All organizations providing financial services such as banking, investment, and insurance constitute financial institutions. Financial frauds and identity thefts in such institutions have increased significantly with the digitalization of the sector. Today, financial institutions are among the top targets of phishing and other cyber threats.
As online education has become more prevalent than ever, schools and colleges face tremendous challenges due to COVID-19. There is growing uncertainty on the revival of regular classes for students. Many educational institutions have resorted to online education as an alternative. However, online education comes with its disadvantages. Cyber adversaries now have one more sector to target. By the looks of it, schools and colleges have become easy targets for these malicious actors. Let us discuss why it is so and how to avoid the threat.
Covid has been around for more than seven months now. And in that time, it has become the number one source of phishing attacks worldwide. We even detailed ten ways hackers use Covid to phish you in a recent post. It’s been so widespread, almost everyone is wary of Covid-related phishing emails by now. You might think that would put an end to them, but nothing could be further from the truth. When it comes to fraudsters, Covid is the gift that keeps on giving.
How good are your employees at spotting phishing emails? There’s a really easy way to find out. Send each one of them a fake phishing email and see how many click. And that’s exactly what Tribune Publishing, publishers of the Chicago Tribune, did recently, and boy did it backfire.
According to The Big Lead, “The media giant has spent the last few years cutting staff at newspapers across the country, leaving workers underpaid and overworked. On Wednesday the company sent out emails to employees suggesting they would be getting raises for all their hard work. It turns out it was a test to see how susceptible they were to a phishing scam. Needless to say, the employees were furious.”
When it comes to preventing phishing attacks, companies are often torn between how to spend their security dollars. The choice they make is usually between two options: employee awareness training and email security hardware/software. The first choice assumes your employees can protect you from phishing attacks if only they can be taught to spot them. The second choice assumes there’s not enough training in the world for you employees to stop every phishing attack—it’s better to leave that to technology.
If it’s time for a big election, you can be sure the scammers will take advantage of that in the next round of phishing attacks. But, election-related phishing attacks may not target who you think. Rather than go after voters, who aren’t accustomed to having to provide credentials in response to an election-related email, the hackers “target political parties and campaigns, think tanks, civic organizations, and associated individuals,” according to CISA (Cybersecurity & Infrastructure Security Agency), a U.S. federal agency responsible for the nation’s cyber infrastructure and readiness, which issued the warning.
As far as phishing attacks go, brand impersonation is the go-to tactic for attackers. This is especially true for credential phishing and business email compromise attacks (BEC). And according to a recent analysis, there are some pretty surprising discoveries regarding brand impersonation.
For starters, is the top 10 list of most phished brands. Many are recognizable like Microsoft, Google, PayPal and NetFlix. But there were also some lower profile organizations that surprisingly made the top 10 list including Maersk, DHL and WeTransfer. Not exactly household names.
Combating phishing attacks used to be just a matter of not clicking on malicious links in an email. If you could spot the suspect link in an email, and didn’t click it, you were pretty much guaranteed to be safe. Not anymore. Oh sure, hackers still want you to click on a malicious link, but their techniques for disguising them is nothing short of remarkable.
There are two really scary aspects to getting a layoff notice. First, of course, is that you’re being laid off, which stinks. The other is that it almost always comes without warning and catches you off guard. When you get the notice, your heart starts racing, you may even panic a little. The last thing you’re prepared to do is to identify the email as a phishing scam. And that’s exactly what the scammers are counting on.
Who would you expect to be the last organization taken in by a phishing attack? How about the “largest source for information security training and security certification in the world?” That’s right. The SANS Institute, around since 1989, training more than 165,000 security professionals around the world, was just breached as the result of a phishing attack.
Given how widespread phishing attacks are, you might think that not only are there a lot of phishing attacks, but that each one lasts a long time. While it’s true that there are a lot of phishing attacks, most phishing attacks do their damage in a really short time.
Research conducted by USENIX recently examined 4.8 million victims who visited phishing pages in a one-year period. And what was the average time of an attack measured by the researchers? “[F]rom the time they first come online, to email distribution, to visitor traffic, to ecosystem detection, and finally to account compromise, we find the average campaign from start to the last victim takes just 21 hours.” Twenty-one hours! It’s over in less than a day.
If you haven’t already heard, Twitter was hacked recently and some pretty high-profile people like Barack Obama and Elon Musk had their accounts compromised. When such a powerful tech company as Twitter gets taken like that, the first impulse is to assume it’s some band of sophisticated hackers or a rogue nation employing some leading-edge network penetration technology that does the damage. But in the case of Twitter, as with most high-profile attacks, nothing could be further from the truth.
At this point, it’s probably impossible to find a company that doesn’t rely on some cloud-based trusted services. Trusted services are services offered by companies so well recognized and respected, that we never give it another thought whether to trust them or not. Companies like Google, Microsoft and Dropbox. We all use them and we all trust them. And that’s exactly what hackers are counting on.
Email impersonation is one of the most prevalent and effective types of phishing attacks. Why is that? Because this type of phishing email supposedly comes from someone or some company you know, so you let your guard down. “As the professional community continues to work in a remote environment, email impersonations present the perfect way for opportunistic fraudsters to take advantage of human vulnerabilities.”
On the 15th of July, 2020, the adversaries could successfully barge into some of the most popular accounts of the San Francisco-based social networking platform Twitter. The attackers infiltrated despite Twitter’s phishing attack prevention measures and used this access to Twitter’s database to hack celebrity Twitter Accounts. This attack has taken the internet by storm as many renowned faces have become its victims. Although Twitter is adopting the phishing prevention best practices, it is unsure whether they will be able to combat the long term effects of this historic breach- A high time organizations must adopt innovative anti-phishing solutions.
As far as phishing emails go, business email compromise (BEC) are amongst the most sophisticated. In BEC, “typically an attack targets specific employee roles within an organization by sending a spoof email which fraudulently represents a senior colleague (CEO or similar) or a trusted customer.”
BEC attacks take time and planning and patience. After all, the attackers are attempting to impersonate a real person, so they have to be very convincing. Now word comes from ZDNet of a sophisticated new group of Russian hackers targeting big companies around the world with BEC phishing emails. Their clever new twist? They’re attempting to impersonate two people.
Probably not. Office 365 has two things going against it when it comes to safe email. First, it’s the most targeted platform, so it’s always getting the hackers’ best shot. Second, it doesn’t have a particularly good traffic record of producing effective email defense.
An example of the first issue is the recent phishing attack on Office 365 remote workers as reported by Malwaretips. According to the article, “Microsoft Office 365 customers are targeted by a phishing campaign using bait messages camouflaged as notifications sent by their organization to update the VPN configuration they use to access company assets while working from home. These phishing messages are a lot more dangerous because of the huge influx of employees working remotely and using VPNs to connect to company resources from home for sharing documents with their colleagues and accessing their orgs’ servers.”
Before COVID-19, pretty much everyone worked in an office so that’s where hackers aimed their phishing attacks. They used spear phishing and business email compromise (BEC) techniques to steal credentials and to steal money. And then something strange happened: everyone started working from home.
Once everyone started working remotely due to the coronavirus, that’s where the hackers went after them because remote workers are even more vulnerable working from home (WFH). COVID-19 themed emails targeting WFH employees with promises of face masks or investments in fake companies claiming to be developing vaccines were very common. And then something strange happened: employees started returning to the office.
Just detecting a phishing attack on a bank isn’t an extraordinary event. There are dozens of phishing attacks per week targeted at the major international banks. As phishing targets go, banks are just too enticing for hackers to ignore. And banks, for the most part, understand the threat and are prepared to deal with most attacks. Most!
If it’s in the news, it’s a phishing attack waiting to happen. First, it was the popularity of the show Game of Thrones. Then it was the new Star Wars sequel. More recently it was the fear of COVID-19. And now, in response to all the recent protests over police brutality, it’s the Black Lives Matter movement. Apparently, hackers get their ideas for phishing attacks from the news.