high – Around $700 (10 DASH) per infected machine. Since multiple devices can be infected with a single installation, the total ransom demand could well be considerable.

What is not 100% certain is how the ransomware is being distributed. McAfee detected one sample on a P2P file sharing network which masquerades as a free software program complete with game/application icon to encourage users to download and run the installer. Other attack vectors may also be used. Based on the current distribution vector, a web filter will offer protection against attacks if P2P file sharing/torrents sites are blocked.

The researchers believe Anatova ransomware has been created by highly skilled malware authors who are currently distributing a prototype of the ransomware. More widespread attacks are to be expected once this testing phase has been completed.

Mongolock Ransomware Deletes Files and Demands Ransom

A new form of MongoLock ransomware is actively being used in a global campaign. A 0.1 BTC ransom is demanded, although file recovery may not be possible. The ransomware immediately deletes files and formats backup drives and a recoverable copy may not be retained by the attackers.

MongoLock ransomware was first detected in January 2017. A major campaign involving the ransomware was detected in September 2018 with the latest attacks having been ongoing since December 2018. The attackers are gaining access to unprotected or poorly protected MongoDB databases and are deleting data and replacing the databases with a new database. Inside the database is a file called readme that contains the ransom demand.

The attackers claim to have exported the database before encrypting it. Victims are required to make a 0.1 BTC payment to a supplied Bitcoin wallet or contact the attackers via email.  Many victims have chosen to pay the ransom; however, there is no guarantee that data can be recovered. It is unclear whether the attackers are making a copy of the database or are simply deleting it.

The attacks are automated and scripts are used to delete the database and create the ransomware note, but the scripts are not always effective. Even if it is the intention of the attackers to obtain a copy of the database, that may not always happen.

The latest version of MongoLock ransomware also conducts a scan of local drives and deletes important data, including files saved to the Desktop, My Documents folder, Recent files, favorites, and any backup files that can be located. The drives are then formatted. This makes payment of the ransom all the more likely. Users are advised they have just 24 hours to make payment before the database is permanently deleted.

The file deletion routine is executed after the files have been uploaded to the attackers’ C2 server, so they can potentially be recovered if the ransom payment is made. However, if the computer is taken offline, file deletion continues but no copy of the file will be obtained by the attackers.

These attacks are primarily conducted on exposed MongoDB databases, which can easily be found using the Shodan search engine. Any businesses that uses MongoDB should ensure that the databases are properly secured, and that authentication is required to gain access. It is also important to ensure the databases cannot be accessed remotely over the Internet.

It is also essential to adopt a good backup strategy. The 3.2.1 approach is recommended. Make three backups, stored on two separate devices, with one copy stored securely off site on a non-networked device.

Malvertising Campaign Delivers New Vidar Information Stealer and GandCrab Ransomware

A malvertising campaign has been detected that delivers two forms of malware: The new, previously unknown Vidar information stealer and subsequently, the latest version of GandCrab ransomware.

The packaging of multiple malware variants is nothing new of course, but it has become increasingly common for ransomware to be paired with information stealers. RAA ransomware has been paired with the Pony stealer, njRAT and Lime ransomware were used together, and Reveton ransomware is used in conjunction with password stealers.

These double-whammy attacks help threat actors increase profits. Not everyone pays a ransom, so infecting them with an information stealer can make all infections profitable. In many cases, information can be obtained and sold on or misused and a ransom payment can also be obtained.

The latest campaign uses the Vidar information stealer to steal sensitive information from a victim’s device. The Vidar information stealer is used to obtain system information, documents, browser histories, cookies, and coins from cryptocurrency wallets. Vidar can also obtain data from 2FA software, intercept text messages, take screenshots, and steal passwords and credit/debit card information stored in browsers. The information is then packaged into a zip file and sent back to the attackers’ C2 server.

The Vidar information stealer is customizable and allows threat actors to specify the types of data they are interested in. It can be purchased on darknet sites for around $700 and is supplied with an easy to use interface that allows the attacker to keep track of victims, identify those of most interest, find out the types of data extracted, and send further commands.

Vidar also acts as a malware dropper and has been used to deliver GandCrab ransomware v5.04 – The latest version of the ransomware for which no free decryptor exists.

While many ransomware variants are delivered via spam email or are installed after access to systems is gained using brute force tactics on RDP, this campaign delivers the malicious payload through malvertising that directs traffic to a websites hosting the Fallout or GrandSoft exploit kits. Those EKs exploits unpatched vulnerabilities in Internet Explorer and Flash Player. The campaign targets users of P2P file sharing sites and streaming sites that attract large amounts of traffic.

Infection with the Vidar information stealer may go undetected. New malware variants such as this may be installed before AV software malware signatures are updated, by which time highly sensitive information may have been stolen, sold on, and misused. If GandCrab ransomware executes, files will be permanently encrypted unless a ransom is paid or files can be recovered from backups.

Businesses can protect against attacks such as these by ensuring that all operating systems and software are promptly patched. Drive-by downloads will not occur if the exploits for vulnerabilities used by the exploit kit are not present.

An additional, important protection is a web filter. Web filters prevent users from visiting websites known to host exploit kits and also sites that commonly host malicious adverts – torrents sites for instance. By carefully controlling the sites that employees can access, businesses can add an extra layer of protection while avoiding legal liability from illegal file downloads and improving productivity by blocking access to non-work-related websites.

For further information on web filters for businesses and MSPs, contact the TitanHQ team today.
 

Department of Homeland Security Issues Warning Over Targeted MSP Cyberattacks

The U.S. government has issued a warning following a spate of MSP cyberattacks by nation-state sponsored hackers.

Homeland Security Warns of Targeted MSP Cyberattacks

Managed service providers (MSPs), cloud service providers (CSPs), and managed security service providers (MSSPs) have been warned about an increase in malicious cyber activity and targeted attacks on IT service providers. Nation-state sponsored hackers are targeting IT service providers in an attempt to gain access to their networks, and ultimately, those of their clients.

It is not difficult to see why MSPs, CSPs, and MSSPs are such an attractive target. These IT service providers usually have administrator access to their clients’ networks or certainly elevated privileges that could allow an attacker to gain access to servers, security appliances, and databases of multiple clients.

The threat of attack is theoretical. There has been an increase in MSP cyberattacks in recent months, so much so that the U.S. Department of Homeland Security (DHS) has issued a warning to all IT service providers specifically due to an increase in attacks on IT service providers by Chinese government-backed hackers.

The DHS Cybersecurity and Infrastructure Security Agency (CISA) has issued cybersecurity guidance for IT service providers on steps that need to be taken to improve security, detect attacks quickly, and prevent threat actors from gaining access to their clients’ networks. Since companies that use IT service providers have also been warned of the risk of attack through their IT companies, MSPs, MSSPs and CSPs are likely to be contacted by clients wanting reassurances.

IT service providers should therefore be proactive and n ensure that CISA guidance is being followed to better protect themselves and their clients.

Feds Launch Campaign to Raise Awareness of Cyber Risks

CISA is not the only government agency to issue a warning in the past few days. The Trump administration has launched a new campaign to raise awareness of cyber risks in all industry sectors. The “Know the Risk, Raise your Shield campaign is being spearheaded by the National Counterintelligence and Security Center (NCSC) at the Office of the Director of National Intelligence. The campaign has been launched in response to increased cyberattacks from state sponsored hackers in Russia, China, Iran, and North Korea and independent hackers.

The aim of the campaign is to ensure that cybersecurity best practices are being followed to make it much harder for the attackers to succeed. The NCSC is aware that improved cybersecurity comes at a cost, but explains that investment in cybersecurity defenses is money very well spent and reminds businesses that an ounce of security equates to a pound of protection.

How Can Businesses and MSPs Improve Their Defenses?

With MSP cyberattacks on the increase it is essential that defenses are improved. While there are many ways that MSPs and businesses can be attacked, one of easiest ways is phishing. Phishing targets a weak link in security defenses: Employees. If a phishing email is delivered to an inbox and an employee responds, credentials will be obtained by the attacker that gives them a foothold to launch further attacks on other employees and MSP clients.

It is therefore important to improve awareness of the risks and train employees how to recognize email threats and how to react. It is also important to ensure that technical spam defenses are implemented to make sure phishing threats are blocked on the server and are not delivered to end users’ inboxes or local spam folders. SpamTitan is an ideal solution for MSPs to implement to block these phishing attacks on their employees and their clients.

SpamTitan is an easy to implement and easy to manage spam filtering solution that provides excellent protection against the full range of email threats. Email attachments are scanned using dual antivirus engines ensuring 100% of known malware threats are blocked. Suspicious attachments that pass the AV scans are sent to a Bitdefender-powered sandbox where they are subjected to an in-depth, sophisticated analysis to identify previously unknown malware threats and malicious scripts. The solution is automatically updated and is fed real-time threat intelligence gathered from an active database of 650 million users. SpamTitan also uses a defense-in-depth approach to protect against phishing threats, including machine learning predictive techniques to identify zero-day phishing threats. SpamTitan scans inbound and outbound emails and includes a data loss prevention feature to prevent attempts to use email accounts to send sensitive data outside the organization.

A web filter should also be implemented to prevent end users from visiting malicious websites where malware is downloaded and to block the web-based component of phishing attacks. A DNS-based web filter blocks attempts to access malicious sites during the DNS lookup process, with zero latency. TitanHQ has developed WebTitan to provide protection against web-based threats. WebTitan stops malicious requests at the DNS layer, which is better than waiting for the payload to be delivered onto the machine and then removed. By stopping it at the DNS layer you’re reducing not only malware infections, but containing machines already infected by preventing them from communicating out to their C&C servers.

Benefits of TitanHQ Cybersecurity Solutions for MSPs

  • Easy client account administration via a central control panel
  • One control panel to manage all clients
  • Intuitive controls with low management overhead
  • Eliminates the need for site visits, with no local support required
  • No end user software installations needed
  • Incorporate new clients in minutes
  • Competitive usage-based pricing with monthly billing
  • Three hosting options: Our servers, a private cloud, or within an MSP’s infrastructure
  • Generous margins for MSPs
  • Industry-leading technical support and customer service
  • Solutions available in a white label version ready to take MSP logos

For further information on spam filtering and web filtering for businesses and MSPs, speak to the TitanHQ team today.

Other important steps to take to improve security include:

  • Use of strong password policies
  • Applying the principle of least privilege
  • Ensuring network and host-based monitoring systems are implemented and logs are regularly checked for signs of malicious activity
  • Performing regular vulnerability scans to identify security weaknesses before they are exploited.

2018 Has Seen a 4,000% Increase in Cryptocurrency Mining Malware

New figures released by anti-virus firms McAfee and Symantec have shown the extent to which hackers are using cryptocurrency mining malware in attacks on consumers and businesses.

Cryptocurrency mining malware hijacks system resources and uses the processing power of infected computers to mine cryptocurrencies – Validating transactions so they can be added to the blockchain public ledger. This is achieved by solving difficult computational problems. The first person to solve the problem is rewarded with a small payment.

For cryptocurrency mining to be profitable, a lot of processing power is required. Using one computer for mining cryptocurrency will generate a few cents to a few dollars a day; however, hackers who infect thousands of computers and use them for cryptocurrency mining can generate significant profits for little work.

The use of cryptocurrency mining malware has increased considerably since Q4, 2017 when the value of Bitcoin and other cryptocurrencies started to soar. The popularity of cryptocurrency mining malware has continued to grow steadily in 2018. Figures from McAfee suggest cryptocurrency mining malware has grown by 4,000% in 2018.

McAfee identified 500,000 new coin mining malware in the final quarter of 2017. In the final quarter of 2018, the figure had increased to 4 million. Figures from Symantec similarly show the scale of the problem. In July 2018, Symantec blocked 5 million cryptojacking events. In December, the firm blocked 8 million.

There are many different ways of infecting end users. Hackers are exploiting unpatched vulnerabilities to silently download the malware. They package coin mining malware with legitimate software, such as the open-source media player Kodi, and upload the software to unofficial repositories.

One of the easiest and most common ways of installing the malware is through email. Spam emails are sent containing a hyperlink which directs users to a website where the malware is silently downloaded. Links are similarly distributed through messaging platforms such as Slack, Discord, and Telegram. One campaign using these messaging platforms included links to a site that offered software that claimed to fix coin mining malware infections. Running the fake software installer executed code on the computer which silently downloaded the malware payload.

Unlike ransomware, which causes immediate disruption, the presence of cryptocurrency mining malware may not be noticed for some time. Computers infected with coin mining malware will slow down considerably. There will be increased energy usage, batteries on portable devices will be quickly drained, and some devices may overheat. Permanent damage to computers is a possibility.

The slowdown of computers can have a major impact for businesses and can result in a significant drop in productivity if large numbers of devices are infected. Businesses that have transitioned to cloud computing that are charged for CPU usage can see their cloud bills soar.

Anti-virus software can detect known coin mining malware, but new malware variants will be unlikely to be detected. With so many new malware variants now being released, AV software alone will not be effective. It is therefore important to block the malware at source. Spam filters, such as SpamTitan, will help to prevent malicious emails from reaching end users’ inboxes. Web filters, such as WebTitan, prevent users from accessing infected websites, unofficial software repositories, and websites with coin-mining code installed that uses CPU power through browser sessions.

 

Worst Passwords of 2018 and Password Best Practices Revealed

It’s the time of year when the poor password practices of users are highlighted. This month has seen the list of the worst passwords of 2018 published and a list of 2018’s worst password offenders.

The Worst Passwords of 2018

So, what were the worst passwords of 2018? SplashData has recently published a list of the worst passwords of 2018 which shows little has changed since last year. End users are still making very poor password choices.

To compile the list, SplashData analyzed passwords that had been revealed through data dumps of passwords obtained in data breaches. More than 5 million exposed passwords were sorted to find out not only the weakest passwords used, but just how common they were. The list of the top 100 worst passwords of 2018 was published, although we have only listed the top 25 worst passwords of 2018:

Top 25 Worst Passwords of 2018

1) 123456
2) password
3) 123456789
4) 12345678
5) 12345
6) 111111
7) 1234567
8) sunshine
9) qwerty
10) iloveyou
11) princess
12) admin
13) welcome
14) 666666
15) abc123
16) football
17) 123123
18) monkey
19) 654321
20) !@#$%^&*
21) charlie
22) aa123456
23) donald
24) password1
25) qwerty123

Unsurprisingly, there has been no change in the top two passwords this year. 123456 and password have held number 1 and 2 spots for the past five years. Donald is a new addition but would not keep a user’s account secure for long, even if their name isn’t Donald. 654321 is also new this year but offers little more protection than 123456.

Other new entries include qwerty123 and password1 – Clear attempts to get around the requirement of including numbers and letters in a password.

How common are the worst passwords of 2018? According to SplashData, 3% of users have used 123456 and 10% of people have used at least one password in the list of the top 25 worst passwords of 2018!

Poor Password Practices and the Worst Password Offenders of 2018

DashLane has published its list of the worst password offenders of the year. In addition to the list containing users who have made very poor password choices by selecting some of the worst passwords of 2018, the report highlights some of the terrible password practices that many individuals are guilty of. Poor password practices that render their passwords absolutely useless.

This year has seen many major password failures, several of which came from the White House, where security is critical. Topping the list was a password faux pas by a visitor to the oval office – Kanye West. Not only was ‘Ye’ guilty of using one of the worst possible passwords on his phone ‘000000’, he also unlocked his phone in full view of an office full of reporters who were filming his meeting with President Trump. Ye’s poor password was broadcast to the nation (and around the world). This incident highlights the issue of ‘shoulder surfing.’ Looking over someone’s shoulder at their screen to see passwords being entered. Something that can easily happen in public places.

Another White House password failure concerned a staffer who committed the cardinal password sin of writing down a username and password to make it easier to remember. It is something that many employees do, but most do not write it on White House stationary and then leave the document at a bus stop.

Password security should be exemplary at the White House, but even more so at the Pentagon. Even staff at the Pentagon are guilty of poor password hygiene, as was discovered by Government Accountability Office (GAO) auditors. GAO auditors discovered default passwords were used for software associated with weapons systems. Default passwords are publicly available online which renders them totally useless. GAO auditors were also able to guess admin passwords with full privileges in only 9 seconds.

These are just three examples of terrible password practices. While they are shocking given the individuals concerned, they are sadly all too common.

Password Best Practices to Keep Accounts Secure

A password prevents other individuals from gaining access to an account and the sensitive information contained therein. Choose a strong password or passphrase and it will help to make sure that personal (or business) information remains confidential. Choose a weak password and an account can easily get hacked. Choose an exceptionally weak password and you may as well have no password at all.

To ensure passwords are effective, make sure you adopt the password best practices detailed below:

  • Make sure you set a password – Never leave any account open
  • Always change default passwords – They are just placeholders and are next to useless
  • Never reuse old passwords
  • Use a unique password for all accounts – Never use the same password for multiple accounts
  • Do not use names, dictionary words, or strings of consecutive numbers or letters
  • Ensure passwords are longer than 8 characters and contain at least one number, lowercase letter, uppercase letter, and a symbol – Long passphrases that are known only to you are ideal
  • Use a random mix of characters for passwords and use a password manager so you don’t have to remember them. Just make sure you set a very strong password for your password manager master password.
  • Set up multi-factor authentication on all of your accounts
  • Never write down a password
  • Never share passwords with others, no matter how much you trust them

Password Best Practices for Businesses

Verizon’s 2018 Data Breach Investigations Report revealed 81% of hacking-related data breaches were due to weak passwords or stolen credentials. It is therefore critical that businesses adopt password best practices and ensure users practice good password hygiene. Businesses need to:

  • Train end users on good password hygiene and password best practices
  • Enforce the use of strong passwords: Blacklist dictionary words, previously exposed passwords, previously used passwords, and commonly used weak passwords
  • Set the minimum password length to 8 characters (or more) and avoid setting a maximum length to encourage the use of passphrases.
  • Follow the password advice published by the National Institute of Standards and Technology (NIST)
  • Don’t enforce password changes too often. End users will just reuse old passwords or make very minor changes to past passwords.
  • Implement multi-factor authentication
  • Encrypt all stored passwords
  • Consider the use of other authentication methods – Fingerprint scanners, facial recognition software, voice prints, or iris scans

University Research Theft: A Major Cause for Concern

Educational institutions are being targeted by cybercriminals for all manner of nefarious purposes: To obtain the personal information of staff and students for identity theft and tax fraud, to steal university funds, and to steal university research.

University research theft is an easy income stream for hackers. Research papers can command high prices on the black market and are highly sought after by nation state governments and businesses.

This fall, the UK’s Daily Telegraph revealed Iranian hackers were selling research papers that had been stolen from top British Universities including Oxford and Cambridge. Several Farsi websites were identified advertising free access to university research papers, including an offer of university research theft to order. Provide the details and, for a price, the research be found and sent through an encrypted channel.

There were papers for sale on highly sensitive subjects such as nuclear research and cybersecurity defenses. Even less sensitive subjects are valuable to foreign businesses. The research could help them gain a competitive advantage at the expense of universities. In the case of Iran, universities are being used to gain access to Western research that would otherwise be off limits due to current sanctions.

It is not just British universities that are being targeted. The hackers are infiltrating university research databases the world over, and it is not just Iranian hackers that have tapped into this income stream. University research theft is a growing problem.

How Are University Databases Breached?

One of the main ways access to research databases is gained is through phishing – A simple method of attack that requires no programming know-how and no malicious software. All that is required is a little time and the ability to create a website.

Phishing emails are sent to staff and students that request a visit a webpage where they are required to enter their credentials to academic databases. If the credentials are disclosed, the phishers have the same access rights as the user. The phishers then download papers or advertise and wait for requests to roll in. They then just search the database, download the papers, and provide them to their customers.

Various social engineering techniques are used to entice users to click the links. Requests are sent instructing the user that they need to reset their password, for instance. The web pages they are directed to are exact copies of the sites used by the universities. Apart from the URL, the websites appear perfectly genuine.

Unfortunately, once credentials have been obtained it can be difficult for universities to discover there has been a breach since genuine login credentials are used to access the research databases.

How to Prevent University Research Theft

No single cybersecurity solution will protect universities from all phishing attacks. The key to mounting an effective defense against phishing is layered phishing defenses.

  • The primary cybersecurity solution to implement is an advanced spam filter to ensure as many phishing emails as possible are blocked and messages containing malicious attachments do not reach inboxes. SpamTitan for instance, blocks more than 99.9% of spam and phishing messages and 100% of known malware. Even advanced spam filtering solutions will not block all phishing emails, so additional controls are required to deal with the <0.1% of phishing emails that are delivered.
  • While a web filter can be used to block access to categories of web content such as pornography, it will also block access to known malicious websites: Websites used for phishing and those that host malware.
  • End user security awareness training is also essential. End users are the last line of defense and will remain a weak link unless training is provided to teach them how to identify malicious emails. Staff and students should be conditioned to report threats to their security teams to ensure action can be taken and to alert first responders when the university is under attack.
  • Multi-factor authentication should also be implemented. If credentials are stolen and used to access a database, email account, computer, or server, from an unfamiliar device or location, a further form of authentication is required before access is granted.
  • Universities should have security monitoring capabilities. Logs of access attempts and should generated and network and user activity should be monitored for potential compromises.

For further information on anti-phishing defenses and cybersecurity solutions that can help prevent university research theft, contact the TitanHQ team today.

Starbucks WiFi Filter Will Start Blocking Porn in 2019

In 2016, Starbucks agreed to filter out pornography from its WiFi networks, but two years on and a Starbuck WiFi filter has yet to be applied anywhere other than the UK.

The 2016 promise came in response to public pressure to take action to prevent customers from abusing its free WiFi network to view pornography. While Starbucks had an acceptable use policy and prohibited the viewing of pornography on its WiFi network, there were no controls in place to prevent customers from accessing such content.

Leading the campaign for a Starbucks WiFi filter was the Internet safety group Enough is Enough. Back in 2016, as part of its Porn Free WiFi Campaign (since renamed SAFE WiFi Campaign) the group stepped up its efforts to convince big businesses to take the lead and implement filtering technology to enforce acceptable internet usage policies on their free WiFi networks. McDonalds and Starbucks were two such brands that were petitioned by the group – a coalition of 75 partner organizations.

More than 50,000 petitions were sent to Starbucks and McDonald’s in 2016, and in response, both agreed to start filtering pornographic web content on their WiFi networks. While McDonald’s acted quickly and started blocking adult content, the Starbucks WiFi filter failed to materialize. The coffee shop chain did implement a WiFi filter in its UK locations, but the Starbucks WiFi filter was not rolled out in other countries.

Since McDonalds took the lead and created a family-friendly free WiFi network, Chick-fil-A has followed suit and has implemented a WiFi filter in its 2,200 restaurants, as have many other restaurant and coffee shop chains. However, two years on and Starbucks has not made good on its promise. The lack of apparent action prompted Enough is Enough to issue a new call for the coffee shop chain to take action.

Enough is Enough Issues Fresh Call for Starbucks WiFi Filter Rollout

“Starbucks has had a tremendous opportunity to put its best foot forward in protecting its customers from images deemed obscene and illegal under the law, but they haven’t budged, despite their promise two years ago and despite the fact that they voluntarily filter this same content in the UK,” said Enough is Enough president and CEO, Donna Rice Hughes. “By breaking its commitment, Starbucks is keeping the doors wide open for convicted sex offenders and others to fly under the radar from law enforcement and use free, public WiFi services to access illegal child porn and hard-core pornography.”

Despite the promise, there has been little news issued on the Starbucks WiFi filter front. “To date, no action has taken place to suggest Starbucks has moved forward with its public commitment. EIE has made repeated attempts to reach out to Starbucks executives by phone, e-mail and certified mail since 2016. Starbucks has remained unresponsive with the exception of a form letter from customer relations,” explained Donna Rice Hughes on November 26, 2018.

Enough is Enough has called for members of the public to petition Starbucks once again and demand a WiFi filtering solution be applied to prevent customers from accessing inappropriate content in its coffee shops.

Starbucks has now confirmed to Business Insider that the chain has been taking action and has been evaluating WiFi filtering solutions to determine whether they can be applied to block access to pornography without inadvertently blocking other types of content.  A solution has now been chosen at last and it will be rolled out in 2019.

WiFi Filtering Made Simple with WebTitan Cloud for WiFi

While web filters have been criticized in the past for overblocking web content, today, web filters such as TitanHQ’s WebTitan Cloud for WiFi allow fine control of Internet content thanks to highly granular settings.

WebTitan Cloud for WiFi includes 53 preset categories of Internet content that can be filtered out in seconds once the solution has been implemented. Implementing WebTitan Cloud for WiFi, configuring the filter, and protecting customers (and employees) takes just a few minutes. No hardware purchases are required, and no software downloads are necessary. Simply change the DNS to point to WebTitan and controls can easily be applied.

In addition to blocking pornography, illegal content such as child pornography and copyright-infringing file downloads via P2P file sharing sites and be blocked. WiFi users will also be protected from malicious sites that download malware, phishing websites, and other web-based threats.

WebTitan Cloud for WiFi is highly scalable and can be used to protect multiple WiFi access points, regardless of where they are located, through an easy-to-use web-based interface. With WebTitan Cloud for WiFi, filtering the Internet and protecting customers could not be any easier.

If you run a business and you offer your customers free, unfiltered WiFi access, now is the perfect time to make a change and send a message to your customers that you are leading the fight against online pornography and are taking action to protect customers by creating a family-friendly WiFi environment.

Key Benefits of WebTitan Cloud for WiFi

  • Filter the Internet across multiple WiFi hotspots
  • Create a family-friendly, safe and secure web browsing environment
  • Manage access points through a single web-based administration panel
  • Delegate management of access points
  • Filter by website, website category, keyword term, or keyword score
  • Block material contained in the child abuse image content URL list (CAIC List)
  • Upload blacklists and create whitelists
  • Reduce the risk of phishing attacks
  • Block malware and ransomware downloads
  • Inspect encrypted websites with SSL certificates
  • Schedule and run reports on demand
  • Gain a real-time view of internet activity
  • Gain insights into bandwidth use and restrict activities to conserve bandwidth
  • Integrate the solution into existing systems through a suite of APIs

Contact TitanHQ today for more information, to book a product demonstration, or to sign up for a free WebTitan Cloud for WiFi trial.

Managed Service providers that want to start offering WiFi filtering to clients should contact the TitanHQ MSP Program team to find out how WebTitan (and other TitanHQ products) can be integrated into their security stacks.

Lire cet article en français.

Business Email Account Compromises Soaring

Business email compromise (BEC) attacks cost businesses billions of dollars each year, and business email account compromises are soaring.

What is a Business Email Compromise Attack?

As the name suggests, these attacks involve the hijacking of business email accounts. The primary aim is to compromise the account of the CEO or CFO, which is usually achieved through a spear phishing attack. Once the email account has been compromised, it is used to send phishing emails to other employees in the company, most commonly, employees in the accounts, finance, and payroll departments.

The emails commonly request wire transfers be made to accounts under the control of the attackers. Requests are also made for sensitive information such as the W-2 Forms of employees.

Since the emails are sent from the CEO or CFO’s own account, there is a much higher chance of an employee responding to the request than to a standard phishing attempt from an external email address. Since the emails come from within an organization, they are also much harder to detect as malicious – a fact not lost on the scammers.

With access to the email account, it is much easier to craft convincing messages. The signature of the CEO can be copied along with their style of writing from sent messages. Email conversations can be started with employees and messages can be exchanged without the knowledge of the account holder.

Fraudulent transfers of tens or hundreds of thousands of dollars may be made and the W-2 Forms of the entire workforce can be obtained. The latter can be used to submit fake tax returns in victims’ names to obtain tax refunds. The profits for the attackers can be considerable, and with the potential for a massive payout, it is no surprise that these attacks are on the rise.

Business Email Account Compromises Have Increased by 284% in a Year

FBI figures in December 2016 suggest $5.3 billion had been lost to BEC scams since October 2013. That figure had now increased to $12.5 billion. More than 30,000 complaints of losses due to BEC attacks were reported to the FBI’s Internet Crime Complaints Center (IC3) between June 2016 and May 2018.

The specialist insurance service provider Beazley has been tracking business email account compromises. The firm’s figures show business email account compromises have increased each quarter since Q1, 2017. In the first quarter of 2017, 45 business email account compromises were detected. In Q2, 2018, 184 business email account compromises were detected. Between 2017 to 2018, there was a 284% increase in compromised business email accounts.

While the CEO’s email credentials are often sought, the credentials of lowlier employees are also valuable. Any email account credentials that can be obtained can be used for malicious purposes. Email accounts can be used to send phishing messages to other individuals in an organization, and to business contacts, vendors, and customers.

Beazley notes that once one account has been compromised, others will soon follow. When investigating business email account compromises, businesses often discover that multiple accounts have been compromised. Typically, a company is only aware of half the number of its compromised accounts.

The High Cost of Resolving Business Email Account Compromises

Business email account compromises can be extremely costly to resolve. Forensic investigators often need to be brought in to determine the full extent of the breach. Each breached email account must then be checked to determine what information has been compromised. While automated searches can be performed, manual checks are inevitable. For one client, the automated search revealed 350,000 document attachments had potentially been accessed, and each of those documents had to be checked manually to determine the information IT contained. The manual search alone cost the company $800,000.

How to Protect Your Organization from Business Email Compromise Attacks

A range of measures are required to protect against business email compromise attacks. An advanced spam and anti-phishing solution is required to prevent phishing and spear phishing emails from being delivered to inboxes.

SpamTitan is an easy-to-implement spam filtering solution that blocks advanced phishing and spear phishing attacks at source. In contrast to basic email filters, such as those incorporated into Office 365, SpamTitan uses heuristics, Bayesian analysis, and machine learning to identify highly sophisticated phishing attacks and new phishing tactics. These advanced techniques ensure more than 99.9% of spam and malicious messages are blocked.

The importance of security awareness training should not be underestimated. End users should be trained how to recognize phishing attempts. Training should be ongoing to ensure employees are made aware of current campaigns and new phishing tactics. Phishing simulation exercises should also be conducted to reinforce training and identify weak links.

Multi-factor authentication is important to prevent third parties from using stolen credentials to access accounts. If a login attempt is made from an unfamiliar location or unknown device, an additional form of identification is required to access the account.

Password policies should be enforced to ensure that employees set strong passwords or passphrases. This will reduce the potential for brute force and dictionary attacks. If Office 365 is used, connection to third party applications should be limited to make it harder for PowerShell to be used to access email accounts. A web filtering solution should also be implemented to block access to phishing accounts where email credentials are typically obtained.

Defense in depth is the key to protecting against BEC attacks. For more information about email and web security controls to block BEC attacks, give the TitanHQ team a call. Our experienced advisers will recommend the best spam and web filtering options to meet the needs of your business and can book a product demonstration and set you up for a free trial.

Massive Malvertising Campaign Directs Millions of Users to Phishing Websites

A massive malvertising campaign has been detected that has so far hijacked at least 300 million browser sessions in the space of just 48 hours.

What is Malvertising?

Malveristing is a method of generating traffic to websites that would otherwise be unlikely to be visited by Internet users. The technique involves using code in adverts submitted to advertising networks to redirect users to a specific website. Clicking a link in one of the adverts can trigger multiple redirects, first to the site detailed in the Ad code, then onto another web page.

Malvertising is often used to direct Internet users to malicious websites, such as those hosting exploit kits that probe for vulnerabilities and silently download malware or phishing websites, tech support scams, and other scam sites.

As spam filtering technology has improved, fewer spam emails are being delivered to inboxes, which means fewer individuals click links in emails and visit malicious websites. Malvertising is a suitable alternative that generates huge volumes of traffic.

The ad networks are used by many high-traffic websites to provide an additional income stream. While the ad networks incorporate checks to ensure advertisers are legitimate, the use of obfuscated JavaScript to redirect visitors and multiple redirects help attackers pass these checks.

Users Directed to Phishing Websites

The latest malvertising campaign is being used to direct Internet users to a variety of web pages, including adult websites and ‘You’ve Won a Gift Card’ scams.

The campaign was detected by researchers at Confiant on November 12. They claim the threat actors behind the campaign are still active. The initial web pages visited via advert redirects contain obfuscated JavaScript code that redirects visitors to other web pages. Many of the final landing pages phish for sensitive information such as names, addresses, email addresses, revenue information, and other personal data.

Malvertising is nothing new and there are more than a dozen threat actors that are primarily using this method to generate traffic to web pages, but this campaign stands out due to its scale and the volume of visitors that have been redirected to malicious websites.

How to Protect Your Business from Malvertising Attacks

As with spam email, malvertising is a serious risk for businesses. The majority of businesses now use a spam filtering solution to prevent malicious messages from reaching inboxes, but fewer businesses have protections in place to prevent their employees from malvertising and other web-based attacks.

Anti-virus and anti-malware solutions may identify malware downloads that take place through these malicious websites, but usually only once the malware has been downloaded. Since most AV solutions are signature-based, if a new malware variant is downloaded it will not be detected.

The most effective way of blocking malvertising is a web filtering solution. A web filter is most commonly used to control the types of content that can be accessed by employees and serves a similar purpose to parental control software. However, in contrast to parental control solutions, enterprise class-web filtering solutions also prevent network users from accessing malicious websites such as those used for phishing and to distribute malware.

WebTitan Cloud – An Easy to Use, Powerful Web Filtering Solution

WebTitan Cloud is an enterprise-class web filtering solution that has been developed to offer protection against web-based attacks, including malvertising.

WebTitan Cloud is a 100% cloud-based web filtering solution. As such, it requires no hardware purchases or software downloads. Implementation is quick and easy and only takes a few minutes. No technical skill is required to start filtering the Internet and start protecting your business from web-based threats.

In addition to blocking access to malicious websites, WebTitan Cloud allows users to restrict internet activity through 53 category-based filters. More than 700 million URLs are crawled, analyzed, and categorized every day, and the solution provides 100% coverage of the Alexa top 1 million most visited websites and blocks more than 3 million malicious URLS at any one time. More than 7,500 businesses around the world trust WebTitan to protect them from malicious web content.

WebTitan Cloud is also an ideal web filtering solution for managed service providers (MSPs), allowing them to easily add web filtering to their security stacks. WebTitan Cloud comes with a variety of hosting options, including the option of hosting the solution within an MSP’s own data center. The solution can also be provided as a white-label ready to take MSP branding.

For further information on WebTitan Cloud for managed service providers and SMBs, details of pricing, and to book a product demonstration, contact the TitanHQ team today.