Human Risk Management Blog

Keeping you informed. Keeping you aware.
Stay on top of the latest in security including social engineering, ransomware and phishing attacks.

The Celebrities Don't Know You, and You Don't Know Them

Over the past four months, the UK’s National Cyber Security Centre (NCSC) has shut down more than 300,000 URLs linking to investment schemes that fraudulently claim to be endorsed by ...

RedCurl APT Uses Spear Phishing to Conduct Corporate Espionage

A previously unobserved APT group called “RedCurl” has been launching cyber espionage campaigns against organizations around the world since at least 2018, according to researchers at ...

Trying for a win, win, win game. Listen to this 5-minute interview with me.

Cyberwire has a short-form podcast called Career Notes and interviewed me recently. They said: "Founder and CEO Stu Sjouwerman takes us on a journey of how his career developed from ...

Phishing with Canva: Bad Guys Exploit Graphic Design Platform

Late last year we reported that Microsoft Sway, an online presentation program, was being exploited by malicious actors to host malicious files used in phishing attacks. Since then, ...

YIKES: Fancy Bear Linux Rootkit

Heads-Up! The CyberWire staff wrote: "The US National Security Agency and Federal Bureau of Investigation yesterday issued a joint alert concerning a new malware toolset operated by ...

43,000+ NHS Staff Hit With Phishing Emails Since March

A Freedom of Information (FOI) request revealed that over 43,000 National Health Service (NHS) staff have had phishing emails slip through the cracks and into their inboxes in the past ...

COVID-Themed Phishing Scams Are on Their Way Out While Some Scammers Use a Vaccine as a Last-Ditch Effort

The latest data on COVID-related phishing scams from security researchers at CheckPoint comes with some good news and insightful trends that may help keep you secure.

Having a Wonderful Time, Wish Your Data Were Here

The US Department of Health and Human Services (HHS) Office for Civil Rights (OCR) issued an alert warning that someone is impersonating the OCR and sending fraudulent postcards to ...

[On-Demand] The Best Ways to Stop Malware and Ransomware That No One Else Will Tell You

With malware attacks on the rise, making sure you keep your organization safe from a costly breach is a top priority. The two best things you can do to stop malware and ransomware attacks ...

Pressure, Peer and Otherwise: Ransomware and Data Theft Go Hand-In-Hand

Data theft is now a well-established element of ransomware attacks, according to John Shier, a Senior Security Expert at Sophos. In a blog post (summarized by iTwire), Shier noted that in ...

FOLLOWUP: Small Business Administration Phishing Campaign

On Wednesday August 12 the Dept. of Homeland Security issued an alert concerning a phishing campaign using malicious spoofs of the Small Business Administration's (SBA) web site. The ...

Phishing Golden Hour

In emergency healthcare settings, the “golden hour” is the time between when a patient suffering a life threatening event (e.g., heart attack, stroke, aneurysm, etc.) is most likely to ...

My lazy Sunday afternoon was interrupted...

My lazy Sunday afternoon was interrupted with what appeared to be a prank, a social engineering attempt, or something else that remains to be identified.

Paying the Ransom After a Ransomware Attack May Become More Complicated, Thanks to the U.S. Treasury

With many organizations considering to pay the ransom should they experience an attack, new guidance from the U.S. Treasury may put a damper on an organization’s ability to pay.

[Heads Up] Apparently Slack Phishing Got So Bad They Had To Do Something About It

Slack has announced a slew of new security features, certificates and integrations, including a verification system that adds an additional layer to protect against phishing scams.

Cybercriminals Target Execs in Microsoft 365 Credential Attack to Launch Internal BEC Scams

A new phishing attack spotted in the wild by security researchers at Trend Micro demonstrates how compromised data in an initial cyberattack is purposed in subsequent attacks.

Many US States Requiring Training on COVID-19 Before Return to Work

Many states across the US are now mandating that organizations provide training to your employees before they can return to work. Definitely check your local state guidelines but KnowBe4 ...

Legitimate Accounts for Illegitimate Business Email Compromise

Cybercriminals frequently use email accounts from legitimate services like Gmail to carry out business email compromise (BEC) attacks, Help Net Security reports. Researchers at Barracuda ...

KnowBe4 Celebrates 10 Years by Planting 10,000 Trees Worldwide

We're celebrating 10 years as a company today! To celebrate this milestone, we'll be planting 10,000 trees around the world to celebrate our 10th anniversary and the addition of its ...


Get the latest insights, trends and security news. Subscribe to CyberheistNews.