CyberheistNews Vol 10 #02
[Heads-Up] The U.S. Government Issues a Warning About a Possible New Wave of Iranian Cyber Attacks 
Christopher C. Krebs, Director of America's CISA, the new Cybersecurity and Infrastructure Security Agency, issued a warning about a potential new wave of Iranian cyber-attacks targeting U.S. assets after Iranian Major General Qassem Soleimani, commander of the Islamic Revolutionary Guard's Quds Force was killed by a U.S. air strike at the Baghdad airport in Iraq.
"Given recent developments, re-upping our statement from the summer," Krebs said in a rare warning on Twitter. "Bottom line: time to brush up on Iranian TTPs and pay close attention to your critical systems, particularly ICS," he added. "Make sure you’re also watching third party accesses!"
“At this point, a cyberattack should be expected,” said Jon Bateman, a former Defense Intelligence Agency analyst on Iran’s cyber capabilities and now a cybersecurity fellow for the Carnegie Endowment for International Peace.
“We know that Iranian cyber operations are currently scoping and preparing to attack our networks — in all sectors of society — to see where they can hit us,” said Virginia Sen. Mark R. Warner, the top Democrat on the Senate Intelligence Committee.
"The Department of Homeland Security stands ready to confront and combat any and all threats facing our homeland," Acting Secretary Chad F. Wolf also said in a statement. "While there are currently no specific, credible threats against our homeland, DHS continues to monitor the situation and work with our Federal, State and local partners to ensure the safety of every American."
Iran Attacks Networks With Disk Wipers
Well, that "ensuring the safety" remains to be seen. Since the 2010 Stuxnet attack they have been working hard on their cyber attack capabilities. Iran's APT33 tends to attack soft civilian targets with disk wipers that destroy your network. For example, APT33 was behind the infamous 2012 Shamoon attack on Saudi Aramco, an attack which erased the data on most of the company’s 20,000 computers.
Iranians' APT34 has hit the headlines a few times last year, including with a phishing attack using LinkedIn. The Iranians also used disk wipers in 2014 at the Las Vegas Sands casino, whose staunchly pro-Israel owner Sheldon Adelson had unwisely suggested the United States drop nuclear bombs on Iran.
Iran's state-sponsored hackers have been working hard to develop low-cost, and possibly hard-to-contribute means of conducting hostile, cyberwar-like activity. They are focusing on critical services, damage or destroy highly specialized equipment, and try to inflict damaging cascading effects upon global industries like finance and energy.
Iranian groups have hit US targets in the past. The US Justice Department, for example, in February of 2018, secured Federal indictments against nine Iranian nationals associated with the Mabna Institute, an organization that serves as a cyber operations contractor for the Revolutionary Guard Corps. Charges included “conspiracy to commit computer intrusions; conspiracy to commit wire fraud; computer fraud - unauthorized access for private financial gain; wire fraud; [and] aggravated identity theft.”
The regime in Tehran was given a message, and it is to be expected they will respond with hybrid (asymmetrical if you will) warfare which is likely to be cyber offensives against strategic industrial targets which are much easier to hit than hardened military ones. Here is a short list of targets Iranians have hit in the past:
Asymmetrical, hybrid cyber warfare has become a reality the last 12 months. With practically limitless industrial targets, many not very well protected against attacks sponsored by nation-states, IT pros need to demand the budget to harden their defenses and truly start applying defense-in-depth.
Here is an article in the Washington Post you can send to your C-level execs to support your budget increase requests:
https://www.washingtonpost.com/technology/2020/01/03/cyber-attack-should-be-expected-us-strike-iranian-leader-sparks-fears-major-digital-disruption/
Christopher C. Krebs, Director of America's CISA, the new Cybersecurity and Infrastructure Security Agency, issued a warning about a potential new wave of Iranian cyber-attacks targeting U.S. assets after Iranian Major General Qassem Soleimani, commander of the Islamic Revolutionary Guard's Quds Force was killed by a U.S. air strike at the Baghdad airport in Iraq.
"Given recent developments, re-upping our statement from the summer," Krebs said in a rare warning on Twitter. "Bottom line: time to brush up on Iranian TTPs and pay close attention to your critical systems, particularly ICS," he added. "Make sure you’re also watching third party accesses!"
“At this point, a cyberattack should be expected,” said Jon Bateman, a former Defense Intelligence Agency analyst on Iran’s cyber capabilities and now a cybersecurity fellow for the Carnegie Endowment for International Peace.
“We know that Iranian cyber operations are currently scoping and preparing to attack our networks — in all sectors of society — to see where they can hit us,” said Virginia Sen. Mark R. Warner, the top Democrat on the Senate Intelligence Committee.
"The Department of Homeland Security stands ready to confront and combat any and all threats facing our homeland," Acting Secretary Chad F. Wolf also said in a statement. "While there are currently no specific, credible threats against our homeland, DHS continues to monitor the situation and work with our Federal, State and local partners to ensure the safety of every American."
Iran Attacks Networks With Disk Wipers
Well, that "ensuring the safety" remains to be seen. Since the 2010 Stuxnet attack they have been working hard on their cyber attack capabilities. Iran's APT33 tends to attack soft civilian targets with disk wipers that destroy your network. For example, APT33 was behind the infamous 2012 Shamoon attack on Saudi Aramco, an attack which erased the data on most of the company’s 20,000 computers.
Iranians' APT34 has hit the headlines a few times last year, including with a phishing attack using LinkedIn. The Iranians also used disk wipers in 2014 at the Las Vegas Sands casino, whose staunchly pro-Israel owner Sheldon Adelson had unwisely suggested the United States drop nuclear bombs on Iran.
Iran's state-sponsored hackers have been working hard to develop low-cost, and possibly hard-to-contribute means of conducting hostile, cyberwar-like activity. They are focusing on critical services, damage or destroy highly specialized equipment, and try to inflict damaging cascading effects upon global industries like finance and energy.
Iranian groups have hit US targets in the past. The US Justice Department, for example, in February of 2018, secured Federal indictments against nine Iranian nationals associated with the Mabna Institute, an organization that serves as a cyber operations contractor for the Revolutionary Guard Corps. Charges included “conspiracy to commit computer intrusions; conspiracy to commit wire fraud; computer fraud - unauthorized access for private financial gain; wire fraud; [and] aggravated identity theft.”
The regime in Tehran was given a message, and it is to be expected they will respond with hybrid (asymmetrical if you will) warfare which is likely to be cyber offensives against strategic industrial targets which are much easier to hit than hardened military ones. Here is a short list of targets Iranians have hit in the past:
- U.S. Banks and Financial system
- Middle East Energy infrastructure
- NY State Dam control systems
- Social Media attacks using Facebook, Twitter and Instagram
- Specific attacks on U.S. political campaigns, officials and journalists
- U.S. targets abroad, both military and civilian
- Telecom systems internationally
- U.S. and international Universities
- International non-governmental organizations
Asymmetrical, hybrid cyber warfare has become a reality the last 12 months. With practically limitless industrial targets, many not very well protected against attacks sponsored by nation-states, IT pros need to demand the budget to harden their defenses and truly start applying defense-in-depth.
Here is an article in the Washington Post you can send to your C-level execs to support your budget increase requests:
https://www.washingtonpost.com/technology/2020/01/03/cyber-attack-should-be-expected-us-strike-iranian-leader-sparks-fears-major-digital-disruption/
[NEW WEBINAR] Business Email Compromise During Tax Season: How to Spot and Defend Against Common BEC Tax Scams
Tax season is upon us, which makes this prime time for hackers to target your unsuspecting users with the latest Business Email Compromise (BEC) scams. From evolved W2 fraud to tax-related spear phishing, cybercriminals capitalize on the first quarter of each new year with smarter, craftier attacks designed to convince your users to provide confidential information, authorize wire transfers, or enable malicious files.
Join Erich Kron and James McQuiggan, KnowBe4 Security Awareness Advocates, on Wednesday, January 15 @ 2:00 pm (ET) for an in-depth discussion of the new types of BEC scams you can expect to see, what your users should be on alert for this tax season, and how to protect your organization from these evolved threats.
In this webinar you will learn:
Date/Time: Wednesday, January 15 @ 2:00 pm (ET)
Save My Spot!
https://event.on24.com/wcc/r/2166335/1E78505C829A46DE110368503BD447C5?partnerref=CHN2
Tax season is upon us, which makes this prime time for hackers to target your unsuspecting users with the latest Business Email Compromise (BEC) scams. From evolved W2 fraud to tax-related spear phishing, cybercriminals capitalize on the first quarter of each new year with smarter, craftier attacks designed to convince your users to provide confidential information, authorize wire transfers, or enable malicious files.
Join Erich Kron and James McQuiggan, KnowBe4 Security Awareness Advocates, on Wednesday, January 15 @ 2:00 pm (ET) for an in-depth discussion of the new types of BEC scams you can expect to see, what your users should be on alert for this tax season, and how to protect your organization from these evolved threats.
In this webinar you will learn:
- Real-world examples of the latest BEC attacks
- Common targets within your organization and techniques used to trick them
- Red flags your users need to know now to spot BEC attacks
- How to educate your organization so you don’t fall victim
Date/Time: Wednesday, January 15 @ 2:00 pm (ET)
Save My Spot!
https://event.on24.com/wcc/r/2166335/1E78505C829A46DE110368503BD447C5?partnerref=CHN2
FBI Warns U.S. Companies About Maze Ransomware
The FBI is warning U.S. companies about a series of recent ransomware attacks in which the perpetrator, sometimes posing as a government agency, steals data and then encrypts it to further extort victims. In an advisory to the private sector last week, the FBI called for vigilance to combat the so-called Maze ransomware, which the bureau said began hitting U.S. organizations in November.
“From its initial observation, Maze used multiple methods for intrusion, including the creation of malicious look-a-like cryptocurrency sites and malspam campaigns impersonating government agencies and well-known security vendors,” states the advisory obtained by CyberScoop.
“In a late November 2019 attack, Maze actors threatened to publicly release confidential and sensitive files from a US-based victim in an effort to ensure ransom payment,” the advisory says, without naming the victim. Continued: https://blog.knowbe4.com/fbi-warns-u.s.-companies-about-maze-ransomware
The FBI is warning U.S. companies about a series of recent ransomware attacks in which the perpetrator, sometimes posing as a government agency, steals data and then encrypts it to further extort victims. In an advisory to the private sector last week, the FBI called for vigilance to combat the so-called Maze ransomware, which the bureau said began hitting U.S. organizations in November.
“From its initial observation, Maze used multiple methods for intrusion, including the creation of malicious look-a-like cryptocurrency sites and malspam campaigns impersonating government agencies and well-known security vendors,” states the advisory obtained by CyberScoop.
“In a late November 2019 attack, Maze actors threatened to publicly release confidential and sensitive files from a US-based victim in an effort to ensure ransom payment,” the advisory says, without naming the victim. Continued: https://blog.knowbe4.com/fbi-warns-u.s.-companies-about-maze-ransomware
[LIVE DEMO] See Ridiculously Easy Security Awareness Training and Phishing
Old-school awareness training does not hack it anymore. Your email filters have an average 7-10% failure rate; you need a strong human firewall as your last line of defense.
Join us, THIS WEEK, Wednesday, January 8 @ 2:00 pm (ET), for a live demonstration of how KnowBe4 introduces a new-school approach to security awareness training and simulated phishing.
Check out our new assessment feature and see how easy it is to train and phish your users.
Date/Time: THIS WEEK, Wednesday, January 8 @ 2:00 pm (ET)
Save My Spot!
https://event.on24.com/wcc/r/2161522/61EC8675F9195AB5ACDC5B9131474C9C?partnerref=CHN3
Old-school awareness training does not hack it anymore. Your email filters have an average 7-10% failure rate; you need a strong human firewall as your last line of defense.
Join us, THIS WEEK, Wednesday, January 8 @ 2:00 pm (ET), for a live demonstration of how KnowBe4 introduces a new-school approach to security awareness training and simulated phishing.
Check out our new assessment feature and see how easy it is to train and phish your users.
- NEW Assessments! Find out where your users are in both security knowledge and security culture to help establish baseline security metrics you can improve over time.
- Train your users with access to the world's largest library of awareness training content and automated training campaigns with scheduled reminder emails.
- Send fully automated simulated phishing attacks, using thousands of customizable templates with unlimited usage.
- Virtual Risk Officer shows you the Risk Score by user, group, and your whole organization.
- Advanced Reporting on 60+ key awareness training indicators.
- Active Directory Integration to easily upload user data, eliminating the need to manually manage user changes.
- Identify and respond to email threats faster. Enhance your incident response efforts with the PhishER add-on!
Date/Time: THIS WEEK, Wednesday, January 8 @ 2:00 pm (ET)
Save My Spot!
https://event.on24.com/wcc/r/2161522/61EC8675F9195AB5ACDC5B9131474C9C?partnerref=CHN3
Wawa Data Breach Class Action Filed
There was a massive data breach suffered by Wawa, a convenience store chain of more than 850 stores around the country. Wawa had recently disclosed that it had suffered a data breach that went undiscovered for nine months in which credit and debit numbers, card expiration dates and cardholders' names were stolen by hackers.
In response to the data breach, the CEO of Wawa issued a detailed letter to affected customers in which you can find the information to activate free credit monitoring offered by Wawa. More information on the letter from the CEO and other related links you be accessed here:
https://blog.knowbe4.com/wawa-data-breach-class-action-filed
There was a massive data breach suffered by Wawa, a convenience store chain of more than 850 stores around the country. Wawa had recently disclosed that it had suffered a data breach that went undiscovered for nine months in which credit and debit numbers, card expiration dates and cardholders' names were stolen by hackers.
In response to the data breach, the CEO of Wawa issued a detailed letter to affected customers in which you can find the information to activate free credit monitoring offered by Wawa. More information on the letter from the CEO and other related links you be accessed here:
https://blog.knowbe4.com/wawa-data-breach-class-action-filed
[LIVE DEMO] See How You Can Get Audits Done in Half the Time at Half the Cost
You told us you have challenging compliance requirements, not enough time to get audits done, and keeping up with risk assessments and third-party vendor risk is a continuous problem.
We listened! KCM now has Compliance, Risk, Policy and Vendor Risk management modules, transforming KCM into a full SaaS GRC platform!
Join us, TOMORROW, Tuesday, January 7 @ 2:00 pm (ET), for a 30-minute live product demonstration of KnowBe4's KCM GRC platform. See how you can simplify the challenges of managing your compliance requirements across your organization and third-party vendors and ease your burden when it's time for risk assessments and audits.
Save My Spot!
https://event.on24.com/wcc/r/2161517/913D5D0E1A03310F65463DD51B49DC54?partnerref=CHN3
Let's stay safe out there.
https://www.youtube.com/watch?v=W9UvWQJoRfE&feature=share
You told us you have challenging compliance requirements, not enough time to get audits done, and keeping up with risk assessments and third-party vendor risk is a continuous problem.
We listened! KCM now has Compliance, Risk, Policy and Vendor Risk management modules, transforming KCM into a full SaaS GRC platform!
Join us, TOMORROW, Tuesday, January 7 @ 2:00 pm (ET), for a 30-minute live product demonstration of KnowBe4's KCM GRC platform. See how you can simplify the challenges of managing your compliance requirements across your organization and third-party vendors and ease your burden when it's time for risk assessments and audits.
- Vet, manage and monitor your third-party vendors' security risk requirements.
- Simplify risk management with an intuitive interface and simple workflow based on the well-recognized NIST 800-30.
- Quick implementation with pre-built requirements templates for the most widely used regulations.
- Secure evidence repository and DocuLinks giving you two ways of maintaining audit evidence and documentation.
- Dashboards with automated reminders to quickly see what tasks have been completed, not met, and past due.
Save My Spot!
https://event.on24.com/wcc/r/2161517/913D5D0E1A03310F65463DD51B49DC54?partnerref=CHN3
Let's stay safe out there.
Warm Regards,
Stu Sjouwerman
Founder and CEO
KnowBe4, Inc
https://www.youtube.com/watch?v=W9UvWQJoRfE&feature=share
Quotes of the Week
"A little more persistence, a little more effort, and what seemed hopeless failure may turn to glorious success." - Elbert Hubbard, Writer (1859 - 1915)
"Study the past, if you would divine the future." - Confucius, Philosopher (551 - 479 BC)
Thanks for reading CyberheistNews
"Study the past, if you would divine the future." - Confucius, Philosopher (551 - 479 BC)
Thanks for reading CyberheistNews
Security News
Seven Kinds of Malware, and All Arrive by Social Engineering
Naked Security outlines seven different categories of malware and describes how each of them through social engineering techniques can affect your organization. Some or all of these functions are often packaged together in the same piece of malware, but it’s helpful to examine them one by one in order to understand the damage they can cause.
https://nakedsecurity.sophos.com/2019/12/28/7-types-of-virus-a-short-glossary-of-contemporary-cyberbadness/
Naked Security outlines seven different categories of malware and describes how each of them through social engineering techniques can affect your organization. Some or all of these functions are often packaged together in the same piece of malware, but it’s helpful to examine them one by one in order to understand the damage they can cause.
- The first on the list is the keylogger, which records data from your keyboard and sends it to the attacker. Keyloggers allow attackers to steal your passwords along with any other sensitive data you’ve typed, such as financial details.
- Another type of malware is the data stealer, which uses data-matching patterns to search your computer for valuable files. Data stealers can automatically recognize things like payment card and bank account numbers, email addresses, passwords, and much more. They can also identify browser databases that store your passwords, personal information, and browser authentication tokens.
- A third variant is the RAM scraper, which can steal data from your computer’s temporary memory. Like data stealers, RAM scrapers can recognize valuable data when they see it. Some pieces of sensitive data—like credit card CVV codes, plaintext passwords, and decryption keys—are never saved to disk for security reasons. RAM scrapers allow attackers to intercept these data before they’re erased.
- A bot is a fourth type of malware which gives an attacker control over your computer. In many cases, your device will then be incorporated into large network of bots on different devices called a botnet. Attackers use botnets to launch massive automated attacks and spam campaigns. Bots also have the ability to receive updates, so the attacker can change the malware’s functionality whenever they desire.
- Next on the list is the banking Trojan, which is malware that targets financial information. Banking Trojans usually contain keyloggers and data stealers, and they often use web form injection to trick victims into entering their payment details into fraudulent data fields. Popular banking Trojans like Emotet, Trickbot, and Dridex are sophisticated and versatile pieces of malware that are used for much more than just stealing bank account details.
- A sixth variant is the remote access Trojan (RAT), a stealthy tool that grants an attacker access to your computer. In some cases, RATs can activate your webcam without turning on the light that indicates the webcam is active.
- Finally, ransomware is malware that encrypts your files and demands a ransom in exchange for the decryption key. Ransomware attacks have grown extremely sophisticated in recent years, with attackers hacking into networks and meticulously setting up the malware in order to cause as much damage as possible.
https://nakedsecurity.sophos.com/2019/12/28/7-types-of-virus-a-short-glossary-of-contemporary-cyberbadness/
Tax Season Warning: the IRS on Social Engineering
We have had occasion to warn of this before, but as 2020 begins and April 15th approaches, it may be worth another mention. The US Internal Revenue Service wants taxpayers to keep a sharp eye out for the signs of social engineering.
According to tweets the IRS issued at the end of December, “The most common way thieves steal identities is simply by asking for them.” This, of course, is especially a problem during tax season, when thieves file fraudulent returns, or use tax worries as the entering wedge of other social engineering campaigns.
The IRS Twitter feed offers a sound short list of things in communications that should put you on your guard. Scammers often:
That kind of impersonation works with all five of the tactics the IRS warns against. It’s also worth noting that most of them work equally well as smishing--that is, text messaging--or as vishing--that is, voice calls--as they do with conventional email phishing.
The tax agency points out on its website that there’s one sure sign that the person who says they’re from the IRS is in fact a scammer: “The IRS doesn't initiate contact with taxpayers by email, text messages or social media channels to request personal or financial information.
This includes requests for PIN numbers, passwords or similar access information for credit cards, banks or other financial accounts.” So if you’ve been contacted out of the blue by someone who says you owe taxes, that you might be about to arrested, or that the Government needs your bank account credentials, it’s fraud.
A threat to an individual is also a threat to that individual’s organization, and businesses and other organizations also deal with the IRS and other Government bodies. This kind of impersonation scam can be easily avoided, especially if an organization takes the trouble to offer its employees new-school social engineering awareness training. The IRS website has full details on phishing here:
https://www.irs.gov/privacy-disclosure/report-phishing
We have had occasion to warn of this before, but as 2020 begins and April 15th approaches, it may be worth another mention. The US Internal Revenue Service wants taxpayers to keep a sharp eye out for the signs of social engineering.
According to tweets the IRS issued at the end of December, “The most common way thieves steal identities is simply by asking for them.” This, of course, is especially a problem during tax season, when thieves file fraudulent returns, or use tax worries as the entering wedge of other social engineering campaigns.
The IRS Twitter feed offers a sound short list of things in communications that should put you on your guard. Scammers often:
- “Pose as a trusted source.”
- “Tell you there’s something wrong with your account.”
- “Claim you’re in violation of a law.”
- “Tell you to open a link or an attachment.”
- “Ask you to log into a familiar-looking--but fake--website.”
That kind of impersonation works with all five of the tactics the IRS warns against. It’s also worth noting that most of them work equally well as smishing--that is, text messaging--or as vishing--that is, voice calls--as they do with conventional email phishing.
The tax agency points out on its website that there’s one sure sign that the person who says they’re from the IRS is in fact a scammer: “The IRS doesn't initiate contact with taxpayers by email, text messages or social media channels to request personal or financial information.
This includes requests for PIN numbers, passwords or similar access information for credit cards, banks or other financial accounts.” So if you’ve been contacted out of the blue by someone who says you owe taxes, that you might be about to arrested, or that the Government needs your bank account credentials, it’s fraud.
A threat to an individual is also a threat to that individual’s organization, and businesses and other organizations also deal with the IRS and other Government bodies. This kind of impersonation scam can be easily avoided, especially if an organization takes the trouble to offer its employees new-school social engineering awareness training. The IRS website has full details on phishing here:
https://www.irs.gov/privacy-disclosure/report-phishing
What KnowBe4 Customers Say
"Dear Michael, Tiffany, it was such a pleasure to work with both of you this year that I’m sending this note to not only you, our the executive and security teams that helped assess and approve your platform – thank you for the wonderful experience! :-)
First, thank you for all your time and efforts working with me since May. The two of you always made an effort to explain the value of security awareness training and your solution in a meaningful manner, take care to understand my questions or concerns, and address them honestly and directly. It’s only recently that I realized that our conversations greatly helped me distill the vague uneasiness I had surrounding our cybersecurity posture into something I could convey and discuss with my peers and leadership.
Second, the space (read: silence) provided me to perform our due diligence research was lovely. After our initial round of conversations was lovely, and allowed me to as we performed our due diligence and research was lovely.
Following our initial round of conversations, Michael respected my request for time to review alternative approaches or solutions, and was very good at reaching out just often enough to remind me that KnowBe4 is available to address any questions or concerns, but never in a manner or frequently enough to cause me annoyance or anxiety, a gesture I really, really appreciated.
Third, I appreciate the time you spent throughout December as I finalized my proposal. You were quick to help me with my remaining concerns and questions, including providing honest feedback on implementation and ongoing admin efforts.
All in all, please consider our extended assessment of your product as a sign that we are committed to deploying it right! As a sign that things are off to a good start, the LMS Team is already really looking forwarding to implementing KnowBe4’s product into our Quality System. Cheers to a new relationship and a more cyber-secure 2020! Sincerely yours,"
- P.A., Senior ICS Solutions Architect
"Dear Michael, Tiffany, it was such a pleasure to work with both of you this year that I’m sending this note to not only you, our the executive and security teams that helped assess and approve your platform – thank you for the wonderful experience! :-)
First, thank you for all your time and efforts working with me since May. The two of you always made an effort to explain the value of security awareness training and your solution in a meaningful manner, take care to understand my questions or concerns, and address them honestly and directly. It’s only recently that I realized that our conversations greatly helped me distill the vague uneasiness I had surrounding our cybersecurity posture into something I could convey and discuss with my peers and leadership.
Second, the space (read: silence) provided me to perform our due diligence research was lovely. After our initial round of conversations was lovely, and allowed me to as we performed our due diligence and research was lovely.
Following our initial round of conversations, Michael respected my request for time to review alternative approaches or solutions, and was very good at reaching out just often enough to remind me that KnowBe4 is available to address any questions or concerns, but never in a manner or frequently enough to cause me annoyance or anxiety, a gesture I really, really appreciated.
Third, I appreciate the time you spent throughout December as I finalized my proposal. You were quick to help me with my remaining concerns and questions, including providing honest feedback on implementation and ongoing admin efforts.
All in all, please consider our extended assessment of your product as a sign that we are committed to deploying it right! As a sign that things are off to a good start, the LMS Team is already really looking forwarding to implementing KnowBe4’s product into our Quality System. Cheers to a new relationship and a more cyber-secure 2020! Sincerely yours,"
- P.A., Senior ICS Solutions Architect
The 10 Interesting News Items This Week
- How Iran's Hackers Might Strike Back After Soleimani's Assassination:
https://www.wired.com/story/iran-soleimani-cyberattack-hackers/ - Intense Phishing Attack Details. This is a good and *real* read!:
https://community.spiceworks.com/topic/2249765-intense-phishing-attack-details - Tech Chiefs Plan to Boost Cybersecurity Spending - The Wall Street Journal
https://www.wsj.com/articles/tech-chiefs-plan-to-boost-cybersecurity-spending-11577701802? - Why Customers Don't Buy Cybersecurity Vendor Claims:
https://www.infosecurity-magazine.com/infosec/why-customers-dont-buy/ - KnowBe4 Has A Blow-Out 2019 Fourth Quarter:
https://blog.knowbe4.com/knowbe4-has-a-blow-out-2019-fourth-quarter - Travel Continues To Be Impacted After RavnAir Group Experiences Cyber Attack On Dash 8 Aircraft:
https://www.kucb.org/post/travel-continues-be-impacted-after-ravnair-group-experiences-cyber-attack-dash-8-aircraft#stream/0 - Celebrity addresses posted online in New Year’s Honours List leak:
https://nakedsecurity.sophos.com/2019/12/30/celebrity-addresses-posted-online-in-new-years-honours-list-leak/ - Hackers keep dumping Ring credentials online 'for the giggles':
https://www.zdnet.com/article/hackers-keep-dumping-ring-credentials-online-for-the-giggles/ - Sextortionists return for Christmas – price goes down, threats go up:
https://nakedsecurity.sophos.com/2019/12/24/sextortionists-return-for-christmas-price-goes-down-threats-go-up/ - Clop Ransomware Now Kills Windows 10 Apps and 3rd Party Tools:
https://www.bleepingcomputer.com/news/security/clop-ransomware-now-kills-windows-10-apps-and-3rd-party-tools/
Cyberheist 'Fave' Links
This Week's Links We Like, Tips, Hints and Fun Stuff
- MAD Penn And Teller Fooled By The Best Card Trick Of All Time. This one is FUN!:
https://www.youtube.com/watch?v=RnWCGwB7idc
- Whoa. Flying world's longest, fastest zip line in Ras al Khaimah, UAE. Now On My Bucket List!:
https://www.flixxy.com/worlds-longest-and-fastest-zip-line-ras-al-khaimah-uae.htm?utm_source=4
- Check out this Tesla powered 450 kW electric go-cart, insane power-to-weight ratio!:
https://electrek.co/2020/01/02/tesla-powered-450-kw-electric-race-car/
- Swiss Police And Star Wars - Stormtrooper Gets A Parking Ticket:
https://www.flixxy.com/swiss-police-and-star-wars-stromtrooper-gets-a-parking-ticket.htm?utm_source=4
- This Japanese cosplayer is so popular she has a phenomenon named after her:
https://sea.mashable.com/culture/8343/this-japanese-cosplayer-is-so-popular-she-has-a-phenomenon-named-after-her
- Linus Tech Tips just used KnowBe4's RanSim in a YouTube video:
https://www.youtube.com/watch?v=cg4rfeX4m_E
- NASA 2020: Are You Ready? They list all their exciting projects. Really cool stuff:
https://www.youtube.com/watch?v=mB1nAzriqRQ
- SpaceX Crew Dragon Animation how they carry astronauts to and from the International Space Station:
https://www.youtube.com/watch?v=sZlzYzyREAI
- How Machine Learning Drives the Deceptive World of Deepfakes:
https://www.youtube.com/watch?v=gsv1OsCEad0
- For The Kids #1: Smartest most conversational parrot ever. Petra the home automation expert, African grey:
https://www.youtube.com/watch?v=ewptevBIqNk - For The Kids #2: A persistent little mouse trying to lift up a cracker almost twice its size:
https://www.flixxy.com/never-give-up-mouse-vs-cracker.htm?utm_source=4
