Security Awareness Training Blog

Keeping You Informed. Keeping You Aware.

Kaspersky: DDoS Often Smokescreen For Phishing Attack

Distributed denial of service attacks, also known as DDoS, are becoming  a major threat. They can bring websites and networks down, and generally make a lot of noise demanding attention.

And according to a new Kaspersky Lab report, that is exactly what hackers are using them for.

The strategy goes that as businesses are preoccupied with handling DDoS attacks, cybercriminals and hackers can use the opportunity for another, more targeted type of attack — like spear phishing, happens in the background. The conclusion comes in Kaspersky Lab’s report, which polled businesses about their cybersecurity experiences.

More than half (56 percent) say DDoS is being used to cover something else.

Phishing Attack Hits Saudi Govt Networks With Disk-Wiping Malware

Hackers penetrated six Saudi Arabian government agencies including its General Authority of Civil Aviation, and bricked thousands of computers with the well-known Shamoon disk-wiper malware. Saudi's Central Bank denies it was hit despite earlier reports that it was one of the victims. 

Russian Central Bank Loses 2 Billion Rubles in Cyberheist

Reuters reported that hackers stole more than 2 billion rubles ($31 million) from correspondent accounts at the Russian central bank, the bank said on Friday. 

“We can’t say exactly when, but we can say today it was stolen,”Ekaterina Glebova, an official in the central bank’s press office, told The Wall Street Journal.

Central bank official Artyom Sychyov discussed the losses at a briefing, saying that the hackers had attempted a cyberheist of about 5 billion rubles.

The Top Five Names In Cybersecurity

Looking for the top names in cybersecurity? Look no further than the Cybersecurity 500 list of the world’s hottest and most innovative cybersecurity companies:

The Q4 2016 edition was just published by Cybersecurity Ventures. Going down the list, we take a look at the top five names from a branding and marketing perspective. 

Scam Of The Week - Fake News: a Content-based Social Engineering Attack

Facebook, Google, and Twitter have recently been facing scrutiny for promoting fake news stories.  Depending on your sources and who you believe, fake news played and is still playing a role in the 2016 presidential election.

10 Ways To Avoid Holiday Scams

With the biggest cybercriminal hacking holidays of the year upon us, it's time for a reminder of red flags to pay attention to when shopping either online or in brick-and-mortar stores. 

Why Advanced Ransomware Is Cybercrime's Most Profitable Business Model

RSA did a revealing ransomware risk-reward analysis. See that $6 million number over to the right?

Why does cybercrime like ransomware so much? Low Risk, High Payoff

From the bad guy's perspective, advanced ransomware is highly lucrative with very little risk involved. The FBI estimates it will be a $1 Billion dollar 'business' in 2016.  RSA did an analysis which gives us some insight in the money to be made! 

"Assume, for instance, that a cybercriminal is targeting consumers and mounts an advanced ransomware campaign in which 1 million users are exposed to a fateful decision: to click or not to click. To be clear, this means several multiples of this number were launched—these are temptations that have successfully run the gauntlet of email security, Web security, and other preventive controls.

Yes, that message is really from Facebook. And, yes, it's really malicious.

By Eric Howes,  KnowBe4 Principal Lab Researcher

Just two weeks after we reported that the bad guys had effectively converted LinkedIin into a phishing platform, Facebook once again found itself being used as an attack vector -- this time for the well-known and much feared Locky ransomware.

Two days ago security researchers Bart Blaze and Peter Kruse reported that malicious messages delivered via Facebook Messenger were being used to trick unsuspecting marks into kicking off a download and install process that, in some cases, ended with Locky ransomware being installed on victims' PCs.

Of all the social media platforms, Facebook is undoubtedly the most heavily targeted given the unsurpassed size of its user base as well as the wide range of native functionality that it offers malicious actors. While many of the elements in this particular attack have been seen before, there was at least one that was new and rather unique.

The Attack

On November 20 an undetermined number of Facebook users received messages in their Messenger accounts from other users already familiar to them. The message consisted of a single .SVG (Scaleable Vector Graphic) image file which, notably, bypassed Facebook's file extensions filter. (.SVG files are XML-based and allow the embedding of other content, including dynamic content -- exactly what the bad guys needed in this scenario.)

KnowBe4 Selected as SC Media 2017 Professional Award Finalist

KnowBe4, the world's most popular platform for new-school security awareness training was named a finalist in the SC Awards 2017 for exemplary professional leadership in cybersecurity.

KnowBe4 was acknowledged as Best IT Security-related Training Program in the Professional Award category of the SC Awards. Winners will be announced at the SC Awards 2017 ceremony to be held February 14, 2017 in San Francisco.

Subscribe To Our Blog

Phish Your Users

Get the latest about social engineering

Subscribe to CyberheistNews