Here’s Proof that Corporate Board Members Want Stronger Phishing Defense
February 12, 2019 by Cofense in Internet Security AwarenessBy Susan Mo More and more, boards of directors are security decision-makers. One example: Cofense just published a case study on a company whose board lit a fire for a stronger phishing defense—and it’s paying dividends. This board took the lead in launching phishing simulations. Queensland Airports Limited (QAL) Aviation hails from my part of the world, Australia. As an aviation company, QAL has a public presence. Translation: any security issues would likely make headlines. So the QAL board mandated an anti-phishing program. Using Cofense PhishMeTM, QAL now runs phishing simulations to condition its employees to recognize and report phishing...
With Upgrades in Delivery and Support Infrastructure, Revenge RAT Malware is a Bigger Threat
February 11, 2019 by Max Gannon in Threat IntelligenceCISO Summary The Revenge RAT malware is getting stealthier, thanks to unusually advanced delivery techniques and support infrastructure. Cofense IntelligenceTM has recently seen this basic and widely available Remote Access Trojan benefit from these upgrades, which help it to access webcams, microphones, and other utilities as Revenge RAT does recon and tries to gain a foothold in targeted computers. When they succeed, RATs enable threat actors to wreak havoc, including monitoring user behavior through keyloggers or other spyware, filching personal information, and distributing other malware.
Expect Credential Phishing to Continue Surging in 2019
February 6, 2019 by Tonia Dudley in Internet Security Awareness“Hackers don’t need to break in, they only need to log in.” This was a quote mentioned at a conference I attended last December and which I repeated in an e-book Cofense™ recently published, 6 Phishing Predictions for 2019. My prediction was that hackers will continue to go full bore with credential phishing, emails that specifically ask for username and password.
Emo..Qak? Geodo/Emotet Botnet Delivers Qakbot Malware as First-Stage Payload
February 4, 2019 by Cofense in Threat IntelligenceBy Max Gannon, Mollie MacDougall, Darrel Rendell, and Aaron Riley CISO Summary In the past few days, CofenseTM has detected double trouble from the Geodo/Emotet malware. Not only have we seen Geodo botnets directly delivering non-Geodo malware via phishing campaigns, we’ve also observed Geodo campaigns use more precise targeting.
We’re Making It Easy for MSSP’s to Deliver Phishing Defense
January 31, 2019 by Cofense in PhishingBy John McCabe We’re Making It Easy for MSSP’s to Deliver Phishing Defense A new Cofense™ Managed Security Service Provider (MSSP) program makes it easy for service providers to offer phishing defense to small and medium-sized businesses. Phishing is a huge problem for SMB’s. With limited budget and expertise, they’re often targets of spear phishing, ransomware, and other attacks.
The Malware Holiday Ends—Welcome Back Geodo and Chanitor
January 29, 2019 by Darrel Rendell in Threat IntelligenceCISO Summary Even cybercriminals knock off for the holidays. Then in January, it’s back to work. We all have bills to pay. This past holiday season, including the Russian Orthodox Christmas which fell on January 7, threat actors cooled their heels and malware campaigns dipped. But with the holidays over, threat actors are back in action. Chanitor malware campaigns are spiking, at even higher levels than a year ago, and Geodo/Emotet campaigns have been surging too.
Introducing the Cofense Triage Certification Program
January 23, 2019 by Cofense in Cyber Incident ResponseBy Kiarra Grant Want to be a certified expert in phishing response? Now you can. Introducing the Cofense Triage TM Operators Certification. It’s our second industry-specific certification program, complementing our program for operators of Cofense PhishMeTM. The new program is focused on Cofense Triage, the first and only phishing-specific incident response platform. Become an expert in Cofense Triage while taking your phishing defense program to the next level. The Cofense Triage Certification program provides: Validation and certification of skills in the operation of Cofense Triage Training in running a successful phishing response program The ability to augment Cofense solution expertise...
Jigsaw Ransomware Returns With Extortion Scam Ploys
January 23, 2019 by Cofense in Phishing Defense CenterBy Lucas Ashbaugh Want to play a game? Jigsaw ransomware does, and it’s going to run you $400… or you could just download the free decrypter online. Jigsaw, featuring Billy The Puppet from Saw, was first released in 2016. It not only encrypts the victim’s files but deletes them at a continuously increasing rate until a payment in bitcoin can be confirmed against the bitcoin blockchain. Now, Jigsaw has been observed again, this time delivered through scam tactics. The Delivery Each email starts off with a ploy about how the threat actor somehow compromised the victim’s financial accounts. After shocking and...
The Kutaki Malware Bypasses Gateways to Steal Users’ Credentials
January 21, 2019 by Darrel Rendell in Threat IntelligenceCISO Summary It’s a case of hiding in plain sight. CofenseTM recently found a phishing campaign that hides the Kutaki malware in a legitimate application to bypass email gateways and harvest users’ credentials.
Phishing Campaigns are Manipulating the Windows Control Panel Extension to Deliver Banking Trojans
January 17, 2019 by Cofense in Threat IntelligenceBy Aaron Riley and Marcel Feller CISO Summary Recently, CofenseTM has seen phishing campaigns that bypass email security using a .cpl file extension attachment. .CPL is the file name extension for items or icons appearing in the Windows Control Panel. These file extensions are vital for most Control Panel tools to function, making endpoint threat mitigation extremely difficult. After evading controls and successfully executing on the endpoint, the .cpl file downloads a second-stage payload, which is typically a banking trojan. According to Cofense IntelligenceTM, most of these phishing campaigns are aimed at South American inboxes. As part of security awareness training...