CyberheistNews Vol 6 #1 First Javascript-only Ransomware-as-a-Service Discovered

It is clear that a ransomware crime wave will surge across America and Canada. Here is what we expect will happen in 2016 and what you need to look out for:

1. Ransomware attacks doubled in 2015 and will double again in 2016. The U.K. is to some extent a bell-weather for the U.S. as they function as a beta test site for Eastern European cyber mafias who can test malicious code in their own time zone. Well, over half (54%) of all malware targeting UK users in 2015 contained some form of ransomware. Buckle up.
   
   
2. The use of Cryptowall 4.0 will explode, and Cryptowall V5.0 will add an actual working "feature" that the TeslaCrypt strain only threatened with: extortion by potentially publishing private personal or sensitive business files on the Internet.
   
   
3. Cryptowall will be the first strain of ransomware to hit a billion dollars in total damages.
   
   
4. Ransomware is the new APT: "Annoying Persistent Threat", as it will be increasingly used in double-payload attacks combined with other scams.
   
   
5. Ransomware-as-a-service hosted on the TOR network and using Bitcoin for ransom payment enables a new generation of cybercrime newbies to make their mark.
   
   
6. Cyber mafias will focus on professional services firms and local government using Cryptowall as their tool and extort tens of thousands of dollars from organizations that don't want their business disrupted or their intellectual property compromised.
   
   
7. A new sleeper ransomware variant will start to stealthily encrypt data, pull your critical files onto a C&C Server, and wait until a backup been made. At that point they will yank the encryption key and demand a much larger amount of ransom than the current 500 bucks.
   
   
8. Bonus Wild-Ass Guess: Ransomware gets bundled with worm-like malware to "brick" all the Windows endpoints and servers of a targeted organization. Cybercriminals will use this technique on a large scale, demanding millions in Bitcoins from their victims and may even offer "innovative" payment plans with protection terms.

Jerome Segura, a senior security researcher over at our friend Malwarebytes, reported a new, in-the-wild tech support scam that has moved from Amazon Web Services to Rackspace's managed cloud network. What it does is spread alarming popups ads that claim a site is infected and directs the reader to click on the ad for help.

Segura warned that this Amazon/Rackspace support scam is particularly tough for security software to recognize because it is more advanced than normal. "Some differences include caution to use anonymizer services, disabling Google indexing, and HTML code obfuscation of the scam page. In addition, the crooks managing these campaigns rely on those cloud services to frequently rotate IP addresses and point them to countless different domains and sub-domains," Segura told SCMagazine.com in an email Wednesday.

Not only are security pros given fits by this scam, but the general public is also more susceptible because they run directly in the browser and prey on people's well-founded computer security fears by displaying fake warnings.

"What makes it even more effective is the fact that the scam page triggers a continuous series of pop up alerts preventing the user from closing the page. Out of desperation, users may end up calling the 800 number to get the situation resolved," Segura said.

The next step has the victim being told by someone posing as a tech support person from a major company that for a fee they will fix the problem. Microsoft estimates that about 3.3 million people have fallen victim to scammers in 2015 and have paid out more than 1.5 billion dollars to the perpetrators.

Segura said Malwarebytes has reported the campaign to Rackspace for takedown and will continue tracking it to see where it goes next.

It is obvious that employees which have stepped through effective security awareness training will not fall for social engineering tricks like this. Find out how affordable this is for your organization and be pleasantly surprised.
https://info.knowbe4.com/kmsat_get_a_quote_now

Endgadget wrote: "As you might guess, infosec memes aren't as straightforward as Pizza Rat or Left Shark. That's because most of the time they run on one part inside joke and two parts hacker history. They're usually technical, and they communicate an intimate knowledge of the slow-roasted levels of hell only understood by an information security professional. Recently, infosec coughed up two particularly transcendent and painfully hilarious memes." I especially like the threatbutt caper. Ready for a good chuckle?
http://www.engadget.com/2015/12/31/2015s-best-infosec-memes/

Today, your employees are frequently exposed to sophisticated phishing and ransomware attacks. Old school security awareness training doesn’t hack it anymore. More than ever, your users are the weak link in your network security. Join us on Wednesday, January 13 at 2:00 p.m. (EST) for a 30-minute live product demonstration of the innovative Kevin Mitnick Security Awareness Training Platform and see how easy it is to train and phish your users:

• Send Simulated Phishing tests to your users and get your Phish-prone percentage.
• Roll out Training Campaigns for all users (or groups) with follow-up emails to “nudge” users who are incomplete on the training.
• Point-of-failure training auto-enrollment.
• NEW Phish Alert Button for Outlook so employees can report phishing attacks.
• NEW Advanced Reporting to watch your Phish-prone percentage drop, with great ROI.

Find out how more than 2,500 organizations have mobilized their end-users as their first line of defense. Register Now:
https://attendee.gotowebinar.com/register/4207198052493900546

"The thing always happens that you really believe in; and the belief in a thing makes it happen."- Frank Lloyd Wright - Architect (1867-1959)

"Some people want it to happen, some wish it would happen, others make it happen."- Michael Jordan

Thanks for reading CyberheistNews

1. Apple's OS X Security Honeymoon Is Over: 41,365 views
   https://blog.knowbe4.com/apples-os-x-security-honeymoon-is-over
   
   
2. The Seven Deadly Social Engineering Vices: 19,079 views
   https://blog.knowbe4.com/bid/290552/The-Seven-Deadly-Social-Engineering-Vices
   
   
3. Antivirus Isn't Dead, It Just Can't Keep Up: 16,219 views
   https://blog.knowbe4.com/antivirus-isnt-dead-it-just-cant-keep-up
   
   
4. KnowBe4 got a CEO Fraud phishing attack. Wrong Mark!: 12,641 views
   https://blog.knowbe4.com/knowbe4-got-a-ceo-fraud-phishing-attack.-wrong-mark
   
   
5. Near-flawless Social Engineering attack spoiled by single flaw: 9,824 views
   https://blog.knowbe4.com/near-flawless-social-engineering-attack-spoiled-by-single-flaw

I received this the last day of the year from a Director of IT Security who works at a mid-size credit union.

"Stu, I think you’ll be interested in my story. If you want to share it, just anonymize it sufficiently. I’ve been very concerned about Business Email Compromise (BEC), particularly because government entities have continually sounded the warning. It’s obviously a very fast way to lose a lot of money, so I determined to prove our own controls. I visited our Finance department head. Did she know about BEC? Yes, she said. Was she sure that we couldn’t be fooled into falling for this scheme? She was very emphatic that this couldn’t happen here with the controls we had in place. Well, says I, how about a test? She agreed, and the game was on.

I explained the exercise to our CEO, who agreed to let me spoof his email address. Fortunately for me, he had just recently requested a wire on behalf of one of our CUSOs. Perfect. I originated a phishing message in the KnowBe4 system using the recent wire request as additional bait (hey, sorry folks – I forgot about this one; please expedite ASAP. Sorry, my bad).

I kept our Finance head in the loop, so there could be no way any funds actually left the credit union. She kept insisting that nothing was going to happen. The big day arrived, and I kicked off the campaign to send the request to the Finance group responsible for processing wires.

We didn’t have long to wait. Two minutes after transmission, Person 1 took the email and passed it along to Person 2, who went straight to the Finance head’s office. This is exactly what is supposed to happen. However, our Finance leader took a little jolt. She was expecting to be informed that the group found the message suspicious. Instead, she was asked to confirm the wire so it could move along. A little chill went down her spine. She let the cat out of the bag at that point, and called her group together for a chat.

In the end, it was determined that the wire would never have been sent. However, she was very worried that there wasn’t more immediate awareness of the scheme before it reached her. The main reason their guard was let down just a little was “it came from our CEO”. She used the opportunity to drive home the necessity to follow procedure no matter who it was – our CEO, the POTUS, or Stu Sjouwerman.

Lessons Learned:

• Test, test, test – no matter how comfortable you think you are, nothing beats a good test for assurance.

• If you have upper management’s support, your job is SO much easier. If you don’t have it, I can only recommend one option – update your resume; you’ll never win.
  
  
• A good service provider like KnowBe4 can help you accomplish your information security program’s objectives."

Excellent lessons I must say. It's worth doing this kind of test in your own organization and see what the results are.

Organizations that discover they're victims of business email compromise exploits should immediately contact law enforcement officials to report the attacks, says Camelia Lopez, a federal prosecutor for the Eastern District of Texas. Here is a short video that explains more:
http://www.cuinfosecurity.com/fighting-business-email-compromises-a-8770

Right after I sent this to our customers, one of them answered back with this: "I can do you one better… the following is true and first hand. I still have the emails." And he's right, that one _is_ better. Read it here:
https://blog.knowbe4.com/credit-union-chilling-ceo-fraud-story

You can use this to send to your users:

Recently, a 19 year old Chinese guy was nabbed and charged with stealing data from a yet unknown airline. He exfiltrated flight booking information of more than a million of the airline's customers. Next, and here is the crafty part, he spoofed the airline in a text message to the airline's customers and claimed their flight had been cancelled and lured them into rebooking their flights with him and stole that money. You have to give it to him, this is pretty smart.

So, remember to THINK BEFORE YOU CLICK. Do not trust any phone call, email or text message that asks you for personal information such as credit card data. Always contact the company yourself, do not click on links, open attachments or dial phone numbers in emails. Call the number on the credit card or pull the number from the website where you went yourself.

A new study about the gap between executive awareness and enterprise security finds that the majority of IT security professionals believe CEOs make decisions with little regard to security. IT security pros also believe management teams are not regularly briefed on cyber-security issues.

The survey, commissioned by cyber-security company CyberArk, was conducted by Dimensional Research and captured the opinions of 308 IT security professionals worldwide. The goal was to capture hard data on visibility and support for security programs at the executive level and determine which metrics are used to define security effectiveness.

"Compliance does not equal security. It can lull a CEO into a state of complacency because all it demonstrates is the simple checking of a box without context for responsible levels of information protection," said John Worrall, chief marketing officer of CyberArk. "Security professionals are briefing executives on the wrong information. They need to arm their CEOs and executive teams with information that matters, such as threat detection risks versus compliance and system availability." More at:
http://www.cioinsight.com/security/slideshows/why-ceos-are-in-the-dark-about-cyber-security.html

According to the Open Forum by American Express, 36% of company data breaches are caused by employee mistakes. For instance, employees could very well send private company information, such as client or customer reference lists, to their personal emails, provide online account credentials to strangers, or leave online company data unattended, which can all lead to sensitive data exploitation. These insider related data leaks can be directly attributed to lack of oversight, accountability, and, more importantly, proper training from their employers.
http://www.business2community.com/cybersecurity/insider-data-breach-hidden-hack-attack-01410396#MYiBtQBlYitB8ZPG.97

Our friends at Malwarebytes would like your opinion about endpoint security solutions and your preferences. The survey takes about 5 minutes and will enter you in a raffle for a new Surface Pro 4. Here is the link:
https://www.surveymonkey.com/r/MBEndpoint

• Best Of 2015 - The Year In Review - GoPro. Turn up the sound, Full screen HD!
  http://www.flixxy.com/best-of-2015-the-year-in-review-gopro.htm?utm_source=4

• Awesome people snowboarding, skiing, ice skating, snow kayaking, wingsuit flying, sky diving and pulling off amazing tricks:
  http://www.flixxy.com/people-are-awesome-winter-2015-edition.htm?utm_source=4

• The USS Trepang submarine emerges from under the ice near the North Pole:
  http://www.flixxy.com/submarine-emerges-from-under-the-ice.htm?utm_source=4

• Using a 250 sized mini quad drone for aerial cinematography is not only possible, but the ONLY way to achieve this shot. Rise & Shine at Venice Beach. Cool:
  https://vimeo.com/149850024

• Jason Latimer, the world champion of magic, revolutionizes one of the oldest magic trick with "Clear Cups and Balls" on The Late Late Show. He's goood:
  http://www.flixxy.com/world-champion-of-magic-transparent-cups-and-balls.htm?utm_source=4

• A side-by-side look at the evolution of American men's and women's fashion from 1915 to 2015:
  http://www.flixxy.com/100-years-of-fashion-girls-vs-guys.htm?utm_source=4

• Dogs doing tricks in slow motion look like superheroes:
  http://www.flixxy.com/dogs-doing-tricks-in-super-slow-motion-4k.htm?utm_source=4

• Three little dachshunds with the combined stamina of an ox and the speed of a greyhound pull girls around on skateboards:
  http://www.flixxy.com/dachshund-chariot.htm?utm_source=4

• 23 Witty Grammar Jokes & Puns to Satisfy Your Inner Grammar Nerd:
  http://blog.hubspot.com/marketing/grammar-jokes?

• National Weather Service Public Service Announcement: "Turn Around Don't Drown":
  http://www.nws.noaa.gov/os/water/tadd/
  
  
• Did you know cats could play Jenga?:
  http://boingboing.net/2015/12/31/did-you-know-cats-could-play-j.html