April 2025 - ExploreSec Cybersecurity Threat Intelligence Newsletter

June 10, 2025

This is a newsletter I create and share with my internal security team. Feel free to grab and do the same.

Ransomware Ecosystem in Flux

Coveware's latest analysis reveals a significant transformation in the ransomware threat landscape as of Q1 2025. The once-dominant Ransomware-as-a-Service (RaaS) model is unraveling due to intensified law enforcement actions, internal discord, and operational setbacks.

Key Insights:

Disintegration of Major RaaS Groups: Prominent groups like LockBit, BlackCat/ALPHV, and Black Basta have collapsed, plagued by internal conflicts and increased scrutiny. Leaked communications from Black Basta highlight challenges in targeting, risk assessment, and evasion of sanctions.

Emergence of New Threat Actors: The void left by these groups is being filled by unaffiliated extortionists, nascent ransomware brands with ties to espionage and hacktivism, and a few remnants of traditional ransomware operations.

Operational Missteps: Recent incidents, such as Clop's underwhelming Cleo campaign and a poorly executed Oracle Cloud SSO breach by a BreachForums actor, indicate a decline in the sophistication and monetization strategies of threat actors.

Rise of Phantom Scams: The appearance of fraudulent ransom notes, like those falsely attributed to BianLian, underscores a trend toward deceptive tactics as traditional extortion methods wane.

Increased Exposure and Arrests: Enhanced operational security measures and international cooperation have led to the identification and apprehension of several threat actors, diminishing the perceived anonymity that once shielded cybercriminals.

Further Reading: Coveware

Stealthy .NET Malware: Hiding Malicious Payloads as Bitmap Resources

Unit 42 researchers have identified a novel obfuscation technique employed by threat actors, wherein malicious payloads are concealed within bitmap resources embedded in seemingly benign 32-bit .NET applications. This method leverages steganography to initiate a multi-stage execution chain, ultimately deploying final payloads such as Agent Tesla, RemcosRAT, or XLoader.

Key Insights:

Steganographic Embedding: Malware is hidden within bitmap resources of .NET executables, allowing it to evade traditional detection mechanisms.

Malspam Distribution: Campaigns have been observed targeting sectors like finance in Türkiye and logistics in Asia, using localized email subjects and attachments to increase credibility.

Multi-Stage Execution: Upon execution, the infected application extracts and deobfuscates embedded payloads, loading them as dynamic-link libraries before executing the final malicious code.

Advanced Obfuscation Techniques: Additional methods such as metadata obfuscation, opcode replacement, and control flow manipulation are used to hinder static analysis and reverse engineering.

Further Reading: Unit 42

New Tool Can Trick Windows into Disabling Microsoft Defender

Security researchers have discovered a new, publicly available tool called "DefendNot" that can manipulate Windows systems into effectively disabling Microsoft Defender, the built-in antivirus software. This tool doesn't exploit vulnerabilities but instead uses legitimate system administration features in unintended ways.

Key Insights for Security Teams:

Abuse of Admin Privileges: Highlights the critical importance of least privilege principles and monitoring privileged accounts.

Bypasses Traditional Defenses: May evade detection by traditional security solutions that primarily look for malware signatures or exploit activity.

Focus on Tamper Protection: Underscores the importance of enabling and closely monitoring tamper protection features within Microsoft Defender.

Need for Behavioral Monitoring: Organizations should emphasize behavioral monitoring and anomaly detection to identify suspicious activity.

Tool is Publicly Available: Means threat actors could potentially incorporate it into their attack chains.

Further Reading: BleepingComputer

NIST Proposes Metric to Identify Likely Exploited Vulnerabilities

The National Institute of Standards and Technology (NIST), in collaboration with the Cybersecurity and Infrastructure Security Agency (CISA), has introduced a proposed metric aimed at determining the likelihood that a given vulnerability has been exploited in the wild. This initiative seeks to enhance the efficiency and cost-effectiveness of enterprise vulnerability remediation efforts.

Key Insights:

Addressing Limitations of Existing Systems: Current remediation strategies often rely on the Exploit Prediction Scoring System (EPSS) and Known Exploited Vulnerabilities (KEV) lists. However, EPSS has been noted for inaccuracies, and KEV lists may not be comprehensive. The proposed metric aims to augment these tools by providing a more accurate assessment of exploitation likelihood.

Enhancing Vulnerability Prioritization: By estimating the probability of exploitation, organizations can better prioritize vulnerabilities, focusing resources on those most likely to be targeted.

Collaborative Approach: The success of this metric depends on collaboration with industry partners to provide necessary performance measurements and validate the effectiveness of the approach.

Further Reading: NIST CSWP 41

New Best Practices Guide for Securing AI Data Released

CISA, NSA, FBI, and international partners have jointly released a new Cybersecurity Information Sheet focused on AI Data Security: Best Practices for Securing Data Used to Train & Operate AI Systems. This guide emphasizes that robust data security is fundamental for ensuring the accuracy, integrity, and trustworthiness of AI outcomes throughout its entire lifecycle.

Key Insights:

Holistic Risk Management: The guide outlines risks stemming from data security and integrity issues across all phases of AI, from development to operation.

Target Audience: It's particularly relevant for Defense Industrial Bases, National Security Systems owners, federal agencies, and Critical Infrastructure owners/operators.

Core Recommendations: Key practices include adopting strong data protection measures, proactively managing AI-related risks, and enhancing monitoring, threat detection, and network defense capabilities.

Vigilance is Key: As AI integration grows, organizations must take deliberate steps to secure the underlying data.

Further Reading: CISA

DDoS Attack "Street Prices": What You Need to Know

Recent analysis of the underground market reveals that the "street prices" for DDoS (Distributed Denial-of-Service) attacks have remained remarkably stable over the past few years, with some new trends in service delivery. While web-based booters are still available, Telegram-based booter services are becoming a new norm, offering readily accessible attack capabilities.

Key Insights:

Stable Pricing: DDoS attack costs have remained consistent, making them a relatively affordable option for malicious actors.

Layer 3/4 Attacks (Volume-based):

1 GB/Day (Booter-Service): ~$1/day

100 GB/Day: ~$25/day

1000 GB/Day (DDoS for Hire): ~$150/day

Layer 7 Attacks (Application-layer):

10,000 RPS/Day (Booter-Service): ~$1/day

50,000 RPS/Day (DDoS for Hire): ~$20/day

100,000 RPS + Protected Services (DDoS for Hire): ~$50/day

Max monthly cost for DDoS for Hire: ~$10,000/month

DDoS-as-a-Service (DDoSaaS) Dominance: This business model continues to thrive, with attackers charging hourly or monthly fees to sustain attacks, often with extra charges for targeting protected services.

Emergence of Telegram Booters: Threat actors are increasingly leveraging Telegram for offering and managing DDoS services, simplifying access for potential customers.

Further Reading: KyberVandals Blog

Deceptive CAPTCHA "ClickFix" Campaign Uses Clipboard Injection to Deliver Malware

Threat actors are employing a new social engineering campaign, dubbed "ClickFix," that utilizes fake CAPTCHA prompts on compromised or cloned websites. This sophisticated technique tricks users into launching malware by combining clipboard injection with abuse of the Windows Run dialog, leading to the delivery of payloads like Lumma Stealer and NetSupport RAT.

Key Insights:

Social Engineering Focus: The campaign heavily relies on user fatigue with CAPTCHA mechanisms, guiding victims through seemingly familiar steps to execute malicious code.

Clipboard Injection & Run Dialog Abuse: The core of the attack involves copying a malicious PowerShell or mshta command to the clipboard, which users are then instructed to paste and execute in the Windows Run dialog.

Living Off the Land Binaries (LOLBins): Attackers extensively use trusted system binaries like PowerShell, mshta.exe, and certutil.exe to bypass traditional security defenses, making detection challenging.

Payloads: Frequently observed payloads include infostealers (e.g., Lumma Stealer targeting browser data, credentials, and crypto wallets) and remote access tools (e.g., NetSupport RAT for full system access).

Simplicity and Effectiveness: The campaign's success stems from its simplicity, avoiding zero-day exploits or complex hidden mechanisms, relying instead on user interaction.

Proactive Defense: This campaign underscores the need for robust endpoint detection and response (EDR) solutions capable of behavioral analysis and detection of LOLBin abuse, alongside user education on suspicious CAPTCHA prompts and the dangers of pasting unknown commands.

Further Reading: SecurityOnline.info

Cybercriminals Exploit AI Hype to Spread Malware

Cybercriminals are increasingly exploiting the public's interest in artificial intelligence by creating fake AI-themed websites and advertisements to distribute malware. A recent campaign identified by Mandiant Threat Defense involves the threat group UNC6032 using deceptive ads on platforms like Facebook and LinkedIn to lure users into downloading malicious software disguised as AI video generation tools.

Key Insights:

Deceptive Advertising: Thousands of malicious ads have been disseminated, impersonating legitimate AI tools such as Luma AI and Canva Dream Lab. These ads direct users to fraudulent websites designed to mimic authentic AI services.

Malware Deployment: Upon interacting with these fake sites, users are prompted to download a ZIP file containing the STARKVEIL malware dropper. This dropper installs multiple malware components, including GRIMPULL, XWORM, and FROSTRIFT, which are designed to steal sensitive information and establish persistent access to the victim's system.

Information Theft: The deployed malware targets a range of data, including login credentials, cookies, credit card information, and digital wallet contents. Some components, like XWORM, also perform keylogging and screen capture, further compromising user privacy.

Evasion Techniques: The malware employs sophisticated methods to avoid detection, such as using Braille pattern blank characters to obscure file extensions and leveraging legitimate processes for malicious activities.

This campaign underscores the importance of vigilance when engaging with online advertisements, especially those offering AI-related services. Users should be cautious of unsolicited offers and verify the legitimacy of websites before downloading any software.

Further Reading: Google Cloud Blog

Beyond the Kill Chain: How Cybercriminals Invest Their Profits

Sophos X-Ops' five-part series, Beyond the Kill Chain, explores what happens after a successful cyberattack. The series reveals how financially motivated threat actors invest their illicit earnings—often blending legitimate business with ethically questionable and outright criminal ventures.

Key Insights:

Legitimate Business Ventures: Cybercriminals are investing in seemingly lawful enterprises such as restaurants, real estate, and e-commerce platforms. These ventures help launder money while also creating additional income streams.

Ethically Dubious Activities: Some threat actors operate in legal gray zones, selling spyware, monetizing vulnerability research under the guise of security services, or manipulating online traffic for advertising profits.

Criminal Enterprises: Illicit gains are also funneled into traditional criminal operations like counterfeit goods, drug trafficking, and underground gambling, showing how cybercrime supports broader organized crime ecosystems.

Implications for Cybersecurity: Mapping how threat actors reinvest their profits helps threat intelligence teams understand evolving risk models and disrupt the infrastructure supporting ongoing cybercriminal activity.

Further Reading: Sophos News

Lumma Infostealer: Disrupted but Not Defeated

A recent global law enforcement operation disrupted parts of the Lumma Infostealer malware-as-a-service platform, seizing over 2,500 domains. However, key infrastructure—particularly servers hosted in Russia—remains intact, allowing Lumma’s core operations to continue.

Key Insights:

Partial Takedown: While many domains were seized, Lumma’s main server remains online, enabling continued malware activity.

Resilience and Recovery: The developer claimed services resumed quickly with no arrests made, signaling strong operational recovery.

Ongoing Threat: Stolen credentials and sensitive data tied to Lumma are still appearing on dark web markets.

Psychological Tactics: Authorities planted disruptive messages in Lumma’s Telegram channels and admin panels to undermine trust in the service.

Mixed Reactions: Some cybercriminals are distancing themselves from Lumma, while others remain loyal and active.

Further Reading: Check Point Blog

CFOs Targeted in Sophisticated Spear-Phishing Campaign

A recent spear-phishing campaign is targeting Chief Financial Officers (CFOs) and finance executives across banking, energy, insurance, and investment sectors in regions including Europe, Africa, Canada, the Middle East, and South Asia. The attackers use a multi-stage approach to deploy NetBird, a legitimate WireGuard-based remote access tool, onto compromised systems.

Key Insights:

Deceptive Recruitment Emails: The campaign begins with emails impersonating a Rothschild & Co recruiter offering a “strategic opportunity.” Victims are directed to a Firebase-hosted page featuring a custom CAPTCHA to access a malicious file.

Malicious Payload Delivery: After solving the CAPTCHA, users download a ZIP file containing a VBS script. When executed, it installs NetBird and OpenSSH, creates a hidden local admin account, and enables Remote Desktop Protocol (RDP) for persistent attacker access.

Evasion Techniques: The use of custom CAPTCHAs and trusted hosting services helps the attackers bypass traditional security defenses and increases credibility.

Attribution: Some infrastructure overlaps with known nation-state campaigns, but the specific threat actor remains unidentified.

Further Reading: Trellix Blog

Threat Actors Exploit Google Apps Script for Evasive Phishing Attacks

Threat actors are leveraging Google's Apps Script platform to host phishing pages that appear legitimate, allowing them to steal login credentials. These campaigns often begin with emails posing as invoice notifications, linking to webpages hosted using Google Apps Script. By operating within Google's trusted environment, attackers make their phishing pages seem more authentic, increasing the chances of success.

Key Insights:

Abuse of Trusted Services: Google Apps Script, a JavaScript-based platform used for automating Google Workspace tasks, is being exploited to host fake login pages that capture user credentials and send them to attacker-controlled servers.

Evasion of Security Measures: Because the scripts are hosted on Google's own domain, they can bypass traditional email and web filters that typically block suspicious domains.

Sophisticated Phishing Techniques: The phishing emails and login prompts are convincingly designed to mimic legitimate services, making it more likely that targets will engage and provide sensitive information.

Further Reading: BleepingComputer

HuluCAPTCHA – An Evolving Fake CAPTCHA Framework

Security researchers have identified "HuluCAPTCHA," a sophisticated fake CAPTCHA framework actively compromising websites. This advanced system tricks users into running malicious commands via fake CAPTCHA prompts and the Windows Run dialog, leading to infections with infostealers and remote access tools.

Key Insights:

Deceptive Execution: Users are redirected from compromised sites to fake CAPTCHA pages, then instructed to copy/paste malicious PowerShell or mshta commands into Windows Run.

Advanced Tracking & Stealth: The framework meticulously tracks user interactions and potential command execution. It leverages Living Off the Land Binaries (LOLBins) to evade traditional defenses.

Payload Versatility: Delivers various infostealers (e.g., Lumma, Aurotun) and remote access tools (e.g., Donut Injector).

Persistent Backdoors: Compromised WordPress sites show sophisticated hidden admin backdoors, designed for stealth and persistence.

High-Value Targets: Attackers are targeting organizations that could hold sensitive data, highlighting the potential for significant impact.

Further Reading: HuluCaptcha — An example of a FakeCaptcha framework

Phishing Campaign Exploits Google.com Open Redirects

A recent phishing campaign has been observed exploiting an open redirect vulnerability within Google's google.com/travel/clk endpoint. Threat actors are leveraging this legitimate Google Travel click-tracking mechanism to redirect users from a trusted google.com domain to malicious phishing sites. This technique adds an air of legitimacy to phishing links, making them harder for users to identify as fraudulent.

Key Insights:

Trusted Domain Abuse: Attackers are using google.com/travel/clk?pc=[token]&pcurl=[target_URL] to redirect users. The presence of google.com in the initial link provides a deceptive sense of security.

Persistent Tokens: The pc token, which controls the redirect, lacks a clear expiration mechanism and can remain valid for months or even years. This allows attackers to reuse tokens across multiple campaigns.

Ease of Exploitation: Obtaining a valid token is trivial, requiring only a visit to Google's hotel search page to copy one from a legitimate link.

Google's Stance: Google's official position classifies open redirects as "very little practical risk," claiming they invest in phishing detection rather than preventing the redirects themselves. This stance is debated given the observed abuse.

Detection Challenge: The initial legitimate google.com domain in the link makes it difficult for users and some security systems to immediately flag it as malicious.

Mitigation Recommendation for Internal Security Teams:

Flag or sandbox any google.com/travel/clk links that appear in email and other messages until Google clarifies its redirect validation mechanisms.

Further Reading: Another day, another phishing campaign abusing google.com open redirects

Cybercriminals Use Fake Booking Sites to Spread AsyncRAT Malware

Cybercriminals are exploiting fake Booking.com websites to infect users with AsyncRAT, a remote access trojan. Victims are lured through deceptive ads and social media links to counterfeit booking sites, where they are tricked into running a malicious PowerShell script. The attack results in full remote control of the infected system, putting sensitive personal information at risk.

Key Insights:

Attackers use fake CAPTCHA prompts to manipulate users into executing malware.

The AsyncRAT payload allows for full system access, including surveillance and data theft.

Domains rotate every few days, making detection and blocking more difficult.

Further Reading: Malwarebytes Blog

UNC6040 – Voice Phishing to Salesforce Data Extortion

Google Threat Intelligence Group (GTIG) is tracking UNC6040, a financially motivated threat cluster specializing in voice phishing (vishing) campaigns. This group is successfully impersonating IT support to gain access to organizations' Salesforce instances, primarily to steal large volumes of data for subsequent extortion. Their tactics rely heavily on manipulating end users rather than exploiting software vulnerabilities.

Key Insights:

Vishing is Key: UNC6040 uses convincing phone calls, often targeting English-speaking employees, to socially engineer access.

Salesforce Data Loader Abuse: They trick victims into authorizing malicious versions of Salesforce Data Loader, gaining broad access to exfiltrate sensitive data.

Lateral Movement: After Salesforce, they use stolen credentials for lateral movement into other cloud platforms like Okta and Microsoft 365.

No Platform Vulnerability: Attacks exploit user trust and process gaps, not inherent Salesforce flaws.

Persistent Threat: Extortion can occur months after the initial intrusion, indicating a patient and persistent threat.

Further Reading: The Cost of a Call: From Voice Phishing to Data Extortion

June 2025 - ExploreSec Cybersecurity Awareness Newsletter

June 9, 2025

This is a monthly newsletter I put together for an internal security awareness program. Feel Free to grab and use for your own program.

Be Cautious of Government Emails About Unpaid Tolls and Other Urgent Matters

Have you recently received an email from a government agency about an unpaid toll or another urgent issue? It's important to be extra careful, as cybercriminals are now exploiting official government email systems to send out scam messages.

Key Insights:

Scammers are using official-looking emails that appear to come from legitimate government departments.

A common scam involves emails claiming unpaid tolls and urging you to click a link to pay.

Be wary of urgent requests for information or payment designed to pressure you.

Always check the actual web address of a link by hovering over it without clicking. Suspicious or non-official links should be avoided.

Never share personal or financial information through links in suspicious emails.

Independently verify any questionable government emails by contacting the agency directly through their official website or phone number.

Further Reading: TechCrunch

Beware of Crypto Scams Promoted Through Hacked Social Media

The Internet Crime Complaint Center (IC3) has issued a public service announcement warning about a growing trend: scammers are taking over social media accounts and using them to trick people into investing in fake cryptocurrency schemes. These scams can look very convincing because they appear to come from accounts you or your friends might already follow.

Key Insights to Protect Yourself:

Be suspicious of investment opportunities shared via social media: Even if a post comes from a friend's account, be very cautious about any cryptocurrency investment being promoted. Their account may have been hacked.

Look for red flags in investment promises: Be wary of claims of guaranteed high returns with little to no risk. Legitimate investments always carry some level of risk.

Don't rush into investment decisions: Scammers often create a sense of urgency to pressure you into investing quickly before you have time to think it over or do your research.

Verify the information through official sources: Before investing in any cryptocurrency opportunity, independently research the platform or opportunity through trusted financial news outlets and official cryptocurrency websites. Don't rely solely on what you see on social media.

Be cautious of direct messages about investments: If you receive unsolicited direct messages on social media encouraging you to invest in cryptocurrency, treat them with extreme caution, even if they appear to be from someone you know.

Report suspicious activity: If you see suspicious cryptocurrency promotions on social media, report them to the platform. If you have been a victim of such a scam, file a complaint with the IC3 at ic3.gov.

Remember: If an investment opportunity sounds too good to be true, it probably is.

Further Reading: IC3

Hacked TikTok Videos Push Fake Apps and Steal Your Info!

Trend Micro researchers have uncovered a concerning new trend: videos on TikTok are promoting what appear to be pirated apps, but are actually designed to trick you into downloading dangerous "infostealer" malware like Vidar and StealC. These videos use clever social engineering, providing step-by-step instructions that lead users to compromise their own systems.

Key Insights:

Be Skeptical of "Free" Pirated Apps: If an offer seems too good to be true, especially for paid software offered for free, it's very likely a scam.

Avoid Unsolicited Technical Instructions: Never follow commands or instructions from untrusted sources, particularly if they tell you to disable security features or run unusual software.

Verify Video Sources: Just because a video is popular doesn't mean it's legitimate. Be cautious of content that pushes you to download files or visit external sites.

Recognize Social Engineering: Scammers use convincing visuals and instructions to make their malicious content seem harmless and easy to follow. Always pause and think before acting.

Further Reading: Trend Micro

Watch Out for Payroll Scams and Fake Login Pages!

Cybercriminals are getting sneakier, using new tricks to steal your paycheck. A recent alert highlights how attackers are using "SEO poisoning" to create fake payroll login pages that show up at the top of search results. If you fall for it and enter your login details, they can change your direct deposit information and reroute your pay!

Key Insights:

Access Payroll Directly: Don't rely on search engines. Always go to your payroll portal by typing the official website address directly into your browser or using a trusted bookmark.

Enable Multi-Factor Authentication (MFA): If your payroll portal offers MFA (like a code sent to your phone), enable it! This adds an extra layer of security.

Be Wary of Suspicious Changes: Set up alerts in your payroll software to notify you of any changes to your direct deposit information. If you get an unexpected alert, investigate immediately.

Report Unauthorized Changes: Know how to report any unauthorized changes or suspicious activity to your HR or IT department right away.

Update Your Devices: Keep your home office routers and mobile devices updated with the latest software and use strong, unique passwords. Attackers can exploit weaknesses in outdated systems to hide their activities.

Further Reading: ReliaQuest

Deceptive CAPTCHA "ClickFix" Campaign Uses Clipboard Injection to Deliver Malware

Key Insights:

Social Engineering Focus: The campaign heavily relies on user fatigue with CAPTCHA mechanisms, guiding victims through seemingly familiar steps to execute malicious code.

Clipboard Injection & Run Dialog Abuse: The core of the attack involves copying a malicious PowerShell or mshta command to the clipboard, which users are then instructed to paste and execute in the Windows Run dialog.

Living Off the Land Binaries (LOLBins): Attackers extensively use trusted system binaries like PowerShell, mshta.exe, and certutil.exe to bypass traditional security defenses, making detection challenging.

Payloads: Frequently observed payloads include infostealers (e.g., Lumma Stealer targeting browser data, credentials, and crypto wallets) and remote access tools (e.g., NetSupport RAT for full system access).

Simplicity and Effectiveness: The campaign's success stems from its simplicity, avoiding zero-day exploits or complex hidden mechanisms, relying instead on user interaction.

Proactive Defense: This campaign underscores the need for robust endpoint detection and response (EDR) solutions capable of behavioral analysis and detection of LOLBin abuse, alongside user education on suspicious CAPTCHA prompts and the dangers of pasting unknown commands.

Further Reading: SecurityOnline.info

Cybercriminals Exploit AI Hype to Spread Malware

Key Insights:

Deceptive Advertising: Thousands of malicious ads have been disseminated, impersonating legitimate AI tools such as Luma AI and Canva Dream Lab. These ads direct users to fraudulent websites designed to mimic authentic AI services.

Malware Deployment: Upon interacting with these fake sites, users are prompted to download a ZIP file containing the STARKVEIL malware dropper. This dropper installs multiple malware components, including GRIMPULL, XWORM, and FROSTRIFT, which are designed to steal sensitive information and establish persistent access to the victim's system.

Information Theft: The deployed malware targets a range of data, including login credentials, cookies, credit card information, and digital wallet contents. Some components, like XWORM, also perform keylogging and screen capture, further compromising user privacy.

Evasion Techniques: The malware employs sophisticated methods to avoid detection, such as using Braille pattern blank characters to obscure file extensions and leveraging legitimate processes for malicious activities.

Further Reading: Google Cloud Blog

Beyond the Kill Chain: How Cybercriminals Invest Their Profits

Key Insights:

Legitimate Business Ventures: Cybercriminals are investing in seemingly lawful enterprises such as restaurants, real estate, and e-commerce platforms. These ventures help launder money while also creating additional income streams.

Ethically Dubious Activities: Some threat actors operate in legal gray zones, selling spyware, monetizing vulnerability research under the guise of security services, or manipulating online traffic for advertising profits.

Criminal Enterprises: Illicit gains are also funneled into traditional criminal operations like counterfeit goods, drug trafficking, and underground gambling, showing how cybercrime supports broader organized crime ecosystems.

Implications for Cybersecurity: Mapping how threat actors reinvest their profits helps threat intelligence teams understand evolving risk models and disrupt the infrastructure supporting ongoing cybercriminal activity.

Further Reading: Sophos News

CFOs Targeted in Sophisticated Spear-Phishing Campaign

Key Insights:

Deceptive Recruitment Emails: The campaign begins with emails impersonating a Rothschild & Co recruiter offering a “strategic opportunity.” Victims are directed to a Firebase-hosted page featuring a custom CAPTCHA to access a malicious file.

Malicious Payload Delivery: After solving the CAPTCHA, users download a ZIP file containing a VBS script. When executed, it installs NetBird and OpenSSH, creates a hidden local admin account, and enables Remote Desktop Protocol (RDP) for persistent attacker access.

Evasion Techniques: The use of custom CAPTCHAs and trusted hosting services helps the attackers bypass traditional security defenses and increases credibility.

Attribution: Some infrastructure overlaps with known nation-state campaigns, but the specific threat actor remains unidentified.

Further Reading: Trellix Blog

Threat Actors Exploit Google Apps Script for Evasive Phishing Attacks

Key Insights:

Abuse of Trusted Services: Google Apps Script, a JavaScript-based platform used for automating Google Workspace tasks, is being exploited to host fake login pages that capture user credentials and send them to attacker-controlled servers.

Evasion of Security Measures: Because the scripts are hosted on Google's own domain, they can bypass traditional email and web filters that typically block suspicious domains.

Sophisticated Phishing Techniques: The phishing emails and login prompts are convincingly designed to mimic legitimate services, making it more likely that targets will engage and provide sensitive information.

Further Reading: BleepingComputer

Cybercriminals Use Fake Booking Sites to Spread AsyncRAT Malware

Key Insights:

Attackers use fake CAPTCHA prompts to manipulate users into executing malware.

The AsyncRAT payload allows for full system access, including surveillance and data theft.

Domains rotate every few days, making detection and blocking more difficult.

Further Reading: Malwarebytes Blog

UNC6040 – Voice Phishing to Salesforce Data Extortion

Key Insights:

Vishing is Key: UNC6040 uses convincing phone calls, often targeting English-speaking employees, to socially engineer access.

Salesforce Data Loader Abuse: They trick victims into authorizing malicious versions of Salesforce Data Loader, gaining broad access to exfiltrate sensitive data.

Lateral Movement: After Salesforce, they use stolen credentials for lateral movement into other cloud platforms like Okta and Microsoft 365.

No Platform Vulnerability: Attacks exploit user trust and process gaps, not inherent Salesforce flaws.

Persistent Threat: Extortion can occur months after the initial intrusion, indicating a patient and persistent threat.

Further Reading: The Cost of a Call: From Voice Phishing to Data Extortion

January 2025 - Security Awareness Newsletter

January 8, 2025

This is a security awareness focused newsletter that I share internally. Feel free to grab and use for your own internal security awareness program. Created with help from ChatGPT.

FBI Shares Strategies to Combat AI-Driven Fraud Schemes

The Federal Bureau of Investigation (FBI) has issued a public service announcement highlighting the increasing use of generative artificial intelligence (AI) by cybercriminals to enhance the sophistication and believability of fraud schemes. These AI-powered tactics are being employed across various fraudulent activities, including romance scams, investment fraud, and job recruitment cons.

Internet Crime Complaint Center

Key Insights:

Enhanced Deception: Generative AI enables criminals to produce highly convincing text, images, audio, and video content, making fraudulent communications appear legitimate and more persuasive.

Voice Cloning: Advanced AI techniques allow for the cloning of voices, which can be used in schemes such as impersonating family members in distress to solicit money or sensitive information.

Synthetic Identities: AI-generated images and profiles are utilized to create fake identities on social media platforms, facilitating social engineering attacks and spear-phishing campaigns.

Recommendations:

Verify Communications: Be cautious of unsolicited messages, especially those requesting personal information or financial transactions. Confirm the authenticity of such communications through direct and reliable channels.

Establish Verification Protocols: Develop secret codes or phrases with family members and trusted contacts to authenticate identities during unexpected or urgent requests.

Limit Personal Information Sharing: Be mindful of the personal data shared on social media and other public platforms, as it can be exploited to craft personalized and convincing scams.

Staying informed about the evolving tactics of AI-driven fraud is crucial in safeguarding personal and financial information.

Further Reading: BleepingComputer Article

Black Basta Ransomware Adopts Advanced Social Engineering Tactics

The Black Basta ransomware group has recently enhanced its attack strategies by incorporating sophisticated social engineering techniques, including email bombing, QR code phishing, and the deployment of custom malware payloads.

Key Developments:

Email Bombing: Attackers inundate targets with excessive emails by subscribing their addresses to numerous mailing lists. This tactic overwhelms victims and increases the likelihood of interaction with subsequent malicious communications.

Impersonation via Microsoft Teams: Threat actors pose as IT support personnel, contacting victims through Microsoft Teams to establish trust and facilitate the installation of remote access tools.

QR Code Phishing: Malicious QR codes are sent to victims, directing them to phishing sites designed to harvest credentials or deploy additional malware.

Further Reading: The Hacker News

Phishing Attacks Target Employee Payroll Accounts

Cybercriminals are increasingly launching phishing attacks aimed at hijacking employee payroll accounts. These schemes often involve fraudulent emails that appear to originate from Human Resources or payroll departments, requesting employees to update or verify their direct deposit information. Unsuspecting employees who comply may inadvertently provide attackers with access to their payroll accounts, leading to unauthorized changes and financial theft.

Key Insights:

Impersonation of Internal Departments: Attackers craft emails that convincingly mimic internal communications from HR or payroll, exploiting employees' trust in these departments.

Urgency and Deception: Messages often convey a sense of urgency, such as impending payroll issues, to prompt quick action without thorough scrutiny.

Credential Harvesting: Links within these emails direct employees to counterfeit login pages designed to capture their credentials, granting attackers unauthorized access.

Further Reading: KnowBe4 Blog

Surge in 'ClickFix' Social Engineering Attacks

Cybersecurity researchers have identified a significant increase in the use of a social engineering tactic known as "ClickFix." This method deceives users into copying and pasting malicious commands into their systems, leading to malware infections.

Key Developments:

Deceptive Error Messages: Attackers present fake error dialogs, prompting users to execute provided commands to resolve non-existent issues.

Malware Delivery: By following these instructions, users inadvertently run scripts that download and install malware such as Lumma Stealer and AsyncRAT.

Global Impact: Campaigns employing ClickFix techniques have targeted organizations worldwide, with notable incidents involving fake GitHub security notifications and counterfeit software updates.

Further Reading: Proofpoint Blog

AI-Driven Investment Scams Proliferate via Social Media

Cybercriminals are increasingly leveraging artificial intelligence (AI) and social media platforms to perpetrate sophisticated investment scams, leading to significant financial and data losses among victims worldwide.

Key Insights:

AI-Generated Deception: Scammers utilize AI to create convincing video testimonials featuring fabricated endorsements from celebrities and financial experts, enhancing the credibility of fraudulent investment schemes.

Social Media Malvertising: Fraudulent advertisements are disseminated through social media channels, often mimicking legitimate company posts or news outlets, to lure potential investors into the scam.

Phishing Tactics: Victims are directed to counterfeit websites designed to harvest personal information under the guise of investment opportunities, leading to identity theft and unauthorized financial transactions.

Recommendations:

Verify Authenticity: Scrutinize investment opportunities, especially those encountered through social media, by researching the offering entity and seeking independent financial advice.

Be Skeptical of High Returns: Exercise caution with schemes promising unusually high or guaranteed returns, as these are common indicators of fraudulent activity.

Protect Personal Information: Avoid sharing sensitive data through unsolicited links or forms; ensure websites are legitimate and secure before providing any personal details.

Staying informed and exercising due diligence are crucial in safeguarding against these evolving AI-driven investment scams.

Further Reading: The Hacker News

Security Alert: Fake Brand Collaboration Scams Targeting YouTube Creators

Cybercriminals are increasingly targeting YouTube content creators by impersonating reputable brands and offering fraudulent collaboration opportunities. These sophisticated phishing campaigns aim to distribute malware, leading to the theft of sensitive information and unauthorized access to creators' systems.

Key Insights:

Impersonation of Trusted Brands: Attackers craft convincing emails that appear to originate from well-known companies, proposing enticing partnership deals to lure creators into their scheme.

Malware Delivery via Documents: The fraudulent offers include attachments, such as contracts or promotional materials, often delivered through password-protected files hosted on platforms like OneDrive to evade detection.

Theft of Sensitive Information: Once the malware is installed, it can steal login credentials, financial data, and grant attackers remote access to the victim's system, compromising both personal and channel security.

Further Reading: CloudSEK Blog

Malicious Ads Deliver SocGholish Malware to Kaiser Permanente Employees

A recent cyberattack has targeted Kaiser Permanente employees through malicious advertisements on Google Search, leading to the distribution of SocGholish malware.

Key Developments:

Malicious Advertisements: Threat actors placed deceptive ads mimicking Kaiser Permanente's HR portal to lure employees searching for benefits and payroll information.

Compromised Website Redirects: Clicking the fraudulent ad redirected users to a compromised website, bellonasoftware[.]com, which briefly displayed a phishing page before prompting a fake browser update.

SocGholish Malware Deployment: The fake browser update led to the download of "Update.js," a malicious script associated with the SocGholish malware campaign, designed to collect system information and potentially allow human operators to execute further malicious actions.

This incident highlights the evolving tactics of cybercriminals in exploiting trusted platforms like Google Ads to distribute malware.

Further Reading: Malwarebytes Blog

Threat Actors Exploit LinkedIn to Target Job Seekers

Cybercriminals are increasingly leveraging LinkedIn to deceive job seekers through sophisticated employment scams. By creating fake recruiter profiles, often enhanced with AI-generated images, these threat actors craft personalized messages that appear to offer legitimate job opportunities. The objective is to lure victims into clicking on malicious links that lead to phishing sites designed to harvest personal information or deploy malware.

Key Insights:

Personalized Deception: Scammers tailor messages based on the victim's professional background, making the fraudulent offers appear credible and enticing.

Advanced Phishing Techniques: The use of AI-generated recruiter profiles and convincing communication strategies increases the likelihood of victims engaging with malicious content.

Exploitation of LinkedIn Features: By abusing LinkedIn's InMail feature, attackers can reach users outside their immediate network, broadening the scope of potential targets.

Further Reading: KnowBe4 Blog

Cybercriminals Impersonate KnowBe4 in Phishing Attacks

Cybercriminals are impersonating KnowBe4 by sending fraudulent emails that closely mimic legitimate "Please Complete Assigned Training" notifications. These deceptive emails aim to trick recipients into clicking malicious links or downloading harmful attachments, potentially compromising personal and organizational security.

Key Insights:

Sophisticated Mimicry: The phishing emails are designed to closely resemble authentic KnowBe4 training notifications, making it challenging for recipients to distinguish between legitimate and fraudulent communications.

Malicious Intent: Interacting with the links or attachments in these emails can lead to malware infections, unauthorized access to sensitive information, or other security breaches.

Targeted Deception: By exploiting the trust associated with KnowBe4's brand, attackers increase the likelihood of recipients falling victim to the scam.

Further Reading: KnowBe4 Blog

Malicious Advertisements Pose Growing Threat to Internet Users

Cybercriminals are increasingly utilizing malicious advertisements, or "malvertising," to distribute malware and conduct phishing attacks. These deceptive ads often appear as legitimate sponsored content on search engine results pages, making it challenging for users to distinguish between safe and harmful links.

Key Insights:

Prevalence of Malvertising: Malicious actors pay search engines to display their harmful URLs as sponsored ads, which are prominently positioned above legitimate search results. This tactic increases the likelihood of user engagement with malicious content.

Deceptive Appearances: These ads are crafted to closely mimic legitimate websites or services, often using familiar branding and language to deceive users into clicking on them.

Potential Consequences: Interacting with malvertising can lead to malware infections, unauthorized access to personal information, and financial loss.

Further Reading: KnowBe4 Blog

Mobile Phishing Campaign Targets Job Seekers

Cybercriminals are impersonating recruiters to target job seekers with phony employment offers. Researchers at Zimperium warn that a phishing campaign is targeting Android phones to deliver the Antidot banking trojan.

Key Insights:

Sophisticated Social Engineering: Attackers masquerade as job recruiters or HR representatives from well-known organizations, sending well-crafted phishing emails that purport to come from real companies, informing recipients that they’ve been selected to advance in the hiring process.

Malware Delivery: Victims are enticed to download a malicious application, leading to the installation of the Antidot banking trojan on their Android devices.

Credential Theft: Once installed, the malware enables a broad set of malicious actions, including credential theft of banking, cryptocurrency, and other critical applications.

Further Reading: KnowBe4 Blog

Phishing Scam Mimics Employment Termination Notices

Cybercriminals are deploying phishing attacks that impersonate employment termination notices to exploit individuals' fear of job loss. These deceptive emails appear to be official communications from human resources departments, complete with authentic-looking logos and case numbers, urging immediate action to avoid "serious legal consequences."

Key Insights:

Deceptive Emails: The phishing emails are designed to closely resemble legitimate employment termination notices, making it challenging for recipients to distinguish between authentic and fraudulent communications.

Malware Distribution: Clicking on the provided link directs victims to a fake Microsoft webpage that prompts the download of malicious software. This malware can steal sensitive information, including banking credentials, leading to significant financial and personal repercussions.

Exploiting Emotional Triggers: By preying on the fear of job loss, attackers increase the likelihood of recipients reacting hastily and clicking on malicious links without proper scrutiny.

Further Reading: KnowBe4 Blog

Malicious Google Ads Exploit Printer Troubleshooting Searches

Cybercriminals are exploiting Google Ads to target users seeking solutions for printer issues, particularly those involving HP and Canon devices.

Key Insights:

Deceptive Advertisements: Scammers purchase Google Ads that appear as legitimate tech support for printer drivers, luring users into clicking on malicious links.

Fake Installation Processes: Upon visiting these fraudulent sites, users encounter a simulated driver installation that culminates in a fabricated error message, warning that further attempts may damage the printer and void its warranty.

Phony Tech Support: The error message prompts users to initiate a live chat, connecting them with scammers posing as tech support representatives, who may then attempt to extract personal information or payments.

Further Reading: KnowBe4 Blog

Phishing Attack Exploits Google Calendar to Bypass Spam Filters

Cybercriminals are leveraging Google Calendar invites to conduct phishing attacks that evade spam filters. By sending fraudulent meeting invitations, they prompt recipients to click on malicious links embedded within the event details.

Key Insights:

Exploitation of Trusted Services: Attackers utilize legitimate Google services, such as Calendar and Forms, to enhance the credibility of their phishing attempts, making detection more challenging.

Evasion of Security Measures: By originating from trusted platforms, these phishing messages can bypass traditional email security filters, increasing the likelihood of reaching potential victims.

Deceptive Tactics: The fraudulent invitations often include links disguised as legitimate actions, such as viewing event details or confirming attendance, which redirect to malicious sites designed to harvest user credentials.

Further Reading: BleepingComputer

Smart Devices in Homes Pose Privacy and Security Risks

Recent analyses have highlighted the potential privacy and security vulnerabilities associated with the increasing presence of smart devices in households. These devices, while offering convenience, can be exploited by malicious actors to compromise personal information and security.

Checkpoint Blog

Key Insights:

Unauthorized Access: Smart devices, such as cameras and voice assistants, can be manipulated to monitor activities within homes without the owner's consent.

Data Exploitation: Information collected by these devices may be accessed or intercepted by unauthorized parties, leading to potential misuse of personal data.

Regulatory Challenges: The rapid adoption of smart technology has outpaced the development of comprehensive regulations, leaving consumers vulnerable to emerging threats.

Further Reading: Check Point Blog

Cybercriminals Exploit Fake CAPTCHAs to Distribute Malware

Recent analyses have identified a deceptive tactic where cybercriminals use fake CAPTCHA pages to distribute malware, exploiting users' trust in these verification systems.

Key Developments:

Malicious Redirects: Users visiting compromised websites are redirected to fraudulent CAPTCHA pages that closely mimic legitimate services like Google and CloudFlare.

Clipboard Hijacking: These fake CAPTCHAs silently copy malicious commands to the user's clipboard via JavaScript, prompting them to execute these commands unknowingly through the Windows Run prompt.

Malware Installation: Executing the copied commands leads to the installation of malware, including information stealers and remote-access trojans (RATs), which can extract sensitive data and provide persistent access to compromised systems.

Further Reading: ReliaQuest Blog

Data Breach at American Addiction Centers Affects Over 422,000 Individuals

American Addiction Centers (AAC), a leading provider of substance abuse treatment services, has reported a data breach impacting more than 422,000 individuals.

Key Details:

Incident Timeline: The breach was detected on September 26, 2024, with unauthorized access occurring several days prior.

Compromised Information: Exfiltrated data includes names, addresses, phone numbers, dates of birth, Social Security numbers, health insurance details, and medical record identifiers. Notably, treatment information and payment card data were not affected.

Threat Actor Involvement: The Rhysida ransomware group has claimed responsibility, alleging the theft of approximately 2.8 terabytes of data.

Notification and Support: AAC has begun notifying affected individuals and is offering 12 months of free credit monitoring services.

Further Reading: SecurityWeek

Sophisticated Phishing Scams Lead to Significant Cryptocurrency Losses

Recent incidents have highlighted advanced phishing attacks where cybercriminals impersonate legitimate services to gain unauthorized access to individuals' cryptocurrency wallets, resulting in substantial financial losses.

Key Insights:

Impersonation of Trusted Entities: Attackers pose as representatives from reputable organizations, such as Google or cryptocurrency platforms, to deceive victims into believing their accounts are compromised.

Manipulation of Security Features: Victims receive seemingly legitimate security alerts and prompts, which are actually orchestrated by the attackers to facilitate unauthorized account access.

Exploitation of Stored Sensitive Information: Once access is obtained, cybercriminals search for stored sensitive data, such as cryptocurrency wallet seed phrases, enabling them to transfer funds without detection.

Further Reading: Krebs on Security

Mobile Phishing Attacks Employ New Tactics to Evade Security Measures

Recent analyses have identified a novel social engineering tactic targeting mobile banking users. Attackers are leveraging Progressive Web Apps (PWAs) and WebAPKs to distribute phishing websites disguised as legitimate applications, effectively bypassing traditional security warnings and app store vetting processes.

Key Insights:

Exploitation of PWAs and WebAPKs: Unlike traditional apps, these malicious PWAs and WebAPKs are essentially phishing websites packaged to look like legitimate applications. This means they do not exhibit the typical behaviors or characteristics associated with malware, making detection more challenging.

Bypassing Security Measures: Their ability to bypass traditional security warnings of a mobile operating system, and total sidestepping of app store vetting processes, is particularly concerning. This allows attackers to distribute malicious content without triggering standard security alerts.

Anticipated Increase in Sophistication: It is anticipated that more sophisticated and varied phishing campaigns utilizing PWAs and WebAPKs will emerge, unless mobile platforms change their approach towards them.

Further Reading: KnowBe4 Blog

'James Bond-Style' Scams Lead to Significant Financial Losses

Recent reports have highlighted a surge in sophisticated scams where fraudsters impersonate trusted entities, such as law enforcement or intelligence agencies, to deceive victims into believing they are involved in international criminal activities.

Key Insights:

Deceptive Communication: Scammers contact individuals, claiming to be from reputable organizations like Amazon, the U.S. Post Office, or law enforcement agencies, alleging the victim's involvement in global criminal schemes.

Manipulative Tactics: Victims are coerced into withdrawing large sums of money from personal accounts under the guise of protecting their funds from criminal misuse. They are instructed to hand over cash to individuals posing as law enforcement agents, who then abscond with the money.

Significant Financial Impact: These scams have led to substantial financial losses for victims, with little to no chance of recovery once the funds are handed over.

Further Reading: KnowBe4 Blog

November 2024 Threat Intelligence Newsletter

November 11, 2024

This is a monthly newsletter I put together for our internal security team with a lean towards phishing and healthcare. Created with help from ChatGPT.

Fake Job Applications Deliver Dangerous Malware

Summary: A spear-phishing campaign is targeting HR professionals with fake job applications containing the More_eggs malware. Operated by the Golden Chickens group as part of a Malware-as-a-Service (MaaS) platform, More_eggs is a sophisticated backdoor used by multiple threat actors to infiltrate corporate networks.

Key Insights (Technical):

Delivery Method: The malware is delivered via malicious Windows Shortcut files (.LNK files) disguised as resumes. When opened, these files execute scripts without raising suspicion.

Execution Technique: The attack leverages living-off-the-land binaries (LOLBins) like wscript.exe to run malicious JavaScript code, bypassing traditional security measures.

Capabilities:

Backdoor Access: Establishes a stealthy backdoor for persistent access.

Payload Deployment: Can download and execute additional malware modules, including ransomware or credential stealers.

Reconnaissance: Gathers system information and can move laterally within the network.

Command and Control (C2): Communicates with C2 servers over HTTP/S protocols, using encrypted channels to evade detection.

Avoidance of Detection: Uses legitimate Windows processes to mask malicious activities, making it harder for security solutions to detect the intrusion.

For further details, read the full article on The Hacker News.

New Ransomware Strain Targeting Healthcare

The U.S. Department of Health and Human Services (HHS) issued a warning about a new ransomware strain, Trinity, which is actively targeting the healthcare sector. Trinity uses techniques like encrypting data and demanding ransoms within 24 hours. It has connections to other ransomware families such as Venus and 2023Lock.

Technical Key Insights:

Exploits Remote Desktop Protocol (RDP) and open ports

Uses privilege escalation to gain higher access

Encrypts critical systems rapidly after infiltration

Further reading: The Record - Trinity Ransomware Alert.

Emerging Cybersecurity Threats Highlighted in HP Wolf Security Report

The September 2024 HP Wolf Security Threat Insights Report identifies key trends in cyberattacks, including a surge in document-based malware, with 61% of threats delivered via email attachments. Attackers are increasingly using malicious archives and PDFs to bypass detection, leveraging techniques like HTML smuggling and exploiting vulnerabilities in outdated software. Threat actors are also using Generative AI to write sophisticated malware, such as AsyncRAT.

Key Insights:

39% of threats delivered in archives

Rise in AI-generated malware

Increased exploitation of known vulnerabilities

Further reading: HP Wolf Security Threat Insights Report.

North Korean IT Worker Incident Highlights Hiring Risks

A recent cyberattack on a company underscores the dangers of unknowingly hiring North Korean operatives. The organization accidentally hired a North Korean IT worker who accessed sensitive data and demanded a ransom. This highlights the need for stringent vetting in remote hiring practices, especially as North Korea increasingly infiltrates global companies.

Recommended Protections:

Implement strict identity verification for remote workers.

Conduct thorough background checks with global databases.

Regularly monitor employee network activity for unusual behavior.

Further reading: GBHackers - North Korean IT Worker Incident.

User-Centric Security Design Inspired by Disney

A recent article from KnowBe4 discusses how organizations can improve security by observing how employees naturally work, similar to Disney’s strategy of observing guests before building paths. The concept of "desire paths" shows that security controls should be designed around actual workflows, reducing friction and improving compliance. By aligning security with user behavior, organizations can mitigate risky workarounds and foster a more secure environment.

Further reading: KnowBe4 - Security Highways.

Healthcare Supply Chain Attacks on the Rise

A recent Proofpoint report reveals that 68% of healthcare workers have faced a supply chain cyberattack, with 82% of these incidents affecting patient care.

Key Insights:

68% of healthcare workers report supply chain cyberattacks.

82% of incidents resulted in disruptions to patient care.

Attacks cause delays in procedures and increase patient risks.

Ransomware and business email compromise are growing threats.

Further reading: Security Magazine - Supply Chain Attacks.

Microsoft’s Deceptive Honeypot Strategy Targets Phishers

Microsoft has launched a clever security strategy by creating fake Azure tenants to lure phishing attackers into honeypots. These realistic tenant environments mimic legitimate setups, tricking attackers into interacting with them. This allows Microsoft to gather valuable intelligence on phishing methods and infrastructure, which can be used to strengthen defenses and share with the wider security community. By engaging with these fake environments, phishers waste time while Microsoft gains crucial insights.

Further reading: BleepingComputer - Microsoft Honeypots.

Mobile-First Cyber Attacks on the Rise

Cyber attackers are increasingly adopting a "mobile-first" strategy, as highlighted by a new report from Zimperium. With 83% of phishing sites now targeting mobile devices and a 13% rise in mobile malware, employees’ personal devices pose a growing risk to organizations. As more employees use their smartphones for work-related tasks, organizations need to bolster mobile security and educate employees on safe practices through security awareness training.

Further reading: KnowBe4 - Mobile-First Attack Strategy.

Cybercriminals Exploiting Steam for Malware Distribution

A recent investigation highlights how cybercriminals are using Steam profiles to exploit a technique called Dead Drop Resolver (DDR) to hide Command and Control (C2) addresses within user profiles. Attackers have leveraged well-known infostealers like Vidar, Lumma, and MetaStealer to extract sensitive data from infected systems by using platforms like Steam and Telegram to evade detection.

Technical Key Insights:

Attackers embed C2 addresses in Steam profiles.

Infostealers target credentials and system data.

Use of obfuscated code and stolen certificates.

Further reading: RT Solar Blog. <---- .ru site

Rise in Phishing Attacks with AI and Impersonation Tactics

A new report from KnowBe4 reveals a 28% rise in phishing attacks during Q2 2024, with 89% of attacks involving brand impersonation. Cybercriminals are increasingly using AI-powered phishing toolkits, making it easier for less-skilled attackers to execute sophisticated campaigns. Commodity phishing attacks, primarily using hyperlinks, have surged, overwhelming organizations' defenses. With impersonation tactics being a dominant trend, organizations must enhance defenses against these evolving threats.

Key Insights:

28% increase in phishing attacks in Q2 2024.

89% of phishing emails involve impersonation.

Commodity phishing attacks up 2,700% compared to normal baselines.

Further reading: KnowBe4 Report.

Phishing-as-a-Service Platform "Sniper Dz" Exposed

A recent investigation reveals the rise of the phishing-as-a-service (PhaaS) platform "Sniper Dz," which is responsible for over 140,000 phishing websites. The platform offers phishing templates targeting major brands and hides malicious content behind proxy servers to evade detection. Additionally, attackers can exfiltrate credentials to centralized servers controlled by Sniper Dz. This growing platform enables less-skilled attackers to launch sophisticated phishing attacks with ease.

Further reading: Unit 42 - Sniper Dz PhaaS.

Dark Angels Ransomware Group Exposed

A recent investigation uncovers the stealth tactics of the Dark Angels ransomware group, which targets high-value systems with Babuk and RagnarLocker-based ransomware. Their techniques include double extortion, data exfiltration, and selective ransomware deployment to minimize detection.

Technical Key Insights:

Uses Babuk ransomware on Windows and RagnarLocker variants on Linux/ESXi servers.

Employs double extortion tactics, stealing data before encryption.

Leverages encrypted communication channels to evade detection.

Further reading: Zscaler - Dark Angels Ransomware Group.

North Korean IT Worker Fraud

SecureWorks reports that North Korean IT workers are fraudulently obtaining remote jobs to access sensitive systems and generate revenue for the regime. These individuals disguise their identities, use VPNs to hide their location, and exploit company resources once hired.

Key Insights:

Perform thorough background checks on freelance and remote candidates.

Monitor network access for unusual activity, especially from VPNs.

Educate hiring managers on this growing threat.

Further Reading: Fraudulent North Korean IT Worker Schemes

Health Care and Social Assistance Sector at Risk

Cyber threats in the Health Care and Social Assistance sector are intensifying, with phishing and social engineering attacks being the most prevalent. Organizations need to prioritize automation and Digital Risk Protection strategies to defend against these sophisticated threats.

Key Insights:

51.55% of incidents are phishing attacks using spearphishing links.

24.76% of attacks exploit public-facing applications.

Automation reduces incident containment time to 1 minute, compared to 2 hours 34 minutes for manual responses.

Further Reading: ReliaQuest Health Care Threat Landscape

AI-Driven Malware and Persistent Ransomware Threats

Check Point's Global Threat Index for September 2024 highlights the rising use of AI in malware creation, with AsyncRAT becoming one of the top threats. AI-powered scripts are being used to deliver malware like AsyncRAT through techniques such as HTML smuggling, showcasing how threat actors with limited technical skills can now leverage AI to create sophisticated attacks. This evolution underscores the need for organizations to adopt proactive security strategies.

In addition, RansomHub, a rebranded Ransomware-as-a-Service group, continues to dominate the ransomware scene, accounting for 17% of reported attacks. Other prominent malware families include FakeUpdates, targeting organizations worldwide, and Androxgh0st, which exploits vulnerabilities across platforms.

Key Insights:

51.55% of the most prevalent malware was related to phishing campaigns, with AI-driven techniques emerging.

RansomHub remains the top ransomware group with a significant global impact.

Joker leads mobile malware, targeting Android users via SMS theft and premium service fraud.

Further Reading: Check Point Threat Intelligence Report

Trinity Ransomware Hits Healthcare Sector

The Trinity ransomware group is targeting healthcare organizations with double-extortion tactics, gaining access through phishing emails and software vulnerabilities. This ransomware not only encrypts data but also steals it, pressuring victims to pay or risk exposure of sensitive information. Two healthcare providers have already been attacked, with 330GB of data compromised from a U.S.-based provider.

Key Insights:

Double extortion tactics increase the urgency for victims to pay.

Initial access often occurs through phishing or vulnerabilities.

Healthcare is a prime target due to critical operations needing quick recovery.

Further Reading: Trinity Ransomware Targets Healthcare

Threat Intelligence Update: Black Basta’s Social Engineering Tactics via Microsoft Teams

The Black Basta ransomware group has employed a sophisticated social engineering campaign targeting organizations through Microsoft Teams. By signing user emails up for multiple spam sources, Black Basta overwhelms the target with unwanted messages. Threat actors then contact the user, impersonating IT support and offering assistance with the email flood. During this call, the attacker convinces the user to install remote access software like Quick Assist or AnyDesk, providing them unauthorized access to the network. Once inside, the attackers can harvest credentials and potentially deploy ransomware.

Key Insights:

Attackers use a flood of spam emails to distract and stress targets.

Impersonation of IT support builds credibility and increases the chance of remote access.

This tactic highlights the need for training employees to verify unexpected IT requests and avoid downloading unapproved software.

Further Reading: ReliaQuest Blog on Black Basta's Techniques

Q3 2024 Ransomware Trends

The ReliaQuest Q3 2024 ransomware report highlights significant shifts in the ransomware landscape, with new groups gaining prominence and using sophisticated tactics to escalate their attacks. RansomHub has overtaken LockBit as the most active group, experiencing an 800% rise in postings from Q1 to Q3. Their growth is attributed to aggressive recruiting and lucrative profit-sharing, which has drawn affiliates from other disrupted groups. This group, along with Play ransomware, continues to exploit vulnerabilities in VPNs and public-facing applications, demonstrating the persistent risk posed by unpatched systems.

Key Insights:

RansomHub’s Rapid Rise: RansomHub posted 195 times in Q3, an 800% increase from Q1, leveraging a 90/10 profit-sharing model to attract affiliates.

Expansion into ESXi Environments: Play ransomware’s new Linux variant targets VMware ESXi servers, broadening its impact across platforms.

High-Risk Sectors: Professional services, healthcare, and manufacturing sectors are top targets due to potential operational disruptions.

Vulnerability Exploits: Attackers frequently gain access through unpatched VPNs and other internet-facing applications, emphasizing the need for timely patch management.

Further Reading: ReliaQuest Q3 Ransomware Report

Update: Q3 2024 Brand Phishing Trends

Check Point Research’s Q3 2024 report reveals that Microsoft continues as the most impersonated brand in phishing attacks, accounting for 61% of brand phishing attempts. Apple (12%) and Google (7%) follow, with new additions Alibaba and Adobe rounding out the top 10. These attacks commonly target the technology, social media, and banking sectors, as cybercriminals exploit brand familiarity to deceive users and capture credentials or payment information. Notably, new phishing sites targeting WhatsApp and Alibaba highlight the evolving strategies of threat actors seeking to exploit user trust.

Key Insights:

Microsoft Dominance: Microsoft phishing attempts made up 61% of brand impersonation attacks, with Apple and Google also highly targeted.

Sector Focus: Technology and social networks were the most impersonated sectors, followed by banking.

Evolving Phishing Tactics: Phishing websites like whatsapp-io.com and alibabashopvip.com show attackers adapting to impersonate new brands.

Further Reading: Check Point’s Q3 2024 Brand Phishing Report.

Global Surge in Cyber Attacks in Q3 2024

Check Point’s Q3 2024 report highlights a significant 75% increase in global cyber attacks compared to last year, with each organization facing an average of 1,876 weekly attacks. Sectors most impacted include Education/Research (3,828 weekly attacks), Government/Military (2,553), and Healthcare (2,434), reflecting the increased focus on these industries. Africa saw the highest regional attack rate, averaging 3,370 weekly, up 90% from 2023, while North America experienced the most ransomware attacks, making up 57% of incidents worldwide. Manufacturing was the top ransomware target, followed by Healthcare and Retail/Wholesale.

Key Insights:

Attack Growth by Sector: The Hardware Vendor industry had the largest increase in attacks, surging by 191%.

Regional Hotspots: Africa, Latin America, and Europe saw the steepest rises, with Europe experiencing an 86% year-over-year spike.

Ransomware Targets: The Manufacturing sector accounted for 30% of ransomware incidents, underscoring cybercriminals' focus on high-disruption industries.

Further Reading: Check Point Q3 2024 Report.

North Korean Cybercriminal Infiltrates UK Company

A UK-based organization recently suffered a breach after inadvertently hiring a North Korean cybercriminal posing as a remote IT worker. Once hired, the attacker used insider access to extract sensitive information and eventually demanded a ransom for its non-disclosure. This case highlights the importance of strict hiring processes for remote roles and enhanced security practices.

Key Insights:

Vetting Remote Employees: Conduct rigorous background checks to confirm credentials.

Data Security: Monitor access and behavior for early threat detection.

Remote Work Risks: Be mindful of cyber threats exploiting virtual roles.

Further Reading: KnowBe4 Article; KnowBe4 10 Hiring Updates

Partnership Between Scattered Spider and RansomHub

ReliaQuest reports a new collaboration between the Scattered Spider and RansomHub groups, merging advanced social engineering skills with network-compromising expertise to target enterprises globally. The partnership leverages RansomHub's effective 90/10 profit-sharing model, attracting experienced threat actors from disrupted groups. This collaboration allows attackers to target critical virtual infrastructures, such as ESXi servers, which host key applications, enabling high-impact ransomware attacks that pressure victims to pay swiftly.

Key Insights:

Targeting of ESXi Servers: These servers, often running multiple virtual machines, are attractive for ransomware attacks as they disrupt operations across organizations.

Social Engineering Tactics: Scattered Spider's expertise in impersonating IT staff aids in gaining unauthorized access to organizational networks.

Rising Threat of RansomHub: RansomHub has rapidly gained dominance, surpassing groups like LockBit, indicating a strategic shift in ransomware collaborations and effectiveness.

For more details, explore the full article at ReliaQuest.

Social Engineering Exploits Valid Accounts

Recent incidents highlight how threat actors are compromising legitimate accounts through social engineering tactics. By manipulating individuals into divulging sensitive information or performing specific actions, attackers gain unauthorized access to systems and data. This method often involves impersonating trusted entities or creating convincing scenarios to deceive targets.

Key Insights:

Impersonation Tactics: Attackers frequently pose as IT support or company executives to extract credentials.

Phishing Campaigns: Sophisticated emails and messages are crafted to appear authentic, luring recipients into providing access details.

Insider Threats: Compromised accounts can be used to launch further attacks within an organization, making detection challenging.

Further Reading: KnowBe4 Article on Social Engineering Exploits.

North Korean Group Adopts Play Ransomware

Unit 42 has identified that the North Korean state-sponsored threat group, Jumpy Pisces (also known as Andariel), has begun collaborating with the Play ransomware group, Fiddling Scorpius. This marks a significant shift in Jumpy Pisces' tactics, moving from traditional cyber espionage to active participation in ransomware operations. The group gained initial access to networks via compromised user accounts, deploying tools like Sliver and their custom malware, DTrack, to facilitate lateral movement and persistence. This collaboration underscores the evolving ransomware landscape, where nation-state actors are increasingly engaging in financially motivated cybercrime.

Key Insights:

Tactical Shift: Jumpy Pisces is now utilizing existing ransomware infrastructures, indicating a move towards financial cybercrime.

Advanced Tools: The group employs sophisticated tools such as Sliver and DTrack for network infiltration and persistence.

Global Targeting: Their activities are expected to target a wide range of victims worldwide, necessitating heightened vigilance.

Further Reading: Unit 42 Article on Jumpy Pisces and Play Ransomware.

Key Cyber Threat Actors in 2024

ReliaQuest's recent analysis identifies five prominent cyber threat actors significantly impacting the cybersecurity landscape in 2024:

RansomHub: Emerging as a dominant ransomware group, RansomHub has surpassed previous leaders like LockBit and ALPHV, posing substantial risks to organizations globally.

IntelBroker: As the acting administrator of BreachForums, IntelBroker oversees activities on one of the largest English-language cybercriminal forums, facilitating various malicious operations.

APT41: A Chinese state-affiliated group, APT41 continues to engage in espionage activities, targeting sectors such as healthcare, telecommunications, and finance.

APT29: Known for its sophisticated espionage campaigns, this Russian state-affiliated group remains active in infiltrating governmental and private sector networks.

KillSec: Originally aligned with the "Anonymous" hacktivist collective, KillSec has recently shifted towards financially motivated ransomware activities, increasing its threat profile.

Further Reading: ReliaQuest Article on Critical Threat Actors.

Halloween’s Digital Threats of 2024

Halloween brings tales of horror, but in 2024, some of the scariest threats come from the digital realm. Cybercriminals are increasingly using advanced tools to target individuals and organizations with new forms of AI-driven malware, IoT exploits, and social engineering tricks that play on our trust.

Key Insights:

AI-Powered Attacks: These cyber “ghosts” can adapt to evade detection, making attacks like spear-phishing and deepfakes more convincing.

IoT Vulnerabilities: Over 20,000 vulnerable IoT devices, including cameras and routers, have become entry points for attackers, posing risks to privacy and security.

Social Media Exploitation: Personal data scraped from social platforms is being weaponized for phishing and blackmail, creating "digital dossiers" for targeted attacks.

Fake Calls and Malware: Scammers posing as bank representatives are using fake calls to steal sensitive information, a trick that’s led to an increase in identity theft and financial loss.

Dating Apps and Location Data: Privacy risks on dating apps, including inadvertent location sharing, are turning digital encounters into real-life safety concerns.

Further Reading: Check Point’s guide on Halloween Cyber Threats.

Phishing Threat Intelligence Newsletter for October 2024

October 18, 2024

This is a monthly newsletter I put together for our internal security team with a lean towards phishing and healthcare. Created with help from ChatGPT.

Phishing via Google Ads Targets Lowe’s Employees

Summary: Interesting technicque to watch. A recent malvertising campaign targeted Lowe’s employees by impersonating the company’s employee portal through fraudulent Google ads. Threat actors used phishing pages that closely resembled the legitimate MyLowesLife site to steal login credentials. These attacks underline the need for caution when clicking on sponsored links, especially for accessing internal portals.

Key Insight: Avoid using search engines to access internal portals—bookmark them instead to reduce exposure to phishing.

Further Reading: Malwarebytes Blog

Emerging Phishing Threats: Typosquatting and Brand Impersonation Trends

Summary: Zscaler's research uncovers a growing trend in phishing attacks involving typosquatting and brand impersonation. Attackers are increasingly mimicking popular brands using lookalike domains to trick users into divulging sensitive information.

Key Insights:

Over 10,000 malicious domains detected between February and July 2024.

Google, Microsoft, and Amazon are the top impersonated brands.

Attackers use free TLS certificates to evade detection.

Sectors like Internet Services and Online Shopping are prime targets.

For more details, visit Zscaler's blog.

Suspected Espionage Campaign Delivers “Voldemort” Malware

Summary: Proofpoint researchers identified a sophisticated espionage campaign distributing custom malware named "Voldemort." This campaign used advanced techniques like abusing Google Sheets for command and control (C2) and targeting organizations globally by impersonating tax authorities. The malware, likely tied to an APT actor, has intelligence-gathering capabilities and is suspected of espionage rather than financial gain.

Key Insights:

Targeted over 70 organizations across multiple sectors.

Abuses Windows file protocols and advanced C2 mechanisms.

For more details, visit Proofpoint's blog.

Scattered Spider Targets Insurance and Financial Sectors Using Cloud Ransomware

Summary: The Scattered Spider group has intensified its ransomware attacks on the insurance and financial industries, leveraging cloud vulnerabilities and phishing campaigns to compromise high-privileged accounts. The group uses social engineering tactics, including SIM swapping, smishing, and cloud credential theft, to gain unauthorized access. Their advanced techniques, combined with partnerships like BlackCat, have made them a formidable threat to cloud-based infrastructures.

Further Reading: EclecticIQ Blog

Top Cyber Attacker Techniques: May-July 2024 Insights

Summary: ReliaQuest’s report from May to July 2024 highlights the growing threat of phishing, accounting for 37% of incidents. The “SocGholish” malware, delivered via fake browser updates, remains widespread. Additionally, exposed credentials make up 88.75% of alerts, posing significant risks. Key sectors targeted by ransomware include manufacturing and tech. To defend against these threats, organizations should enhance multi-factor authentication, monitor user behavior, and deploy rapid response measures.

Key Insights:

Phishing remains a top threat.

Credential exposure is a major risk.

Ransomware is heavily targeting manufacturing and tech sectors.

Further Reading: ReliaQuest Blog

Unveiling RECORDSTEALER: A Persistent Infostealer Targeting Sensitive Data

Summary: RECORDSTEALER (Raccoon Stealer V2) is a malware targeting sensitive information like passwords, payment data, and cryptocurrency wallets. It infects systems through malvertising and fake downloads, focusing on web browsers for data exfiltration. RECORDSTEALER’s infrastructure has been disrupted, but related malware such as VIDAR and STEALC are still active.

Key Insights:

Uses browser exploits for credential harvesting.

Communicates with command-and-control servers using encrypted channels.

Evades detection via obfuscation and process injection.

Further Reading: Google Cloud Blog

Splinter: A New Post-Exploitation Red Team Tool

Summary: Splinter, a post-exploitation tool developed in Rust, allows for remote command execution, file uploads, and process injection. It uses encrypted HTTPS for command-and-control (C2) communication, making it harder to detect. Initially built for red team operations, the tool's misuse poses significant risks to compromised systems.

Technical Key Insights:

Splinter supports process injection into system processes.

Uses encrypted C2 channels for communication.

Built with Rust for enhanced performance and cross-platform compatibility.

Further Reading: Unit 42 Article

Supershell Malware Targeting Linux SSH Servers

Summary: Supershell, a Go-based backdoor, is being deployed on Linux SSH servers through brute-force attacks. Once installed, it provides attackers with remote access via a reverse shell, enabling them to hijack systems and deploy additional payloads like cryptocurrency miners.

Key Insights:

Uses reverse shell for remote control.

Exploits weak SSH credentials via brute-force attacks.

Can execute additional malicious payloads, such as XMRig miners.

Written in Go, enhancing cross-platform capabilities.

Further Reading: AhnLab ASEC Report

Cybercriminals Exploit Legitimate Software with CAMO Techniques

Summary: ReliaQuest's latest findings reveal the growing use of legitimate IT tools by cybercriminals in "Commercial Applications, Malicious Operations" (CAMO). These tools, such as PDQ Deploy and SoftPerfect, are used for spreading ransomware, exfiltrating data, and evading detection by blending into normal network operations. This trend complicates incident detection and response.

Key Insights:

CAMO tools can bypass detection by leveraging legitimate system capabilities.

Attackers use trusted tools to move laterally and exfiltrate data.

Network segmentation, monitoring, and whitelisting can mitigate these threats.

Further Reading: ReliaQuest Blog

Phishing Attack Uses Two-Step Approach to Evade Detection

Summary: A new phishing attack leverages a two-step process, using legitimate platforms like Microsoft Office Forms as an intermediary to evade detection. After clicking the phishing email link, users are directed to a legitimate form before being redirected to a fake login page designed to steal credentials. This sophisticated approach helps attackers bypass security filters by exploiting trusted platforms.

Key Insight: Be cautious of phishing links that utilize legitimate services as intermediaries before redirecting to malicious sites.

Further Reading: KnowBe4 Blog

Surge in Malicious Links Marks 133% Increase in Q1 2024

Summary: Phishing attacks using malicious links surged by 133% in the first quarter of 2024, as attackers shift away from traditional attachments to evade detection. Links allow attackers to obfuscate malicious content and use redirects, CAPTCHA, and legitimate services to conceal their payloads. This growing trend emphasizes the need for organizations to enhance email security and continuously train employees to spot suspicious links.

Further Reading: KnowBe4 Blog

HR-Related Phishing Tactics Grow More Sophisticated

Summary: Threat actors are increasingly using HR-related phishing emails, disguised as official company communications, to trick employees into providing credentials. These phishing attacks often use urgent subjects like “Revised Employee Handbook,” leading victims to a fake Microsoft login page. Attackers use the stolen credentials for further exploitation. The campaign evades email security platforms by leveraging legitimate-looking content and psychological manipulation.

Further Reading: Cofense Blog

Inc Ransom Attack: Advanced Extortion Techniques Emerge

Summary: The Inc Ransom group uses advanced techniques like data exfiltration without encryption, exploiting firewall vulnerabilities and hiding within legitimate network traffic using tools like Impacket and PowerShell. By deploying Rclone for data transfer, they evade detection while pressuring victims through extortion. The report includes details on a recent attack against a healthcare organization.

Technical Key Insights:

Use of Rclone for stealth data exfiltration.

Abuse of firewall vulnerabilities for initial access.

Impacket and PowerShell used to blend into legitimate traffic.

Data theft replaces encryption in the extortion strategy.

Further Reading: ReliaQuest Blog

RansomHub Reigns, Meow Ransomware Surges in August 2024

Summary: RansomHub leads ransomware threats, targeting Windows, macOS, Linux, and VMware ESXi systems using sophisticated encryption techniques. Meanwhile, Meow ransomware shifts focus from encryption to selling stolen data on leak marketplaces, employing the ChaCha20 encryption algorithm. Both groups aggressively target exposed RDP configurations and vulnerable systems.

Technical Analysis:

RansomHub uses robust encryption across multi-platform environments, complicating recovery.

Meow exploits ChaCha20 for file encryption and omits .exe files, leveraging leak sites for extortion.

Both utilize exposed RDP ports for initial access.

Further Reading: Checkpoint Blog

Phishing-as-a-Service Platform Sniper Dz Gains Traction with Unique Tactics

Summary: The Sniper Dz Phishing-as-a-Service (PhaaS) platform has facilitated the creation of over 140,000 phishing websites. It offers pre-made phishing templates targeting major brands, leveraging public proxy servers and SaaS platforms to evade detection. Sniper Dz uses unique obfuscation techniques, enabling phishing campaigns to bypass traditional security measures while collecting stolen credentials.

Key Insights:

Sniper Dz uses proxy servers to hide phishing activities, making detection more difficult.

Phishers can easily launch campaigns targeting popular services without needing technical expertise.

Integrating proxy detection mechanisms and monitoring SaaS usage can help identify such attacks.

Further Reading: Unit42 Article

DragonForce Ransomware: Advanced Tactics and Affiliate Program

Summary: DragonForce, using both LockBit and ContiV3 forks, targets critical sectors through its RaaS affiliate program. The ransomware employs sophisticated tactics like BYOVD to disable EDR/XDR systems, coupled with SystemBC for persistence and lateral movement. Affiliates can customize attacks using the builder to encrypt files, terminate security processes, and evade detection through advanced anti-analysis features. Mimikatz and Cobalt Strike are used for credential harvesting and system reconnaissance.

Key Technical Insights:

BYOVD: Drivers like TrueSight.sys and RentDrv.sys disable security.

RSA-1024 & Salsa20 encryption for ransomware payloads.

Use of PowerShell and Cobalt Strike for malware execution and persistence.

Further Reading: Group-IB Blog

RDP Brute-Force Attacks

Summary: Remote Desktop Protocol (RDP) brute-force attacks remain a high-risk method for attackers to gain unauthorized access to networks. Cybercriminals exploit weak/default credentials and exposed RDP ports using automated tools, making it a preferred method for both nation-state and cybercriminal groups. Attackers can use compromised access for data theft, deploying ransomware, or selling credentials on dark web forums.

Technical Highlights:

Attackers use tools like Hydra and Medusa for brute-forcing RDP.

RDP exploits involve enumeration via port scans and credential stuffing.

Initial access brokers often sell RDP access for further attacks.

Defense Recommendations:

Use strong, unique passwords and multi-factor authentication.

Limit RDP exposure to the internet, utilizing VPN and firewalls.

Implement rate-limiting and robust monitoring to detect unusual RDP activity.

For more details, you can visit ReliaQuest's article on RDP Brute-Force Attacks.

New Phishing Tactic Exploits HTTP Headers for Stealthy Redirects

Summary: Attackers are using a new technique involving HTTP response headers to automatically redirect users to phishing pages. The tactic leverages compromised websites, making the phishing links appear legitimate. This technique is particularly challenging to detect and has been observed in phishing campaigns targeting various industries.

Key Insights:

HTTP headers are manipulated for silent phishing page redirects.

Attackers pre-populate victim data (like email addresses) to enhance credibility.

Detection is difficult, requiring heightened user vigilance and advanced security monitoring.

For more details, visit KnowBe4.

Cyber Predators Exploit Healthcare Vulnerabilities with Ransomware and Data Theft

Summary: Cybercriminals are increasingly targeting healthcare organizations, exploiting weaknesses to steal patient data and extort hospitals via ransomware attacks. These criminals collaborate through darknet marketplaces, offering ransomware-as-a-service, and trading access to compromised healthcare systems. With attacks up 32% globally in 2024, healthcare remains a prime target due to its valuable data and often outdated security infrastructure.

Key Insights:

Healthcare sees an average of 2,018 attacks weekly, with APAC and Latin America hit hardest.

Ransomware-as-a-service empowers less experienced criminals.

Hospitals face high risks due to the critical nature of their operations.

Phishing Campaign Exploits Google Apps Script for Sophisticated Attacks

Summary: A new phishing campaign manipulates Google Apps Script macros to target users across multiple languages. The phishing emails falsely claim to provide “account details” and include links to malicious pages mimicking legitimate Google services. Victims are tricked into disclosing sensitive information, leading to data theft and operational disruption.

Key Insights:

Attack uses Google’s infrastructure to appear legitimate.

Affected users may disclose sensitive data via a deceptive Google Apps Script URL.

Advanced email filtering, real-time URL scanning, and phishing awareness training are crucial defenses.

For more details, visit Checkpoint Research.

New Windows PowerShell Phishing Campaign Highlights Serious Risks

Summary: A recently discovered phishing campaign uses GitHub-themed emails to trick recipients into launching PowerShell commands, enabling the download of password-stealing malware. The attack uses social engineering techniques, disguising itself as a CAPTCHA verification process. By exploiting PowerShell’s automation capabilities, attackers gain unauthorized access to credentials stored on victims' systems.

Key Insights:

Attack targets GitHub users but could be adapted for broader use.

Exploits PowerShell to execute malicious commands.

Vigilance and disabling unnecessary PowerShell access are crucial defenses.

For more, visit Krebs on Security.

Phishing Attacks Exploit Content Creation and Collaboration Platforms

Summary: A recent phishing campaign abuses popular content creation and collaboration tools to trick users into clicking malicious links. Cybercriminals use legitimate-looking posts and documents with embedded phishing URLs, leading to credential theft through fake login pages. These attacks have been seen in both business and educational environments.

Key Insights:

Phishing emails from trusted platforms contain hidden threats.

Common platforms include design tools and document-sharing services.

Users should be cautious of unexpected links and suspicious login requests.

For more information, visit KnowBe4.

Cyber Threats Looming for the 2024 U.S. Election

Summary: As the 2024 U.S. election approaches, cyber threats from nation-state actors, hacktivists, and cybercriminals are expected to rise. These include disinformation campaigns, phishing attacks, and attacks on electoral infrastructure. Businesses should brace for phishing campaigns and SEO poisoning targeting politically charged topics.

Key Insights:

Nation-state groups may conduct hack-and-leak operations and influence campaigns.

Expect a surge in phishing attacks and scams using election-related themes.

Businesses should implement advanced cybersecurity measures to mitigate risks.

For more details, visit ReliaQuest.

Phishing Threat Intelligence From August 2024

September 9, 2024

These are news articles from August 2024. Feel free to take and share with your internal cybersecurity team. A mention of explores.com would be great!

Dismantling Smart App Control

Elastic Security Labs recently uncovered multiple vulnerabilities in Windows Smart App Control (SAC) and SmartScreen. These weaknesses allow attackers to bypass security measures using techniques such as signed malware, reputation hijacking, and LNK stomping. These methods enable initial access without triggering security warnings, posing significant risks. Security teams should focus on detecting these evasive tactics and not rely solely on OS-native features.

Key Insights:

Signed Malware: Attackers use valid certificates to bypass SAC.

Reputation Hijacking: Leveraging trusted apps to execute malicious code.

LNK Stomping: Crafting LNK files to evade MotW checks.

For more details, visit the Elastic Security Labs article.

Securing Domain Names from Takeover

Recent research highlights vulnerabilities in domain name management that leave over a million domains susceptible to hijacking. This issue arises from weak authentication practices at several web hosting providers and domain registrars. Cybercriminals exploit these weaknesses to take control of domains, using them for phishing, spam, and malware distribution. To mitigate risks, it is crucial to ensure proper DNS configuration and use DNS providers with strong verification processes.

Key Insights:

Vulnerability: Over a million domains at risk.

Exploitation: Hijacked domains used for malicious activities.

Recommendation: Strengthen DNS configuration and provider verification.

For more details, visit the Krebs on Security article.

Exploitation of Google Drawings and WhatsApp

A newly identified phishing campaign exploits Google Drawings and WhatsApp's URL shortener to create convincing redirects to malicious sites. This method allows attackers to bypass security filters and deceive users into thinking they are visiting legitimate sites like Amazon. These tactics highlight the increasing sophistication of phishing threats, emphasizing the need for heightened vigilance and advanced security measures.

Key Insights:

Exploited Tools: Google Drawings and WhatsApp's URL shortener.

Attack Strategy: Redirects users to malicious sites mimicking trusted brands.

Recommendation: Implement advanced phishing detection and maintain user vigilance.

For more details, visit the Menlo Security article.

Concerns Over Cloudflare’s Anti-Abuse Posture

Spamhaus has raised concerns about Cloudflare's anti-abuse policies, highlighting that cybercriminals are exploiting Cloudflare’s services to mask malicious activities. Despite numerous abuse reports, Cloudflare's current approach often shields the true location of harmful content, complicating efforts to combat cybercrime. This situation underscores the need for stronger abuse management practices to prevent cybercriminals from leveraging trusted services to conduct illegal activities.

Key Insights:

Exploitation: Cybercriminals are using Cloudflare to hide malicious activities.

Response: Current anti-abuse measures are inadequate in addressing the issue.

Recommendation: Enhanced abuse management and accountability are needed.

For more details, visit the Spamhaus article.

Royal Ransomware Rebrands as BlackSuit

The ransomware group formerly known as Royal has rebranded as BlackSuit, increasing their ransom demands to over $500 million. This shift indicates a more aggressive approach, with the group targeting larger organizations across various sectors. BlackSuit continues to use sophisticated tactics, including double extortion, where they threaten to release stolen data if their demands are not met. Organizations should strengthen their defenses and ensure incident response plans are up-to-date.

Key Insights:

Rebranding: Royal ransomware is now BlackSuit.

Increased Ransom: Demands exceed $500 million.

Tactics: Double extortion remains a primary threat.

Recommendation: Strengthen defenses and update incident response plans.

For more details, visit the KnowBe4 article.

New Phishing Scam Using Cross-Site Scripting

A recent phishing scam uncovered by KnowBe4 employs cross-site scripting (XSS) attacks to harvest personal details from unsuspecting victims. Attackers use this method to inject malicious scripts into legitimate websites, tricking users into entering sensitive information like login credentials. This technique bypasses traditional security measures, making it a particularly dangerous threat. Users should be cautious when clicking on links in emails and ensure that websites they interact with are secure.

Key Insights:

Attack Method: Cross-site scripting (XSS) used to steal personal details.

Target: Login credentials and sensitive information.

Recommendation: Verify website security before entering personal information.

For more details, visit the KnowBe4 article.

Surge in File-Sharing Phishing Attacks

KnowBe4 reports a staggering 350% increase in file-sharing phishing attacks over the past year. These attacks often disguise themselves as notifications from popular file-sharing services, tricking users into revealing sensitive information or downloading malware. The rapid rise in these attacks highlights the need for enhanced email security and ongoing employee training.

Key Insights:

350% Increase: Significant rise in file-sharing phishing attacks.

Attack Method: Disguised as legitimate file-sharing notifications.

Recommendation: Strengthen email security and employee awareness.

For more details, visit the KnowBe4 article.

Rising Use of URL Shorteners in Phishing Attacks

Recent intelligence highlights a growing trend where cybercriminals use URL shorteners to obscure malicious links in phishing campaigns. This tactic effectively conceals the true destination of links, making it difficult for users and traditional security tools to detect threats. These shortened URLs often appear in seemingly legitimate emails or text messages, leading to fraudulent websites designed to steal credentials or deploy malware.

For more details, visit the KnowBe4 article.

Surge in Microsoft Brand Impersonation Attacks

A recent report shows a 50% increase in phishing attacks impersonating Microsoft in just one quarter. These attacks target users by mimicking Microsoft’s branding to steal credentials or deploy malware. Given Microsoft’s widespread use in organizations, employees should be extra cautious when receiving emails claiming to be from Microsoft, especially those requesting login details or prompting downloads. Always verify the sender's address and report suspicious emails to IT.

For more details, visit the KnowBe4 article.

Dark Angels Ransomware Group Rakes in Record Ransoms

The Dark Angels ransomware group has secured a record $75 million ransom payment from a fortune 50 company recently. Unlike other groups, Dark Angels avoid public leaks and minimize operational disruptions for their victims, making it easier to coerce payments quietly.

For more details, visit the Krebs on Security article.

Inc Ransom Attack Analysis

Overview: In April 2024, the "Inc Ransom" group targeted a ReliaQuest customer, employing a double-extortion strategy without encrypting files. They exploited an unpatched Fortinet vulnerability to gain access, installed remote management tools like AnyDesk, and used techniques like pass-the-hash for lateral movement. Data was exfiltrated using unconventional tools such as Restic.

Key Insights:

Mitigations: Prioritize patch management, enforce network segmentation, and deploy host-based controls to prevent unauthorized software execution.

Emerging Trends: Use of legitimate tools by attackers to blend in with normal activity.

Actionable Steps: Strengthen defenses by regularly updating and auditing systems, ensuring proper segmentation, and limiting privileges to essential accounts.

For a detailed analysis, visit the full report here.

URL Rewriting Exploited by Threat Actors

Overview: Threat actors are increasingly abusing URL rewriting, a security feature intended to protect against phishing, to mask malicious links. By compromising legitimate email accounts and using URL rewriting, attackers can disguise phishing URLs as safe, often leveraging the security vendor's domain to gain trust.

Key Insights:

Mitigations: Enhance vigilance when clicking on links, even those appearing to be from trusted sources.

Emerging Trends: Attackers are exploiting the gap between initial scans and later weaponization of URLs.

For a detailed analysis, visit the full report here.

Exfiltration Tools on the Rise

A recent analysis by ReliaQuest highlights the growing use of advanced exfiltration tools by cybercriminals to steal sensitive data. Tools like Rclone, WinSCP, and FileZilla are increasingly being leveraged to exfiltrate data from compromised networks. These tools are difficult to detect as they mimic legitimate traffic, making traditional defenses less effective.

For more details, visit the ReliaQuest article.

North Korean IT-Worker Scheme Exposed in Tennessee

A Nashville resident, Matthew Isaac Knoot, was arrested for facilitating a scheme that funneled hundreds of thousands of dollars to North Korea’s illicit weapons program. Knoot allegedly helped North Korean IT workers secure remote jobs with U.S. and British companies by using stolen identities. The funds, earned through six-figure salaries, were laundered and funneled back to North Korea. This case underscores the growing threat of North Korean cyber operations targeting remote work environments.

For more details, visit the full article.

Top Malware in July 2024: Remcos and RansomHub

The July 2024 Threat Index highlights a surge in activity by the RansomHub ransomware group and a new Remcos malware campaign. RansomHub continues to dominate as the most prevalent ransomware, accounting for 11% of attacks, while LockBit3 and Akira follow closely behind. A critical security lapse led to the distribution of Remcos via a malicious ZIP file disguised as a CrowdStrike update. Additionally, FakeUpdates remains a persistent threat, utilizing fake browser updates to deploy RATs like AsyncRAT.

Key Insights:

RansomHub: Leading ransomware, targeting Windows, macOS, Linux, and VMware ESXi.

Remcos Campaign: Exploits a security software update issue, spreading via phishing attacks.

FakeUpdates: Tops the malware list, leveraging compromised websites to deliver Remote Access Trojans.

For a deeper dive, visit Checkpoint’s Threat Index.

Focus on Malware Loaders: Evolving Threats in 2024

In 2024, nearly 40% of malware incidents involved advanced loaders like SocGholish, GootLoader, and Raspberry Robin. These loaders are pivotal in deploying ransomware and Remote Access Trojans (RATs). SocGholish has notably enhanced its tactics with Python scripts, making it harder to detect, while GootLoader and Raspberry Robin use sophisticated evasion techniques, posing significant threats to critical sectors.

Key Insights:

SocGholish: Now using Python for persistence.

GootLoader: Continues to exploit legitimate platforms.

Raspberry Robin: Notable for its complex evasion tactics.

For more detailed insights, visit the full article here.

Emerging Malware Variants to Watch in 2024

In recent months, several malware variants have gained prominence in the cyber threat landscape. Notable among them are LummaC2, Rust-based stealers, SocGholish, AsyncRAT, and Oyster, each posing significant risks to organizations across all sectors.

Key Insights:

LummaC2: A powerful infostealer with increasing reach.

Rust-based Stealers: Notable for their advanced evasion techniques.

SocGholish: Continues to be a persistent threat through fake browser updates.

AsyncRAT: Versatile and widely used for remote access.

Oyster: A backdoor linked to Wizard Spider, signaling targeted attacks.

For more details, visit ReliaQuest.

Exploring the Abuse of Impacket: A Growing Threat

Impacket, a versatile Python-based toolkit, has become a favored tool among threat actors for lateral movement, privilege escalation, and remote code execution in Windows environments. Threat actors commonly exploit Impacket scripts like psexec.py, smbexec.py, and wmiexec.py to perform these actions stealthily. The toolkit’s ability to mimic legitimate network activity complicates detection, making it a significant challenge for organizations to defend against.

Key Insights:

psexec.py: Used for executing remote commands with elevated privileges.

smbexec.py: Facilitates lateral movement without additional software installation.

wmiexec.py: Enables stealthy command execution through WMI.

For more information, visit ReliaQuest.

Copybara Android Malware: A Rising Threat

The latest variant of Copybara, an Android malware family, has evolved to use the MQTT protocol for command-and-control (C2) communication, enhancing its stealth. This malware exploits Android’s Accessibility Service for keylogging, screen capturing, and phishing attacks, particularly targeting cryptocurrency exchanges and financial institutions. Copybara’s ability to impersonate legitimate apps makes it especially dangerous.

Key Insights:

MQTT Protocol: Used for stealthy C2 communication.

Accessibility Service Exploitation: Enables comprehensive device control.

Targeted Attacks: Focus on financial institutions and cryptocurrency exchanges.

For more details, visit Zscaler.

Massive QR Code Phishing Campaign Abuses Microsoft Sway

A significant phishing campaign has been detected, exploiting Microsoft Sway to host malicious landing pages targeting Microsoft 365 users. The campaign, identified by Netskope Threat Labs, saw a 2,000-fold increase in activity, primarily targeting sectors in Asia and North America. Attackers use QR codes embedded in phishing emails, redirecting victims to malicious sites. This method exploits the weaker security controls of mobile devices and evades email scanners, making it particularly effective and dangerous.

Key Insights:

Targeted Sectors: Technology, manufacturing, and finance.

Attack Method: QR codes bypass traditional security by embedding in images.

Risk Increase: Heightened threat to mobile device users.

For more details, visit BleepingComputer.

Malvertising Campaign Impersonates Google Products

A recent malvertising campaign has been detected, impersonating various Google products to lure users into tech support scams. These malicious ads, exploiting Google’s Looker Studio, redirect victims to fake Microsoft or Apple warning pages, urging them to call a fraudulent support number. This campaign serves as a reminder to be cautious of online ads, even those that appear to represent trusted brands.

Key Insights:

Target: Users of Google products.

Tactics: Fake tech support scams via malvertising.

Impact: Potential malware installation and data theft.

For more details, visit KnowBe4.

Deceptive AI: A New Wave of Cyber Threats

As AI technology advances, cybercriminals are increasingly using AI-generated content (AIGC) to deceive users on social media. This includes creating fake profiles, deepfake videos, and AI-crafted messages that are nearly indistinguishable from real content. A recent survey revealed that a significant portion of users struggle to identify these threats, which can lead to fraud, identity theft, and misinformation. It's crucial to be aware of these risks and stay vigilant online.

For more details, visit KnowBe4.

North Korean IT Workers Target U.S. Tech Companies

North Korean IT workers are increasingly applying for remote jobs at U.S. tech firms using false identities. They employ AI-generated profile images and fake job histories, aiming to funnel earnings back to the North Korean regime, posing security risks and potential sanctions violations. Key insights include the importance of rigorous background checks and enhanced candidate verification processes to counter this threat. Collaboration with security experts and intelligence sharing is critical.

For more insights, visit Cinder.

Risks in Publicly Exposed GenAI Development Services

A recent analysis highlights significant security risks in publicly exposed GenAI development services, particularly vector databases and low-code LLM tools. These platforms often handle sensitive data but can be misconfigured, leading to potential data leakage, data poisoning, and exploitation of vulnerabilities. To mitigate these risks, organizations should enforce strict access controls, monitor activity, and ensure all software is updated.

For a deeper dive, visit Legit Security.

How Attackers Exploit Digital Analytics Tools

Cybercriminals are increasingly weaponizing digital analytics tools like link shorteners, IP geolocation services, and CAPTCHA challenges. These tools, often used for legitimate purposes, are repurposed to obscure malicious activity, evade detection, and tailor attacks to specific targets. Organizations should implement automated analysis and monitor suspicious patterns in these tools to mitigate risks.

Key Insights:

Threat actors use link shorteners to mask phishing URLs.

IP geolocation data helps attackers target specific regions.

CAPTCHA services are abused to bypass automated security scans.

Further Reading: Google Cloud Blog

GenAI and the Surge of AI-Driven Fraudulent Websites

Cybercriminals are increasingly leveraging large language models (LLMs) to scale the creation of fraudulent websites, including phishing sites and fake online stores. Netcraft reports a significant rise in AI-generated content for scams, with a 3.95x increase in such websites from March to August 2024. These AI tools enhance the credibility of scams by improving text quality, making malicious content more convincing and harder to detect. Organizations must enhance their defenses to mitigate the risks posed by this emerging threat.

Key Insights:

LLMs are used to generate convincing text for scams.

AI-driven scams have seen a sharp increase in recent months.

Monitoring and takedown strategies are essential to combat this trend.

Further Reading: Netcraft Blog

So-Phish-ticated Attacks: A New Wave of Social Engineering

A sophisticated threat actor is conducting targeted social engineering attacks against over 130 U.S. organizations. These attacks, which include phishing via SMS and direct phone calls, are designed to harvest credentials and one-time passcodes. The use of native English speakers and tactics that bypass traditional security tools makes these attacks particularly challenging to detect.

Key Insights:

Attacks bypass traditional detection.

Focus on credential harvesting.

Targeting multiple industry verticals.

Further Reading: GuidePoint Security Blog

Originally posted on exploresec.com

Exploring a phishing program - *Created with the help of ChatGPT*

How to build a phishing program

January 25, 2024

The first thing I recommend, is reading Phishing Dark Waters by Christopher Hadnagy, Michele Fincher, and Robin Dreeke. They have a lot of great insights on phishing and how to build a program and I used the book as a guide to build my own. One of the ideas in the book that really helped give me direction for building the program were the metrics. The book broke metrics down into four categories:

Clicked and Reported
Clicked and Didn’t Report
Didn’t Click and Reported
Didn’t Click and Didn’t Report

The idea of a phishing program is to reduce click rates and increase reporting rates. These metrics helped establish goals and strategies for building and running a successful phishing program. Using these metrics as a guide we were able to reduce click rates and improve reporting rates by over 50% at a company with over 6000 employees. Below we’ll get into getting started, the mindset to have, how to mature the program, and metrics and reporting.

Getting Started

Leadership buy-in

The first thing needed is leadership buy-in. The higher up the leadership buy-in the more effective the program. If buy-in isn’t at the highest level don’t fret. Once the program is started leadership will start to buy-in once they see the metrics. Metrics have a way of providing valuable insight into the risk associated with phishing attacks for the company.

Who to tell

Before sending a phish you need to inform the people that will help keep the phish from becoming a full blown incident. This can vary depending on the organization. Some will want very few people to be told. Others will want legal and HR input. The essential people that need to be involved is the person you report to and the Security Operations Center (SOC) and help desk managers.

The SOC and help desk managers will need to determine if their people need to be told. The SOC and help desk should be included in the phishing simulation, other times it might be more beneficial to let them to know. Often, they managers will want to see how their directs respond to a phishing email report. For larger phishes it’s a good idea to inform the help desk but for more targeted phishes they may not need to be told. There’s also always the option of making them a targeted phishing group.

Automation

Sending out phishes will increase the workload on other departments like the help desk, the SOC, and anyone monitoring the security inbox, if that’s not already the SOC. Automation is a friend here. Setup automated responses wherever a phishing email may be reported.

We didn’t do this for our first phish of the company and had over 500 people report the email. I responded to every single one of them because it was my miss and I wanted to acknowledge and show people appreciation for reporting a phish. If they’re not acknowledged and thanked they’ll be less likely to send in a phishing email in the future.

Recognize people who report phishing emails

To make an effective phishing program people need to be recognized and thanked for taking the time to identify and report a phishing email. If there’s a platform where employees can send other employees praise or recognition I would load anyone who reports a phish in there. People need positive feedback to continue the positive behavior.

Also, it’s okay if people tell each other about the simulated phish. We want others getting into the habit of giving their peers and co-workers a heads up that they have a phishing email in their inbox. Simulated phish or real phish people giving each others a heads up is a good thing.

Create your first phish

To start pick something super dumb that has a lot of indicators that easily identify it as a phishing email. This will provide a baseline for the overall click rate of the organization. It will help build the roadmap for future phishes. Establishing the baseline sets the starting point. As click rates go down the difficulty of the phishes can be increased and reported on. This will help show a reduction in risk to leadership.

The thing to remember about click rate and phishing emails is that there a lot of factors that go into clicking on an email. The time of day, the stress levels of people, what’s going on at work and at home, and luck. Who get’s sent a phish, time of day, and the type of phish are the only things in our control. Click rate is volatile. I’ve seen a monthly phish get a 2% click rate. I’ve also seen a monthly phish get a 14% rate. Pay attention to the time of year and what might be going on inside and outside the organization.

Deciding on whether to blast out the email or schedule it over a period of time is going to be very important. For larger groups you want to schedule the phish over a period of time. I would phish the entire company monthly. They’d get the phish at random times throughout the month. For smaller groups I had the option of sending them the phish all at once. Sending out a phish to several thousand emails in one day that will not make you any friends with the SOC or help desk, especially if automation is not set up.

What’s off limits

Even if your CEO gives you free reign, like I’ve had in the past, you do not have free reign. GoDaddy got in trouble for a phish in 2020 that the security team sent. The lure was a $650 holiday bonus. After people clicked they instead got told they were assigned extra security awareness training. While the bad guys may use this type of technique or other types of phishing emails we as the good guys should not stoop so low. That type of phish is getting people’s hopes up and then bringing it back down. This will result in an angry reaction.

Anything dealing with financial, family members, politics, religion, or sex are off limits. These topics create an extra strong emotional reaction from people. I also wouldn’t mess with anything related to marketing or other departments needing to get employees engaged. Any of these will be sure to get you in political hot water. Even if you get backed up by the CEO that group may have to accept it, but they won’t like it and will look to sabotage the program.

The phishing program is something people in the organization should understand is here to help. It’s already hard enough to get people to buy-in and feel good about security. Pissing them off won’t help the program and may even result in it being hamstrung. That’s why it’s important to remember that a phishing program is practicing for the real thing. It’s not the game of “Gotcha!” it’s practice.

It’s about practice

The phishing program is about practicing the activity of receiving and responding to a phishing email. Getting people to get them doesn’t help and can put the phishing program in choppy political waters. That’s why the program needs to tie back to something real world.

Dig into your email gateway and look for phishes that are being caught in there. Check the security inbox to see what actual phishing emails are being reported there. Look for ones that are of a general nature for the entire company. Pay attention to the news and what are some of the latest phishing emails being sent to people. Think about the time of year. Packages are flying around during November and December. The phishing platforms do a good job of adding new templates with the latest phishing emails they’re seeing. Make it relevant.

Targeted phishes

Targeted phishes are phishes that are sent to a targeted group. The purpose should be specific to the department or group of people and related to techniques attackers may use to try and get into an organization. Again, look in security tooling to understand what certain groups are being targeted with and research phishes in the news that relate to the company’s industry.

Depending on your organization you can go outside of the parameters of making it related to outside news events. In the past I’ve seen phishes using Game of Thrones and the latest Avengers movies as lures. These were sent to groups who were aware of the phishing program and did a better job of identifying phishes. For targeted phishes like this make sure to host training afterwards to discuss and reiterate the practice aspect of the phish.

One of the most successful phishes I ever did was part of a lunch and learn session. The phish got a 50% click rate and it wasn’t even my idea. As part of the session I asked the people in attendance for ideas for a phish to send to IT. We had a praise platform that you could use to send people praise. So we decided to do a phish that used one of the notification emails for getting praise. Then we made it look like it was from the CEO. We did add several indicators that it was a phishing email such as giving them a nonexistent praise and an obvious link if you hover over it. We got clicks almost immediately during the session.

Later that day I was visited by a couple of directors in the IT department who said they had never fallen for an internal phish before at any organization. I avoided severe political backlash in this situation because they were in a group with a low click rate and they had access to the lunch and learn where we did the phish. In another organization this could have caused a lot of issues.

Despite conducting phishes as a way to gather information and reduce risk in the organization we are still going to bruise some people’s ego. Which is why we need to be thoughtful and careful about the phishes we send.

Increase the difficulty

As the click rate goes down, increase the difficulty. Determining if you can increase the difficulty should be from a reduced click rate from a period of over three or more months. Month-to-month click rate can be volatile. To increase difficulty reduce the number of indicators in a phishing email. If you started with five indicators reduce it to four. This allows the phishing emails to have levels of difficulty that can be reported on.

Indicators can be anything from reducing misspellings to making domains look a lot more legitimate. We’ve used domains that were bought to protect the company from typosquatting attacks. We loaded those into the platform and used them when we needed to increase the difficulty of phishing emails.

Reporting, Metrics, and extra training

As mentioned above, I like to use click rate and report rate. Other statistics don’t provide as much insight. The phishing platform may not have those statistics as default which means some excel jujitsu will be needed to get the metrics worth reporting up.

I never liked calling out individuals unless they were flagged multiple times as repeat clickers and put the company at a significant risk. In that case a conversation with their manager and HR is useful. One of the things I find useful was to group click rate and report rate by department. Grouping departments gives people an out but still allows large groups of people to be reported up if they’re having trouble with phishing emails. Leadership liked this grouping as it provided them with good insight into which departments were struggling with phishing emails. This also motivates departments do better because they don’t want to be in the top 10 click rate and want to be in the top 10 for report rate.

As far as training, I didn’t like assigning extra training from the phishing platform unless there was buy-in from the top and could be tied to something performance wise from an HR standpoint. If I assigned training without any sort of outcome, people could ignore the training and not have any repercussions. I do still think training is important and preferred in-person training because it allowed me to walk them through the phish and allow them to ask questions. I found that the groups I got to work with in these training sessions did a much better job with phishing emails. Those sessions can also be recorded and put into a LMS platform.

Summary

A phishing program can be a powerful security awareness tool for an organization. It should look to decrease click rate and improve report rate. The first phish should set a baseline. Increase the difficulty as click rates go down and report rates go up. Try to tie phishes to relevant phishes that is being seen in the company’s security tooling. Even with free reign certain phishes are off-limits. The CEO might be okay with it but everyone else will start to harbor bad feelings towards the phishing program and security and will look to undermine it when possible.

Identify what metrics are important and put those together to be reported up. Creating top 10 lists for departments is a great way to gamify the reporting and get people to more actively participate. Finally. remember this is about practice. Anyone can fall for a phish if the right factors line up. Taking an empathetic approach will help with making the program more engaging and effective.

Drop any questions you may have in the comment section below or reach out via the contact form.

This post first appeared on Exploring Information Security.