CyberheistNews Vol 13 #51 Phishing Is Still the No. 1 Attack Vector, With Huge 144% Malicious URL Spike

Phishing Is Still the No. 1 Attack Vector, With Huge 144% Malicious URL Spike

Analysis of nearly a year's worth of emails brings insight into exactly what kinds of malicious content are being used, who's being impersonated, and who's being targeted.

I love data built on statistically relevant data samples, as the larger the data set, the more relevant and representative of an entire industry, country or world it is.

One such report is Hornetsecurity's just released Cyber Security Report 2024. They analyzed 45 billion emails sent in 2023 to see exactly which techniques cybercriminals are using to infiltrate your network.

First, the seemingly "good" news: according to Hornetsecurity, only 3.6% of all emails were considered malicious. At first glance, this seems rather small. But when you consider that we're still talking about 1.6 billion emails that are putting organizations at risk, this is actually horrible news.

Phishing was the most common email-based attack method, representing 43.3% of attacks (other email attack methods included advanced-fee scams, extortion, impersonation, etc.). And within those emails, malicious URLs was the top technique used at 30.5% (a 144% growth from last year). For those emails with attachments, HTML files were most popular – found in 37.1% of cases.

Using a "threat index," Hornetsecurity listed the top 20 industries based on risk; research, entertainment, manufacturing, media and healthcare topped the list in this very interesting infographic. [link below]

Regardless of the specific technique(s) used, it takes a user falling for the social engineering used and engaging with a link, attachment, or phone number to keep an attack moving forward. By enrolling users in new-school security awareness training, organizations reduce that risk, thereby lowering the likelihood of successful attack via phishing.

KnowBe4 empowers your workforce to make smarter security decisions every day. Over 65,000 organizations worldwide trust the KnowBe4 platform to strengthen their security culture and reduce human risk.

Blog Post with links and infographic:
https://blog.knowbe4.com/phishing-remains-common-attack-technique

[NEW FEATURE] PhishER Plus and CrowdStrike Falcon Sandbox Integration

Now there's a new, super easy way to protect your users against malicious emails through the power of KnowBe4's PhishER Plus!

PhishER Plus gives you extremely effective capabilities:

Global PhishRIP, a cutting-edge email quarantine feature that automatically removes malicious email before your user is exposed to the threat, and Global Blocklist, an active global threat feed from over 10 million trained users for Microsoft 365.

These are real-world phishing threats, triple-vetted by humans and AI-validated. The result? Your Microsoft 365 email filters get a significant boost, all from within your PhishER console.

With the PhishER Plus and CrowdStrike Falcon Sandbox integration you can streamline your workflow to further analyze user-reported malicious emails without risking your organization's environment.

Join us for a live 30-minute demo of the Plus features of PhishER, the #1 Leader in the G2 Grid Report for SOAR Software.

With PhishER Plus you can:

• New! Use crowdsourced intelligence from more than 10 million users to block known threats before you're even aware of them
• New! Automatically isolate and "rip" malicious emails from your users' inboxes that have bypassed mail filters
• New! Simplify your workflow by analyzing links and attachments with the CrowdStrike Falcon Sandbox integration from a single console
• New! Leverage the expertise of the KnowBe4 Threat Research Lab to analyze tens of thousands of malicious emails reported by users around the globe per day
• Automate message prioritization by rules you set and cut through your incident response inbox noise to respond to the most dangerous threats quickly

Find out how adding PhishER Plus can be a huge time-saver for your Incident Response team while ensuring your users are safe!

Date/Time: TOMORROW, Wednesday, December 20, @ 2:00 PM (ET)

Save My Spot:
https://info.knowbe4.com/phisher-demo-3?partnerref=CHN2

WSJ: 'A Hidden Risk in the Municipal Bond Market: Hackers'

The Wall Street Journal has an interesting perspective on K-12 Public schools suffering ransomware attacks. The number doubles between 2021 and 2022 to almost 2,000 a year. Here are a few paragraphs with a link to the full article:

"Hacks are on the rise across all industries, but the public sector's weak protections make it an increasingly attractive target for cybercriminals. Cybercrime has left schools, hospitals and utilities from Baltimore to Los Angeles struggling to pay ransom, restore services and boost security. Finances have suffered, threatening credit ratings.

"The number of K-12 public schools suffering ransomware attacks almost doubled between 2021 and 2022 to almost 2,000 a year, according to a report by Emsisoft, a cybersecurity company. The growing use of technology in education, which was accelerated by the Covid-19 pandemic, as well as healthcare's reliance on IT infrastructure, has made schools and hospitals particularly vulnerable, according to analysts.

"This year alone, we've seen a lot more of these attacks compared to prior years, and it's a concern that has come up in almost every discussion that we have with issuers," said Li Yang, lead analyst at S&P Global Ratings.

"Cyberattacks on the Los Angeles Unified School District, the nation's second-largest school system, caused problems including the release of confidential student data. Superintendent Alberto M. Carvalho said officials convened a task force of cybersecurity experts to begin modernizing the district's technology. This year the school district sold hundreds of millions of dollars of debt and plans to use $72 million to secure its technology infrastructure, according to a spokesperson."

Read the full article here and forward this to your own network:

Blog post with links:
https://blog.knowbe4.com/wsj-a-hidden-risk-in-the-municipal-bond-market-hackers

Got (Bad) Email? IT Pros Are Loving This Tool: Mailserver Security Assessment

With email still a top attack vector, do you know if hackers can get through your mail filters? Spoofed domains, malicious attachments and executables to name a few...

Email filters have an average 7-10% failure rate where enterprise email security systems missed spam, phishing and malware attachments.

KnowBe4's Mailserver Security Assessment (MSA) is a complementary tool that tests your mailserver configuration by sending 40 different types of email message tests that check the effectiveness of your mail filtering rules.

Here's how it works:

• 100% non-malicious packages sent
• Select from 40 automated email message types to test against
• Saves you time! No more manual testing of individual email messages with MSA's automated send, test, and result status
• Validate that your current filtering rules work as expected
• Results in an hour or less!

Find out now if your mailserver is configured correctly, many are not!
https://info.knowbe4.com/mailserver-security-assessment-CHN

How To Fight Long-Game Social Engineering

By Roger Grimes.

CISA sent out a warning about a Russian advanced persistent threat (APT) called Star Blizzard warning about their long-game social engineering tactics.

They create fake email and social media accounts, contact their potential victims, talk about a non-threatening subject to gain the victim's confidence, and wait to launch their malicious attack. I call this long-game social engineering.

In the course of my 35-year computer security career, I have had the unfortunate opportunity to be the target of more than a few APT long-game social engineering campaigns from different nation-states; mostly from the Russians and Chinese, but I am sure other countries have tried.

I do not know why I have been targeted by professional nation-state hackers. Perhaps it is just a normal expectation after writing for decades on how to fight cybercrime. Perhaps it is because I have frequently publicly criticized various nation-states (e.g., Russia, China, Iran, Korea, etc.) for their cybercriminal activity.

Their crime today goes far beyond traditional nation-state activities, focusing on causing operational interruption of regular businesses, privacy invasions, and intellectual property theft.

Perhaps it is because I worked for Microsoft and other cybersecurity orgs in the past, and by compromising me, they can figure out what me or my organization is up to. I do not know. All I can tell is that for sure I have been targeted by multiple nation-state actors over the years (some identified in the press or by the Department of Justice later on).

I do not think I have ever successfully been compromised by them (although no one can disprove a negative). Most have been easy to spot. Some harder. Either way, when they begin asking me to click on links, open documents, or start asking me to talk about particular non-public vendor technologies, I get suspicious.

[CONTINUED] Blog post with links:
https://blog.knowbe4.com/fight-long-game-social-engineering

[Whitepaper] The Security Culture How-to Guide

Improving the security culture of your organization can seem daunting.

An entire culture sounds almost too big to influence. But influencing security culture is possible with the right plan, buy-in and content.

With the right culture supporting them, your users will be better equipped to identify potentially devastating cyber attacks and social engineering threats before they affect your network.

This how-to guide will walk you through how to build a step-by-step plan, helping you understand the fundamentals of security culture and what you can do to move the culture needle in your organization.

You'll learn:

• The fundamental ABCs of culture change and how each builds off each other
• A seven-step cycle for improving your security culture
• Advice and best practices for making the most out of each step in the process

Download this guide today!
https://info.knowbe4.com/wp-security-culture-how-to-guide-chn

You can read CyberheistNews online at our Blog
https://blog.knowbe4.com/cyberheistnews-vol-13-51-phishing-is-still-the-no-1-attack-vector-with-huge-144-percent-malicious-url-spike

How To Fight Long-Game Social Engineering

Researchers at Nisos warn that North Korean threat actors are impersonating skilled job seekers to obtain remote employment at U.S. companies.

"The identified personas claim to have highly sought-after technical skills and experience and often represent themselves as U.S.-based teleworkers, but Nisos investigators found indications that they are based abroad," the researchers write.

"Boasting expert-level skills in mobile and web-based applications as well as a number of programming languages, the personas also list significant remote work experience which can be difficult to verify. The personas further obfuscate their identities by impersonating U.S.-based individuals' identities and/or copying resume content from publicly visible profiles of unassociated individuals, further increasing the difficulty of identifying the personas."

The researchers note that the threat actors have crafted phony personas on job-seeking platforms.

"Nisos investigators found that although the personas are often active on professional networking sites, IT industry-specific freelance contracting platforms, software development platforms, and common messaging applications, they are usually not active on social media platforms," the researchers write.

"Nisos assesses that the accounts were created solely for the purpose of acquiring employment. Investigators found instances of several accounts, associated with a persona, using the same picture but different names; other accounts lacked profile photos. Investigators also found that many of the accounts are only active for a short period of time before they are disabled.

"Nisos assesses the accounts remained active only for a short period of time because they were created in support of an application for a specific position or were flagged for fraudulent behavior and removed by the platform provider."

Nisos explains that hiring these individuals is a violation of U.S. and UN sanctions, since they "provide a critical stream of revenue that helps fund the DPRK regime's highest economic and security priorities, such as its weapons development program, and may also leak intellectual property (IP) and other sensitive information to the DPRK."

Blog post with links:
https://blog.knowbe4.com/north-korean-operatives-infiltrate-job-platforms

Who's Calling? Spam, Scams and Wasted Time

First ever insight into those annoying spam calls provides enlightening detail into how many calls are there, where are they coming from, and how much time is wasted dealing with them.

It's sort of the new normal — never answer your phone if you don't know the caller and let it go to voicemail. Why? Because of the proliferation of spam calls that nobody wants to receive.

But just how bad is it? Global communications provider, Truecaller, released its' first Monthly U.S. Spam and Scam Report, and there are some interesting bits of detail that give you an idea of just how much effort is being put into these calls that are riddled with scams:

• Americans receive 2.1 billion spam calls each month
• The average American individually gets 5.6 spam calls a month
• The average spam call is 3.36 minutes long

What's interesting is where these come from. 90.7% of the calls originate from within the U.S. But of the other nearly 10% of calls, the majority of them (84.5%) originate in India.

I've written about Americans being scammed out of hundreds of millions of dollars by India-based call center scams. So the Truecaller data fits what we're seeing over here at KnowBe4.

These spam calls are scams. Individuals need to be made aware of the types of scams — similar to how users within an organization should be enrolled in new-school security awareness training. This will lower the effectiveness of these scams and thus undermine these cybercriminal organizations.

KnowBe4 empowers your workforce to make smarter security decisions every day. Over 65,000 organizations worldwide trust the KnowBe4 platform to strengthen their security culture and reduce human risk.

Blog post with links:
https://blog.knowbe4.com/calling-spam-scams-wasted-time

What KnowBe4 Customers Say

"Love the "not an automated email" which, would be even better, if that was part of the automated message. Regardless, ya we're doing well. Vanessa V. has been a stellar customer success manager. The offices are seeing value and I'm slowly but surely (with Vanessa's help), escalating the campaigns and looking at expanding to physical media tests etc. Thanks for the check in."

- D.D., Security Administrator

"Hi Stu, thank you for getting in touch, I'm pleased with KnowBe4 and we are utilizing phishing campaigns and training to enhance user awareness. I would like to express how fantastic [our CSM] Sarah has been - She's been incredibly helpful in resolving numerous inquiries. I truly appreciate her dedication and expertise in helping us navigate through various issues."

- A.Z. - Senior Security Engineer

1. Russian Cyber Actors are Exploiting a Known Vulnerability with Worldwide Impact:
   https://www.nsa.gov/Press-Room/Press-Releases-Statements/Press-Release-View/Article/3616384/russian-cyber-actors-are-exploiting-a-known-vulnerability-with-worldwide-impact/
   
   
2. White House Cyber Czar confirmed in Senate:
   https://therecord.media/harry-coker-confirmed-senate-national-cyber-director
   
   
3. Ukrainian Civilians Endure Combined Russian Missile- and Cyberattack that disrupts Mobile Phone, Internet, and Air-Raid System:
   https://arstechnica.com/security/2023/12/ukrainian-cells-and-internet-still-out-1-day-after-suspected-russian-cyberattack/?is=dfc2d22d39450dd63ab59ac76f872acea1dca69961d8ea16d6815219b3e327c8
   
   
4. Meet Taylor Swift's Pro-Russia "Disinformation Doppelganger":
   https://www.wired.com/story/russia-ukraine-taylor-swift-disinformation/
   
   
5. MITRE: New Threat Model Framework for Critical Infrastructure:
   https://www.mitre.org/news-insights/news-release/mitre-red-balloon-security-and-narf-announce-emb3d?is=dfc2d22d39450dd63ab59ac76f872acea1dca69961d8ea16d6815219b3e327c8
   
   
6. Washington Post: "China's cyber army is invading critical U.S. services":
   https://www.washingtonpost.com/technology/2023/12/11/china-hacking-hawaii-pacific-taiwan-conflict/
   
   
7. Police Arrest Hundreds of Human Traffickers Linked to Cyber Fraud:
   https://www.infosecurity-magazine.com/news/police-arrest-hundreds-human/
   
   
8. Microsoft disrupts cybercrime gang behind 750 million fraudulent accounts:
   https://www.bleepingcomputer.com/news/microsoft/microsoft-disrupts-cybercrime-gang-behind-750-million-fraudulent-accounts/
   
   
9. UK at high risk of 'catastrophic ransomware attack', Parliamentary committee report says:
   https://www.theguardian.com/technology/2023/dec/13/uk-at-high-risk-of-catastrophic-ransomware-attack-report-says
   
   
10. How a social engineering hack turned these Facebook pages into a dumping ground for spam:
    https://www.engadget.com/how-a-social-engineering-hack-turned-these-facebook-pages-into-a-dumping-ground-for-spam-143010079.html
    
    

• Virtual Vaca #1: My Solo Trip to Chicago - Holiday Lights & Sightseeing:
  https://youtu.be/Es9X1du3SVM
  
  
• Virtual Vaca #2 To The Past - 1902 at the Great Yorkshire Show at Leeds, UK:
  https://youtu.be/T02bvTwZODk
  
  
• There's a new bot in town. Check this out (until the very end)!:
  https://twitter.com/i/status/1734756150137225501
  
  
• Project ONE / A Milestone in Automotive History (Full Trailer):
  https://youtu.be/PucQxtBc6fI
  
  
• Dune: Part Two, Official Trailer 3:
  https://youtu.be/U2Qp5pL3ovA
  
  
• Put a Bow on It - Happy Holidays from Boston Dynamics:
  https://www.youtube.com/watch?v=Cdc5iVqjNVs
  
  
• Bryan Saint fools Penn & Teller AGAIN with a green folder and a Rubik's cube!:
  https://www.flixxy.com/bryan-saint-fools-penn-and-teller-again-with-a-green-folder-and-a-rubiks-cube.htm?utm_source=4
  
  
• Lockpicking Lawyer - Two Serious Flaws in the Hermex CL-60T:
  https://youtu.be/bfGr5f8TCUc
  
  
• The Secret Architecture of America's $1BN Fortress:
  https://youtu.be/2G-HdtbO4CI
  
  
• Did you know there is an Excel World Championship in "spreadsheeting"?:
  https://www.wsj.com/tech/microsoft-world-excel-championships-las-vegas-448c5f0b
  
  
• Most Canadians Live South of Seattle and Other Map Surprises:
  https://www.atlasobscura.com/articles/map-surprises-location-mistakes
  
  
• NASA Is Bringing Supersonic Planes BACK. Great for a 15-min break:
  https://youtu.be/2jAH-51feAA?si=6AAhbujVKK1qUJ4L
  
  
• Here's what it looks like inside a nuclear power plant:
  https://youtu.be/xHA3rI6bwpI
  
  
• Why Austin TX uses just one streetlight for a neighborhood?:
  https://youtu.be/LDiXNsWQzD0
  
  
• For Da Kids #1 - Attention Seeking Rottie Brings Woman Gifts To Win Her Heart:
  https://youtu.be/n034ieShVjk
  
  
• For Da Kids #2 - Woman Teaches Duckling to Walk:
  https://youtu.be/JKVHqOXn0hg
  
  
• For Da Kids #3 - Outgoing Tortoise Asks Strangers For Butt Scratches:
  https://youtu.be/QeaUpY1vJ7o
  
  
• For Da Kids #4 - Woman Is Best Friends With A 9-Foot Lemon Shark:
  https://youtu.be/OkwmDyltJfg
  
  
• For Da Kids #5 - Two Prairie Dogs Get on to Mischief in New Home:
  https://www.youtube.com/watch?v=J32eAAv7P6w