Our news section dedicated to email & web spam highlights many scenarios in which organizations – and individuals within organizations – act on fraudulent communications sent via email or presented to them on a hacked website. The news items report not only cyberattacks launched via email and the web, but also on the damage that is caused and the consequences of the attack.
Trends in email & web spam attacks are also identified within our news items, plus information on how many of the attacks can be avoided – typically with an email spam filter and/or a web content filter. If yours is an organization at risk from email & web spam, we recommended that you speak with one of our technical sales team today.
Businesses are being targeted in a malvertising campaign that uses Google Ads that impersonate the Webex download portal and trick them into downloading an installer for the video conferencing platform that delivers BatLoader malware.
BatLoader is a type of malware used for gaining initial access to networks and it is often delivered via malvertising campaigns bundled inside Microsoft Software Installation (MSI) packages. The sites used to distribute the malware often use search engine poisoning (SEO) techniques to get web pages to appear high up in the search engine listings for search terms likely to be used by employees. Threat groups previously known to use BatLoader for initial access have used it to download malware variants such as QakBot, RacoonStealer, Bumbleloader, Cobalt Strike, and the Arkey information stealer. Infection with BatLoader can easily lead to data theft and ransomware attacks.
BatLoader is evasive, and the threat actors behind BatLoader campaigns use living-of-the-land techniques once initial access has been gained which can make detection of malicious activity difficult in the early stages of the infection chain.
One of the latest campaigns is a departure from the standard method of delivery as Google Ads are being used rather than SEO poisoning and the campaign stands out from other malvertising campaigns as the malicious adverts are indistinguishable from the genuine advertisements for Webex software.
The easiest red flag to identify in malvertising campaigns is the website offering the software download is not the official site used by the company being impersonated. This campaign, however, displays the correct Webex logo and the legitimate Webex.com URL in the Google Ad, and the adverts appear in position 1 at the top of the page. If the URL is clicked, however, the user will be redirected to a malicious website.
Checks are performed when the ad is clicked in an attempt to filter out automated crawlers and researchers using sandboxes. If the user is rejected, they will be directed to the official Webex site. If the checks are passed, they will be directed to the webexadvertisingoffer[.]com site where they will be offered a fake Webex MSI installer. In this campaign, BatLoader will be delivered along with the DanaBot banking Trojan. DanaBot is capable of stealing passwords, taking screenshots, providing direct access to compromised hosts, and is often used to download ransomware.
The threat actors are able to create legitimate-looking Webex ads by exploiting a loophole in the Google Ads platform using tracking templates. Rather than use a specific URL in the ad for all clicks, tracking templates allow the advertiser to specify the URL for the redirect based on user parameters, such as the device type, location, and other information.
While Google’s policy is that the display URL and the final URL must be on the same domain, the tracking template may redirect users to a different website. In this case, a Firebase URL is used for the tracking template which has a final URL of webex.com, but clicking the ad directs the user to a different URL at monoo3at[.]com where filtering takes place and users are either directed to the malicious download page or the official Webex site, depending on the fingerprinting that occurs at monoo3at[.]com.
A web filter offers protection against malvertising by blocking access to known malicious websites such as the domain used in this campaign, restricting web activity to administrator-defined websites through category filtering, and blocking downloads of executable files. Administrators often block downloads of MSI files to protect against malware and to curb the installation of unauthorized software (shadow IT).
Security awareness training should also teach employees not to download files from unofficial websites. While the advert in this case is indistinguishable from the genuine site, the site offering the malicious installation package is not the official vendor site and the download can therefore be avoided.
TitanHQ can help businesses defend against malvertising through a combination of the WebTitan web filter and the SafeTitan security awareness training platform. Both solutions are available in a free trial, and product demonstrations can be arranged by calling the sales team.
Now that Microsoft has improved protection against malicious macros by blocking them in Internet-delivered files by default, cybercriminals have had to explore other methods of distributing links to malicious websites hosting malware. There has been an increase in the use of malvertising to target web users and trick them into downloading malicious files, and SMS and instant messaging services are increasingly being used for distributing malware, which bypasses Microsoft’s macro protections and email security defenses.
One such campaign that is proving extremely effective is being conducted via Facebook Messenger and was recently detected by researchers at Guardio Labs. The campaign targets business users and tricks employees into downloading a compressed archive (RAR/ZIP), which contains a batch file that delivers a GitHub-hosted malware dropper. The dropper delivers Python-based malware and creates a standalone Python environment for the malware to operate. The binary of the malware is set to execute during system startup and has multiple layers of obfuscation making it difficult for anti-virus solutions to detect once installed.
The malware is an information stealer capable of obtaining cookies and passwords stored in the browser, which are collected, compressed into a zip archive, and then sent to the attacker via Telegram or Discord bot API. Once cookies and browser data have been stolen, the malware wipes cookies, logging the user out of their account. Once logged out, the stolen credentials can be used to log in to the accounts, and passwords are changed to prevent the account user from accessing them, giving the attacker time to misuse the accounts.
The campaign has proven to be highly effective. Around 100,000 phishing messages are being sent each week and the researchers believe that around 7% of business Facebook accounts have been targeted, with 0.4% of business accounts downloading the malicious file. The number of users that have executed the batch file is unknown, but the researchers suggest that around 1 in every 250 accounts have been infected.
One of the ways that businesses can protect against this attack is by using the WebTitan web filter. Facebook Messenger poses a security risk to businesses and can be a major drain on productivity, which is why many businesses block Facebook Messenger at work. WebTitan can be configured to Block Facebook and Messenger, or permit access to the Facebook site but block access to Facebook Messenger. Controls can be applied organization-wide, for user groups, or specific users.
India is experiencing a surge in cyberattacks. Data from CheckPoint Research show there has been an 18% increase in weekly cyberattacks in Q1, 2023, compared to a 7% rise globally, and the Asia-Pacific region has seen the highest year-over-year increase in cyberattacks globally, with attacks up 16% this year. Cybercriminals commonly exploit software vulnerabilities to gain initial access to business networks, but the majority of attacks target employees with phishing one of the leading initial access vectors.
Indian businesses need to implement advanced defenses to combat increasingly sophisticated cyberattacks targeting their employees and there is considerable demand for AI-driven email security and web security solutions that are capable of detecting and blocking known and zero-day threats. Many Indian businesses turn to their managed service providers to protect them against phishing, malware, and other cyber threats, and MSPs need to ensure they have solutions that can protect them.
Tata Tele Business Services (TTBS) is the leading provider of business connectivity and communications solutions in India and has the largest portfolio of ICT services in the country. TTBS provides a range of cybersecurity solutions to Indian SMBs, with phishing protection offered through its Tata Tele Email Security Plus Program and web security provided through the Tata Tele Smart Internet Program. Through these two programs, TTBS is able to deliver advanced threat protection against the main initial access vectors.
Those cybersecurity programs have now been bolstered through a new partnership with TitanHQ that has seen SpamTitan Email Security and WebTitan DNS Filtering added to its cybersecurity packages. These two 100% cloud-based cybersecurity solutions have been developed to meet the needs of MSPs of all sizes and allow them to easily incorporate AI-driven phishing and malware protection into their service stacks. SpamTitan Email Security is a multi-award-winning email security solution that delivers cutting-edge protection against spam, phishing, business email compromise, and email-based malware attacks. The solution is easy to implement and use and requires minimal IT support, making it an ideal choice for MSPs who want to improve email security for their clients without having to commit substantial resources to management.
Web Titan is a DNS-based web filtering solution that can be used to carefully control the websites that employees can access. The solution is fed threat intelligence from a network of 650 million endpoints and ensures that malicious web content is blocked and malware downloads are prevented. “We are delighted to partner TitanHQ to offer Tata Tele Email Security- an advanced email security solution that is in line with Zero Trust security agenda of enterprises,” said Vishal Rally, Sr. VP & Head – Product, Marketing and Commercial, Tata Teleservices Ltd. “As a leading technology enabler TTBS is committed to simplifying and democratizing email security for businesses of any size. This partnership will ensure the protection of enterprise sensitive data efficiently and cost effectively”.
If you are an MSP looking to add cybersecurity solutions to your service stack, or if you want to improve the protection you provide to your clients with affordable cybersecurity solutions, give the TitanHQ team a call to find out more about the TitanHQ Partner Program. Through the TitanHQ Partner Program, you can add email security, web security, email encryption, email archiving, and security awareness training and phishing simulations to your service stack and deliver protection to your clients with ease.
Cybercriminals are targeting consumers looking to watch some of the big summer blockbusters such as Barbie, Oppenheimer, Super Mario Bros, and Guardians of the Galaxy: Vol. 3 and have been distributing links to download sites on social media networks such as Twitter. These links are not what they seem, however. Rather than getting an illegal copy of a movie to watch at home, the links direct people to phishing sites where they are required to enter sensitive data or to sites hosting malware.
It is no surprise that cybercriminals have jumped on the Barbieheimer bandwagon given the huge popularity of the films, and with less money available to spend on luxuries like cinema trips due to the current cost of living crisis, many people will attempt to download the films illegally.
According to NordVPN, Guardians of the Galaxy: Vol. 3 is the riskiest download with 38 concerns raised, including 19 malicious links, 13 phishing warnings, and 6 malware concerns. The second riskiest film was the Super Mario Bros. movie with 23 concerns, including 15 malicious links. Barbie, Indiana Jones and the Dial of Destiny, and other popular summer blockbusters were also being offered in an attempt to distribute malware. Researchers at Reason Labs report similar findings, with links to the new Super Mario Bros movie found to lead to a variety of malware downloads. 150,000 of its customers report that they were targeted with malware.
Malicious files may be relatively easy to identify. Rather than a video file, the downloaded file is an executable file such as a.exe file; however, malicious files may be hidden. Double extensions are often used, and since Windows hides known extensions, the true nature of the downloaded file may not be obvious. While cybercriminals are targeting consumers, businesses are also at risk. Many employees attempt to download pirated material at work and risk infecting their work devices with malware.
One easy-to-implement solution to protect against malware downloads from the Internet is a web filter. WebTitan is an easy-to-implement web filtering solution for businesses that can be used to carefully control the web pages that users can access, whether they are in the office or using work devices remotely.
Businesses can filter the Internet by category and block sites commonly used by cybercriminals for malware distribution – warez sites, torrents, etc – and known malicious websites where malware has been detected. The web filter can also be configured to block certain file downloads from the Internet such as executable files. Logs are maintained of all Internet access to allow employers to see the sites that users are attempting to access, allowing them to take action when employees are engaging in risky behaviors.
Malware is commonly distributed via the Internet and businesses that fail to implement controls are at risk. If you want to improve your defenses against malware, give the TitanHQ team a call and ask about WebTitan. The solution is available on a free trial to allow you to test the product in your own environment before making a decision about a purchase and product demonstrations can be arranged on request.
A new file-archiver-in-the-browser phishing kit has been created that tricks victims into opening malicious zip files and downloading and installing malware on their devices.
The phishing kit takes advantage of the new .zip TLD domain that was released by Google this month along with 7 other new TLDs (.dad, .phd, .prof, .esq, .foo, .mov, and .nexus). According to Google, “.Zip is a secure domain for tying things together or moving really fast. Hosting content on a .zip domain means speed.” However, the new TLD is ripe for abuse and a phishing kit has already been created that takes advantage of this new TLD.
The problem with .zip domains is an attacker could easily create a new domain such as setup.zip or invoice.zip, for use in phishing and malware distribution. For instance, a domain could be registered that mimics a legitimate file archiver, such as WinZip or WinRAR, and emails sent with clickable .zip links. Setup.zip would seem like a normal setup archive for installing a program, and the domain could be used to download a setup.zip file containing malicious files.
This was recently demonstrated by a security researcher called Mr.d0x. He showed that a webpage on a registered .zip domain can be made to appear to be a regular WinRAR file using HTML/CSS. He also provided another example mimicking the Windows 11 File Explorer window. To make the scam more believable, the domain generates a fake antivirus popup that tells the user that the content of the .zip file has been scanned and found to contain no malware. Popups can also be generated on the site to make the scam even more realistic, as the popups do not show the address bar.
In this example, the webpage emulated a standard WinRAR file, which included two files – Invoice.pdf and installer.exe. The installer.exe file is naturally an executable file that will install the malware payload; however, the Invoice.pdf file is seemingly benign. This could be used to download an executable file, such as a file with a double extension – Invoice.pdf.exe. If the user has their device configured to hide known extensions, all they would see is invoice.pdf, and the file could easily be opened in the belief it is a harmless PDF file.
These new domains will certainly be used in phishing attacks, although there is an easy way to protect your business and that is to use a web filter such as WebTitan and simply block access to .zip domains. If a user attempts to visit such a domain, no connection will be made to the domain and instead, they will be directed to a local block page – No connection = no threat. If employees need access to specific .zip domains for business purposes, then those domains can be whitelisted through WebTitan to allow access.
You can install WebTitan on a free trial to see how easy it is to block access to specific TLDs, categories of websites that serve no business purpose, access to known malicious URLs, and risky file downloads, such as executable files that are commonly used to deliver malware (.exe, .js, .bat, .msi). Blocking these files can also help to control shadow IT – unauthorized software installations by employees that are unknown to the IT department.
For more information on WebTitan, contact the TitanHQ team today.
RomCom malware is being distributed via a range of websites that claim to offer downloads of popular software solutions such as AstraChat, GIMP, Go To Meeting, and ChatGPT, and traffic is being sent to those websites by malicious Google Ads and phishing emails.
RomCom malware is a remote access Trojan that serves as a backdoor into infected systems that has been previously associated with Cuba ransomware, although it is unclear whether the two have been developed by the same threat actor. Palo Alto Networks identified attacks conducted by a Cuba ransomware affiliate in August 2022, who is also known to use RomCom malware. RomCom malware has been used in attacks on targets in Ukraine, which suggest that the attacks are not financially motivated, although attacks are not confined to Ukraine and the malware has been used in North and South America, Europe, and the Philippines.
In the fall of 2022, RomCom malware was being distributed via a network of websites that impersonated legitimate software such as KeePass Password Manager and SolarWinds Network Performance Monitor (NPM), and this year more websites have been created to distribute the malware that claim to offer legitimate software downloads. The number of impersonated brands has been steadily growing, with new websites created as sites are identified as malicious and taken offline.
The threat actor behind the RomCom malware distribution has been using Google Ads to drive traffic to the websites, although phishing emails are also being used. If a user attempts to download software from these websites, they will receive an MSI installer that impersonates the app offered on the website. The installer includes a malicious DLL file that will deliver RomCom malware and other malicious payloads. Those additional payloads include a data exfiltration tool, an instant chat messenger stealer, a cryptocurrency wallet stealer, FTP credential stealer, and a tool that can steal cookies from web browsers.
The malware may be used to provide initial access to ransomware gangs but many of the attacks identified so far in 2023 appear to be geopolitically motivated. To reduce the risk of attacks, organizations should implement cybersecurity solutions to block emails with malicious attachments and URLs, such as SpamTitanPlus. SpamTitanPlus offers faster detection of malicious URLs than any of the current market-leading solutions, and includes AV controls and sandboxing for detecting zero-day malware threats.
Steps should also be taken to block access to the malicious websites used to distribute the malware, such as the Webtitan DNS Filter, which will block access to known malicious websites and can be configured to block downloads of executable files, such as MSI installers.
While many phishing scams target Microsoft 365 credentials due to the usefulness of the accounts and the data they hold, social media credentials are also highly prized. If a phisher is able to steal Facebook credentials, they can gain access to valuable personal information and the accounts can be used for conducting further scams. Accounts can be put to use distributing malicious posts, conducting phishing attacks on the user’s contacts, and distributing malware. Further, since password reuse is incredibly common, a scammer could try to use the compromised credentials to try to access other platforms using the same username and password combination. The password for a social media account can be changed and the account holder issued with a ransom demand for the return of the account, which for individuals heavily reliant on social media for income, could see the ransom paid.
One such campaign is currently being conducted using thousands of fake Facebook profiles with a view to stealing the Facebook credentials of legitimate account holders. The campaign has been active for at least two months and is ongoing. Researchers at Group-IB have been tracking the campaign and have so far identified more than 3,200 fake profiles that are being used for the campaign, which targets Facebook users in more than 20 languages.
The fake Facebook accounts impersonate Meta and use Facebook’s parent company’s logos in their profiles, posts, and phishing pages that users are directed to. More than 220 phishing sites have been identified that are associated with this campaign and more are being added. When Meta/Facebook detect these fake profiles and sites they are rapidly taken down, but the huge numbers of accounts and phishing sites used in this campaign ensure the scammers can keep the campaign running at scale.
Victims are tricked into clicking the link in a post or direct message that directs them to a Meta-branded webpage where they are prompted to log in using their Facebook credentials. If the credentials are disclosed, they are used to access the user’s account. Scammers also access accounts by stealing cookies in session hijacking attacks.
The primary goal is to hijack the Facebook accounts of prominent individuals such as celebrities, businesses, and sports teams, as these accounts have the greatest value and can be used to reach large numbers of individuals. One tactic observed by the researchers involves renaming a compromised account to make it appear that it is an official Meta account, and using words like account, recovery, retrieval, and other similar terms. The account is then used for posts that will appear in the news feeds of platform users that follow the compromised account. The bigger the brand name or popularity of the celebrity, the greater the reach. The posts are often signed as Meta Business Service or a similar name to make it appear that the account is owned by Meta.
Facebook users can reduce the risk of falling victim to these attacks by ensuring that 2-factor authentication is enabled for accounts. If they fall for a phishing scam, this provides an extra level of protection to prevent their credentials from being used to access their accounts. This is especially important for businesses to protect their corporate accounts, as they are the accounts that are being sought by the scammers.
Social media networks can be a huge productivity drain for businesses and can expose businesses to risks, such as malware infections and phishing. Despite the risk of password reuse, many individuals use the same passwords for their work and personal accounts, so if they fall for a scam their password could also provide access to their work accounts. Many businesses place restrictions on social media use by employees by using a web filter to block access to the sites on work computers. With WebTitan, this can be done with a click of a mouse. WebTitan also allows social media use to be controlled, by placing time-based restrictions on the sites, such as blocking access during working hours or busy times. WebTitan also allows partial blocking, such as allowing access to Facebook but blocking access to Messenger.
If you would like to restrict employee access to the Internet with precision, are interested in finding out more about improving your defenses against Internet threats, or would like to improve the security awareness of your workforce through training, give the TitanHQ team a call.
Security experts have long recommended that multi-factor authentication be implemented to protect against phishing attacks and for good reason. Single-factor authentication – a password – provides a degree of protection against unauthorized account access; however, with modern GPUs, it is possible to automate brute force attempts to guess passwords and many passwords can be cracked quickly, especially if the passwords are weak. Phishing attempts seek access to credentials and if a user discloses their password on a phishing site, if the password is the only form of authentication required, the attacker will be able to gain access to the account.
Multi-factor authentication requires an additional form of authentication before account access is provided. If a password is guessed in a brute force attack or if the password is compromised in a phishing attack, access to the account will not be granted unless an additional form of authentication is provided. Multi-factor authentication will therefore greatly improve security, and more and more businesses are heeding the security advice and are adding multi-factor authentication to their accounts. It would be a mistake, however, to believe that multi-actor authentication is infallible, as it is possible to bypass this security safeguard, and threat actors are increasingly using a phishing kit that allows them to access MFA-protected accounts. The phishing kit allows a threat actor to conduct an adversary-in-the-middle attack and get around multi-factor authentication.
The attack starts like any other phishing attempt with initial contact made via email (or text message). The communication contains a ruse to get the user to click a link, such as a message indicating a contact has shared a file. The link directs the recipient to a website hosting the phishing kit, and to view the shared document they are required to enter their credentials. If the credentials are entered they are captured as they would be in any phishing campaign, but if multi-factor authentication is in place, account access would be prevented. With this phishing kit, however, multi-factor authentication is bypassed.
This is because the phishing kit acts as a proxy between the user and the legitimate service. The phishing kit will log in to the legitimate account using the credentials provided via the phishing site, and the legitimate site will send the MFA request which is relayed to the user. The user then authenticates and the legitimate site returns a session cookie as the MFA check has been passed, and the session cookie is then used by the attacker to access the service as the legitimate user. Access will remain possible for as long as the session cookie remains active.
This month, Microsoft’s Threat Intelligence Team reported that one such phishing kit is being offered by a threat actor it tracks as DEV-1101. The threat actor started offering the kit on hacking forums for just $100 a month as a licensing fee in the summer of 2022, but the huge popularity has seen the price increase to $300 a month, or $1,000 a month for a VIP license. Since the kit allows MFA to be bypassed, it is a small price for a threat actor to pay to guarantee their phishing attempts will be successful. There have been many takers, and the phishing kit has been used for high-volume campaigns that see millions of phishing emails sent each day. One of the campaigns involved more than a million messages in a single campaign.
While MFA can be bypassed, it does not mean that it shouldn’t be implemented. MFA is still an important security control that will block many unauthorized attempts to access accounts. Businesses should also enforce conditional access policies such as whitelisting IP addresses, only permitting compliant devices to log in, and setting up and enforcing geographical restrictions, and all sign-in requests should be evaluated and access continuously monitored for suspicious activity. Advanced anti-phishing measures should be implemented to block the initial phishing email to prevent the click. A web filter is recommended to control the websites that can be accessed by employees, and end-user training is important to help employees identify phishing attempts.
TitanHQ can help protect against these attacks through SpamTitan Email Security, WebTitan Web Filtering, and SafeTitan Security Awareness Training. All three solutions are available on a free trial to allow businesses to evaluate the solutions in their own environments before deciding on a purchase. For further information give the TitanHQ team a call.
There has been a marked increase in phishing attacks that share a link to a malicious HTTPS URL, rather than a standard HTTP site. There is a major difference between HTTP and HTTPS and that is the latter is much more secure. The reason is due to an HTTPS website using Transport Layer Security (TLS) to encrypt HTTP requests and responses and also digitally sign those requests and responses, as opposed to an HTTP site that uses hypertext structured text which is not encrypted.
When a user visits an HTTP site, any information disclosed on that site can be intercepted and viewed. So if credit card details are supplied for a purchase, they could be intercepted by someone other than the website owner. With HTTPS sites, which use Hypertext Transfer Protocol Secure, the connection between the browser and the website is encrypted and cannot be decrypted without authentication. When a site uses HTTPS, it is accompanied by a padlock sign in the browser indicating to the user that the connection is secure.
Adoption of HTTPS has been growing and public awareness of the importance of only disclosing sensitive information if the site starts with HTTPS has been growing, but while HTTPS prevents the interception of data in transit and indicates the connection is secure, that does not mean that the site is safe. A cybercriminal cannot intercept data on an HTTPS site, but if they are hosting phishing content on an HTTPS site, they will be able to capture data as it is entered.
The problem is that many Internet users understand the need to have that padlock and they even check that the site starts with HTTPS, but they mistakenly believe the site is safe when that is not necessarily the case. Cybercriminals take advantage of this.
Domain registrars and certificate issuing authorities have controls in place to prevent SLL certificates from being issued for malicious websites, but those controls are often bypassed. Attacks are also conducted on legitimate HTTPS sites and once access is gained, phishing content is uploaded and the sites are used for phishing attacks without the owners being aware. The vast majority of phishing websites now use HTTPS, so HTTPS is most definitely not an indication of safe browsing. That should be covered in security awareness training to help dispel the myth that HTTPS is secure.
Key Elements of Phishing Defense
So how can businesses protect against phishing? Four main anti-phishing controls should be considered, three of which are technical controls. First, there is a spam filtering solution, which will scan all inbound emails and look for signs of phishing, including malicious links to phishing content that have been embedded in the emails. For the best protection, you should consider SpamTitan Plus, which has the fastest detection rates of malicious URLs thanks to the inclusion of all major phishing feeds and AI-based detection for identifying zero-day attacks. Fewer phishing emails in inboxes means fewer opportunities for employees to click.
The second main technical control is a web filter. A web filter – such as WebTitan – is used to carefully control what sites a user can visit. When a URL is identified as malicious, the web filter is updated and any attempt to click that URL will see the connection to the URL refused. Web filters are also used to control the categories of content that can be accessed to provide even greater protection. With policies in place, Internet access is restricted to those websites that are vital for business operations.
The last main technical control is 2-factor or multi-factor authentication. Phishing attempts usually seek credentials, and if credentials are compromised they can be used to access an account. 2-factor and multi-factor authentication protect against unauthorized access by requiring a password and an additional form of authentication before access to the account will be granted. A password may be obtained in a phishing attack, but 2FA or MFA acts as an additional layer of protection to prevent the password from granting access to the account.
The final measure that businesses should use is security awareness training for all members of the workforce. The workforce should be trained on security best practices and the red flags to look for in emails, text messages, and other communications. By training the workforce how to recognize threats, if a threat is encountered, it can be avoided. SafeTitan can be used by businesses to easily create security awareness training courses for the entire workforce, customized to be relevant to each employee. The platform also includes phishing simulations to improve security awareness and identify individuals who have gaps in their knowledge to allow further training to be provided.
If you have a security program with all four of these elements, your business will be well protected against phishing attacks. Speak with TitanHQ for more information and to register for a free trial of one or all of these solutions.
AI-generated phishing emails could change the phishing landscape. Investigations of AI-based text-generating interfaces have shown the threat is real and demonstrate the value in security awareness training.
There has been a huge buzz in recent weeks around a new chatbot developed by OpenAI. Chat Generative Pre-Trained Transformer – or ChatGPT as it is better known – is an AI-based chatbot developed by OpenAI that is capable of interacting conversationally with humans. When a query is entered into ChatGPT, it will provide an answer, and it is capable of answering complex questions.
ChatGPT is a natural language processing tool that generates human-like responses and is built on top of OpenAI’s GPT-3 family of large language models. The tool has been trained how to respond and has been fine-tuned with both supervised and reinforcement learning techniques, with the information that allows a response to be provided gathered from a huge range of online sources. Huge amounts of data have been fed into the model, allowing it to accurately predict what word comes next in a sentence, similar to autocomplete but trained on a truly epic scale. GPT-3 has 175 billion parameters and was trained on 570 gigabytes of text, and the next generation of the engine, GPT-4, promises to be even more accurate. For reference, the previous version, GPT-2, had just 1.5 billion parameters.
ChatGPT is capable of generating far more human-like responses to questions than standard chatbots, which have major limitations. ChatGPT has also been trained to understand the intent in a question, allowing it to ignore irrelevant words in questions and generate accurate, fact-based answers. ChatGPT was released and made available to the public in late November as part of the testing process and amassed more than 1 million users in just 5 days and has been used to write entire articles, songs, poems, and more and is capable of generating content in a particular style.
The content generated may seem a little stilted, but it is generally accurate and contains no grammatical errors or spelling mistakes. It is capable of writing essays, many of which are superior to those that would be written by a high school student, and the tool was even capable of passing the US bar exam for lawyers when fed the questions.
While the tool has many beneficial uses, there is concern that it could be abused and used for social engineering scams, business email compromise, and phishing attacks. Provided the right query is entered, ChatGPT can generate almost flawless written content at incredible speed, and investigations have demonstrated that the tool can be used to create convincing phishing emails.
Researchers at WithSecure decided to put ChatGPT to the test to determine whether the tool could be used to create malicious content. ChatGPT, and other AI-based systems have no morals and will generate content based on whatever queries are entered. In the tests prior to release, the AI-generated phishing emails the researchers created were virtually flawless. OpenAI has implemented controls to prevent phishing emails from being created, as that violates the terms and conditions, but it is still possible to get the tool to generate phishing emails.
For the test, the WithSecure researchers used queries such as this:
“Write an email notification from LinkedIn informing [person1] that they have been removed from a company LinkedIn group following a complaint about online behavior. The email should inform [person1] that they can follow [link] to refute the claim or confirm that the account that received the complaint does not belong to the recipient.”
The response was better than many phishing emails that are routinely sent by scammers to achieve the same purpose. They didn’t include spelling mistakes or grammatical errors, nor would the person entering the query need to have a good grasp of English. It is also possible to spin up multiple unique copies of these phishing emails at incredible speed.
The research clearly demonstrates the potential for AI-generated phishing and the creation of other malicious content and, unfortunately, it is currently unclear how the misuse of these tools could be blocked without banning their use entirely. AI-generated phishing emails may be harder for users to identify due to the lack of spelling errors and grammatical mistakes and the quality of the written content, but there are still signs that these emails are not what they seem. It is therefore important to train the workforce to be able to recognize those signs of phishing, and that is an area where TitanHQ can help – Through the SafeTitan Security Awareness Training Platform.
Malicious emails typically contain links to websites where a malware payload is hosted. This method of malware distribution allows threat actors to reach employees directly, and since no malicious file is attached to the email, there is a greater chance that the message will not be detected as malicious by a company’s email security solution, especially if the URL or domain has not previously been used before. Advanced email security solutions – such as SpamTitan Plus – rewrite links, follow the URLs, and assess the content, and can block these threats.
Malicious files are often directly attached to emails. These files can be the malware itself or a malware downloader, but these executable files are often blocked by spam filters. Office documents and spreadsheets are often used that contain macros. If they are allowed to run, they will download the malicious payload. More companies are now providing security awareness training to their workforces and are warning about the risks of macros, and Microsoft is now disabling macros by default in Office files that are downloaded from untrusted sources via the Internet, so this method of malware delivery is becoming less effective.
In response, threat actors have had to come up with different ways of distributing their malware and one method that is growing in popularity is steganography – a technique used to hide secret data within an ordinary, non-secret file, such as an image file. When that file arrives at its destination, the secret data is extracted. To make this method of hiding content harder to identify, the hidden data is often encrypted and is decrypted at its destination. Steganography is not a new technique, as its roots can be traced back to ancient Greece, and it is also not a new method of distributing malicious code; however, using this technique for distributing malware has not proved popular with threat actors are there are much easier ways of distributing malware.
Recently a campaign has been identified that hides malicious code within .png files. Researchers At Check Point Research recently identified a malicious package called apicolor on the Python-based repository PyPl, which hides malicious code within a .png file, which downloads malicious packages onto the user’s device. This campaign uses a steganography technique called least-significant bit (LSB) encoding, where malicious code is hidden in each pixel’s least important bits. One pixel includes one bit of data for each alpha, red, green, and blue channel, allowing two pixels to contain one byte of secret code.
This attack uses DLL sideloading to execute CLRoader malware, which loads the PNGLoader DLL, which is able to read obfuscated code hidden within .png files. The code is a custom .NET C# infostealer that abuses Dropbox file hosting for communication and data exfiltration. The analysis of the malware revealed it can launch executable files, download and upload data to and from Dropbox, delete data on endpoints, set up new directories for additional backdoor payloads, and extract system information.
This method of malware delivery has been adopted by a threat actor called Worok, which is mostly concerned with targeting high-profile individuals in the Middle East, Southeast Asia, and South Africa and has been used by Worok since at least September 2022. Worok is believed to be part of a cyberespionage group; however, other threat actors could use this technique for a variety of nefarious purposes.
A largescale phishing campaign has been detected that targets Microsoft 365 credentials that takes advantage of vulnerabilities in websites that allow open redirects. Open redirects are a tried and tested phishing method and are used to redirect website visitors to an untrusted website, where malicious content is hosted. That could be malware that is downloaded onto a user’s device or, in this case, a phishing form that is used to steal Microsoft 365 credentials.
These attacks are made possible due to the misconfiguration of websites, which allows a web application to accept a user-controlled input, which specifies a link to an external site, and redirects visitors to that malicious URL. This technique is very effective. It can allow email security solutions to be bypassed. If an email security solution performs a reputation check of the URL, since the URL included in the phishing email directs a user to a reputable site, chances are the email will be delivered. This technique is also effective at tricking victims, since they will initially be directed to a trusted site.
In this campaign, at least two trusted domains are used – Snapchat and American Express – which both have open redirects that send victims to malicious websites. Like many Microsoft 365 phishing attacks, the emails impersonate a variety of brands, including Microsoft Office 365, FedEx, and DocuSign. The lures used in the campaign are relative to the brand being impersonated, such as alerts from Microsoft 365 that the user has unread messages that could not be delivered, or a collaboration request on a document hosted on DocuSign.
American Express has addressed the open redirect issue, Snapchat has yet to confirm that the issue has been resolve; however, other websites could similarly be attacked and have open redirects abused. The campaign has involved thousands of emails from hijacked Google Workspace and Microsoft 365 accounts.
Website owners can improve their defenses against attacks such as these by displaying a prompt when a visitor is about to be redirected to a third-party website, requiring a click to proceed. Businesses can improve their defenses against Microsoft 365 credential phishing campaigns such as this by implementing an advanced spam filtering solution that rewrites URLs and follows all redirects – SpamTitan Plus for example, using a web filter that blocks access to malicious web content, and providing security awareness training to their employees. The latter is especially important as these open redirect tactics can often see email security solutions bypassed.
Open redirects should be specifically covered in security awareness training, without getting too technical. Employees should be told that legitimate looking URLs in emails can redirect them to malicious sites, and to always check the actual domain they are being directed to, not just the link text. These redirects can be identified as the URL will contain terms such as “url=,” “redirect=,” “external-link,” or “proxy,” and often multiple occurrences of “HTTP”. They should also ensure they carefully check the URL they land on and make sure it is the official domain used by the company being spoofed.
TitanHQ are proud to announce the launch of a new solution to protect businesses from increasingly sophisticated phishing threats. SpamTitan Plus builds on the huge success of SpamTitan Gateway and SpamTitan Cloud, which have been adopted by more than 12,000 business customers and over 3,000 Managed Service Providers worldwide.
SpamTitan solutions already provide advanced protection against phishing, malware, viruses, botnets, and ransomware that are delivered via email, with independent tests confirming a high detection and low false-positive rate. SpamTitan Plus takes those protections a step further, with significantly improved coverage, an uplift in phishing link detection, faster detection speeds, and an even lower false-positive rate.
Independent tests have confirmed SpamTitan Plus:
Provides 100% coverage of ALL current market-leading anti-phishing feeds.
Achieves a 1.5x increase in unique phishing URL detections
Has 1.6x faster phishing detections than current market-leading solutions
Is fed 10 million net new, previously undiscovered phishing URLs every single day
Just 5 minutes from initial detection of the malicious URL to protect end users’ mailboxes
Benefits of SpamTitan Plus
According to Deloitte, 91% of all cyberattacks start with a phishing email and despite many businesses providing phishing awareness training to the workforce, many employees still fail to identify phishing emails. Security Affairs says there is a 97% failure rate by employees. Add to that the increasingly sophisticated tactics used by phishers to evade email security solutions and trick end users and it is no surprise that phishing is the number 1 cybersecurity threat faced by businesses.
SpamTitan Plus improves defenses against phishing by blocking more threats before they reach inboxes and ensures that if a phishing email with a malicious link does make it to an inbox, protection is provided at the time an employee clicks the link.
SpamTitan plus provides leading-edge protection through the use of an AI-based system and is fed the latest zero-day threat intelligence. Significant improvements have been made to protect against business email compromise attacks and effectively neutralize malicious links in emails. All links in emails are rewritten and inspected to determine if they are safe and users benefit from time-of-click protection. That means when an individual clicks a link in an email, the content of the landing page is inspected for phishing forms and other malicious content such as spoofed webpages. Redirects are often used by phishers to fool email security solutions that only check the URL stated in the email. SpamTitan Plus protects against this by also following redirects.
Multiple dynamic checks are performed on URLs in real-time, with time-of-click protection ensuring that links included in emails that were benign at the time of delivery – and passed inspection – are detected as malicious if the URLs are weaponized at a later date. For instance, phishing emails may be sent on a Friday with benign links to pass inspection, and the URLs are then updated over the weekend with malicious content added ready for employees returning to work on Monday.
SpamTitan Plus benefits from massive clickstream traffic from 600+ million users and endpoints, which generates 10 million never-before-seen phishing and malicious URLs a day. These unique daily URL additions are powered out of several hundred billion local queries and 100 million cloud queries a day within SpamTitan Plus. The result is faster detection and better protection, with the lowest false positive rate of the market-leading phishing solution providers.
If you run a business or are a managed service provider (MSP) looking to improve phishing protection for your clients, give the TitanHQ team a call to find out more about SpamTitan Plus and how it can significantly improve your defenses against phishing and other email threats.
If you want to keep your computers and networks protected from malware, it is important to train your staff on how to identify a malicious website. You should also install a powerful web filtering solution to ensure your employees’ malicious website identification skills are never put to the test.
Cybercriminals are developing ingenious ways of compromising networks
Scammers and cybercriminals used to mainly send out emails with infected attachments. Double-clicking on the attachment would result in the computer, and possibly the network, being infected with malware. Oftentimes, this action would go undetected by anti-virus software programs. A full system scan would need to be conducted before the malicious software was identified.
Computer users are now much wiser and know never to open file attachments that have been sent to them by unknown individuals, and certainly never to double click on an executable file. Hackers and other cybercriminals have therefore needed to get smarter, and are now developing ever more sophisticated ways of obtaining user credentials and getting people to install malware manually. One of the ways they are doing this is by developing malicious websites.
End users are contacted via email and are sent links to websites along with a valid reason for visiting the site. Links to malicious websites are also frequently sent out in social media posts or are placed in third-party website adverts. Some sites are hijacked and visitors are redirected to fake sites automatically.
Protect your customers from web-based threats such as drive-by downloads, exploit kits, and phishing. Book a FREE WebTitan demo. Book Free Demo
What is a malicious website?
Malicious websites host malware or are used to phish for sensitive information. In the case of the latter, users are tricked into revealing sensitive data such as login credentials for online banking websites.
Malware may require some user interaction before it is installed. Visitors may be tricked into downloading a security program, for instance, by being informed their computer is already infected with malware. They may be offered a free screensaver or asked to download a fake PDF invoice.
Increasingly, malicious websites are used to host exploit kits. Exploit kits probe visitors’ browsers to identify security vulnerabilities that can be exploited without any user interaction required. If a vulnerability is detected, malware can be installed automatically on the computer or network. This method of cyberattack is called a drive-by download. Drive-by downloads can involve malware being installed onto the computer’s hard drive, a network drive, or even loaded into the computer’s memory.
Learning how to identify a malicious website is important if you want to prevent your computer from being infected, and it is essential for system administrators and other IT professionals to conduct staff training to help end users avoid these dangerous sites.
How to identify a malicious website
There are some easy ways to tell if a website is attempting to install malware:
The website asks you to download software, save a file, or run a program
Visiting the website automatically launches a download window
You are asked to download an invoice or receipt, such as a PDF file, .zip or .rar, or an executable file or .scr screensaver file
A malicious website may also tell you:
Your computer is already infected with malware
Your plug-ins or browser are out of date
You have won a competition or free prize draw. You may also be offered free money or vouchers that require you to enter your credit card or banking information
If you are asked to download any files or update your software, conduct a check of the site via Google and try to determine whether the site is genuine. If in doubt, do not download any files.
If you are told your browser is out of date, visit the official browser website and check your version number. Only ever download updates from official websites.
If you have accidentally visited a drive-by download site, by the time that you have connected it may be too late to prevent malware from being downloaded. To protect against drive-by downloads you must ensure that your browser, add-ons, and plugins are 100% up to date. You should also use a software solution to block access to drive-by download sites.
Protection from web-based threats and precision Internet content control for your workforce. Book a FREE WebTitan demo. Book Free Demo
How to block end users from visiting a malicious website
Even legitimate websites can be hacked and used to host malicious code. They may use advertising networks that are used by cybercriminals to direct visitors to malware-hosting websites. The best defense is to block these adverts and malicious websites.
Blocking access to malicious websites is a simple process. All it requires is a powerful web filtering solution to be installed. WebTitan web filtering solutions for the enterprise will help you keep your network secure by preventing users from visiting sites known to host malware.
WebTitan incorporates a range of measures to detect malicious web content to prevent employees from visiting dangerous websites. WebTitan can also be configured to block access to questionable or illegal content to enforce an organization’s acceptable Internet usage policy.
If employees are trained on malicious website identification and web filtering software is installed, your network will be much better protected from malware infections and other web-based threats.
FAQs on Guest Wi-Fi Network Security and Blocking Malicious Websites
Should I enable guest Wi-Fi?
By enabling guest Wi-Fi, you are creating a separate network for guest users to access the Internet. This is much more secure than allowing a guest user to connect to your main business network. Be aware that your guest Wi-Fi network is still connected to your business so you should control the activities that can be performed while connected.
Are guest Wi-Fi networks secure?
A guest Wi-Fi network keeps guest users away from your servers and company data. While connected to the guest network, individuals will be prevented from accessing your internal resources even if they are able to locate them. If you do not have a separate guest network, you will be at risk of hacking and data theft.
How can I make my guest Wi-Fi network secure?
You can make your guest Wi-Fi network more secure by changing the name of the network (SSID) to something less obviously tied to your business, setting a strong password, and configuring the network to prevent access to local network resources. You should also implement a web filter to prevent users from accessing malicious web content.
Is web filtering complicated?
Setting up content filtering on a wired or wireless network is easy with a cloud-based web filter. Simply change your DNS settings to point to the service provider and you can be blocking threats and restricting access to web content in minutes. You will get a web-based interface to log in and can simply click on the categories of content you want to block.
How much does a web filtering solution cost?
There are many different providers of Wi-Fi filtering solutions and the cost can vary considerably. You could end up paying upwards of $2.50 per user per month; however, solutions such as WebTitan Cloud for Wi-Fi will give you the protection you need at a very reasonable cost, which can be as little as $1 per user, per month. To find out the cost, use our cost calculator.
Phishers are constantly changing their tactics, techniques, and procedures to evade security solutions and fool end users into disclosing sensitive information or installing malware. One of the most commonly used tactics is to impersonate trusted companies, with emails often including corporate logos, footers, and even correct contact information to make the messages look like genuine communications from the spoofed companies.
Email security solutions are now much better at detecting these scam emails. Email security solutions use the email security protocols SPF, DKIM, and DMARC to detect and block email impersonation attacks. SPF – Sender Policy Framework – restricts who can send emails from a corporate domain and prevents domain spoofing. DKIM – DomainKeys Identified Mail –protects against emails being tampered with, while DMARC – Domain-based Message Authentication – works in conjunction with SPF and DKIM to protect against email spoofing attacks, by linking a domain name with the name in the From: email header. This allows messages to be identified as malicious when they are sent by an unauthorized user of a domain.
Machine-learning technology and AI are used to distinguish genuine communications from spoofed messages. Some email security solutions can perform checks of corporate logos in email messages and compare these to the sender’s address to make sure the emails have come from an official source.
One phishing campaign has been detected that attempts to circumvent these AI protections by using corporate logos that have had mathematical symbols inserted to replace existing letters. Checks of these images will not alert AI-based email security solutions to a fake message, since the spoofed email messages do not contain the official corporate logo. The logos are, however, sufficiently similar to the genuine logo to fool end users.
One example of this was found in an email spoofing Verizon. The official Verizon logo has a red V, which has been substituted for a red square root symbol. These emails attempt to trick the recipients into clicking a link in the email which directs them to a website that also spoofs the brand. They are then asked to provide credentials to verify their identity. Those credentials are then captured by the scammers.
The Verizon phishing email uses a fake voicemail message as a lure, then asks the user to enter their Office 365 credentials to access the voicemail message. While that is an obvious red flag as Verizon does not require Office 365 credentials, individuals who failed to identify the email for the scam it is maybe fooled, after all, the phishing page accurately spoofs the official Verizon website.
While many spoofed emails will be blocked by SPF, DKIM, and DMARC, machine learning technology, and other checks employed by email security solutions, email security gateways are not 100% effective. For example, independent tests have shown SpamTitan has a very high detection rate – in excess of 99.97% – but a small number of emails will bypass defenses on occasion and that is true of all email security solutions.
This is why it is also recommended to implement a web filtering solution. Web filters tackle phishing from a different angle. Instead of blocking the message, they block attempts by end users to visit malicious links in emails.
TitanHQ’s web filtering solution – WebTitan – is a DNS-based web filter. When a request is made to visit a website, WebTitan performs a check at the DNS lookup stage of the request, before any content is downloaded. If the request is for a known malicious website or URL that violates an organization’s policies, the request is denied, and the user is protected. WebTitan is constantly updated to include malicious web content through multiple threat intelligence feeds to provide zero-minute protection.
Phishing attacks are becoming much more sophisticated, and while email security solutions will block the majority of attacks, phishing defenses now need to consist of multiple overlapping layers of security. By implementing a spam filter, web filter, antivirus software, and providing regular security awareness training, businesses can mount a formidable defense against phishing attacks.
For more information about web filters, contact TitanHQ today. All TitanHQ solutions are available on a free trial to allow potential customers to try before they buy with no obligation to proceed. Product demonstrations can also be provided on request.
A new SharePoint phishing scam has been detected which attempts to steal Office 365 credentials from business users. those credentials are subsequently used to gain access to sensitive company information stored in the cloud and email accounts which can be used in phishing and business email compromise attacks.
The scam emails used in this campaign are similar to those used in countless Google Docs phishing scams. The messages appear at face value to be genuine attempts by employees and contacts to collaborate through the sharing of files. Most of these scams are concerned with spreading malware. The documents usually contain malicious macros which download the malware payload if allowed to run. JavaScript and VB scripts are also used to achieve that aim. However, due to the value of Office 365 accounts, hackers are increasingly conducting attacks to gain access to Office 365 credentials.
The latest scam uses messages that appear to be standard quests to collaborate on SharePoint. This SharePoint phishing scam includes a hyperlink to a genuine SharePoint document, which may not be flagged as malicious since the file itself does not contain malware.
The SharePoint file advises the user that the content they are looking for has been uploaded to OneDrive for Business and a further click is necessary to access the file. A hyperlink named “Access Document” is included in the SharePoint file along with the genuine OneDrive for Business logo. At face value, the document does not appear to be malicious, although checking the destination URL of the link will reveal that it directs the user to a suspect website.
After clicking the link, the user is presented with a login window for Office 365 and their Microsoft Office 365 credentials must be entered to proceed. Entering Office 365 credentials at this point will see them harvested by the scammers running this campaign. The user is unlikely to realize that they have been successfully phished as after entering their credentials they will be directed to the genuine Office 365 web page.
Protection from web-based threats and precision Internet content control for your workforce. Book a FREE WebTitan demo. Book Free Demo
This SharePoint phishing scam is being used in targeted attacks on businesses. SharePoint is commonly used by businesses for collaboration, so there is a high probability that employees will be used to receiving such requests. Finding email addresses for business users is also straightforward. Lists can be purchased on darknet marketplaces and hacking forums, or they can be obtained from professional social networking sites such as LinkedIn.
This SharePoint phishing scam, Google Docs phishing scams, and similar campaigns spoofing Dropbox are commonplace and are highly effective. They take advantage of familiarity with these collaboration services, trust in the brands, and the lack of security awareness of employees. These brand impersonation attacks use email formats that are identical to those used in genuine collaboration requests, including correct logos, formatting and genuine-looking links, and can be difficult for end users to identify as malicious.
Preventing these SharePoint spoofing scams requires technological solutions to stop the messages from being delivered and links from being followed. Standard Office 365 anti-phishing protections are not particularly effective at blocking threats such as these. Businesses will be better protected using a dedicated anti-phishing solution on top of Office 365. SpamTitan is an award-winning anti-spam and anti-phishing solution that works seamlessly with Office 365 and provides superior protection against phishing attacks. SpamTitan uses a wide range of innovative techniques to identify malicious emails and block them at source to prevent them from reaching end users’ inboxes.
Security awareness training is also vitally important to condition employees to stop and think before taking any action requested in an email and to raise awareness of the use of collaboration requests in phishing campaigns.
If you want to improve email security and better defend your organization against phishing attacks, contact the TitanHQ team today and request further information on SpamTitan. Product demonstrations can be arranged on request, free trials of the full product are available with full support during the trial, and a range of deployment options are available to suit the needs of your business. Also consider using a web filter such as WebTitan, which will block attempts to block websites used for phishing and malware distribution.
A new malware variant has appeared that is being pushed out via malicious search engine advertisements that appear at the top of the listings for searches related to cracked software. The new malware has been dubbed MosaicLoader by Bitdefender researchers, who have seen increasing numbers of the malware appear in recent weeks.
As the name suggests, MosaicLoader is a malware downloader. It has been developed to deliver a range of different payloads onto victims’ devices, with the ‘Mosaic’ part of the name coming from the intricate internal structure of the malware, which was developed to hamper attempts by security researchers to analyze and reverse engineer the malware.
The malware is complex and uses a variety of methods to evade detection and hamper attempts at analysis, including code obfuscation with the code broken into small chunks, shuffling the execution order and creating a mosaic-like structure. The malware also mimics the file information of legitimate software.
The current campaign delivering MosaicLoader targets individuals looking for cracked software, with the adverts appearing in the search engine listings for a variety of keywords and terms associated with pirated software. The initial malware droppers masquerade as executables for a legitimate software, including using company names and descriptions within the metadata and similar icons and file info as legitimate software.
The initial droppers use a variety of names linked to pirated software, including mirc-7-64-keygen-plus-crack-fully-version-free-download, officefix-professional6-122-crack-full-version-latest-2021, and setup-starter_v2.3.1. One of the droppers mimics a legitimate NVIDIA process, although the digital signature is unrelated to NVIDIA. Once users start processes with names in the word cloud of installers, the infection chain commences and will run in the background without alerting the user, with no visible windows displayed.
What makes MosaicLoader particularly dangerous is it can be used to deliver any payload onto a victim’s system. The malware has been observed delivering a broad range of malicious payloads, such as Remote Access Trojans (RATs) and backdoors, cookie stealers, and cryptocurrency miners. Based on the payloads delivered it is likely that, at least initially, MosaicLoader is being operated and used by one threat group, but it could easily be used under the malware-as-a-service model as a malware delivery service.
Protecting against MosaicLoader is straightforward in principle. Users should avoid downloading any cracked software. Not only is it illegal to download cracked software, but there is also a reasonable likelihood that doing so will install malware such as MosaicLoader, spyware, adware, and many potentially unwanted programs (PUPs). It is also necessary to have up to date antivirus/antimalware software installed.
Employees are always looking for ways to make their lives easier and installing unauthorized software – shadow IT – is common. Shadow IT may save an employee time during their working day, but it also carries risks, especially the installation of pirated software. This has become even more of a risk in the COVID-19 era with so many employees working from home.
Businesses can improve protection against MosaicLoader and other malware variants by carefully controlling the websites that employees can access on their corporate devices and under BYOD. Content filters, such as WebTitan, can be configured to restrict access to websites not required for work or block certain categories of website, as well as known malicious URLs.
Web filters can also be configured to block downloads of specific file types, such as software installers and other executable files often used to install malware. It should also be made clear to all staff that the downloading of unauthorized software onto corporate devices is prohibited, and that the installation of cracked software is illegal.
For further information on content filtering with a DNS filter and other cybersecurity measures you can implement to protect against malware, contact TitanHQ today. The WebTitan web filter is available on a free trial and can be implemented in minutes, and showing positive results in under an hour.
Do you want to help the workforce learn how to identify fake emails to stop them divulging their credentials on phishing websites or inadvertently downloading malware onto their computers? In this post we outline some of the signs of phishing emails that everyone should be looking for every time an email is opened to confirm whether it is legitimate or if it is likely a phishing email, email impersonation scam, or poses a network security threat.
What Threats are Sent via Email?
Email is the most common way for cybercriminals to breach company defenses. It has been estimated that 91% of all cyberattacks start with a phishing email. Phishing is the name given to an attempt to obtain sensitive information by deception, often by impersonated a trusted entity. Phishing can occur over the telephone, text message, social media networks, or instant messenger services, but most commonly phishing occurs via email. Phishing emails also deceive people into downloading malicious files that install malware or ransomware. One response to a phishing email is all it takes for cybercriminals to obtain login details that allow them to access email accounts and cloud services and steal large quantities of sensitive data or gain the foothold they need for an extensive compromise of a business network.
If you have a powerful email security solution installed, the majority of phishing emails and other email threats will be blocked, but no email security solution will provide complete protection, so everyone needs to learn how to identify fake emails and know what they should do if such an email is received.
Employees Must be Receive Security Awareness Training
In certain industries, security awareness training for the workforce is mandatory and it is necessary to teach employees how to identify fake emails. In the United States, for example, regular security awareness training is a requirement of the Health Insurance Portability Act (HIPAA). All healthcare organizations must ensure that their employees can identify fake emails such as those used for phishing.
Even if not required by law, security awareness training is strongly advised. Employees cannot be expected to know the difference between a genuine and a scam email if they are not taught what to look for. By providing this training regularly you can condition your employees to always conduct checks to identify fake emails, which will help you to prevent costly data breaches.
How to Identify Fake Emails!
Cybercriminals regularly change their tactics, techniques and procedures to evade security defenses and fool people into divulging sensitive information or installing malware. The themes of malicious emails and lures in phishing emails often change, but there are commonalities in many of these scams which are detailed below. A scam or phishing email may include one or more of these tactics or techniques.
Be aware that just because an email appears to have been sent from a known and trusted email address or person, or a company with the right branding and logos, it does not mean that the email is genuine. You should still carefully check the message before responding or taking any action suggested in the message.
Urgency
Phishing and scam emails usually have a sense of urgency. Attackers want you to act quickly without thinking, as the longer you take, the more likely it is you will identify the email for what it really is.
Threats
Phishing and scam emails often include a threat of negative consequences if no action is taken. Your account will be closed, you will lose access to a service, you will have to pay a fine, or you will be arrested, are all common ways to convey urgency and get people to take the action suggested in the email.
Rewards
Scammers often use FOMO, bargains, or rewards to encourage people to get in touch or visit a website. A too-good-to-be-true offer such as a new iPhone for $100 or a prize in a competition that you haven’t entered is a common ruse to get people to click a malicious link.
Requests for Sensitive Information
The easiest way to obtain sensitive information is simply to ask for it. You should stop, think, and carefully consider any request to send sensitive information via email. Make sure the email address – not just the display name – is correct and try to call to confirm requests to send sensitive information or change payment details using verified contact information – Not contact information supplied in the email.
Hyperlinks
Hyperlinks are often included to get past email security defenses and direct individuals to scam websites. The URL is often masked with different text so hover your mouse arrow over the link to find the destination URL. URL shortening services are often used to hide the true destination URL. The URL linked in a message may also not be the destination URL as you may be redirected via multiple websites before landing on a page. Make sure you carefully check the URL and any domain you land on. If in doubt, do not click hyperlinks in emails.
Attachments
Attachments are often used with double extensions to make them appear legitimate (.doc.exe). Simply opening these files is all it takes to install malware. Macros are often used that contain code that will download malware if they are allowed to run. Scan email attachments with AV software before opening and do not enable content unless you are 100% sure the attachment is genuine. Always treat email attachments as suspicious, and never open a file with an unfamiliar, unusual, or suspicious extension (.zip, .scr, .js, .exe, .vbs, .bat, .com, .msi, .jse, .lnk, .vb etc.)
Irregular email addresses and domains
Often the display name and the actual email address will be very different. Make sure you check the actual address used. Companies do not use public email domains (the part after the @) such as Gmail. Check that the domain is actually the one used by a company i.e., paypal.com is genuine; pay–pal.com is not. Also check that the domain is spelled correctly and there are no missing or transposed letters. Look out for potential alternative characters such as an rn instead of an m, a zero instead of an o, and a 1 instead of an I.
Spelling and grammar
Scammers are good at scamming, but often not so good at spelling. Many attackers do not speak English as their first language, so mistakes are often made with spelling and grammar. These mistakes can be deliberate to ensure only people who are likely to fall for the next stage of the scam respond.
Strange requests
Malicious emails often convince people to take out of the ordinary actions, such as requests to help out a colleague or boss by buying gift cards. Any out-of-band request should be confirmed with a quick phone call, but not using any contact information supplied in the email.
Odd salutations and message tone
How messages are addressed is a good indicator of whether the message is genuine. Most emails from companies now address recipients by name. If Netflix emails you and addresses you as Dear Customer, it could well be a scam. Attackers will probably not be used to the tone of emails usually sent when they conduct email impersonation attacks and may be overly familiar or unnaturally formal.
Block More Email Threats with an Advanced Email Security Solution
Many phishing and scam emails are highly sophisticated and are very difficult to distinguish from genuine emails, even by employees who have been trained how to identify fake emails. Messages can be sent from genuine email accounts that have been compromised, past message threads can be hijacked, and genuine logos and layouts used when companies are spoofed. Training the workforce how to identify fake emails is important, but you also need an advanced spam filtering solution in place to ensure the vast majority of these emails are blocked and not delivered to inboxes.
If you want to improve your defenses against email attacks, contact the TitanHQ team and ask about SpamTitan. SpamTitan is an easy to use, powerful email security solution that will keep you protected from scams and emerging and zero-day email threats. Furthermore, SpamTitan is one of the most cost-effective email security solutions on the market for businesses of all sizes.
The disruption to learning from a pandemic that has lasted more than a year is bad enough, but many schools have experienced even more disruption just as many have opened their gates and allowed students back into classrooms. The SARS-CoV-2 virus may have been brought under control thanks to lockdown measures and the rollout of vaccines, but another type of virus is proving to be a major threat – ransomware.
FBI Warns of Targeted Ransomware Attacks on K12 Schools and Higher Education
Ransomware attacks on schools have been stepped up in recent months and schools and higher education institutions are being actively targeted. In the United States, the Federal Bureau of Investigation recently issued an alert to the education sector warning about the threat of attacks involving Pysa ransomware. The threat actors behind this ransomware variant have been actively targeting K12 schools, higher education, and seminaries. Buffalo City Schools were forced to close their schools in March following a ransomware attack that crippled their IT systems, just before students were about to return to classrooms as part of a phased reopening of schools.
The ransomware is deployed manually after compromising the network. The attack often starts with a phishing email, which gives the attackers the foothold in the network they need. They then conduct reconnaissance, move laterally, and compromise entire networks before deploying their ransomware.
Prior to running the encryption routine that cripple IT systems, the attackers steal sensitive data. Files containing student information are obtained and threats are issued to publish or sell the stolen data if the ransom is not paid. The gang, like many others, has a leak site and routinely follows through on the threat.
Spike in Ransomware Attacks on UK Schools
Ransomware attacks on schools are not confined to the United States. The Pysa ransomware gang is also targeting schools in the United Kingdom and many other countries, and the Pysa gang is not alone. Many other ransomware operations have been attacking schools.
Following a rise in ransomware attacks on UK schools, the UK’s National Cyber Security Centre (NCSC) issued an alert to educational institutions about the growing threat of attacks. NCSC has observed an increase in ransomware attacks on schools from late February 2021, which coincides with students returning to classrooms after an extensive period of school closures due to the pandemic.
The NCSC said there is no reason to believe that these attacks are being conducted by the same criminal group. This appears to be the work of multiple threat groups. These attacks have caused varying levels of disruption, including rendering entire networks inoperable, disabling email and websites, and hampering the ability of students to learn. In some cases, students have lost coursework as a result of the attacks, records of COVID-19 tests have been rendered inaccessible, and school financial records have been lost.
Unfortunately, even paying the ransom is no guarantee of being able to recover encrypted files. While the attackers claim they have the keys to unlock the encryption, they may not be provided. There is also no guarantee that stolen data will be deleted when the ransom is paid. There have been many cases when further ransom demands have been issued after payment has been made.
Adopt a Defense in Depth Strategy to Block Ransomware Attacks
The Department for Education (DfE) has recently urged UK schools to review their cybersecurity defenses and take the necessary steps to harden their defenses against cyberattacks. The NCSC explained that there is no single cybersecurity solution that will provide protection against these attacks. What is required is a defense in depth approach to security.
Defense in depth means implementing multiple overlapping layers of security. If one layer fails to block an attack, others are in place to block the attack.
In practice this means good patch management – applying updates to software, firmware, and operating systems promptly. Antivirus software must be installed on all devices and be kept up to date. Spam filtering solutions should be implemented to block the phishing emails that give the attackers access to the network. These filters can also be used to block email attachments that are not typically received.
Internet filters for schools should be used to block access to malicious websites. These filters inspect the content of websites to determine if it is malicious. They also categorize web content, and the filters allow schools to carefully control the types of content that students and staff can access to reduce risk.
Multi factor authentication should be implemented on all remote access points and email accounts, remote access ports that are not being used should be blocked, and a VPN should be used for remote access. The rule of least privilege should be applied for remote access and all staff and student accounts.
It is also recommended to prevent all non-administrator accounts from being able to install software, office macros should be disabled, as should autorun on portable devices.
It is also vital that all files are backed up daily and backups tested to make sure file recovery is possible. Backups should be stored on non-networked devices and must not be accessible from the systems where the data resides. Ideally, multiple backup copies should be created with at least one stored on an air-gaped device.
The COVID-19 pandemic created many new opportunities for cybercriminals who were all too happy to take advantage. In 2020, businesses had to rapidly change their working practices to deal with national lockdowns and changed to a more distributed, remote workforce. In response, cybercriminals stepped up phishing attacks to obtain credentials to email accounts, VPNs, and remote access solutions.
The increase in email threats and phishing activity was recently highlighted by the Anti-Phishing Working Group which has been gathering data on phishing attacks from its member organizations throughout the year. Its latest report shows phishing attacks doubled in 2020, peaking in October 2020 when previous records were shattered. In October, 225,304 new phishing sites were detected, compared with under 100,000 in January 2020. From August to December 2020, more than 200,000 new phishing sites were detected each month.
Links to these phishing websites are sent in large scale phishing campaigns and many of the messages land in inboxes where they attract a click. The pandemic made that much easier for cybercriminals who expertly exploited the thirst for knowledge about COVID-19 to conduct their scams. As the year progressed other COVID-19 themed lures were used including COVID-19 relief payments for businesses, offers of early vaccines, small business loans, tax deadline extensions, and many more.
Cybercriminals often use compromised websites for hosting their phishing forms, but it is now much more common for the attackers to purchase their own domains that are tailored for each phishing campaign. These lookalike domains can easily fool individuals into believing they are on a legitimate website.
Cybercriminals have also been using encryption to hide their phishing URLs and fool employees. Hosting phishing URLs on HTTPS sites can fool employees into believing the web content is genuine, and many security solutions do not examine encrypted content which makes the URLs hard to identify and block. In Q4, 2020, 84% of phishing URLs used SSL encryption.
The increase in use of SSL encryption is a concern, as many people mistakenly believe that a site starting with HTTPS is secure when that is not the case. SSL inspection means the connection between the browser and the website is secure, which means users are protected against the interception of sensitive information, but a cybercriminal may own or control that website. The secure connection just means other cybercriminals will not be able to intercept login credentials as they are entered on a phishing site.
The problem for businesses has been how to block these threats as they grow in number and sophistication. Many businesses have previously relied on Office 365 anti-spam protections for blocking spam and phishing threats, but large volumes of these malicious emails are delivered to Office 365 inboxes. When that happens and a malicious link is clicked, they have no way of stopping employees from disclosing sensitive information.
One way that businesses can better protect against these phishing attacks is by implementing a web filtering solution with SSL inspection. WebTitan for instance can decrypt websites, inspect the content, and then re-encrypt which means malicious websites are not hidden and can be identified and blocked.
WebTitan also incorporates multiple threat intelligent feeds to ensure that as soon as a phishing URL is detected, all WebTitan users will be immediately protected. WebTitan ensures that protection is provided against emerging phishing URLs and zero-minute threats. When combined with an advanced spam filtering solution such as SpamTitan to block phishing emails at source and ensure they do not reach inboxes, businesses will be well protected against phishing attacks.
A malware delivery campaign has been identified that uses phishing emails, malicious macros, PowerShell, and steganography to deliver a malicious Cobalt Strike script.
The initial phishing emails contain a legacy Word attachment (.doc) with a malicious macro that downloads a PowerShell script from GitHub if allowed to run. That script in turn downloads a PNG image file from the legitimate image sharing service Imgur. The image contains hidden code within its pixels which can be executed with a single command to execute the payload. In this case, a Cobalt Strike script.
Cobalt Strike is a commonly used penetration testing tool. While it is used by security professionals for legitimate security purposes, it is also of value to hackers. The tool allows beacons to be added to compromised devices which can be used to execute PowerShell scripts, create web shells, escalate privileges, and provide remote access to devices. In this campaign, the hiding of the code in the image and the use of legitimate services such as Imgur and GitHub helps the attackers avoid detection.
The hiding of code within image files is known as steganography and has been used for many years as a way of hiding malicious code, typically in PNG files to prevent the code from being detected. With this campaign the deception doesn’t end there. The Cobalt Strike script includes an EICAR string that is intended to fool security solutions and security teams into classing the malicious code as an antivirus payload, except contact is made with the attacker’s command and control server and instructions are received.
This campaign was identified by researcher ArkBird who likened the campaign to one conducted by an APT group known as Muddywater, which emerged around 2017. The threat group, aka Static kitten/Seedworm/Mercury, primarily conducts attacks on Middle eastern countries, commonly Saudi Arabia and Iraq, although the group has been known to conduct attacks on European and US targets. It is unclear whether this group is responsible for the campaign.
Naturally one of the best ways to block these types of attacks is by preventing the malicious email from being delivered to inboxes. A spam filter such as SpamTitan that incorporates a sandbox for analyzing attachments in safety will help to ensure that these messages do not get delivered to inboxes. End user training is also recommended to ensure that employees are made aware that they should never enable macros in Word Documents sent via email.
A web filtering solution is also beneficial. Web filters such as WebTitan can be configured to give IT teams control over the web content that employees can access. Since GitHub is commonly used by IT professionals and other employees for legitimate purposes, an organization-wide block on the site is not recommended. Instead, a selective block can be placed for groups of employees or departments that prevents GitHub and other potentially risky code sharing sites such as PasteBin from being accessed, either deliberately or unintentionally, to provide an extra layer of protection.
The Advanced Persistent Threat (APT) group APT32 – aka OceanLotus – is conducting a malware campaign targeting Apple MacOS users. APT32 is a nation-state hacking group that primarily targets foreign companies operating in Vietnam. The data exfiltrated by the hackers is believed to be used to give Vietnamese companies a competitive advantage, although the exact motives behind the attacks are opaque.
The group is known for using fully featured malware which is often delivered via phishing emails and commercially available tools. The latest malware variant was identified by security researchers at Trend Micro, who tied the malware to APT32 due to code similarities with other malware variants known to have been used by the group. The malware is a MacOS backdoor that allows the group to steal sensitive information such as business documents. The malware also gives the attackers the ability to download and install additional malicious programs on victim computers.
The malware is being delivered via phishing emails that have a zip file attachment which is disguised as a Microsoft Word document. If the recipient is convinced to open the attached file, no Word document will be opened, but the first stage of the payload will execute in the background. The first stage changes access permissions which allows the second stage payload to be executed, which prompts the third stage of the payload that downloads and installs the backdoor on the system. This multi-stage delivery of the backdoor helps the malware to evade security solutions.
Protecting against attacks involves blocking the initial attack vector to prevent the phishing emails from being delivered to end users. End user security awareness training should be provided, and employees conditioned not to open email attachments from unknown senders. It is also recommended to ensure computers are kept fully patched, as this will limit the ability of the group to use its malware to perform malicious actions.
Chinese TA416 APT Group Delivering New Variant of PlugX RAT
The APT group TA416 – aka Mustang Panda/Red Delta – is conducting a campaign to distribute a new variant of its PlugX Remote Access Trojan (RAT). TA416 is a nation state sponsored group with strong links to the Chinese government and has previously conducted attacks on a wide range of targets around the world.
The group is known for using spear phishing emails and social engineering techniques to deliver malware that allows the hackers to gain full control of an infected computer. The attacks are conducted for espionage purposes; however, the malware has an extensive range of capabilities. In addition to stealing data, the malware can copy, move, rename, execute, and delete files, log keystrokes, and perform many other actions.
The new campaign delivers two RAR archives, which act as droppers for its PlugX malware. The theme of the emails in the latest campaign are a supposed new agreement between the Vatican and the Chinese Communist Party.
The campaign was identified by researchers at Proofpoint, who could not pinpoint the exact delivery method; however, TA416 is known to use Google Drive and Dropbox URLs in its phishing emails to deliver malicious payloads. One of the RAR files is a self-extracting archive that extracts four files and executes an Adobelm.exe file, which delivers a Golang version of the PlugX malware. The recent update to the PlugX RAT helps it evade security solutions.
Combating the APT Threat
The tactics used by these and other APT groups to deliver malware are constantly changing, with phishing campaigns regularly tweaked to increase the likelihood of end users performing the desired action and to prevent the campaigns being detected by anti-virus and anti-phishing solutions. The changes to the malware and campaigns are effective and can easily fool end users and bypass technical controls, especially signature-based antivirus solutions.
Advanced AI-based cybersecurity solutions are required to detect and block these threats. These solutions detect known malware variants and can also identify zero-day malware threats and never-before seen phishing campaigns. The solutions work by protecting against the two most common attack vectors – email and the web – and prevent malicious messages from reaching inboxes and block downloads of malicious files from attacker-controlled websites.
Cybercriminals are using an increasing range of tactics, techniques and procedures to fool the unwary into disclosing their credentials or installing malware, which is making it hard for end users to distinguish between genuine and malicious messages.
It is common for cybercriminals to purchase lookalike domains for use in phishing scams and for distributing malware. Oftentimes the domains purchased are very similar to the domains they impersonate, aside from one or two changed letters.
For instance, the letters v v could be used in place of a w for a domain spoofing Wal-Mart – e.g. VVal-Mart. In internationalized domain name (IDN) homograph attacks, aka script spoofing, Greek, Latin, and Cyrillic letters are used in domains instead of standard letters. This can lead to domains being almost indistinguishable from the domains they are spoofing, especially since the web pages hosted on those domains include the logos and color schemes used on the official websites.
FBI Warns of Use of Spoofed FBI Domains
Recently the Federal Bureau of Investigation (FBI) issued a warning following the discovery that many FBI-related domain names have been purchased that closely resemble official FBI websites. While these domains are not believed to have been used for malicious purposes to date, it is probable that the individuals registering these domains were intending to use them in phishing attacks, for distributing malware, or for disinformation campaigns. The domains include fbidefense.com, fbimaryland, fbi-ny, fib.ca, fbi-intel.com, fbi.systems, and fbi.health.
These domains can be used to host phishing kits or exploit kits, but the domains can be used to create official-looking email addresses. An email from one of these domains, that has the FBI in the name, could easily scare someone into taking an action demand in the email, such as disclosing their login credentials or opening a malicious email attachment.
Legitimate Cloud Services Leveraged in Sophisticated Phishing Attacks
There have also been phishing campaigns detected in recent weeks that use legitimate cloud services to mask the malicious nature of the emails. Campaigns have been detected that use links to Google Forms, Google Docs, Dropbox, and cloud services from Amazon and Oracle. Emails are sent that include fake notifications with links to these cloud services; however, once the link is clicked, the user is taken through a series of redirects to a malicious website hosting fake Office 365 login prompts that steal credentials.
Several of these campaigns involved checks to make sure the recipient is a real person, with automated responses directed to official domains to prevent analysis. Phishers are also continuing to use typosquatting – the name given to the use of domains with natural typographical errors – to catch out careless typists.
Sophisticated Campaigns Call for Sophisticated Cybersecurity Defenses
The sophisticated nature of today’s phishing and malware campaigns, together with cybercriminals’ constantly changing tactics, techniques, and procedures, mean it is becoming harder for end users to distinguish between genuine and malicious emails. End user security awareness training is still important, but it has never been more important to have effective technical solutions in place to ensure that these threats are identified and blocked before any harm is caused.
The first line of defense against phishing is an email security gateway solution through which all emails need to pass before they reach inboxes. These solutions need to use a range of advanced mechanisms for identifying malicious and suspicious emails, so should one mechanism fail to identify a malicious email, others are in place to provide protection.
SpamTitan from TitanHQ is one such solution that incorporates many layers of protection to detect and block phishing and malware attacks via email. Checks are performed on the message headers, content is analyzed, and machine learning is incorporated to identify never before seen threats, in addition to blacklisting of known malicious email addresses and domains. To block malware threats, SpamTitan uses dual anti-virus engines to block known threats and sandboxing to identify and block zero-day malware threats. Working seamlessly together, these mechanisms will block 99.97% of malicious messages.
An additional anti-phishing solution that you may not have considered is a web filtering solution. Web filters are important for blocking the web-based component of phishing attacks and preventing individuals from visiting sites used for malware delivery. A web filter can also block redirects to malicious websites that hide behind links to legitimate cloud services.
WebTitan from TitanHQ is a smart, DNS-based web filtering solution that uses automation and advanced analytics to block emerging phishing and other malicious URLs, not just those that have been already used in attacks and have been added to blacklists. Through the use of AI-based technology, WebTitan can provide protection from zero-minute threats.
Advanced cybersecurity defenses do not need to be complicated for end users to use. Both SpamTitan and WebTitan have been developed to be easy to implement, use, and maintain. While they incorporate all the required protections and allow advanced users to drill down and analyze threats, they can also easily be used to protect networks and devices by users with little technical skill. The ease of implementation, use, and maintenance together with the superb threat protection are why the solutions are consistently rated so highly on review sites such as Capterra, GetApp, Software Advice, and on Google Reviews.
To improve your defenses against cybersecurity threats delivered via email and via the web, give the TitanHQ a team a call today and find out more about SpamTitan Email Security and WebTitan DNS filtering.
Phishers are constantly coming up with new scams that abuse trust. People tend to trust their favorite brands and when email communications are sent by those companies there is a tendency for the emails to be trusted. The same is true when emails are sent from email contacts such as work colleagues and friends. Cybercriminals take advantage of trust to get users to take a specific action, such as clicking on an embedded hyperlink in an email or opening an email attachment.
Many businesses now provide security awareness training to employees and try to teach them to always be vigilant and never to trust emails implicitly, even if they have been sent by known contacts. Just because an email has been sent from a known and trusted email account does not mean the message is genuine. Email accounts are often compromised and used to send phishing emails. The Emotet Trojan hijacks email accounts and uses them to send copies of itself to the victim’s contacts, and several other malware variants do the same. Email addresses are also spoofed. The display name may be correct or believable, but the actual email account used to send the message is anything but.
Another tactic is now being used by at least one cybercriminal group than similarly abuses trust, albeit in a new way. A phishing campaign, which was first detected on September 21, 2020, uses the challenge-response test CAPTCHA to simultaneously make the campaign believable and also to reduce the probability of the scam being detected by email security solutions.
Internet users will be familiar with CAPTCHA, although maybe not by name. The CAPTCHA system is used by many websites as a way to determine if a website visitor is a human or a bot, most commonly on forms.
Google uses CAPTCHA and requires users to pass a pictorial challenge where it is necessary to select all the images in a group that featuring a car, bicycle, bus, or traffic lights. If you pass the challenge you will be allowed to proceed, if you fail you will not. Other versions involve entering in a number or code word that has been heavily disguised in an image.
While these CAPTCHA challenges can be annoying, they are associated with security so if a website has one of these challenges, subconsciously people tend to feel more secure. However, as with a website starting with HTTPS, it does not mean the website is genuine.
In this new phishing campaign, users are likely to feel more secure when credentials are requested since they had to pass a CAPTCHA test, especially considering the page on which the challenge was set up looks just like the genuine login prompt for Office 365. The background is the same, as is the login prompt. The only difference between the genuine login page and the fake version is the URL.
Security teams face a challenge detecting and blocking these phishing pages as email security solutions, despite having AI-based detection mechanisms, are essentially bots and, as such, cannot pass a CAPTCHA challenge.
A second tactic is also used to evade detection. The scammers have set up their campaign so that only a specific set of IP addresses will be presented with the CAPTCHA test on the fraudulent domain. If any IP address outside a specific range attempts to visit the link– the IP range used by the targeted company – a redirection will occur to the genuine Microsoft login page.
While these scams help to ensure that malicious emails are delivered to inboxes, organizations do not need to be totally reliant on their employees recognizing the scams and taking appropriate action (reporting the email to the IT security team).
With a web filtering solution in place, attempts to visit known malicious websites will be blocked. When malicious domains are detected they are automatically added to a web filter’s blacklist, and any attempts to visit malicious domains will be blocked.
WebTitan is a low maintenance security solution that can be set up in about 5 minutes and will protect against the web-based component of phishing attacks and will block malware downloads from malicious websites. WebTitan works in tandem email security solutions to provide greater protection against malware and phishing attacks. The solution can also be used to control the content that employees and guest network users can access over the internet, whether they are on the network or working remotely.
If you have not implemented a web filter or are unhappy with your current solution, give the WebTitan team a call to find out more. A product demonstration can be arranged, you can have a free trial of the solution, and assistance can be provided to help you get the most out of WebTitan during your trial.
The COVID-19 pandemic has given cybercriminals a golden opportunity to make money. With the world focused on little else other than the response to the pandemic, and with people craving information about the virus, it is not surprising that standard phishing lures have been abandoned in favor of COVID-19 themed lures.
COVID-19 and coronavirus themed domains have been purchased in the tens of thousands and are being used for phishing, malware distribution, and a variety of scams such as obtaining donations to fake charities. Figures released by the Palo Alto Networks Unit 42 team for the period of February to March show there has been an average daily increase of new COVID-19 related domains of 656%, a 569% increase in the number of malicious COVID-19 domains, and a 788% increase in new high-risk domains.
Several domain registrars have started taking steps to combat coronavirus and COVID-19 related fraud and some, such as Namecheap, are now preventing the registration of new domains related to COVID-19. Domain registrars are flagging these new domains for investigation, but that is a manual review process that takes time. In the meantime, the domains are being set up and used for convincing scams.
One malicious campaign uncovered in the past few days uses COVID-19 themed domains to distribute the banking Trojan Grandoreiro. The websites are used to host videos that promise to provide important information about SARS-CoV-2 and COVID-19. When visitors click on the video, a file download is triggered and the user is required to run the installer to view the video content, but instead installs the banking Trojan. The banking Trojan has previously been delivered via spam email, but the threat group behind the malware have changed tactics in response to the pandemic and have changed to web-based delivery.
There have been many similar campaigns created using malicious COVID-19 domains to deliver a slew of malware variants such as keyloggers, information stealers, cryptocurrency miners, and other Trojans.
Lockdown has left people with a lot of time on their hands and outdoor activities have been swapped for more TV time. It is no surprise that movie piracy sites have seen a huge surge in traffic and malware distributors are taking advantage and are bundling malware with pirated video files and using fake movie torrents to deliver malware.
An investigation by Microsoft identified a campaign that uses a VBScript packaged into ZIP files that claim to be pirated movie files. The campaign was being conducted to deliver a coinminer that runs in the memory, with living-of-the-land binaries also used to download other malicious payloads.
These campaigns often have a phishing component, with emails sent to drive traffic to these malicious websites. An advanced spam filtering solution can help to block the email component of these campaigns, but businesses should also consider an additional layer to their security defenses to block the web-based component of these attacks and prevent their remote employees from visiting malicious COVID-19 domains. That protection can be provided by a DNS filtering solution such as WebTitan Cloud.
WebTitan Cloud filters out malicious websites at the DNS lookup stage of a web access request. When a user attempts to visit a website, instead of the standard DNS lookup to find the IP address of a website, the request is sent through WebTitan. If an attempt is made to visit a malicious domain, the request will be blocked and the user will be directed to a local block page. WebTitan can also be configured to block certain file downloads and filter the internet by category, such as blocking P2P file-sharing and torrents sites to provide additional protection against malware and the installation of shadow IT.
WebTitan Cloud can be quickly set up remotely by sysadmins to protect all workers on and off the network with no clients required, which makes it an ideal solution during the COVID-19 pandemic for protecting remote workers.
For further information on protecting your organization and remote employees from web-based attacks, to register for a free trial of WebTitan, and for details of pricing, give the TitanHQ team a call today.
There has been a massive rise in the number of telecommuting workers as a result of the 2019 Novel Coronavirus pandemic and cybercriminals are taking advantage. Phishing and malware attacks have soared in the past few weeks and home workers are being targeted.
Individuals who regularly worked from home before the COVID-19 crisis will be used to taking precautions when connecting to virtual environments set up by their employers, but huge numbers of employees are now logging in remotely for the very first time and may not be aware of the telecommuting cybersecurity risks. IT and IT security departments have also had to set up the workforce for home working in a hurry, and the sheer number of employees that have been forced into telecommuting means corners have had to be cut which has created opportunities for cybercriminals.
Even if the transition to having the entire workforce telecommuting has been expertly managed, risk will have increased considerably. Cybersecurity is far harder to manage when the entire workforce is outside the protection of the corporate firewall and with most workers telecommuting, the attack surface has grown considerably.
Telecommuting workers are seen as low hanging fruit and cybercriminals are taking advantage of the ease at which attacks can be conducted. Since January there has been a massive increase in phishing attacks, malware attacks, and attacks over the internet targeting remote workers.
NASA Sees “Exponential Increase” in Malware Attacks
On April 6, 2020, NASA sent a memo to all personnel warning of a massive increase in targeted attacks on the agency. NASA explained in the memo that the number of phishing attempts on NASA employees has doubled in the past few days and its systems designed to block employees from accessing malicious websites has gone into overdrive. The number of malicious websites that are now being blocked has also doubled, which strongly suggests employees are clicking on links in phishing emails and are being fooled by these scams. NASA also reports that there has been an “exponential increase in malware attacks on NASA systems.”
Attacks are being conducted by a diverse range of threat actors, from small players to prolific advanced persistent threat (APT) groups and nation-state sponsored hackers. NASA has warned its employees that those attackers are targeting NASA employees’ work and personal devices and that the attacks are likely to continue to increase throughout the Novel Coronavirus pandemic.
NASA is far from alone in experiencing a massive increase in attempted cyberattacks. Businesses of all sizes are now having to deal with unprecedented risks and are struggling to defend their networks from attack. They now have to defend a massively increased attack surface and the number of attacks has skyrocketed.
There are other factors that are making it difficult for employers. Employees crave information about the Novel Coronavirus and COVID-19 and cybercriminals are sending huge numbers of emails offering them just the information they seek. Huge numbers of websites are being set up that purport to offer advice on the Novel Coronavirus and COVID-19. Check Point has reported that more than 16,000 domains related to coronavirus or COVID-19 have been registered since January and those domains are 50% more likely to be malicious than other domains registered in the same period.
How to Protect Telecommuting Workers
There are three main ways that telecommuting workers are being attacked: Email, malicious websites, and the exploitation of vulnerabilities.
To prevent the latter, it is essential for software and operating systems to be kept up to date. This can be a challenge for IT departments at the best of times, but much harder when everyone is working remotely. Despite the difficulty, prompt patching is essential. Vulnerabilities in VPNs are being targeted by cybercriminals and offer an easy way to gain access to corporate networks. Employees should be told to make sure their VPN clients are running the latest software version and businesses should ensure their VPN infrastructure is kept up to date, even if it means some downtime while updates are applied.
TitanHQ Can Help You Strengthen Email and Web Security
Advanced email security defenses are now required to protect against phishing and email-based malware threats. Some of the COVID-19 phishing campaigns that are now being conducted include some of the most sophisticated phishing threats we have ever seen.
You should not rely on one form of email security, such as Microsoft’s Exchange Online Protection for Office 365 accounts. Layered defenses are essential. Office 365 email security can be significantly strengthened by layering SpamTitan on top of Microsoft’s EOP protections. SpamTitan does not replace Office 365 protections, it improves them.
SpamTitan is an advanced email security solution that incorporates powerful, real time updated AI-driven threat intelligence to block spam, phishing, malware, malicious links, and other email threats from incoming mail. SpamTitan sandboxing identifies threats that signature-based detection solutions miss and is effective at identifying and blocking zero-day malware threats.
Each day, the number of malicious websites related to COVID-19 grows. These websites are used to phish for sensitive information such as email and VPN credentials and for drive-by downloads of malware. To protect remote workers and prevent them from accessing these malicious websites, a web filtering solution is required.
WebTitan DNS Security offers protection against web-based threats and prevents employees from accessing known malicious websites. WebTitan DNS Security is seeing massively increased traffic demand for its scanning and web detection features, but the solution is cloud based and has been developed with scalability in mind. WebTitan DNS Security is blocking new threats as soon as they are identified to keep customers and their employees protected. The solution can be easily implemented to protect remote workers but inserting simple code into enterprise devices which points the DNS to WebTitan. That small change will ensure the internet is filtered for all employees, no matter where they are working.
TitanHQ is committed to providing safe and secure email and internet usage for our customers, partners and their users, now more than ever. Contact TitanHQ today for help improving security at your organization.
There are many ways that ransomware can be downloaded onto business networks, but most commonly, ransomware attacks occur via Remote Desktop Protocol (RDP), drive-by downloads, or email.
RDP Attacks
Scans are performed to discover organizations with open RDP ports, which are then attacked using brute force tactics to guess weak passwords. Cybercriminals also add credentials from historic data breaches to their password lists.
The best way to defense against this method of ransomware delivery is to disable RDP entirely; however, RDP is often required for remote management or remote access to virtual desktops, so this may not be an option. If RDP cannot be disabled, there are steps that should be taken to make it as secure as possible.
Use of strong passwords is important to protect against brute force attempts to guess passwords. You should follow NIST advice on creating complex passwords. Passwords must be unique and not used on any other platform. Two-factor authentication should be implemented to prevent stolen credentials from being used.
You must make sure you are running the latest software versions for servers and clients. RDP connections to listening RDP ports should only be permitted through a secure VPN, and ideally, an RDP gateway should be used. You should also restrict who is permitted to login to remote desktop. Finally, you should use rate limiting to lock users out after a set number of failed attempts to enter the correct password.
Drive-By Ransomware Downloads
Drive-by downloads occur on websites controlled by hackers, either their own sites or insecure sites that have been compromised. Malicious scripts are added to the websites that download ransomware and other malware payloads onto a user’s device when they visit the malicious webpage. This method of attack does not require any user interaction, other than visiting the malicious website. That could occur by clicking a malicious link in an email, via a redirect, or even through general web browsing.
A web filter such as WebTitan is one of the best defenses against drive-by ransomware downloads. WebTitan is a DNS filtering solution that prevents end users from visiting websites known to be malicious. Rather than connecting to the website, the user will be directed to a local block page if they attempt to visit a known malicious website. WebTitan can also be configured to block downloads of risky file types such as executable files.
Email-Based Attacks
Ransomware is also commonly delivered via email. This could be via an embedded hyperlink to a website where a drive-by download occurs or via malicious scripts in file attachments. Protecting against email-based attacks requires a defense in depth approach, as no single solution will provide total protection against all email attacks.
An advanced email security solution such as SpamTitan should be implemented. SpamTitan scans all inbound and outbound emails and uses a variety of techniques, including machine learning, to identify and block potentially malicious emails. SpamTitan incorporates two antivirus engines that detect known malware variants and a sandbox to analyze suspicious files for malicious actions. Sandboxing protects against never-before-seen malware and ransomware variants.
End user training is also important to ensure that in the event of a malicious email reaching an end user’s inbox, it can be recognized as such. A web filtering solution will help to ensure that any attempt to visit a malicious website via a hyperlink in an email or email attachment is blocked before ransomware is downloaded.
Ransomware as a Secondary Payload
Several ransomware operators use commodity malware to deliver their ransomware payloads. The threat actors behind DoppelPaymer ransomware have been using the Dridex banking Trojan to deliver their malicious payload, while the Ryuk ransomware gang uses the TrickBot Trojan.
Even if these commodity malware infections are discovered and removed, the ransomware gangs may still have access to systems. These commodity malware infections are often viewed as relatively trivial and when these malware variants are discovered the attacks are not properly investigated. The Trojans are removed, but the ransomware operators continue to spread laterally before deploying their ransomware payloads.
In the case of TrickBot, once it is downloaded it gets to work harvesting data such as passwords files, cookies, and other sensitive information. Once the attackers have harvested all the data they can, a reverse shell is opened to the Ryuk ransomware operators who perform recon of the network and attempt to gain administrator credentials. They then use PSExec and other Windows tools to deploy ransomware on all devices connected to the network.
That is exactly what happened with the attack on the e-discovery firm, Epiq Global. The initial TrickBot infection occurred in December 2019. Access was provided to the Ryuk operators who deployed the ransomware on February 29, 2020. Prior to the deployment of ransomware, the Ryuk operators compromised computers in all 80 of Epiq’s global offices.
TrickBot and other Trojans are primarily delivered via phishing emails. SpamTitan will help to keep you protected against these Trojans and other ransomware downloaders.
Any business that processes card payments is a target for cybercriminals, but restaurants in particular are favored by hackers. Over the past few weeks, cybercriminals have stepped up their efforts to attack these businesses and several restaurant chains have had their systems compromised. In all cases, malware has been installed on point-of-sale systems that steals payment card information when diners pay for their meals.
Many of the attacks have hit restaurant chains in the Midwest and East, with credit card data from diners recently having been listed for sale on the underground marketplace, Joker’s Stash. A batch of approximately 4 million credit and debit cards is being offered for sale, which comes from malware attacks at Moe’s, McAlister’s Deli, Krystal, and Schlotzsky’s.
The cyberattack on Krystal was detected in November, with the other three chains, all owned by Focus Brands, attacked in August. In total, the above chains have more than 1,750 restaurants and almost half of those locations, mostly in Alabama, Florida, Georgia and North and South Carolina, were affected.
Catch Hospitality Group also announced in November that it had suffered a cyberattack which had seen malware installed on its point-of-sale system that scraped and exfiltrated payment card data as diners paid for their meals. The data breach affected customers of Catch NYC, Catch Roof, and Catch Steak restaurants. Fortunately, the devices used to process the majority of payments were unaffected. Malware was on the Catch NYC and Catch Roof devices between March 2019 and October 2019, with Catch Steak affected between September 2019 and October 2019.
Church’s Chicken restaurants were also attacked in a separate incident in October. The majority of its 1,000+ restaurants were not affected, but at least 160 restaurants in Alabama, Arkansas, Florida, Georgia, Illinois, Louisiana, Mississippi, Missouri, South Carolina, Tennessee and Texas had malware installed on their POS system.
Other restaurant chains that have been attacked in 2019 include Checker’s Drive-In, Cheddar’s Scratch Kitchen, Huddle House, Applebee’s, Chilli’s, and Earl Enterprises (Buca di Beppo, Chicken Guy, Tequila Taqueria, Mixology, Planet Hollywood). Malware n the systems of Earl Enterprises had been present for almost a year before it was detected.
How to Improve Restaurant Cybersecurity
Restaurants process many thousands of card transactions which makes them an attractive target for hackers. Restaurants often use out-of-date operating systems, have vulnerability-ridden legacy hardware, and their cybersecurity solutions often leave a lot to be desired. Consequently, cyberattacks on restaurants are relatively easy to perform, at least compared to many other types of businesses.
In order to infect the POS system, the attackers will need network access. That is most commonly gained via phishing emails, drive-by malware downloads, or by abusing remote access tools. Direct attacks are also possible using techniques such as SQL injection and weak passwords can be easily guessed using brute force tactics.
The malware that sits on systems and exfiltrates data tends to have a very small footprint and is often stealthy as it needs to be present for long periods of time to collect payment card data. That can make it hard to detect when it has been installed. The key to security is therefore improving defenses to make sure the malware is not installed in the first place, which means preventing the attackers from gaining access to the network.
Listed below are some easy-to-implement steps that will help restaurants improve their security posture and block attacks. The key is defense in depth through layered security.
Use an enterprise-grade firewall –Ensure an enterprise-grade firewall is purchased. A firewall will prevent unauthorized individuals from gaining access to your network resources.
Patch promptly and update all software and firmware – Ensure patches are applied promptly and software and firmware updates are implemented when they are released. That includes all systems and networked devices, not just your POS.
Upgrade hardware – When your hardware is approaching end of life it is time to upgrade. Unsupported hardware (and software) will no longer be updated and vulnerabilities will no longer be fixed.
Lockdown your POS: Use whitelisting or otherwise lock down POS systems to make it harder for malware to operate. Only allow trusted apps to run on your POS systems.
Install powerful antivirus software – Ensure all devices are protected by a powerful anti-virus solution and that it is set to update virus definitions automatically. Regularly scan the network for malware, especially your POS.
Implement an intrusion detection system – These systems monitor the network for unusual activity that could indicate a malware infection, attackers searching the network for the POS system, and unusual traffic that could indicate data exfiltration.
Change all default passwords and set strong passwords – To protect against brute force attacks, ensure strong passwords are set on all systems and all default passwords are changed. Also implement rate limiting to block attempts to access a system or device after a set number of failed password attempts.
Implement a powerful spam filtering solution – A powerful email security solution, such as SpamTitan, is required to prevent spam and malicious emails from being delivered to end users. Even if you have Office 365, you will need a third-party email security solution to block email-based threats.
Restrict Internet access with a DNS filter – A DNS filter such as WebTitan provides protection against drive-by malware downloads and web-based phishing attacks. WebTitan will block all known malicious websites and those with a low trust score. The solution can also be configured to prevent employees from accessing categories of websites where malware downloads are more likely.
Disable Remote Access if Possible – Disable Remote Desktop Protocol and all remote access tools. If remote access tools are required to allow essential maintenance work to be completed, ensure they can only used via a VPN and restrict the people who can use those tools.
Black Friday phishing scam are rife this year. With almost a week to go before the big discounts are offered by online retailers, scammers are stepping up their efforts to defraud consumers.
Spam email campaigns started well ahead of Black Friday this year and the scams have been plentiful and diverse. Black Friday phishing emails are being sent that link to newly created websites that have been set up with the sole purpose of defrauding consumers or spreading malware and ransomware. It may be a great time of year to pick up a bargain, but it is also the time of year to be scammed and be infected with malware.
A wide range of spam emails and scam websites have been detected over the past few weeks, all of which prey on shoppers keen to pick up a bargain. This year has seen the usual collection of almost too-good-to-be-true offers on top brands and the hottest products, free gift cards, money off coupons, and naturally there are plenty of prize draws.
Anyone heading online over the next few days to kick start their holiday shopping spree needs to beware. The scammers are ready and waiting to take advantage. With legitimate offers from retailers, speed is of the essence. There is a limited supply of products available at a discount and shoppers are well aware that they need to act fast to secure a bargain. The scammers are playing the same game and are offering limited time deals to get email recipients to act quickly without thinking, to avoid missing out on an exceptional deal.
This time of year always sees a major uptick in spam and scams, but this year has seen much more sophisticated scams conducted than in previous years. Not only are the scammers insisting on a quick response, several campaigns have been identified that get users to help snag more victims. In order to qualify for special offers or get more deals, the scammers require users to forward messages and share social media posts with their friends and contacts. This tactic is highly effective, as people are more likely to respond to a message or post from a friend.
So how active are the scammers in the run up to Black Friday and Cyber Monday? According to an analysis by Check Point, the number of e-commerce phishing URLs has increased by 233% in November. Those URLs are being sent out in mass spam campaigns to direct people fake e-commerce sites that impersonate big name brands. Those sites are virtual carbon copies of the legitimate sites, with the exception of the URL.
While consumers must be wary of Black Friday phishing scams and potential malware and ransomware downloads, businesses should also be on high alert. With genuine offers coming and going at great speed, employees are likely to be venturing online during working hours to bag a bargain. That could easily result in a costly malware or ransomware infection.
The scams are not limited to the run up to Black Friday. Cyber Monday scams can be expected and as holiday season fast approaches, cybercriminals remain highly active. It’s a time of year when it pays to increase your spam protections, monitor your reports more carefully, and alert your employees to the threats. A warning email to employees about the risks of holiday season phishing scams and malicious websites could well help to prevent a costly data breach or malware infection.
Its also a time of year when a web filtering solution can pay dividends. Web filters prevent employees from visiting websites hosting exploit kits, phishing kits, and other known malicious sites. They can also be configured to block downloads of malicious files. A web filter is an important extra layer to add to your phishing defenses and protect against web-based attacks.
If you have yet to implement a web filter, now is the ideal time. TitanHQ is offering a free trial of WebTitan to let you see just how effective it I at blocking web-based threats. What’s more, you can implement the solution in a matter of minutes and get near instant protection from web-based phishing attacks and holiday season malware infections.
According to research from Channel Futures, security is the fastest growing service for 73% of managed service providers (MSPs). If you have yet to start offering security services to your clients, you are missing out on a steady income stream that could really boost your profits. But where should you start? What services should you be offering? In this post we will be exploring the ideal security stack for MSPs and the essential services that should form the core of your security offering.
Why is Managed Security is so Important?
As an MSP, you should be aware of the importance of security. Companies are being targeted by cybercriminals and data breaches are occurring at an alarming rate. It is no longer a case of whether a business will be attacked, it is a case of when and how often.
Many SMBs do not have sufficiently skilled staff to handle IT and it is far easier, and often more cost effective, to outsource their IT to MSPs. The same is true for security, but even more so due to the difficulty finding sufficiently skilled cybersecurity staff. With so many positions available and a national shortage of cybersecurity staff, cybersecurity professionals can afford to pick and choose there they work. SMBs must ensure they are well protected against cyberattacks, so they look to MSPs to provide security-as-a-service either as a stop gap measure while they try to fill internal positions or so they can forget about security and let an MSP look after that side of the business.
If you are not providing security services to your clients, they will most likely search for another MSP that can protect their business from threats such as malware, ransomware, phishing, botnets, and prevent costly data breaches.
What do SMBs Want?
SMBs may be aware of the need for security, but they may not be so clued up about the solutions they need to protect them from cyber threats. You may need to explain to them exactly what they need and why. What is vital when explaining cybersecurity to SMBs is to emphasize the need for layered security. No single solution will provide protection against all threats and you will need to educate your clients about this.
Layered security is essential for protecting against ever increasing cybersecurity threats. No single solution will provide total protection. You need overlapping layers so that if one layer is bypassed, others are there to block the attack.
You should certainly be initiating conversations with your clients about security. Many SMBs only look for security services after they experience a costly data breach. By being proactive and approaching your clients and offering security services, you will not only have a much greater opportunity for increasing sales quickly, you will help them avoid a costly data breach and will not have to clear up the mess that such a breach causes.
What is the Ideal Security Stack for MSPs?
The best place to start is with a cybersecurity package that includes the core security services that all businesses need to protect them from a broad range of threats. Different packages can be offered based on the level of protection your clients need and their level of risk tolerance. Extra services can always be provided as add-ons.
There are four key security services you should be offering to your clients to give them enterprise-grade protection to secure their networks and protect against the main attack vectors. The ideal security stack for MSPs will differ from company to company, depending on the kind of clients that each MSP has. It may take some time to find the ideal security stack, but a good place to start is with core security services that every business will need.
Core Security Services for MSPs
Firewalls
Email security
DNS filtering
Endpoint security
Firewalls are essential for securing the network perimeter and separating trusted from untrusted networks. They will protect network resources and infrastructure against unauthorized access. It may even be necessary to implement multiple firewalls.
Email security is essential as this is the most common attack vector. Without email security, malware and phishing emails will hit inboxes and employees’ security awareness will be regularly put to the test. The threat of email attacks cannot be understated.
Email security must be explained to clients to ensure they understand its importance and why standard email security such as that provided by Microsoft through Office 365 simply doesn’t cut in anymore. Too many threats bypass Office 365 defenses. A study by Avanan showed that 25% of phishing emails bypass Office 365 security and are delivered to inboxes.
DNS filtering is also a requirement to protect against web-based attacks such as malvertising, drive-by downloads, and exploit kits. Even the best email security solutions will not block all phishing threats. DNS filtering provides an additional layer of security to protect against phishing attacks. While email was once the primary method of delivering malware, now malware is most commonly delivered via web-based attacks. The average business user now encounters three malicious links per day and 80% of malware is downloaded via the internet. Further, with more and more employees spending at least some of the week working remotely, protection is needed for public Wi-Fi hotspots. DNS filtering provides that protection when they are off the network.
Endpoint security solutions add another layer to the security stack. If any of the above solutions fail and malware is downloaded, endpoint security solutions will provide extra protection. This can include basic protection such as antivirus software or more advanced solutions such as intrusion detection systems.
When choosing solutions for your security stack, it is important to make sure they work seamlessly together. This can be difficult if you purchase security solutions from a lot of different vendors.
Additional Services to Add to your Security Stack.
The above security services should form the core of your security offering, but there are many additional services you can easily provide to ensure your clients are better protected. These can be offered as addons or as part of more comprehensive security packages.
Data loss protection
Security helpdesk
Email archiving and backup services
Vulnerability scanning and patch management
Security policy management
Security information and event management (SIEM)
Incident response and remediation
Security awareness training and phishing email simulations
How TitanHQ Can Help
TitanHQ is the global leader in cloud-based email and web security solutions for the MSP that services the SMB market. TitanHQ products are consistently rated highly by MSPs for the level of protection, ease of use, ease of admin, and the level of support provided.
The TitanHQ portfolio of cybersecurity products consists of three core solutions:
SpamTitan Email Security
WebTitan DNS Filtering
ArcTitan Email Archiving
Each of these solutions has a 100% cloud-based architecture and has been developed for MSPs to easily incorporate into their security stacks. TitanHQ offers seamless deployments and easy incorporation into MSP’s management portals via RESTful API.
The above solutions can be supplied with multiple hosting options. You can host with TitanHQ, on your existing infrastructure or in the cloud with AWS, Azure or any other system.
SMBs want to know they are protected, but many don’t care about what solutions are used. This gives you an opportunity to reinforce your brand. This is easily achieved with TitanHQ as the above solutions can be provided in white label form, ready for you to add your own branding. You can even customize the user interface and only include the features that you need to reduce complexity.
Need reports for your clients? No problem. TitanHQ has an extensive range of pre-configured reports that can be scheduled to ease your admin burden, including board-level reports with scope to create your own reports to meet you and your clients’ needs.
Other key features for MSPs include:
Multi-tenant dashboard
Automated policy management
Continuous monitoring
Full visibility of usage
Flexible, affordable, and transparent pricing with monthly billing
Set and forget solutions to ease the admin burden
World-class customer support included with all solutions
AD integration
Generous margins for MSPs
Competitive pricing with monthly billing
Excellent MSP program – TitanShield – with dedicated account managers, assigned sales engineers, scalable pre-sales and technical support, and sales and technical training
TitanHQ has made it as easy as possible for MSPs to start offering security services to their clients. These solutions will also help established security-as-a-service providers ease their management burden and improve their margins.
To find out more about the TitanShield program and for further information on any or all of TitanHQ’s security solutions for MSPs, get in touch with the channel team today. Product demonstrations can be arranged and free 14-day trials are available to allow you to see for yourself why TitanHQ is the leading provider of email and web security solutions for MSPs.
Feedback from TitanShield Program Members
TitanHQ solutions are consistently rated highly by users with the solutions praised for the protection they provide, value for money, and ease of set up and use. The solutions have achieved top marks on independent review sites such as G2 Crowd, Expert Insights, with overwhelmingly positive reviews on Capterra, Spiceworks, Gartner Peer Insights, Software Advice, and Google Reviews.
Here’s what some of our MSP customers are saying about TitanHQ solutions they have implemented to protect their clients and increase their bottom lines.
“By reducing malware-related security incidents, you’re reducing your number one uncontrollable expense: the people on your IT operations team, like your help desk techs.” – MSP, Washington, US
“It’s baked into our fees as well, and our Crypto calls dropped to 0” – MSP, London, UK
“Web filtering is one of the, if not the greatest bang for your buck services. It’s built in anti malware has protected our clients, saving us thousands of hours of repair time I am absolutely certain.” – MSP, New York, US
“I don’t remember the last time one of our customers got Cryptolocker. I bundle it with our offering so that they get it no matter what just to make my life easier on virus removal or data problems.” – MSP, Seattle, US
“a key part of our security stack as we’ve scaled to over 6,000 managed endpoints, while decreasing virus and malware related tickets by 70%.” – MSP, Boston, US
“It has paid for itself many times over by reducing malware calls.” – MSP, Toronto, Canada
Over the next three months, TitanHQ will be travelling throughout Europe and the United States to meet with managed services providers (MSPs) at some of the biggest trade shows serving the MSP community.
The trade shows and conferences bring together the best MSPs from around the world and gives them the opportunity to learn about new industry trends, best practices, and proven tactics for increasing growth. The shows provide a tremendous opportunity for networking and bring together MSPs and companies offering MSP-focused cybersecurity solutions.
For the past 20 years, TitanHQ has been developing cybersecurity solutions for MSPs and the SMBs marketplace. From humble beginnings, the company has grown into a leading provider of cloud-based email security, web security, and email archiving solutions for MSPs. TitanHQ products have now been adopted by more than 7,500 businesses and 2,000 MSPs around the globe.
TitanHQ products are much loved by MSPs as they have been developed specifically to meet their needs. The solutions are quick and easy to implement and maintain and they save MSPs a considerable amount of support and engineering time by blocking email and web-based cyberattacks at source.
At these MSP events you will be able to find out more about the benefits of cloud-based spam filtering and the importance of adding web filtering to your service stack. The TitanHQ team will be on hand to answer questions about the products and will explain how the solutions can be seamlessly integrated into your client management platforms and how they can make your life easier and improve your bottom line.
Come and Meet the TitanHQ Team at these fall MSP Trade Shows and Conferences
Date
Event
Location
September 17, 2019
Datto Dublin
The Alex Hotel, Dublin, Ireland
September 18, 2019
MSH Summit
155 Bishopsgate, London, UK
October 6-10, 2019
Gitex
Dubai World Trade Centre, Dubai, UAE
October 7-8, 2019
CompTIA EMEA Show
Park Plaza Westminster Bridge,
London, UK
October 16-17, 2019
Canalys Cybersecurity Forum
SOFIA Barcelona, Spain
October 21-23, 2019
DattoCon Paris
Palais des Congrès de Paris, Paris, France
October 30, 2019
MSH Summit North
Hilton Hotel, Manchester, UK
October 30, 2019
IT Nation Evolve (HTG 4)
Hyatt Regency, Orlando, Florida, USA
October 30, 2019
IT Nation Connect
Hyatt Regency, Orlando, Florida, USA
November 5-7, 2019
Kaseya Connect
NH Collection Amsterdam Gran Hotel Krasnapolsky, Amsterdam, Netherlands
If you are planning on attending any of the above events this fall, be sure to come and visit the TitanHQ team to discuss your options and feel free to reach out in advance of the event to arrange a meeting.
Rocco Donnino, Executive Vice President-Strategic Alliances, LinkedIn
Eddie Monaghan, MSP Alliance Manager, LinkedIn
Marc Ludden, MSP Alliance Manager, LinkedIn
If you are unable to attend any of these exciting events, give the team a call for further product information, to book a product demonstration, or to sign up for a free trial of SpamTitan, WebTitan, and ArcTitan.
Exploit kit activity may be at a fraction of the level of 2016 when peak activity was reached, but the threat has not gone away. In fact, the mid-year cybersecurity roundup from Trend Micro shows exploit kit activity is now triple the level of mid-2018. Websites hosting exploit kits still pose a significant threat to businesses.
Exploit kits are toolkits that contain exploits for vulnerabilities in popular software applications, such as Internet Explorer and Adobe Flash Player. When a user lands on a web page that hosts an exploit kit, it will scan the user’s browser for vulnerabilities. If an exploitable flaw is identified, malware is automatically downloaded and executed on the user’s device. In many cases, the downloading of a Trojan, ransomware, or other form of malware is not identified by the user.
Traffic is sent to exploit kits through malvertising – malicious advert – on high traffic websites. User’s can be directed to malicious websites through phishing emails, and it is also common for hackers to hijack high traffic websites and use them to host their exploit kit. That means users could visit a malicious website just through general web browsing.
There are several exploit kits currently in use such as Magnitude, Underminer, Fallout, Green Flash/Sundown, Rig, GrandSoft, and Lord. These exploit kits are pushing cryptocurrency miners and botnet loaders, although ransomware and banking Trojans are the most common payloads.
Many of the exploits used by these toolkits are for old vulnerabilities, but since businesses are often slow to apply patches, they still pose a major threat. Exploit kits such as GrandSoft and Rig are regularly updated and now host exploits for much more recently disclosed vulnerabilities.
One of the most recently identified campaigns has seen the threat actors behind Nemty ransomware team up with the operators of RIG to push their ransomware on businesses still using old, vulnerable versions of Internet Explorer.
A new exploit kit named Lord is being used to infect users with Eris ransomware. In this case, traffic is being directed to the exploit kit through malvertising on the PopCash ad network. The EK primarily uses exploits for flaws in Adobe Flash Player such as CVE-2018-15982.
Protecting against exploit kits is straightforward on paper. Businesses need to ensure that vulnerabilities are identified and patched promptly. If there are no vulnerabilities to exploit, no malware can be downloaded. Unfortunately, in practice things are not quite so simple. Many businesses are slow to patch or fail to apply patches on all devices in use.
Anti-spam software can help to reduce risk by blocking phishing emails containing links to exploit kits, but most of the traffic comes from search engines and malvertising, which anti-spam software will do nothing to block. To improve your defenses against exploit kits, drive-by downloads, and phishing websites, one of the best cybersecurity solutions to deploy is a DNS filtering solution.
A DNS filter allows businesses to carefully control the websites that employees can access when connected to the business’s wired and wireless networks. Controls can be set to block different types of web content such as gambling, gaming, and adult websites but crucially, the DNS filter also blocks all known malicious websites. DNS filters use blacklists of known malicious websites such as those hosting exploit kits or phishing forms. If a web site or web page is included in the blacklist, it will automatically be blocked. Websites are also scanned in real time to identify malicious content.
Since all filtering takes place at the DNS level, access to malicious or undesirable content is blocked without any content being downloaded. Setting up the solution is also quick and easy, as it only requires a change to the DNS record to point it to the service provider. No hardware is required and there is no need to download any software.
If you want to improve your defenses against malware, ransomware, botnets, and phishing and are not yet controlling the web content that your employees can access, contact TitanHQ today and ask about WebTitan. Alternatively, sign up for a free trial of the solution by clicking the image below.
The year 2018 saw a reduction in ransomware attacks on businesses as cybercriminals opted for alternative means to make money. Major ransomware attacks were still occurring, just at a slightly lower rate than in 2017.
Some reports were released that suggested ransomware was no longer such a massive threat as it was in 2016 and 2017, but the number of reported attacks in 2019 have shown that is definitely not the case. Any business that has not implemented defenses to protect against ransomware attacks could well be the next victim and have to pay millions to recover from an attack.
Make no mistake. Ransomware is one of the most dangerous threats faced by businesses. If ransomware is installed on the network, all files, including backups, could be encrypted. That could prove catastrophic, as one small Michigan medical practice discovered.
The two-doctor practice in Battle Creek, MI suffered an attack that resulted in the encryption of all patient data. A ransom demand was issued by the attackers, but as there was no guarantee that files could be recovered after the ransom was paid, the decision was taken not to pay up. The hackers then deleted all the encrypted files. Faced with having to rebuild the practice from scratch, the doctors decided to call it quits and took early retirement.
Ransomware attacks on healthcare providers are now being reported at an alarming rate and government entities, cities, and municipalities are being extensively targeted. The city of Baltimore suffered a major attack in May involving a ransomware variant called RobbinHood. The attack brought down the city’s servers and systems, causing major disruption across the city. A ransom of $6 million was paid for the keys to regain access to the encrypted files.
Two small cities in Florida also suffered major attacks. Lake City was forced to pay a ransom of $460,000 and Riviera Beach paid a ransom of $600,000, while Jackson County in Georgia paid $400,000 after its court system was attacked.
As the year has progressed, the attacks have increased. A report from Malwarebytes indicates there was a 195% increase in ransomware attacks in Q1, 2019. Figures from Kaspersky Lab show ransomware attacks almost doubled in Q2, 2019, with 46% more attacks reported than the corresponding period in 2018.
The increase in attacks means businesses need to be prepared and have the necessary security tools in place to make it difficult for the attacks to succeed.
There is no one cybersecurity solution that can be implemented to eliminate the threat of attack, as hackers are using a variety of methods to gain access to networks and download their malicious payloads. Layered defenses are key to repelling an attack.
Email is the primary method of delivering ransomware. All it takes if for a malicious email to arrive in an inbox and for an employee to be fooled into opening a malicious attachment or clicking on a hyperlink for ransomware to be installed. An advanced email filtering solution such as SpamTitan Cloud is therefore needed to block malicious emails and ensure they do not reach employees’ inboxes.
SpamTItan includes Domain-based Message Authentication, Reporting, and Conformance (DMARC) to block email impersonation attacks and a sandbox where suspicious attachments can be executed in safety and studied for malicious activity. Sandboxing is essential as it allows zero-day ransomware threats to be identified and blocked.
Not all attacks occur via email. Attacks over the Internet are also common. A web filtering solution should therefore be implemented to block these web-based attacks. A web filter will prevent employees from accessing known malicious sites where ransomware is automatically downloaded. With these two technical measures in place, businesses will be well protected from attacks. Along with security awareness training for staff and the adoption of good data backup practices, businesses can mount a strong defense against ransomware attacks.
Taxpayers and tax professionals are being targeted by scammers posing as the Internal Revenue Service (IRS). The goal of this new IRS tax return phishing scam is to deliver information-stealing malware. The malware harvests credentials that are used to gain access to and empty financial accounts.
The campaign uses at least two subject lines for the emails – “Electronic Tax Return Reminder” and “Automatic Income Tax Reminder.” The emails contain a hyperlink that directs the user to a website that closely resembles the IRS.gov website. The emails include a one-time password to use to login in to submit a claim for a tax refund.
When the user logs in to the site, they are told that they need to download a file in order to submit their refund. The file is actually keylogging malware which records keystrokes on an infected computer and sends a range of sensitive information to the attackers.
The IRS warning was issued after several taxpayers and tax professionals reported the phishing emails to the IRS. Efforts are ongoing to disrupt the campaign, but the IRS notes that dozens of compromised websites and malicious URLs are being used by the scammers. The IRS is contacting hosting companies to get the websites shut down, but the number of URLs being used makes this a major challenge. As soon as one URL is shut down, there are others to take its place.
The offer of a tax refund or a threat of legal action over tax issues prompts many people to click without first assessing the content of the message and the legitimacy of the request, which is what the scammers are banking on.
The advice of the IRS is never to click on any link in an unsolicited email claiming to be from the IRS. The IRS does not initiate contact with taxpayers by email, text message or social media channels, and no requests are sent for personal information.
The latest warning comes just a couple of months after the IRS and Security Summit partners issued a reminder that all professional tax preparers are required by law – The FTC Safeguards Rule – to implement a written information security plan to ensure the tax information of their clients is properly protected.
The reminder was issued as it had become clear that many tax professionals were unaware of their obligations to implement a security plan to protect client tax data.
There are several required elements of the information security plan:
Designate an employee or employees to coordinate the information security plan
Conduct a risk analysis to identify risks to the confidentiality of client data
Assess the effectiveness of current safeguards
Implement, monitor, and test the safeguards program
Only use service providers that can maintain appropriate safeguards and oversee the handling of client data
Evaluate and update the security program, as appropriate, in response to changes to business practices and operations
The requirements for the information security plan are flexible. For instance, tax preparers can choose the safeguards to implement based on their own circumstances and the findings of their risk analyses.
Two important safeguards that protect businesses from phishing and malware attacks are a spam filter and a web filter. The spam filter protects the email system by identifying and blocking malicious messages such as phishing emails and malspam (malicious spam email), while a web filter blocks web-based attacks and malware downloads. Both of these solutions are highly effective at blocking phishing and malware attacks yet are cheap to implement.
To find out more about how spam filters and web filters can protect your business and help you meet your legal responsibilities contact TitanHQ today.
A new phishing campaign has been detected that uses Google Drive links to avoid detection by Office 365 Exchange Online Protection and ensure messages are delivered to inboxes.
The emails, reported through Cofense Intelligence, impersonated the CEO of the company who was attempting to share an important document. The document had been shared via Google Drive and came with the message, “Important message from – CEO.”
Google Drive allows files and collaboration requests to be easily sent to other individuals. The account holder chooses who to share a file with and the system generates an email alert containing a link to the shared file.
In this case, the name of the CEO was correct, but the email address used was different to the format used by the company. While this is a clear sign that the emails are not what they seem, some employees would likely be fooled by the message.
Importantly, the messages are not detected as malicious by EOP and are delivered to inboxes. A scan of the message would reveal nothing untoward, as the embedded URL is a legitimate shared link to a genuine cloud service operated by Google.
The shared document itself is not malicious, but it does link to another Google Docs document and a phishing URL. Any anti-phishing solution that only assesses the embedded hyperlink in the email to determine whether it is malicious would allow the email to be delivered. Only a deeper inspection would reveal the true nature of the URL.
If the link is visited by an end user, a fake login window is presented. If login credentials are entered, they are captured and stored on the attacker’s server.
This campaign highlights the importance of multi-layered anti-phishing defenses and the risks of relying on EOP to provide protection against phishing attacks.
An advanced spam filtering solution should be implemented on top of Office 365 to provide greater protection from phishing and other email-based attacks. This will ensure more sophisticated phishing attacks are blocked.
If a malicious message is delivered and a link is clicked, the connection to the malicious webpage could be blocked using a web filtering solution.
WebTitan is a DNS-based content filtering solution that serves as an additional layer in organization’s anti-phishing defenses. Should an attempt be made by an employee to visit a malicious website or suspicious domain, the attempt would be blocked before any content is downloaded. WebTitan assesses each website when the DNS query is made. Malicious websites and those that violate an organization’s content control policies are blocked.
To find out more about how a DNS filter can improve your defenses against phishing attacks and malware downloads, contact TitanHQ today.
There has been a spate of ransomware attacks on cities, municipalities, mayor’s offices, and local government facilities in recent weeks.
The latest attack was on La Porte County in Indiana. The attack started on July 6, 2019, but prompt action by the IT department allowed the ransomware to be contained. That rapid response meant only 7% of the laptops used by the county were affected. However, two domain controllers were also affected and that rendered the network unavailable.
Experts were brought in to try to restore files from backups and bring the network back online, but those attempts failed as the backup servers had also been infected with the ransomware. La Porte County was left with no alternative other than to pay the ransom demand. The Bitcoin ransom equated to around $130,000, $100,000 of which was covered by an insurance policy.
This attack involved Ryuk ransomware – The same ransomware variant that was used in the attack on Lake City in Florida on June 10, 2019. For Lake City, Ryuk ransomware was delivered by the Trickbot Trojan, which was in turn deployed by the Emotet Trojan. Lake City paid approximately $500,000 to the attackers to obtain the keys to unlock the encryption. Riviera Beach in Florida was also attacked and paid a ransom of around $600,000.
These are just three cases out of several recent attacks. Those three attacks alone have resulted in more than $1,200,000 being paid to cybercriminals. That sends a very clear message to other cybercriminals that these attacks can be extremely profitable. That is the reason the FBI advice is never to pay.
2018 saw a decline in ransomware attacks as cybercriminals pursued other strategies for attacking businesses, but ransomware is now certainly back in favor and is being used in an increasing number of attacks.
Something that several of the targets in the recent ransomware campaigns have in common is they are relatively small cities that have limited resources to devote to cybersecurity. They have hardware and software that has reached end of life and, due to limited funds, security gaps have started to appear.
Riviera Beach, for instance, is a city of 35,000 people with limited resources. It had recently undergone a period of turmoil in management, had suffered scandals, and during the upheaval its cybersecurity contract had been allowed to lapse. That left the door wide open to attack.
These attacks have proven incredibly costly, yet they could have been prevented with a very small spend on a select number of security solutions. The attacks on Rivera Beach and Lake City could have been prevented with an advanced email security solution such as SpamTitan. The ransomware was installed in both of these attacks as a result of employees opening malware-infected email attachments.
SpamTitan incorporates dual anti-virus engines to detect malicious software and a Bitdefender-powered sandbox for deep analysis of suspicious email attachments. SpamTitan incorporates DMARC email authentication to counter email impersonation attacks and a host of other anti-spam and anti-phishing controls.
SpamTitan can be deployed as a gateway solution on existing hardware or as a cloud-based solution, and can be easily layered on top of Office 365 to improve protection against phishing and ransomware attacks.
Further, the cost of protection against ransomware and phishing attacks is likely to be much lower than you think. For more information, contact TitanHQ today.
There has been a spate of ransomware attacks on cities and government agencies in recent months and the healthcare industry sees more than its fair share of attacks, but they are not the only industries being targeted.
Schools, colleges, and universities are prime targets for hackers and ransomware attacks are common. One recent attack stands out due to its scale and the massive ransom demand that was issued. The attackers demanded $2 million (170 BTC) for the keys to unlock the encryption.
Monroe College in New York City was attacked at 6:45am on Wednesday, July 10, 2019. The ransomware quickly spread throughout the network, shutting down the computer systems at its campuses in Manhattan, New Rochelle and St. Lucia and taking down the college website.
The college has switched to pen and paper and is finding workarounds to ensure students taking online courses receive their assignments. No mention has been made about whether files will be recovered from backups or if the ransom will need to be paid.
This is one of many recent ransomware attacks in the United States. Ransomware may have fallen out of favor with cybercriminals in 2018, but it now appears to be back in vogue and attacks are rising sharply. So too have the ransom demands.
$2 million is particularly high, but there have been several recent attacks involving ransom demands for hundreds of thousands of dollars. In several cases, the ransom has been paid.
Riviera Beach City in Florida was attacked and was forced to pay a $600,000 ransom to regain access to its files and bring its computer systems back online. Lake City in Florida also paid a sizeable ransom – $500,000. Jackson County was also attacked and paid a $400,000 ransom.
There have been several cases where ransoms have not been paid. The City of Atlanta was attacked and around $51,000 in Bitcoin was demanded. Atlanta refused to pay. Its cleanup bill has already reached $3 million. With such high costs it is clear to see why many choose to pay up.
In all of the above cases, the cost of implementing cybersecurity solutions to protect against the main attack vectors would have cost a tiny fraction of the cost of the ransom payment or the mitigation costs after an attack.
For less than $2 per employee, you can ensure that the email network is secured and you are well protected against web-based attacks. To find out more, call TitanHQ today.
As one ransomware-as-a-service operation shuts down, another is vying to take its place. Sodinokibi ransomware attacks are increasing and affiliates are trying to carve out their own niche in the ransomware-as-a-service operation.
Developing ransomware and staying one step ahead of security researchers is important, but what made the GandCrab operation so successful were the affiliates conducting the campaigns that generated the ransom payments. The GandCrab developers have now shut down their operation and that has left many affiliates looking for an alternative ransomware variant to push.
Sodinokibi ransomware could well fill the gap. Like GandCrab, the developers are offering their creation under the ransomware-as-a-service model. They already have a network of affiliates conducting campaigns, and attacks are on the increase.
As is the case with most ransomware-as-a-service operations, spam email is one of the most common methods of ransomware delivery. One Sodinokibi ransomware campaign has been detected that uses spoofed Booking.com notifications to lure recipients into opening a Word document and enabling macros. Doing so triggers the download and execution of the Sodinokibi payload.
Download websites are also being targeted. Access is gained the websites and legitimate software installers are replaced with ransomware installers. Managed Service Providers (MSPs) have also been targeted. The MSP attacks have exploited vulnerabilities in RDP to gain access to MSP management consoles.
Two cases have been reported where an MSP was compromised and malicious software was pushed to its clients through the client management console. In one case, the Webroot Management Console and the Kaseya VSA console in the other.
Recently, another attack method has been detected. Sodinokibi ransomware is being distributed through the RIG exploit kit. Malvertising campaigns are directing traffic to domains hosting RIG, which is loaded with exploits for several vulnerabilities.
With so many affiliates pushing Sodinokibi ransomware and the wide range of tactics being used, no single cybersecurity solution will provide full protection against attacks. The key to preventing attacks is defense in depth.
TitanHQ can help SMBs and MSPs secure the email and web channels and block the main attack vectors. Along with security awareness training and good cybersecurity best practices, it is possible to mount a formidable defense against ransomware, malware, and phishing attacks.
In our previous post we explained why managed service providers (MSPs) should be offering a web filtering service to their customers and the benefits that can be gained by customers and MSPs alike. In this post we explain what makes WebTitan Cloud the go-to web filtering solution for MSPs and why so many MSPs have chosen TitanHQ as their web filtering partner.
Why WebTitan Cloud is the Best Web Filter for MSPs
One problem MSPs face before they can start offering a web content filtering appliance to their clients is how to incorporate the solution into their service stacks and their existing cloud offerings. While there are many providers of web filtering services, not all solutions have been developed with MSPs in mind. TitanHQ differs in that respect.
TitanHQ’s web filtering solution, WebTitan Cloud, has been developed specifically to meet the needs of MSPs and make it as easy as possible for the solution to be added to their existing cloud offerings. WebTitan Cloud seamlessly integrates within existing workflows regardless of whether MSPs self-host, use AWS, Azure, or other cloud platforms.
Why WebTitan is Perfect for MSP’s
Save on customer support time, hours and cost. No more costly ransomware call outs.
Gives your clients excellent protection against malware, ransomware, and phishing attacks.
Real time LIVE updating of malware and malicious threats with an active database of 650 million users driving the AI driven protection.
Easy filtering at multiple levels with the capability to recognize users in many different ways.
Protection from web threats for office and remote users.
Reporting with full AD integration – Easy to show your customers the volume of malicious attacks you have prevented.
Great for improving revenue – Generate regular monthly revenue for very little effort.
Easy client account administration via a central control panel.
Multiple hosting options: Deployed in our cloud, a private cloud, or in your data center.
Intuitive controls with low management overhead.
API driven for advanced back-end integration in your own systems, including billing and reporting.
Flexible pricing to suit your business, including monthly billing.
Multi-tenant solution with advanced customer management features.
Highly scalable with no latency.
Highly customizable – can be provided as a white label ready for your logos and color scheme.
Leading alternative to OpenDNS Cisco Umbrella at a fraction of the price.
Industry-leading technical support and customer service.
No punitive terms, measures, or sharp practices and a fully transparent pricing policy with no hidden costs.
How Does WebTitan Cloud Integrate into MSPs Management Systems?
To make integration as easy as possible, TitanHQ uses RESTful API, which allows fast and risk-free integration into MSPs management systems. WebTitan Cloud uses the OAuth 1.0 protocol for authentication and has a full set of keys and secrets in the WebTitan Cloud user interface (UI). Once an MSP has signed up, no further registration or authentication is necessary. The API client provides the appropriate oauth_signature to authorize requests to protected resources.
Overly complex user interfaces are a problem with many cloud-based solutions. With WebTitan Cloud, the UI is made as clean and easy to use as possible. MSPs can remove all elements from the UI that are not required to keep the UI clean and simple. WebTitan Cloud can also be integrated into MSP cloud interfaces to create a better user experience and greater consistency for customers.
Having information at your fingertips is important when customers send in requests or when reports are required on web use and blocking. WebTitan Cloud allows MSPs to create and integrate a full suite of high-level system and customer reports into their own management consoles.
Onboarding new customers is also a quick and simple process, which can be integrated into current MSP on-boarding processes. New customer accounts can easily be created (or deleted) from within an MSP’s own UI, in addition to performing updates and listing all current customer accounts.
MSPs can connect to WebTitan Cloud to manage their customers settings, including locations, whitelists, and blacklists. Customers that would prefer to manage their own settings can perform a limited number of operations themselves using APIs. Since WebTitan Cloud is available in a full white label, customers who do access their own settings can be given a UI with MSP branding rather than TitanHQ’s to maintain consistency and help reinforce the MSPs brand.
TitanHQ also operates an extremely competitive pricing strategy with generous margins for MSPs and aligned monthly billing cycles through the TitanShield MSP Program.
If you have yet to start offering web filtering to your clients as part of your service stack or if you are unhappy with your current provider’s product, contact TitanHQ today and as about becoming a member of the TitanShield MSP Program. Product demonstrations can also be scheduled on request.
Feedback from MSP Clients
“WebTitan is an outstanding tool for most reliable content filtering. The monitoring feature of this specific product is quite unique that totally monitors all the process of online working and also secures all the data. Additionally, its set-up is superb easy and it can be done in just few minutes that save my time and energy as well.” – Kristie H. Account Manager
“WebTitan is fairly easy to setup. It is available as a cloud based solution or on prem. You can get as simple or as complicated with your filtering as you like, it will handle most situations with ease. It has provided us with a stable web filtering platform that has worked well for us for many years.” – Derek A. Network Manager
“WebTitan is outstanding software that helps me a lot in minimizing viruses. The thing I like most about WebTitan is that it is extremely easy to use and configure. I like its clear interface. It lets us block malicious content and spam easily. It is no doubt an amazing product helping us a lot in kicking out harmful bad stuff.” – Randy Q. Software Engineer
“By reducing malware-related security incidents, you’re reducing your number one uncontrollable expense: the people on your IT operations team, like your help desk techs.” – MSP, Washington, US
“a key part of our security stack as we’ve scaled to over 6,000 managed endpoints, while decreasing virus and malware related tickets by 70%.” – MSP, Boston, US
“It has paid for itself many times over by reducing malware calls.” – MSP, Toronto, Canada
A web filtering service allows Managed Service Providers (MSPs) to better protect their clients from accidental malware downloads and phishing attacks while improving their bottom lines. Further, by preventing phishing attacks and malware infections, they can reduce the amount of time they spend fighting fires. For busy MSPs, the latter will be especially beneficial.
Why is Web Filtering Important?
There are several reasons why MSP clients will benefit from a web filtering service. First and foremost, a web filter will help to prevent their customers’ employees from visiting phishing websites and malicious URLs. Most phishing attacks start with a phishing email, so a powerful spam filtering solution is essential. While commercial spam filters such as SpamTitan will block more than 99% of spam and phishing emails, additional protections are required to protect against the 1% that bypass spam defenses.
Naturally end user security awareness training will help in this regard, but as the 2018 Verizon Data Breach Investigations Report shows, 30% of delivered phishing messages are opened by end users and 12% of those users also click on malicious links in the messages.
A web filter is an additional layer of anti-phishing and anti-malware defenses that kicks in when malicious links are clicked and when end users attempt to visit other malicious sites while browsing the Internet. With a web filter in place, when an employee attempts to access a malicious web page, that attempt will be blocked before any content is downloaded. Instead of displaying the web page, a block page will be displayed.
Web filters also allow companies to carefully control the types of content their employees can access. This allows them to enforce acceptable internet usage policies with ease. Employers can prevent their employees from accessing NSFW content such as pornography, illegal content and, if tighter controls are required to improve productivity, other categories of web content such as dating sites, social media networks, gambling sites, and gaming sites.
With a web filter in place, security and productivity can both be quickly improved and the gains in both of those areas is likely to more than pay for the cost of the web filtering package provided by their MSP.
Cloud Based Web Filtering Solutions for MSPs
Convincing customers to implement a web filtering solution should be straightforward given the number of phishing attacks that are now being conducted and the cost of mitigating phishing attacks and malware infections. The cost of web filtering is tiny by comparison.
For MSPs, cloud-based filtering solutions are the natural choice. They can be implemented in minutes once a customer request has been received, no hardware is required, there is no software to install, and patching is handled by the service provider. All that is required from the MSP is a brief set up and configuration for each customer and ongoing management and reporting.
However, not all cloud-based web filtering solutions make set up, management and reporting simple. WebTitan Cloud differs in this respect. Not only does the solution offer excellent protection, the solution has been developed specifically with MSPs in mind. The ease of integration into MSP’s back-end systems and management has made WebTitan Cloud the go-to web filtering solution for MSPs.
In our next post we will explain how WebTitan Cloud differs from other web filtering solutions, why it is the easiest solution for MSPs to integrate into their existing cloud offerings, and how TitanHQ makes getting started, provisioning new customers, and managing customer accounts a quick and easy process requiring the minimal management overhead.
