#spear-phishing

[cyber-sec]

Stan Ghouls Deploys NetSupport RAT in Central Asia

Targeted attacks by Stan Ghouls hit organisations in Uzbekistan and nearby countries using spear-phishing PDFs and Java-based loaders to install NetSupport RAT for persistent access.

Source: Kaspersky

Read more: CyberSecBrief

[arielmcorg]

Descubren una operación de spear-phishing iraní cuyo objetivo es atacar a ex altos cargos del gobierno israelí

Descubren una operación de spear-phishing iraní cuyo objetivo es atacar a ex altos cargos del gobierno israelí

Check Point Research (CPR), la división de Inteligencia de Amenazas de Check Point® Software Technologies Ltd. (NASDAQ: CHKP), un proveedor de soluciones de ciberseguridad a nivel mundial, descubrió una reciente operación de spear-phishing con base en Irán dirigida contra antiguos funcionarios israelíes, personal militar de alto rango, becarios de instituciones de investigación, grupos de…

View On WordPress

[vpnanswers]

Going Phishing Day56 - Identity Quest

As a side effect of other cyberattacks, such as spear-phishing or ransomware, credential harvesting can occur.

[gustavoalara]

Investigadores revelan las últimas tácticas de phishing lateral

Los correos electrónicos procedentes de cuentas legítimas y comprometidas son difíciles de detectar, tanto para los sistemas de protección de correo electrónico existentes como para los propios destinatarios.

Tácticas de phishing lateral

Investigadores de Barracuda, UC Berkeley y UC San Diego han estudiado 180 incidentes de phishing lateral y han identificado los siguientes patrones que tanto empresas como personas deben conocer:

Uno de cada 10 ataques de phishing lateral tiene éxito

El 42% no se informa al equipo de seguridad o TI de la organización

El 98% de los incidentes de phishing lateral ocurrieron durante un día laborable

Se podría pensar que la mayoría del phishing lateral tomaría la forma de mensajes precisos y altamente personalizados, pero en la mayoría de los casos eso no es cierto.

"En los incidentes estudiados, nuestros investigadores descubrieron que la mayoría de los ataques de phishing laterales se basan en dos narrativas engañosas: mensajes que alertan falsamente al usuario de un problema con su cuenta de correo electrónico y mensajes que proporcionan un enlace a un documento falso 'compartido', apuntó Barracuda en un informe publicado recientemente.

Estos tipos de mensajes comunes representan el 63 por ciento de los correos electrónicos de phishing lateral. En el 30 por ciento de los casos, el lenguaje utilizado se adaptó a las organizaciones empresariales objetivo (p. Ej., "Calendario de trabajo actualizado. Por favor, distribúyalo a sus equipos").

“En el enfoque más sofisticado, el 7 por ciento de los ataques involucraron contenido altamente específico que era exclusivo de la organización de la cuenta secuestrada. Por ejemplo, en un incidente de adquisición de cuenta de correo electrónico, el atacante comprometió una cuenta en una organización que estaba a punto de celebrar su 25 aniversario. Utilizando la cuenta secuestrada, el atacante envió docenas de correos electrónicos de phishing a compañeros de trabajo que anunciaban un evento de celebración del 25 aniversario ", compartió la compañía.

En la mayoría de los casos (45%), los atacantes intentaron comprometer las cuentas aleatorias y no persiguieron a las víctimas con algún vínculo con la cuenta secuestrada (esas han sido atacadas en solo el 29 por ciento de los ataques). Además, aparentemente, este lote de incidentes estudiados no involucró a los estafadores de BEC (business email account), ya que los atacantes usaron la cuenta secuestrada para enviar a compañeros de empresa en solo el 1 por ciento de los casos observados.

Otro descubrimiento interesante: los destinatarios de los correos electrónicos de phishing lateral a menudo encontraron los correos electrónicos sospechosos y respondieron a la cuenta secuestrada para preguntar si el correo electrónico era legítimo o destinado a ellos. En el 17.5% de los casos, los atacantes respondieron con garantías de que el correo electrónico era legítimo y que el archivo adjunto / correo electrónico era seguro de abrir.

Finalmente, para mantener su acceso a las cuentas comprometidas el mayor tiempo posible, se sabe que los atacantes eliminan los correos electrónicos de phishing que enviaron y las respuestas que recibieron.

Defensa

Conocer estas tácticas es una de las formas en que las personas y las empresas pueden protegerse. Otra es usar soluciones de seguridad que estén orientadas a detectarlas. La protección de cuentas de usuario con autenticación multifactor puede servir para evitar la mayoría (si no todos) de estos ataques.

[rmarcelozano]

Olympic Destroyer: reaparece como amenaza peligrosa

Olympic Destroyer: reaparece como amenaza peligrosa

Olympic Destroyer reaparece apuntándole a organizaciones de protección contra amenazas químicas y biológicas

  Los analistas de Kaspersky Lab que siguen la actividad de Olympic Destroyer, amenaza que se hizo famosa al atacar la ceremonia de apertura de los Juegos Olímpicos de Invierno de Pyeongchang con un gusano de red destructivo, han descubierto que el grupo que se encuentra detrás todavía se…

View On WordPress

[allisonlegal]

Fake SEC Emails Target Execs for Inside information

  Cyber scammers are using a new trick to get confidential corporate information: They are sending spoofed emails, purporting to be from the Security and Exchange Commission, and aiming them at lawyers, compliance managers, and other company officials who file documents with the SEC. The security company FireEye (FEYE, -0.65%) discovered the ruse in late February, when…

Fake SEC Emails Target Execs for Inside information was originally published on Allison Legal Law Firm

[ujjalnewsnish]

Cyber War: Sex, Fingerprints and Spear-Phishing

New Post has been published on http://www.newsnish.com/technology/computer/laptop/cyber-war-sex-fingerprints-and-spear-phishing/

Cyber War: Sex, Fingerprints and Spear-Phishing

Anyone working for the U.S. government who had a secret – financial, sexual, criminal or otherwise – well, it’s no longer secret. The latest cyber data breaches of the Office of Personnel Management included the background investigation records of almost 20 million people. That stolen information is now in the hands of someone else.

“Some people are calling it one of the biggest intelligence failures ever,” said Richard Stiennon, author of There Will be Cyberwar.

Also recently stolen is all the personal information of some 20 million people who signed up for the Canadian-based online dating service for people who are married or in a committed relationship but want to have an affair.

And so is all the health information of millions of Americans who had signed up for health care through Premera Blue Cross, UCLA Health, and Anthem Inc., the second largest U.S. health insurer.

Not only is the background information of millions of people available, so are their social security numbers, credit card numbers, and email accounts. And if they were engaging in any illicit behavior, that information is out there too.

Analysts say that all that data together is a treasure trove of secret information that can be cross-checked, data-mined, and potentially used to blackmail people and undermine U.S. national security.

Who Has It?

Washington has not directly accused any one state, person or organization of the massive data breaches, and it is not clear if they are all the same actor. In the case of independent hackers, stolen data is often put up for sale on the “dark web” to the highest bidder.

If a state like China was behind the OPM breach, as many analysts believe, it will most likely hold onto the information and exploit it.

“An adversary like China, who knows a person’s weaknesses, can use that to intimidate or influence that person, and start them on a path to recruit them as a spy,” said Bob Gourley, publisher of ThreatBrief.com and co-founder of the cyber security consultancy Cognitio.

Whoever has the information also has a critical understanding of the structure of the U.S. federal government.

“They [now] have a complete database of all the people with security clearances. There have also been previous breaches of military and police organizations, so they’ve identified all of those people as well, So just from the data alone, you know who has got access to what critical information,” explained Stiennon.

Spear Phishing

That, in turn, opens the door to “spear phishing” – sending an e mail that appears to be from a known individual or business. When the recipient opens the email, the hacker gains access to that person’s computer.

“So, say you know somebody who is cleared at the top secret level, and their job is with Lockheed Martin and they are actively working in the radar systems, they could be targets,” said Stiennon, who is also the co-founder of IT-Harvest, an independent analyst firm.

Once inside someone’s computer, a hacker can remotely turn on the computer microphone or camera, as well as navigate through documents and emails and go on to attack other people or data banks which might be connected to the original target.

“Unfortunately, the U.S. government is a poorly defended organization corporate-wide,” Gourley said. “There are pockets of very strong security in places like the FBI, the Secret Service, and most parts of the Department of Defense and the intelligence community. Other than that, the government is very poorly defended.”

Fears Overblown?

Brandon Valeriano, a professor at Glasgow University who writes on cyber conflict, agreed that the U.S. government security infrastructure was “a mess.” But he said that fears about the latest data breaches were overblown.

“We have this sort of James Bond-esque perspective of security, with this idea that we can turn agents and get information about their affairs and make them do things for the government – that is kind of an antiquated notion of how things work,” Valeriano said.

“We see this information as sortable and usable, and it’s really not. This is terabytes of information. This is hundreds of thousands of millions of pages of information that is not readily usable, especially when you’re talking about cross language skills,” he said.

But Brett Williams, a retired Air Force General who was Director of Operations, U.S. Cyber Command from 2012 to 2014, says information, even if gathered by agents of a government like that of China, can still be sold on the market.

And one of the newer players on that market is the Islamic State extremist group.

“We have to understand that things only two or three years ago were available to the most sophisticated actors or nation-states are routinely available to anybody that wants to go purchase them and knows where to purchase them,” Williams told VOA.

Cyber analysts agree that both private industry and government agencies were aware of all the threats and working to counter them. But the latest breaches show that a lot more had to be done.

“I would say most people still underestimate the probability that they will be hacked, and they underestimate how much it will cost in the end. So getting ahead of that risk assessment process is also very important,” Williams said.

Source:Voanews

[obscureref]

Symantec, the world’s biggest antivirus-software maker, built a $15 billion empire on the back of a technology that it acknowledges doesn’t work that well at all.

The New York Times, a Symantec customer, reported today that its computer network was hacked repeatedly by attackers in China, and that Symantec’s programs didn’t catch the breaches. In response, Symantec put out a statement that said “anti-virus software alone is not enough.”

Other security technologies are needed to stop an attack like the one that hit the Times, Symantec said. While that may appear to be a bizarre admission from an antivirus maker, it’s no secret among security companies — and their customers — that antivirus programs are becoming less useful.

While security software is good at blocking malicious software it’s seen before, changing just one line of programming code can make a piece of commonly used malware invisible. Sophisticated attacks using custom software often doesn’t trigger alarms. Even Symantec itself was hacked and had some of its code stolen.

Well, anti-virus used to work well. And might still work well enough to protect personal computers. But once you're a big, valuable target, yeah, you need more to keep your systems and data safe.

Cybersecurity. It's a growth industry.

(Source: Bloomberg)