CyberheistNews Vol 6 #4 Scam Of The Week: Phish With Hidden Sting

As you may have heard, KnowBe4 has released a no-charge Outlook Add-in that allows your employees to report phishing attacks to your Incident Response team with just one click. It's called the Phish Alert button.

What you probably didn't know is that system admins have an option to share these phishing emails with KnowBe4's researchers and many do.

We have tens of thousands of our Phish Alert add-ins installed now and our analysis of the reported phishing emails is showing some interesting results.

There is a particular type of phish our research team sees more and more of. This attack plays out as follows:

1. Employees receive an email with an attachment -- usually PDF or DOC.
   
   
2. Body of the email contains no malicious links and consists only of a social engineering ruse to open the attached doc.
   
   
3. The attached doc is itself not malicious -- i.e., no exploits or malicious macros/scripts. What's visible to the user is a second ruse to click an embedded link in the document.
   
   
4. The link embedded in the doc leads to either an exploit site/page or a fake login page for a recognized service.

These phishes are slipping past AVs and email security apps/appliances because the email body contains nothing obviously malicious and the attachment itself is not malicious in and of itself. AV and email security apps are not scanning the links in the attached docs.

This is something to watch out for, and warn your employees about. I would send them the following, and while you are at it, send it to friends and family as well.

"Bad guys are getting smarter by the month. They now send you emails that your antivirus and spam filters do not catch. It goes like this: The email has an attachment that you are tricked into opening. In the attachment is a link that they try to make you click on. The link goes to a malicious website and will infect your computer.

Do not open attachments you did not ask for. When you get an attachment, verify if that person sent it to you and why. If in doubt, throw it out. Always Think Before You Click.

You can get your own complimentary Phish Alert Outlook Add-in here:
https://info.knowbe4.com/free-phish-alert

Effective security awareness training for your high-risk employees is becoming a major priority. The accounting team of FACC, who design and manufacture aircraft components for Boeing and Airbus were social engineered to transfer around 54 million dollars to a foreign bank.

They disclosed on their blog that they had become a victim of "a crime act using communication information and information technologies." Other things mentioned were that their board immediately involved the Criminal Investigation Department and engaged a forensic investigation. The cyberattack activities were executed from outside of the company.

They continued with: "The financial accounting department of FACC was the target of cyber fraud. The damage is an outflow of approx. EUR 50 million (U.S. 54M) of liquid funds. The management board has taken immediate structural measures and is evaluating damages and insurance claims.”

Good luck with that. Cyber insurance policies tend not to cover this type of social engineering scam, see the article below. CEO Fraud, also known as Business Email Compromise (BEC) is a highly sophisticated Internet scam that penetrates one or more email accounts of employees in accounting departments, lurks for months and figures out policy and procedures, and then waits until the CEO is out on business travel before the scam kicks into gear. The scams are proportional to regular wire transfers so that the transaction does not raise eyebrows.

C-level employees, especially CEOs and CFOs, have to be aware of the various techniques the scammers are using to trick them into wiring large amounts of money. Effective security awareness training is a must these days.

The KnowBe4 integrated training and simulated phishing platform enables your security team to simulate CEO Fraud attacks and make sure that the accounting team is inoculated against these attacks. More details and links at the KnowBe4 Blog:
https://blog.knowbe4.com/ceo-fraud-costs-boeing-vendor-54-million-dollars

Brian Krebs warned of a CEO Fraud case where a Texas manufacturing firm is suing its cyber insurance provider for refusing to cover a 480,000 thousand dollar loss following an email scam that impersonated the firm’s chief executive:

"At issue is a cyber insurance policy issued to Houston-based Ameriforge Group Inc. (doing business as “AFGlobal Corp.“) by Federal Insurance Co., a division of insurance giant Chubb Group. AFGlobal maintains that the policy it held provided coverage for both computer fraud and funds transfer fraud, but that the insurer nevertheless denied a claim filed in May 2014 after scammers impersonating AFGlobal’s CEO convinced the company’s accountant to wire 480,000 thousand dollars to a bank in China.

"According to documents filed with the U.S. District Court in Harris County, Texas, the policy covered up to 3 million dollars, with a 100,000 dollars deductible. The documents indicate that from May 21, 2014 to May 27, 2014, AFGlobal’s director of accounting received a series of emails from someone claiming to be Gean Stalcup, the CEO of AFGlobal."

A link to the whole story is below but the conclusion is already blindingly clear: even if you have cyber insurance, that does not automatically mean you are covered for CEO Fraud where employees get social engineered to wire large amounts of money out of the country. To quote IT Security guru Bruce Schneier: "If you think technology can solve your security problems, then you don’t understand the problems and you don’t understand the technology." More:
http://krebsonsecurity.com/2016/01/firm-sues-cyber-insurer-over-480k-loss/

I Was Interviewed By ABC News About
Malware Infections

I was interviewed by Tampa's ABC News about the massive increase in malware infections in Tampa. Adam Walser visited the KnowBe4 offices and asked why the rate was 842% over the national average. We had some fun discussing the risks of visiting pr0n sites. VIDEO:
https://www.knowbe4.com/knowbe4-in-the-news/

Oh, and a customer sent us this: "We’ve got a few employees wearing Manning jerseys here at the office in Patriots country today. Will we be sending them simulated: 'Breaking news: Peyton Manning found dead from HGH overdose phishing emails'? Yes, yes we will." We were very amused here at KnowBe4.

"No one has ever made himself great by showing how small someone else is."
- Irvin Himmel

"The price of greatness is responsibility."- Winston Churchill

Thanks for reading CyberheistNews

• Coolest way to turn up for a coffee! Stunning cinematography and one of the best paragliding videos ever!
  http://www.flixxy.com/see-you-at-the-cafe.htm?utm_source=4

• Robots can now defend themselves against our flying kicks:
  http://qz.com/595702

• An exceptional composition of amazing video footage:
  http://www.flixxy.com/this-is-what-the-internet-was-made-for.htm?utm_source=4

• Drone magacopter breaks world record lifting weight:
  https://m.youtube.com/watch?v=3dJipfE4Ve8

• Researchers discover the design of an abandoned subterranean
  ant mega city:
  http://www.flixxy.com/ant-city-development.htm?utm_source=4

• From the weird Japanese Department. Walrus dances to Michael Jackson hit:
  http://www.flixxy.com/talented-walrus-dances-to-michael-jackson.htm?utm_source=4

• The Amazing Miniature Wonderland in Hamburg, Germany:
  http://www.flixxy.com/the-amazing-miniature-wonderland-in-hamburg-germany.htm?utm_source=4
  
  
• How do you encourage more people to take the stairs instead of the escalator? Check out the 'piano stairs' in Stockholm, Sweden:
  http://www.flixxy.com/piano-stairs-fun-theory.htm?utm_source=4