You are here

Home » Cybersecurity

Cybersecurity

BEC Continues to Surpass Ransomware in Financial Impact, Despite Headlines

CSO Online has posted an article detailing how business email compromise (BEC) attacks continue to have a larger impact on the economy compared to ransomware attacks, despite the more significant amount of media attention devoted to the latter. Based off of data from the FBI, in 2021 BEC attacks were responsible for the loss of $2.4 billion, in comparison to a loss of $49.2 million to ransomware attacks. The article offers a few explanations for this mismatch between reality and expectation.

Threat Awareness - Microsoft 365 and eFax Spoofed in New Customer Feedback-Based Phishing Campaign

Cofense posted a blog detailing a phishing campaign utilizing unique tactics that is targeting multiple sectors, including energy, financial services, commercial real estate, food, and manufacturing. This campaign, which spoofs eFax and Microsoft 365, approaches targets in a nontraditional way by pretending to be from a survey site asking for customer feedback.

MFA is Being Bypassed with More Fervor

Despite the ability to significantly reduce the risk from account takeovers, MFA is not without its challenges. While MFA is a simple control to use, configuring it isn’t necessarily so seamless – yet it’s a control that can’t be dismissed. From MFA push notification fatigue to exploiting weaknesses in self-enrollment configurations, multiple threat actor types seem to be increasingly bypassing this important cyber defense technique.

Security Awareness – Poor Configurations to Blame for Large Percentage of Ransomware

A new report from Microsoft analyzes the evolving nature of the ransomware business into a ransomware as a service (RaaS) model and offers important lessons and recommendations for network defenders. The most notable finding, among others, is that over 80 percent of ransomware attacks can be traced to common configuration errors in software and devices. The RaaS model lowers the barrier to entry and obfuscates the identity of the attackers behind the ransomware.

FBI PIN - Proxies and Configurations Used for Credential Stuffing Attacks on Online Customer Accounts

The FBI has published a TLP:WHITE Private Industry Notification (PIN) warning that cyber criminals are leveraging proxies and configurations to mask and automate credential stuffing attacks on online customer accounts of U.S. businesses. These attacks, if successful, can lead to financial losses associated with fraudulent purchases, customers being notified, system downtime and remediation, and reputational cost.

Threat Advisory – Current Phishing Campaign Mimics a Primacy Agency Data Validation Request

by Andrew Hildick-Smith

Attention: If the EPA or your primacy agency asks you to validate your basic Public Water Supply (PWS) system information, look extremely closely to the email and validate/verify the request is legitimate BEFORE you respond. Please view the attachment for screenshots of the actual phishing messages so you can spot and report similar scams.

What Happened?

Threat Awareness - DarkTortilla Malware

Security researchers are warning defenders to be aware of ‘DarkTortilla’ which several threat actors are using to deliver a wide range of information stealers, remote-access Trojans (RATs), and other malicious payloads. DarkTortilla was first observed by researchers in October 2021, but they believe it has been active since at least 2015. Similar to other malware, threat actors are distributing DarkTortilla via spam emails with file attachments such as .ISO, .ZIP, and .IMG. In some instances, they have also used malicious documents to deliver the malware.

Pages

Subscribe to Cybersecurity