BEC Group Launches Hundreds of Campaigns

Feb 2, 2023 9:14:15 AM By Stu Sjouwerman

A business email compromise (BEC) gang has launched more than 350 attacks against organizations in the US, according to researchers at Abnormal Security. The threat actor, which Abnormal ...

Alert: Refund Scam Targeting Federal Agencies via RMM Software

Jan 30, 2023 8:51:25 AM By Javvad Malik

At least two federal civilian agencies were the unfortunate victims of a refund scam campaign, perpetrated through the use of remote monitoring and management (RMM) software. CISA, the ...

Do Not Get Fooled Twice: Mailchimp's Latest Breach Raises Alarm Bells – Protect Yourself Now!

Jan 25, 2023 1:23:12 PM By Javvad Malik

For the second time in less than a year, Mailchimp has found itself in a precarious situation, having to admit that it has been breached. It appears that a social engineering attack ...

The Current State of Cybersecurity Should Fear AI Tools Like ChatGPT

Jan 20, 2023 9:57:35 AM By Stu Sjouwerman

Malicious use of the text-based AI has already begun to be seen in the wild, and speculative ways attackers can use ChatGPT may spell temporary doom for cybersecurity solutions.

Unusual Blank-Image Phishing Attacks Impersonate DocuSign

Jan 20, 2023 8:59:19 AM By Stu Sjouwerman

An unusual phishing technique has surfaced this week. Avanan, a Check Point Software company, released a blog Thursday morning detailing a new attack in which hackers hide malicious ...

[Ache In the Head] The Problems With Your Not-So-Secure Email Gateway

Jan 14, 2023 9:59:24 AM By Stu Sjouwerman

I have been doing some research on Secure Email Gateways. The picture is not that pretty. Below I will summarize what I found.

[Heads Up] Phishing Attacks Are Now The Top Vector For Ransomware Delivery

Jan 13, 2023 6:57:21 AM By Stu Sjouwerman

Phishing attacks are now the top vector for ransomware delivery, according to researchers at Digital Defense. Phishing emails can be highly tailored to specific employees in order to ...

Government Workers as Phishing Targets

Jan 12, 2023 8:56:34 AM By Stu Sjouwerman

Government workers are prime targets for social engineering attacks, according to Kaitlyn Levinson at GCN. Attackers use different tactics to target government employees in specific ...

Phishing in the Service of Espionage

Jan 9, 2023 9:14:12 AM By Stu Sjouwerman

Reuters describes a cyberespionage campaign carried out by the hitherto little-known threat group researchers track as "Cold River." The group is circumstantially but convincingly linked ...

There is a New Trend in Social Engineering with a Disgusting Name; "Pig-butchering"

Jan 3, 2023 1:52:21 PM By Stu Sjouwerman

The technique began in the Chinese underworld, and it amounts to an unusually protracted form of social engineering. The analogy is with fattening up a pig, then butchering it for all ...

Finance and Insurance Is the Sector Most Impacted by Data Breaches In 2022

Dec 30, 2022 2:40:01 PM By Stu Sjouwerman

Analysis of the year’s breaches shows Finance and Insurance businesses are the most targeted and have lost a material count of records as a result.

One Out of 10 Threats Still Make It All the Way to the Endpoint

Dec 30, 2022 2:34:39 PM By Stu Sjouwerman

Despite good intentions, layered security measures, and efficacy claims by security solution vendors, new data shows that email-based threats are still getting all the way to the Inbox.

Phishing Activity Rose 130% in the Second Half of 2022, Representing Three-Quarters of All Email-Based Attacks

Dec 29, 2022 10:22:48 AM By Stu Sjouwerman

New data focused on cyberattacks in the second half of the year-to-date shows phishing taking the overwhelming lead as the initial attack vector of choice.

[Heads Up] Giant LastPass Breach Can Supercharge Spear Phishing Attacks

Dec 28, 2022 2:27:36 PM By Roger Grimes

By Roger A. Grimes. KnowBe4 recommends that everyone use a password manager to create and use strong passwords as a part of their password policy ...

QBot Malware Attacks Use SVG files to Perform HTML Smuggling

Dec 27, 2022 9:20:16 AM By Stu Sjouwerman

QBot malware phishing campaigns have adopted a new distribution method using SVG files to perform HTML smuggling that locally creates a malicious installer for Windows.

Spear Phishing Campaign Targets Japanese Political Organizations

Dec 22, 2022 9:43:59 AM By Stu Sjouwerman

Researchers at ESET warn that a Chinese-speaking threat actor dubbed “MirrorFace” targeted Japanese political organizations with spear phishing emails in the run-up to the Japanese House ...

"How I lost my dog and almost my Google credentials..."

Dec 21, 2022 4:45:48 PM By Stu Sjouwerman

A well-trained Knowster posted: "I lost my dog this weekend and my mother in law was trying to be helpful and put my real phone number on a few social media posts she made. Now im getting ...

Ivanti Report Shows Cybersecurity Practitioners Concentrating on Right Threats

Dec 21, 2022 9:25:23 AM By Roger Grimes

A recent Ivanti report shows cybersecurity practitioners getting more focused on the threat landscape, but defenders may need to hone their attention to focus on the right threats.

Now BEC Attacks Steal Physical Goods

Dec 20, 2022 8:49:21 AM By Stu Sjouwerman

The Federal Bureau of Investigation (FBI), the Food and Drug Administration Office of Criminal Investigations (FDA OCI), and the US Department of Agriculture (USDA) have released a joint ...

Social Engineering, Money Mules, and Job Seekers

Dec 19, 2022 10:32:37 AM By Stu Sjouwerman

A small town in Manitoba, WestLake-Gladstone (population about 3300), fell victim to a social engineering campaign. The municipal government seems to have been a target of opportunity, ...