CyberheistNews Vol 10 #33
[Heads Up] Explosion of Zoom Meeting Phishing Attacks Targeting O365 and Outlook 
Researchers at INKY have observed an explosion of Zoom-themed phishing attacks over the Spring and Summer of 2020. Most of the attacks are aimed at stealing credentials to services like Outlook and Office 365 by directing users to spoofed login pages.
The researchers say they’ve observed the emails being sent from legitimate, compromised accounts as well as convincing spoofed domains. “At INKY, most of the Zoom impersonator phishing emails we have seen came from hijacked accounts, but we also saw newly created domain names like zoomcommuncations[.]com and zoomvideoconfrence[.]com,” they write.
“As disturbing as that is, it’s also what makes these fake meeting invitations so easy to fall for and so difficult for traditional Secure Email Gateways (SEGs) to catch.”
Additionally, the attackers are using obfuscation and other techniques that make it more difficult for security systems to detect their phishing pages. “If the hacker includes a fake attachment, it leads to a fake login page that’s locally hosted on the recipient’s computer, not the internet,” the researchers write.
“To make matters worse, the HTML, JavaScript, and PHP code is usually encoded so it’s unreadable to humans and automated security tools. It’s a clever way to remain undetectable and evade URL reputation checkers. Similarly, if the hacker includes a malicious link, these redirect to a fake login that’s hosted on a compromised server or a hosting service the attacker paid for.”
INKY provides a number of screenshots of some of the spoofed websites, and they appear identical to the legitimate login portals for Outlook and Office 365. In the Outlook example, the site’s URL was “owa-mail-auth[.]web[.]app,” which could fool even someone who had been trained to scrutinize URLs.
Attackers are constantly taking steps to improve the reach and effectiveness of their phishing campaigns. New-school security awareness training enables your employees to avoid falling for these attacks, even if the phishing sites appear perfectly convincing.
Blog Post with links:
https://blog.knowbe4.com/explosion-of-zoom-meeting-phishing-attacks-over-spring-and-summer-of-2020-and-targeting-office365-and-outlook-credentials
Researchers at INKY have observed an explosion of Zoom-themed phishing attacks over the Spring and Summer of 2020. Most of the attacks are aimed at stealing credentials to services like Outlook and Office 365 by directing users to spoofed login pages.
The researchers say they’ve observed the emails being sent from legitimate, compromised accounts as well as convincing spoofed domains. “At INKY, most of the Zoom impersonator phishing emails we have seen came from hijacked accounts, but we also saw newly created domain names like zoomcommuncations[.]com and zoomvideoconfrence[.]com,” they write.
“As disturbing as that is, it’s also what makes these fake meeting invitations so easy to fall for and so difficult for traditional Secure Email Gateways (SEGs) to catch.”
Additionally, the attackers are using obfuscation and other techniques that make it more difficult for security systems to detect their phishing pages. “If the hacker includes a fake attachment, it leads to a fake login page that’s locally hosted on the recipient’s computer, not the internet,” the researchers write.
“To make matters worse, the HTML, JavaScript, and PHP code is usually encoded so it’s unreadable to humans and automated security tools. It’s a clever way to remain undetectable and evade URL reputation checkers. Similarly, if the hacker includes a malicious link, these redirect to a fake login that’s hosted on a compromised server or a hosting service the attacker paid for.”
INKY provides a number of screenshots of some of the spoofed websites, and they appear identical to the legitimate login portals for Outlook and Office 365. In the Outlook example, the site’s URL was “owa-mail-auth[.]web[.]app,” which could fool even someone who had been trained to scrutinize URLs.
Attackers are constantly taking steps to improve the reach and effectiveness of their phishing campaigns. New-school security awareness training enables your employees to avoid falling for these attacks, even if the phishing sites appear perfectly convincing.
Blog Post with links:
https://blog.knowbe4.com/explosion-of-zoom-meeting-phishing-attacks-over-spring-and-summer-of-2020-and-targeting-office365-and-outlook-credentials
[Live Demo] Ridiculously Easy Security Awareness Training and Phishing
Old-school awareness training does not hack it anymore. Your email filters have an average 7-10% failure rate; you need a strong human firewall as your last line of defense.
Join us TOMORROW, Wednesday, August 12 @ 2:00 pm (ET), for a live demonstration of how KnowBe4 introduces a new-school approach to security awareness training and simulated phishing.
Get a first look at new features and see how easy it is to train and phish your users:
Date/Time: TOMORROW, Wednesday, August 12 @ 2:00 pm (ET)
Save My Spot!
https://event.on24.com/wcc/r/2546182/891B9A9B20586860079CBE2E0F461430?partnerref=CHN2
Old-school awareness training does not hack it anymore. Your email filters have an average 7-10% failure rate; you need a strong human firewall as your last line of defense.
Join us TOMORROW, Wednesday, August 12 @ 2:00 pm (ET), for a live demonstration of how KnowBe4 introduces a new-school approach to security awareness training and simulated phishing.
Get a first look at new features and see how easy it is to train and phish your users:
- NEW! AI Recommended training suggestions based on your users’ phishing security test results.
- NEW! Brandable Content feature gives you the option to add branded custom content to select training modules.
- Train your users with access to the world's largest library of 1000+ pieces of awareness training content.
- Send fully automated simulated phishing attacks, including thousands of customizable templates with unlimited usage.
- Assessments allows you to find out where your users are in both security knowledge and security culture to help establish baseline security metrics you can improve over time.
- Advanced Reporting on 60+ key awareness training indicators.
- Active Directory Integration to easily upload user data, eliminating the need to manually manage user changes.
Date/Time: TOMORROW, Wednesday, August 12 @ 2:00 pm (ET)
Save My Spot!
https://event.on24.com/wcc/r/2546182/891B9A9B20586860079CBE2E0F461430?partnerref=CHN2
The Scariest Things We Saw at Black Hat 2020
Our longtime friend Neil Rubenking wrote: "The ongoing COVID-19 pandemic in the US knocked a lot of security conferences offline—or rather, it knocked them to online-only. This year, both Black Hat and DEF CON (along with HOPE 2020 and others) used live and prerecorded video coupled with chat platforms.
It worked out surprisingly well and could be a pattern for other gatherings to follow. That said, the experience lacked the fun of an in-person event, and it's hard to make time for a video session when you also have to walk the dog. Hopefully, 2021 will be a kinder year for everyone. Here are the scariest things we saw at Black Hat 2020."
https://www.pcmag.com/news/the-scariest-things-we-saw-at-black-hat-2020
And of course if you registered for Black Hat you can also see the KnowBe4 sessions we had there now On Demand:
https://www.knowbe4.com/black-hat
Our longtime friend Neil Rubenking wrote: "The ongoing COVID-19 pandemic in the US knocked a lot of security conferences offline—or rather, it knocked them to online-only. This year, both Black Hat and DEF CON (along with HOPE 2020 and others) used live and prerecorded video coupled with chat platforms.
It worked out surprisingly well and could be a pattern for other gatherings to follow. That said, the experience lacked the fun of an in-person event, and it's hard to make time for a video session when you also have to walk the dog. Hopefully, 2021 will be a kinder year for everyone. Here are the scariest things we saw at Black Hat 2020."
https://www.pcmag.com/news/the-scariest-things-we-saw-at-black-hat-2020
And of course if you registered for Black Hat you can also see the KnowBe4 sessions we had there now On Demand:
https://www.knowbe4.com/black-hat
Top CISOs Say Security Awareness Training for Employees Is Top Priority
Steve Morgan at Cybercrime Magazine said: "Training employees how to recognize and defend against cyberattacks has long been the most underspent sector of the cybersecurity industry. But we’re in the midst of a sea change that is predicted to result in a $10 billion market by 2027.
Progressive CISOs at the largest companies in the U.S. are pushing hard for more employee security awareness training and phishing simulation programs. Nine of them opened up to Cybercrime Magazine on humans being the weak link in the cyber defense chain, and the need to build a security-aware culture.
“Security leaders, in general, know that the human side of things is critical to consider when it comes to the overall security posture of their company,” says Perry Carpenter, chief evangelist and strategy officer at KnowBe4.
But shockingly, not every Fortune 500 and Global 2000 company has a full-time security awareness training manager, according to Carpenter. For some organizations, the responsibilities fall on the shoulders of security personnel who are burdened with other tasks. While we’re not yet in an ideal place, Carpenter says that large enterprises are definitely moving in the right direction."
Check out what CISOs at State Street, Mastercard, Northwell Health, Standard Industries, Microsoft, Delta Airlines, IBM, S&P Global and HP have to say about it:
http://cybersecurityventures.com/cisos-say-security-awareness-training-for-employees-is-top-priority/
Steve Morgan at Cybercrime Magazine said: "Training employees how to recognize and defend against cyberattacks has long been the most underspent sector of the cybersecurity industry. But we’re in the midst of a sea change that is predicted to result in a $10 billion market by 2027.
Progressive CISOs at the largest companies in the U.S. are pushing hard for more employee security awareness training and phishing simulation programs. Nine of them opened up to Cybercrime Magazine on humans being the weak link in the cyber defense chain, and the need to build a security-aware culture.
“Security leaders, in general, know that the human side of things is critical to consider when it comes to the overall security posture of their company,” says Perry Carpenter, chief evangelist and strategy officer at KnowBe4.
But shockingly, not every Fortune 500 and Global 2000 company has a full-time security awareness training manager, according to Carpenter. For some organizations, the responsibilities fall on the shoulders of security personnel who are burdened with other tasks. While we’re not yet in an ideal place, Carpenter says that large enterprises are definitely moving in the right direction."
Check out what CISOs at State Street, Mastercard, Northwell Health, Standard Industries, Microsoft, Delta Airlines, IBM, S&P Global and HP have to say about it:
http://cybersecurityventures.com/cisos-say-security-awareness-training-for-employees-is-top-priority/
See How You Can Get Audits Done in Half the Time at Half the Cost
You told us you have challenging compliance requirements, not enough time to get audits done, and keeping up with risk assessments and third-party vendor risk is a continuous problem.
KCM GRC is a SaaS-based platform that includes Compliance, Risk, Policy and Vendor Risk Management modules. KCM was developed to save you the maximum amount of time getting GRC done.
Join us TOMORROW, Wednesday, August 12 @ 1:00 PM (ET), for a 30-minute live product demonstration of KnowBe4's KCM GRC platform. Plus, get a first look at brand new compliance management features we’ve added to make managing your compliance projects even easier!
Save My Spot!
https://event.on24.com/wcc/r/2546167/CF9D29AD88F0EB04FED00E78E352B927?partnerref=CHN2
You told us you have challenging compliance requirements, not enough time to get audits done, and keeping up with risk assessments and third-party vendor risk is a continuous problem.
KCM GRC is a SaaS-based platform that includes Compliance, Risk, Policy and Vendor Risk Management modules. KCM was developed to save you the maximum amount of time getting GRC done.
Join us TOMORROW, Wednesday, August 12 @ 1:00 PM (ET), for a 30-minute live product demonstration of KnowBe4's KCM GRC platform. Plus, get a first look at brand new compliance management features we’ve added to make managing your compliance projects even easier!
- NEW! Control guidance feature provides in-platform suggestions to help you create controls to meet your specific scopes and requirements.
- NEW! Assign additional users as approving managers to review task evidence before a task is closed with tiered-level approvals.
- Vet, manage and monitor your third-party vendors' security risk requirements.
- Simplify risk management with an intuitive interface and simple workflow based on the well-recognized NIST 800-30.
- Quick implementation with pre-built requirements templates for the most widely used regulations.
- Dashboards with automated reminders to quickly see what tasks have been completed, not met, and past due.
Save My Spot!
https://event.on24.com/wcc/r/2546167/CF9D29AD88F0EB04FED00E78E352B927?partnerref=CHN2
BOOK OF THE WEEK: "Messing With the Enemy"
I am thoroughly enjoying "Messing with the Enemy: Surviving in a Social Media World of Hackers, Terrorists, Russians, and Fake News" written by Clint Watts. He is an extremely skilled (and funny) social engineer. The book has tons of examples. Here is the Amazon blurb and it's a Stu's Warmly Recommended.
"A former FBI Special Agent and leading cyber-security expert offers a devastating and essential look at the misinformation campaigns, fake news, and electronic espionage operations that have become the cutting edge of modern warfare—and how we can protect ourselves and our country against them."
Here is the link to Amazon Kindle (note we are not an Amazon affiliate):
https://www.amazon.com/Messing-Enemy-Surviving-Terrorists-Russians-ebook/dp/B07S2WQWBZ/
And here are two recent examples of the disinformation campaigns out there in the wild that are used for clickbait:
I am thoroughly enjoying "Messing with the Enemy: Surviving in a Social Media World of Hackers, Terrorists, Russians, and Fake News" written by Clint Watts. He is an extremely skilled (and funny) social engineer. The book has tons of examples. Here is the Amazon blurb and it's a Stu's Warmly Recommended.
"A former FBI Special Agent and leading cyber-security expert offers a devastating and essential look at the misinformation campaigns, fake news, and electronic espionage operations that have become the cutting edge of modern warfare—and how we can protect ourselves and our country against them."
Here is the link to Amazon Kindle (note we are not an Amazon affiliate):
https://www.amazon.com/Messing-Enemy-Surviving-Terrorists-Russians-ebook/dp/B07S2WQWBZ/
And here are two recent examples of the disinformation campaigns out there in the wild that are used for clickbait:
- "US Officials: Russia Behind Spread of Virus Disinformation":
https://www.voanews.com/covid-19-pandemic/us-officials-russia-behind-spread-virus-disinformation
- Russia Working to Damage Biden’s White House Bid, Spy Agencies Say - The WSJ:
https://www.wsj.com/articles/russia-working-to-damage-joe-bidens-white-house-bid-u-s-intelligence-agencies-say-11596827109
The Best Ways to Stop Malware and Ransomware That No One Else Will Tell You
With malware attacks on the rise, making sure you keep your organization safe from a costly breach is a top priority. The two best things you can do to stop malware and ransomware attacks are to figure out how malware is getting by your defenses and for how long. Your current antivirus vendor isn’t going to tell you the answers to either of these. But Roger Grimes, Data-Driven Defense Evangelist at KnowBe4, will.
Join Roger on Wednesday, August 19th at 2:00 PM (ET) as he dives into the best ways to stop malware dead in its tracks using real-life methods no one else is talking about.
He’ll show you:
Date/Time: Wednesday, August 19 @ 2:00 PM (ET)
Save My Spot!
https://event.on24.com/wcc/r/2565530/8BE140382E584C38A8E0C6B83F8A608F?partnerref=CHN1
Let's stay safe out there.
With malware attacks on the rise, making sure you keep your organization safe from a costly breach is a top priority. The two best things you can do to stop malware and ransomware attacks are to figure out how malware is getting by your defenses and for how long. Your current antivirus vendor isn’t going to tell you the answers to either of these. But Roger Grimes, Data-Driven Defense Evangelist at KnowBe4, will.
Join Roger on Wednesday, August 19th at 2:00 PM (ET) as he dives into the best ways to stop malware dead in its tracks using real-life methods no one else is talking about.
He’ll show you:
- The two best questions to ask to prevent malware and ransomware
- The most common ways malware gets around your defenses
- A live malware demonstration and how you can prevent it immediately
- Step-by-step action plans you can start implement now
- How to enable your end users to become your best, last line of defense
Date/Time: Wednesday, August 19 @ 2:00 PM (ET)
Save My Spot!
https://event.on24.com/wcc/r/2565530/8BE140382E584C38A8E0C6B83F8A608F?partnerref=CHN1
Let's stay safe out there.
Warm Regards,
Stu Sjouwerman
Founder and CEO
KnowBe4, Inc
Quotes of the Week
"Don't find fault, find a remedy."
- Henry Ford, Industrialist (1863 - 1947)
"Don't ever become a pessimist... a pessimist is correct oftener than an optimist, but an optimist has more fun, and neither can stop the march of events."
- Robert A. Heinlein, Sci-Fi Writer (1907 - 1988)
Thanks for reading CyberheistNews
- Henry Ford, Industrialist (1863 - 1947)
"Don't ever become a pessimist... a pessimist is correct oftener than an optimist, but an optimist has more fun, and neither can stop the march of events."
- Robert A. Heinlein, Sci-Fi Writer (1907 - 1988)
Thanks for reading CyberheistNews
Security News
Social Engineering on the Dead Tree Platform
Scammers are using snail mail to draw people into scams more commonly associated with Nigerian 419 scam emails, Graham Cluley reports. Cluley presents a letter that one of his readers received in the mail, which was customized to contain the name of the person it was addressed to.
“My name is Wai Fei, and I write today to discuss the unclaimed inheritance of 11 million USD,” the letter says. “At this point, I must ask that you deal with this matter with highest discretion, as the content of this letter is not trivial.
I am sending this letter with confidential internet local auto-mailer service. In 2004, a person with whom you share common name; Mr [name redacted] invested funds with the Hong Kong investment house I work with. During the time, we spread the funds across diverse local opportunities to make significant returns.”
The letter then explains that the recipient stands to make $11 million (or $5.5 million, if they plan on upholding their end of the bargain).
“In 2005, he instructed that the initial sum ($11m) be liquidated for a cash investment in Beijing,” it says. “For this we contacted the mainland Shengjing Bank, to convey the money for a cash delivery. Only last year, the Shengjing Bank disclosed that the money remains unclaimed. Upon investigations, we discovered that Mr [name redacted] died in Jiangxi shortly after transfer was made.
Graham Cluley has the story:
https://grahamcluley.com/a-scam-letter-warn-your-vulnerable-loved-ones-to-be-on-their-guard/
Scammers are using snail mail to draw people into scams more commonly associated with Nigerian 419 scam emails, Graham Cluley reports. Cluley presents a letter that one of his readers received in the mail, which was customized to contain the name of the person it was addressed to.
“My name is Wai Fei, and I write today to discuss the unclaimed inheritance of 11 million USD,” the letter says. “At this point, I must ask that you deal with this matter with highest discretion, as the content of this letter is not trivial.
I am sending this letter with confidential internet local auto-mailer service. In 2004, a person with whom you share common name; Mr [name redacted] invested funds with the Hong Kong investment house I work with. During the time, we spread the funds across diverse local opportunities to make significant returns.”
The letter then explains that the recipient stands to make $11 million (or $5.5 million, if they plan on upholding their end of the bargain).
“In 2005, he instructed that the initial sum ($11m) be liquidated for a cash investment in Beijing,” it says. “For this we contacted the mainland Shengjing Bank, to convey the money for a cash delivery. Only last year, the Shengjing Bank disclosed that the money remains unclaimed. Upon investigations, we discovered that Mr [name redacted] died in Jiangxi shortly after transfer was made.
Graham Cluley has the story:
https://grahamcluley.com/a-scam-letter-warn-your-vulnerable-loved-ones-to-be-on-their-guard/
Focus on the Underlying Behavior
Identifying malicious behavior is a more effective long-term strategy than trying to block individual malicious actors, according to Johnathan Hunt, Vice President of Security at GitLab. On the CyberWire’s Hacking Humans podcast, Hunt used the example of trying to stamp out malicious activity, particularly cryptojacking, that cropped up in GitLab code repositories.
“For probably several years in my career, I noticed that the operational team that would lead would attack the bad actors, whether it was through trying to block IP addresses, whether it was just trying to block the specific activity that they were trying to do or exploit, the scans they were running,” Hunt said. “And then we would continue to see the same behavior over and over – whether it came from different IP addresses, whether it seemed to come from different types of profiles, whether it came from different areas within the service itself or the application itself.
You're not going to win playing defense
And we quickly realized that that's a losing battle. Like, you're not going to win playing defense.” Hunt said he realized that this strategy was ineffective, so he switched to looking at the behavior itself.
“And so it was at that time my philosophy had changed to, we should ignore the person, and we should go after the behavior,” he said. “We should go after the activity. We should be looking at what it is that they're trying to do, what - the control they're trying to circumvent, the types of attacks that they're using, the areas of the application that they're looking to expose.
And how can we address the problem? How can we get to the root of the problem and address that behavior within the product or service that we're offering?”
Hunt’s organization then created tools that could automatically detect and block cryptomining activity based on its underlying characteristics, rather than manually hunting down every user who abused the platform. Hunt also noted that focusing on behavior can help organizations defend against accidental or unexpected adverse events.
“And I also want to point out that it doesn't have to be malicious activity from the outside, although that's probably what you would think of first, right?” he said. “Mice are nuisances, right? So yes, we did have nuisances within our service.
We did have a nuisance from external forces interacting with our service, trying to exploit our platform, trying to compromise our services or customers. But it could also be internal behaviors that we're looking at, right? It doesn't always have to be malicious. It could be unintentional bad behavior that originates from employees, from the way we build services to the way that we code the platform or the application itself.”
One crucial area in which organizations can focus on defending against behavior is user education. New-school security awareness training can keep your employees up-to-date on current phishing trends, but more importantly, it can educate them about fundamental social engineering tactics so they can thwart new or unfamiliar attacks.
The CyberWire has the story:
https://www.thecyberwire.com/podcasts/hacking-humans/110/transcript
Identifying malicious behavior is a more effective long-term strategy than trying to block individual malicious actors, according to Johnathan Hunt, Vice President of Security at GitLab. On the CyberWire’s Hacking Humans podcast, Hunt used the example of trying to stamp out malicious activity, particularly cryptojacking, that cropped up in GitLab code repositories.
“For probably several years in my career, I noticed that the operational team that would lead would attack the bad actors, whether it was through trying to block IP addresses, whether it was just trying to block the specific activity that they were trying to do or exploit, the scans they were running,” Hunt said. “And then we would continue to see the same behavior over and over – whether it came from different IP addresses, whether it seemed to come from different types of profiles, whether it came from different areas within the service itself or the application itself.
You're not going to win playing defense
And we quickly realized that that's a losing battle. Like, you're not going to win playing defense.” Hunt said he realized that this strategy was ineffective, so he switched to looking at the behavior itself.
“And so it was at that time my philosophy had changed to, we should ignore the person, and we should go after the behavior,” he said. “We should go after the activity. We should be looking at what it is that they're trying to do, what - the control they're trying to circumvent, the types of attacks that they're using, the areas of the application that they're looking to expose.
And how can we address the problem? How can we get to the root of the problem and address that behavior within the product or service that we're offering?”
Hunt’s organization then created tools that could automatically detect and block cryptomining activity based on its underlying characteristics, rather than manually hunting down every user who abused the platform. Hunt also noted that focusing on behavior can help organizations defend against accidental or unexpected adverse events.
“And I also want to point out that it doesn't have to be malicious activity from the outside, although that's probably what you would think of first, right?” he said. “Mice are nuisances, right? So yes, we did have nuisances within our service.
We did have a nuisance from external forces interacting with our service, trying to exploit our platform, trying to compromise our services or customers. But it could also be internal behaviors that we're looking at, right? It doesn't always have to be malicious. It could be unintentional bad behavior that originates from employees, from the way we build services to the way that we code the platform or the application itself.”
One crucial area in which organizations can focus on defending against behavior is user education. New-school security awareness training can keep your employees up-to-date on current phishing trends, but more importantly, it can educate them about fundamental social engineering tactics so they can thwart new or unfamiliar attacks.
The CyberWire has the story:
https://www.thecyberwire.com/podcasts/hacking-humans/110/transcript
What KnowBe4 Customers Say
"Shannon, trust me when I say, we will NEVER be without KB4 again. Just yesterday one of my senior attorneys said she was in a webinar where they were discussing how Twitter was recently hacked and how they culprits got in, and she yelled, “I know all about this! I’ve learned about don’t pick up strange USB’s, don’t let strange people in the office to walk around, don’t click Willy Nilly on anything I’m not expecting!”
She said that it’s a kudos to me for protecting our firm and forcing everyone to learn. So BIG HUGE thank you to you guys over at KB4 for creating this and making it easy for me to deploy and teach. Feel free to copy and paste this and send it out to your entire company. You CAN teach an old seasoned dog professional new tricks."
- S.S., Manager Information Technology
"Shannon, trust me when I say, we will NEVER be without KB4 again. Just yesterday one of my senior attorneys said she was in a webinar where they were discussing how Twitter was recently hacked and how they culprits got in, and she yelled, “I know all about this! I’ve learned about don’t pick up strange USB’s, don’t let strange people in the office to walk around, don’t click Willy Nilly on anything I’m not expecting!”
She said that it’s a kudos to me for protecting our firm and forcing everyone to learn. So BIG HUGE thank you to you guys over at KB4 for creating this and making it easy for me to deploy and teach. Feel free to copy and paste this and send it out to your entire company. You CAN teach an old seasoned dog professional new tricks."
- S.S., Manager Information Technology
"Hi Stu, What an amazing company you have. First off, you have an excellent product. At first, I thought the staff would reject it and find it invasive to their workday. I'm finding just the opposite. People are more than happy to learn new ways to protect themselves and our network from the "bad guys".
Second, you have amazing employees. Everyone that has helped me with this client as well as another client that I have, always are friendly, informative, and helpful. They are patient beyond belief. And now I received the book "A Data-Driven Computer Security Defense" in the mail today. I haven't even started reading it yet but I'm excited to.
Thank you so much for sending it. As with all your emails that you send, this will be another tool to help me protect the network and its data. Thank you very much!!! In my eyes, you are doing everything right."
- S.E., Contracted IT Support
Second, you have amazing employees. Everyone that has helped me with this client as well as another client that I have, always are friendly, informative, and helpful. They are patient beyond belief. And now I received the book "A Data-Driven Computer Security Defense" in the mail today. I haven't even started reading it yet but I'm excited to.
Thank you so much for sending it. As with all your emails that you send, this will be another tool to help me protect the network and its data. Thank you very much!!! In my eyes, you are doing everything right."
- S.E., Contracted IT Support
The 11 Interesting News Items This Week
- How to Survive a Ransomware Attack Without Paying the Ransom. Norsk Hydro Case Study at Bloomberg:
https://www.bloomberg.com/news/features/2020-07-23/how-to-survive-ransomware-attack-without-paying-ransom - Here is an example of quite surprising Ransomware customer service:
https://twitter.com/jc_stubbs/status/1289199296328298497 - 10 tips for cybersecurity awareness programs in uncertain times:
https://searchsecurity.techtarget.com/feature/10-tips-for-cybersecurity-awareness-programs-in-uncertain-times - Less Than Half of Security Pros Can Identify Their Organization's Level of Risk:
https://www.darkreading.com/risk/less-than-half-of-security-pros-can-identify-their-organizations-level-of-risk-/d/d-id/1338577 - Pen Testers Who Got Arrested Doing Their Jobs Tell All:
https://www.darkreading.com/vulnerabilities---threats/pen-testers-who-got-arrested-doing-their-jobs-tell-all/d/d-id/1338570 - Tech workforce in defense and aerospace targeted in latest phishing attack:
https://www.mcafee.com/blogs/other-blogs/mcafee-labs/operation-north-star-a-job-offer-thats-too-good-to-be-true/ - Hackers Dump 20GB of Intel’s Confidential Data Online:
https://threatpost.com/hackers-dump-20gb-of-intels-confidential-data-online/158178/ - Interpol warns of 'alarming rate' of cyberattacks amid pandemic:
https://www.upi.com/Top_News/World-News/2020/08/05/Interpol-warns-of-alarming-rate-of-cyberattacks-amid-pandemic/7621596611530/ - Ransomware: The tricks used by WastedLocker to make it one of the most dangerous cyber threats:
https://www.zdnet.com/article/ransomware-the-tricks-used-by-wastedlocker-to-make-it-one-of-the-most-dangerous-cyber-threats/ - DHS Urges 'Highest Priority' Attention on Old Chinese Malware Threat:
https://www.darkreading.com/attacks-breaches/dhs-urges-highest-priority-attention-on-old-chinese-malware-threat/ - BONUS An article in Entrepreneur by yours truly: "Why Active Listening Is a Critical Skill for Founders and Entrepreneurs" (and any professional really):
https://www.entrepreneur.com/article/354104
Cyberheist 'Fave' Links
This Week's Links We Like, Tips, Hints and Fun Stuff
- Your virtual Vacation: Secrets of Himalaya, Pure, Calm, Peaceful Nepal in 4K:
https://www.flixxy.com/secrets-of-himalaya-nepal-in-4k.htm?utm_source=4 - Your second virtual Vacation: BMX Riding Dubai's Most Famous Landmarks with Kriss Kyle:
https://www.youtube.com/watch?v=0y04vdZvmag - Celebrating the very best video submissions from Awesome People this week!:
https://www.flixxy.com/people-are-awesome-best-of-the-week-87.htm?utm_source=4 - And another Compilation of The Very Best People Are Awesome of 2018. Wow:
https://www.youtube.com/watch?v=Cn2bMLNMiFk - "Starship SN5 150-meter Hop" For size, think Grain Silo!:
https://youtu.be/s1HA9LlFNM0 - Watch The NASA astronauts' dramatic return to Earth on SpaceX capsule in 6 minutes:
https://m.youtube.com/watch?v=Kb1pxn1FoXw - The Jeep Gladiator 6x6 With Corvette Engine Looks Apocalyptic. I want one:
https://www.motor1.com/news/437221/jeep-gladiator-6x6-pickup-truck/ - How the Mansion in Oscar Award-winning Korean Movie ‘Parasite’ Was Made:
https://www.youtube.com/watch?v=3y7Snqiah9M - This Might Be The Wildest Boat Race On Earth, the Red Bull Dinghy Derby 2016. Not for me!:
https://www.youtube.com/watch?v=SjNi3qPeOrg - Futuristic Mercedes Drives Sideways. Don't know how I missed this!:
https://youtu.be/Ii4HKg7hw18 - A little long but cool. Compilation of the best ship-launch videos:
https://www.youtube.com/watch?v=w4TdvOYuefg - For Da Kids #1 - Opera performed by animals, a CG short:
https://www.youtube.com/watch?v=fT-h6BDiV50
For Da Kids #2 - Dolphin Kisses Dog, Jumps For Joy!
https://www.youtube.com/watch?v=tdd93lspM6w - For Da Kids #3 - [FAVE] Bird Laughs Like Super-Villain
https://www.youtube.com/watch?v=YE8PTMSFMUg
