When you become the worldwide No.1 player in your field with tens of thousands of organizations using your platform, you get on people's radar. Both the good guys and the bad apples.
The bad guys see a target they can exploit, so for the last few years I've been waiting for a criminal spoof of KnowBe4, wondering why it was taking them so long, but finally it's here.
They are targeting you, the IT Pro with the keys to the kingdom
The text of this credentials harvesting phishing email has obvious errors and problems. It makes a half-hearted attempt to talk to both the end-user and the system admin, but ultimately it is a social engineering attack on the person with domain admin rights.
An IT pro who is very distracted by the 16 fires they are putting out, might just initially get tricked by this one if they forget to hover over the link:
However, after clicking the button, when you wind up at this spoofed Microsoft login page you for sure know that something is amiss! Nice try Mr. Bad Guy, but no cigar.
This is a fairly transparent attack that would not fool anyone who has stepped through our new-school security awareness training program.
If the attacker knew who KnowBe4 customers were, they could target them specifically, but like any InfoSec company we never disclose those. Your security is the No. 1 thing we keep in mind with everything we do.
For as far as we can see, KnowBe4 is the only simulated phishing and awareness training platform that is SOC2 Type 2 certified. We believe they all should be. KnowBe4 also recently implemented a bug bounty program.
I recommend you have a look at our page dedicated to your security.
It starts out with: "We here at KnowBe4 would like to make a few things clear with respect to security. First, we respect your privacy and take significant efforts to protect all your data. Second, we would never do anything with your data that we wouldn’t want you to do with ours. Third, we are a security company built and operated by highly security-minded individuals.
Keeping our customers' data secure is the most important thing KnowBe4 does. We go to considerable lengths to ensure that all data provided to KnowBe4 is done so securely - keeping KnowBe4 systems and your data secure is fundamental to our business." Please read this page to see what we do to keep your data secure:
https://www.knowbe4.com/security
When you rise to the top, a few bad hats will try to tear you down. As we all know, the price of freedom is eternal vigilance and a willingness to act in its defense. So, we consider attacks like this as a badge of honor, and they only inspire us to keep expanding and give you fantastic service.
One email from us to you shows if your email server is configured correctly. To enter just go here fill out the form, it's quick, easy and often a shocking discovery.
Warm regards,
Stu Sjouwerman
Founder and CEO, KnowBe4, Inc
