Phishbait Follows Current Events

Phishbait Current EventsCrisis draws opportunistic criminals, and the Kaseya ransomware incident is no different. Kaseya’s updates on the incident have included repeated warnings not to be taken in by emails or phone calls purporting to offer news, advice, or patches of the company’s VSA software.

“Spammers are using the news about the Kaseya Incident to send out fake email notifications that appear to be Kaseya updates. These are phishing emails that may contain malicious links and/or attachments,” the company posted on Friday, adding:

“Spammers may also be making phone calls claiming to be a Kaseya Partner reaching out to help. Kaseya IS NOT having any partners reach out – DO NOT respond to any phone calls claiming to be a Kaseya Partner.

“DO NOT click on any links or download any attachments in emails claiming to be a Kaseya advisory. However, some customers have subscribed to our support site and, at this point, those automated emails may contain links. As precaution, be careful with any links or attachments in any emails.”

Malwarebytes had noted last week that references to the Kaseya incident have begun appearing as phishbait in social engineering schemes, usually emails offering malicious links or attachments. The subjects suggest an offer of advice, warning, or counsel in the matter of the Kaseya exploit. “Threat actors often use opportunistic themes in their campaigns and we believe this is the case here,” Jerome Segura, Director of Threat Intelligence at Malwarebytes said. “This Kaseya fake update is a Cobalt Strike payload and interestingly hosted on the same IP address used for another campaign pushing Dridex. In the past we've seen the same threat actor behind Dridex using Cobalt Strike.”

Treat emails or phone calls of this kind with the same caution you’d apply to notices of automatic renewals of services you don’t remember signing up for, or appeals for your cooperation from foreign officials (or their widows). New school security awareness training can help your people develop resistance to these forms of social engineering.

Kaseya’s warnings, and their accompanying updates, may be found here. Malwarebytes’ tweet on the incident may be found here

Free Phishing Security Test

Would your users fall for convincing phishing attacks? Take the first step now and find out before bad actors do. Plus, see how you stack up against your peers with phishing Industry Benchmarks. The Phish-prone percentage is usually higher than you expect and is great ammo to get budget.

PST ResultsHere's how it works:

  • Immediately start your test for up to 100 users (no need to talk to anyone)
  • Select from 20+ languages and customize the phishing test template based on your environment
  • Choose the landing page your users see after they click
  • Show users which red flags they missed, or a 404 page
  • Get a PDF emailed to you in 24 hours with your Phish-prone % and charts to share with management
  • See how your organization compares to others in your industry

Go Phishing Now!

PS: Don't like to click on redirected buttons? Cut & Paste this link in your browser:

Subscribe To Our Blog

Ransomware Hostage Rescue Manual

Get the latest about social engineering

Subscribe to CyberheistNews