Experts insist that following the basic principles of cyber security will go a long way to lowering the odds of being victimized by an attacker. The latest proof is last month’s ransomware attack on Colonial Pipeline in the U.S. Hackers got in by exploiting a compromised username and password, according to an official of FireEye’s Mandiant threat intelligence service. Mandiant was called in to investigate the breach. The executive told Bloomberg News the password for a virtual private network account was no longer in use, but was still valid. That password was posted on the dark web, which raises the possibility a current or former Colonial employee used the same password on another account that had been hacked.
The recent ransomware attack on Colonial Pipeline inspired a threat actor to create a new phishing lure to trick victims into downloading malicious files. The emails are targeted and tailored as urgent notifications to download and install a system update that would defend against the latest ransomware strains.
The emails ask employees to download a “ransomware update” that is actually malware. Cyberattackers are now using the notoriety of the Colonial Pipeline ransomware attack to leverage further phishing attacks, according to the findings of a cybersecurity company. It is common for attackers to use widely-covered news events to get people to click on malicious emails and links, and cybersecurity firm INKY said it recently received multiple helpdesk emails about curious emails their customers were receiving.
INKY processed 656,954,951 emails in 2020. From this data, they ranked the top 25 most-phished brands during 2020. In round numbers, that’s two-thirds of a billion. Within this pool, Inky found 4,874,096 phishing campaigns. Of those phishing campaigns, 591,293 of them were brand impersonations. Out of the brand-impersonation group, INKY found 40,903 unique campaigns.
The cybercriminal interest in hijacking university email domains is one of cybersecurity’s worst kept secrets and yet it’s become a problem that only seems to generate more bad news.
Source: www.healthitsecurity.com A new phishing campaign has been spotted in the wild using hidden text, or what’s known as zero font, to bypass email security controls and deliver malicious emails to the user, according to a recent report from Inky Technology.
Video conferencing tech has been a lifeline for businesses, helping them sustain operations and communications amid the surreal events of 2020. But this sudden reliance was a vulnerability that some were ready to exploit.
Cybercriminals have been spotted using HTML/CSS and Unicode tricks to bypass tools meant to block malicious emails, marking a new twist in phishing techniques, security researchers report.
We’re used to hackers slipping malicious links and attachments into phishing emails. That doesn’t mean there aren’t the occasional slip-ups that result in malware infections, but for the most part, cyber-savvy users recognize the tricks used to fool them.
Inbound Mail Protection
Block impersonations and coach users against phishing.
Learn more
Outbound Mail Protection
Prevent high risk data loss before it can get out the door.
Learn more
Internal Mail Protection
Protect against attacks that come from within.
Learn more
Email Encryption
Guard sensitive data with fast and simple encryption.
Learn more
Advanced Attachment Analysis
Detect deeply hidden malware from inbound attachments.
Learn more
Graymail Protection
Boost productivity by filtering out bulk email.
Learn more
Security Awareness Training
Educate employees with phishing simulation and videos.
Learn more
Email Signatures
Control signatures for compliance and branding.
Learn more
DMARC Monitoring
Monitordomain usage to improve email delivery.
Learn more
Archiving
Protect, recover, and ensure compliance for critical data.
Learn more
