This Company Turned a Phishing Attack into a Teachable Moment
February 27, 2019 by Zach Lewis in PhishingYou’ve read it on this blog before. It’s not enough to simulate phishing emails and raise employees’ awareness. At the end of the day, you need to be able to stop real attacks. One key: basing simulations on phishing threats you actually see in your organization. Following is a real example of one CofenseTM customer that took these words to heart. This company is global. It operates in an extremely data-rich industry that stores Social Security numbers, email addresses, credit card information, and more. In other words, they have a lot to protect. First, the company leveraged information from a...
A Closer Look at Why the QakBot Malware Is So Dangerous
February 22, 2019 by Max Gannon in Threat IntelligenceCISO Summary Cofense Intelligence ™ recently reported a phishing campaign distributing the QakBot malware. QakBot infestation is a significant threat, so be sure to share today’s follow-up post with your SOC analysts. We’ll drill down into the novel techniques QakBot uses to stymie detection and manual analysis. This sophisticated banking trojan, which Cofense™ has seen distributed via the Geodo/Emotet botnet, uses multiple tools to cover its tracks and steal credentials. The threat actors who have developed it are creative and aggressive.
When Sharing Isn’t Caring: Phishing Attacks Are Abusing File-Sharing Sites
February 20, 2019 by Tonia Dudley in Internet Security AwarenessCofense™ has predicted continued growth in phishing attacks that abuse file-sharing services, for example, Google Docs or Sharepoint. In this post, I’ll examine why and how threat actors are doubling down on this tactic. First, here’s the full prediction from Cofense threat analysts Nick Guarino and Lucas Ashbaugh: “The majority of phish seen in the wild in 2019 will live in historically ‘trusted’ sharing services like Google Docs, Sharepoint, WeTransfer, Dropbox, Citrix ShareFile, and Egnyte. It’s difficult for these services to keep up with the constant barrage of varied phishing tactics (Whack-A-Phish, anyone?). In fact, the service providers can be...
Here’s Proof that Corporate Board Members Want Stronger Phishing Defense
February 12, 2019 by Cofense in Internet Security AwarenessBy Susan Mo More and more, boards of directors are security decision-makers. One example: Cofense just published a case study on a company whose board lit a fire for a stronger phishing defense—and it’s paying dividends. This board took the lead in launching phishing simulations. A leading aviation company in my part of the world, Australia, has a highly public presence. Translation: any security issues would likely make headlines. So the board mandated an anti-phishing program. Using Cofense PhishMeTM, the company now runs phishing simulations to condition its employees to recognize and report phishing emails. The program is still in the...
With Upgrades in Delivery and Support Infrastructure, Revenge RAT Malware is a Bigger Threat
February 11, 2019 by Max Gannon in Threat IntelligenceCISO Summary The Revenge RAT malware is getting stealthier, thanks to unusually advanced delivery techniques and support infrastructure. Cofense IntelligenceTM has recently seen this basic and widely available Remote Access Trojan benefit from these upgrades, which help it to access webcams, microphones, and other utilities as Revenge RAT does recon and tries to gain a foothold in targeted computers. When they succeed, RATs enable threat actors to wreak havoc, including monitoring user behavior through keyloggers or other spyware, filching personal information, and distributing other malware.
Expect Credential Phishing to Continue Surging in 2019
February 6, 2019 by Tonia Dudley in Internet Security Awareness“Hackers don’t need to break in, they only need to log in.” This was a quote mentioned at a conference I attended last December and which I repeated in an e-book Cofense™ recently published, 6 Phishing Predictions for 2019. My prediction was that hackers will continue to go full bore with credential phishing, emails that specifically ask for username and password.
Emo..Qak? Geodo/Emotet Botnet Delivers Qakbot Malware as First-Stage Payload
February 4, 2019 by Cofense in Threat IntelligenceBy Max Gannon, Mollie MacDougall, Darrel Rendell, and Aaron Riley CISO Summary In the past few days, CofenseTM has detected double trouble from the Geodo/Emotet malware. Not only have we seen Geodo botnets directly delivering non-Geodo malware via phishing campaigns, we’ve also observed Geodo campaigns use more precise targeting.
We’re Making It Easy for MSSP’s to Deliver Phishing Defense
January 31, 2019 by Cofense in PhishingBy John McCabe We’re Making It Easy for MSSP’s to Deliver Phishing Defense A new Cofense™ Managed Security Service Provider (MSSP) program makes it easy for service providers to offer phishing defense to small and medium-sized businesses. Phishing is a huge problem for SMB’s. With limited budget and expertise, they’re often targets of spear phishing, ransomware, and other attacks.
The Malware Holiday Ends—Welcome Back Geodo and Chanitor
January 29, 2019 by Darrel Rendell in Threat IntelligenceCISO Summary Even cybercriminals knock off for the holidays. Then in January, it’s back to work. We all have bills to pay. This past holiday season, including the Russian Orthodox Christmas which fell on January 7, threat actors cooled their heels and malware campaigns dipped. But with the holidays over, threat actors are back in action. Chanitor malware campaigns are spiking, at even higher levels than a year ago, and Geodo/Emotet campaigns have been surging too.
Introducing the Cofense Triage Certification Program
January 23, 2019 by Cofense in Cyber Incident ResponseBy Kiarra Grant Want to be a certified expert in phishing response? Now you can. Introducing the Cofense Triage TM Operators Certification. It’s our second industry-specific certification program, complementing our program for operators of Cofense PhishMeTM. The new program is focused on Cofense Triage, the first and only phishing-specific incident response platform. Become an expert in Cofense Triage while taking your phishing defense program to the next level. The Cofense Triage Certification program provides: Validation and certification of skills in the operation of Cofense Triage Training in running a successful phishing response program The ability to augment Cofense solution expertise...