Bundle Up and Build an End-to-End Phishing Defense
December 2, 2019 by Cofense in Cyber Incident ResponsePhishingBy David Mount, Product Marketing Back in 2008, CofenseTM (then PhishMe®) pioneered the concept of phishing simulation as a tool to reduce organizational risk to phishing threats. Since then, the phishing threat landscape has evolved at a rapid pace, as evidenced in many of the posts on this blog. Back then, traditional approaches to Security Awareness didn’t (and still don’t) demonstrably and measurably improve security posture, especially relating to phishing threats. And, as we’ve mentioned before (and we highlight in this blog), every threat identified by the Cofense Phishing Defense CenterTM has bypassed the technical controls like Secure Email Gateways...
Threat Actors Use Bogus Payment HTML File to Scoot Past Proofpoint Gateway
November 18, 2019 by Cofense in Cyber Incident ResponsePhishingProofpointSEG MissesYou’ve Been Served: UK Scammers Deliver ‘Predator the Thief’ Malware Via Subpoena
November 6, 2019 by Cofense in Cyber Incident ResponseMalware AnalysisBy Aaron Riley Not even the halls of justice are immune from scammers. A new phishing campaign spoofing the UK Ministry of Justice has successfully targeted users with a subpoena-themed email delivering Predator the Thief, a publicly available information-stealing malware. Cofense IntelligenceTM has observed employees in insurance and retail companies receiving these emails. The phishing email states that the recipient has been subpoenaed and is asked to click on a link to see more details about the case. The enclosed link uses trusted sources—namely Google Docs and Microsoft OneDrive—for the infection chain. The initial Google Docs link contains a redirect...
New Credential Phish Targets Employees with Salary Increase Scam
October 31, 2019 by Cofense in Cisco IronPortCyber Incident ResponsePhishingProofpointSEG MissesBy Milo Salvia, Cofense Phishing Defense CenterTM The Cofense Phishing Defense Center (PDC) has observed a new phishing campaign that aims to harvest Office365 (O365) credentials by preying on employees who are expecting salary increases. The threat actors use a basic spoofing technique to trick employees into thinking that their company’s HR department has shared a salary increase spread sheet. Here’s how it works: Email Body Figure 1: Email Body The threat actor attempts to make the email appear to come from the target company by manipulating the “from” field in the headers. In particular, the threat actor changes the...
What’s Up With Malware? Find Out In Our Q3 Report
October 23, 2019 by Cofense in Threat IntelligenceBy Alan Rainer and Max Gannon On the malware front, the summer of 2019 was quiet and steady-state. But the end of Q3 saw the infamous Emotet resurface, presaging a malware uptick in Q4. Read all about it in the Cofense Q3 2019 Malware Trends Report. Maintaining a relative lull when Emotet suspended activity, threat actors in Q3 stuck to tried-and-true practices of intrusion. Phishing emails containing keyloggers (namely ‘Agent Tesla’) slightly rose in popularity, while information stealers like Loki Bot fell. Threat actors continue to seek the easiest, most efficient way of infiltrating users. Agent Tesla, for example, offers...
New Credential Phish Masks the Scam Page URL to Thwart Vigilant Users
October 22, 2019 by Cofense in Cyber Incident ResponsePhishingRetarus Email SecurityAgent Tesla Keylogger Is Now a Top Phishing Threat
October 18, 2019 by Cofense in Malware AnalysisThreat IntelligenceBy Aaron Riley, Cofense IntelligenceTM The Agent Tesla keylogger is an increasingly widespread piece of malware in the phishing threat landscape, targeting multiple industries and using multiple stages within its infection chain. Currently, threat actors prefer archived files or weaponized Microsoft Office productivity documents to deliver this malicious software to the endpoint. Agent Tesla is sold as a commercial subscription license and offers a 24/7 support team. With an easy to use and abundant feature set—like a document exploit builder embedded into the malware management web panel—this keylogger lends itself to all levels of threat actors. A typical theme for...
This Credential Phish Masks the Scam Page URL to Thwart Vigilant Users
October 17, 2019 by Cofense in Cyber Incident ResponsePhishingBy Milo Salvia, Cofense Phishing Defense CenterTM The Cofense Phishing Defense Center (PDC) has observed a phishing campaign that aims to harvest credentials from Stripe, the online payment facilitator handling billions of dollars annually, making it an attractive target for threat actors seeking to use compromised accounts to gain access to payment card information and defraud consumers. The phish prevents email recipients from seeing the destination of an embedded link when they try to hover over the URL. Instead, what they see is a bogus account message. Here’s how the campaign works. Email Body The email pretends to be a notification...
Phish Found in Proofpoint-Protected Environments – Week Ending June 7, 2020
June 10, 2020 by Cofense in PhishingProofpointSEG MissesPhishes Found in Proofpoint-Protected Environments – Week Ending May 31, 2020
June 2, 2020 by Cofense in PhishingProofpointSEG MissesPhishes Found in Proofpoint-Protected Environments – Week Ending May 24, 2020
May 27, 2020 by Cofense in PhishingProofpointSEG MissesPhishes Found in Proofpoint-Protected Environments – Week Ending May 17, 2020
May 20, 2020 by Cofense in PhishingProofpointSEG MissesKeeping You Ahead of Phishing Attacks with SEG-Evasion Based Threat Intelligence
May 14, 2020 by Cofense in PhishingThreats of Terror Pervade Recent Extortion Phishing Campaigns
December 20, 2018 by Cofense in Phishing Defense CenterBy Lucas Ashbaugh “There is an explosive device (tronitrotoluene) in the building where your business is conducted […] there will be many victims if it explodes”
Re: The Zombie Phish
October 31, 2018 by Cofense in Malware AnalysisPhishing Defense CenterThreat IntelligenceBy: Lucas Ashbaugh, Nick Guarino, Max Gannon Out of nowhere, someone responds to an email conversation that wrapped up months ago. It’s a real conversation that actually happened. Maybe it’s about a meeting, a job opportunity, or a reply to that problem you had over a year ago; this email is highly relevant to you. But something is off, the topic of the email is months out of date and now there is a weird error message. This is a devious tactic, reviving an email conversation long dead – it’s the Zombie Phish. Not Your Average Phish The Cofense™ Phishing...
Email Security Gateway (to Your Next Breach)
October 16, 2018 by Cofense in Phishing Defense CenterBY THE COFENSE PHISHING DEFENSE CENTER Email is the most common attack vector in today’s threat landscape. Not only does email deliver over 92% of malware1, but by the end of 2017 the average user received 16 malicious emails per month.2 Cyber-criminals and APT actors abuse email to deliver malware or steal user credentials and other sensitive data. Because it is ubiquitous, email is an oft-targeted, massive attack surface. Proofpoint and Mimecast Often Can’t Handle Simple Phishing Attacks That’s why companies spend thousands to millions of dollars on security technologies, including secure email gateways. Let’s be clear: it is erroneous...
We’re Seeing a Resurgence of the Demonic Astaroth WMIC Trojan
September 10, 2018 by Cofense in Phishing Defense CenterBy Jerome Doaty and Garrett Primm The Cofense™ Phishing Defense Center (PDC) has recently defended against a resurgence of Astaroth, with dozens of hits across our customer base in the last week. In just one week, some estimated 8,000 machines have been potentially compromised.
The Lazy Man’s Guide to Phishing
August 16, 2018 by Cofense in Phishing Defense CenterBy Lucas Ashbaugh Laziness and sloppy work are the twenty first century’s newest business model, and for phishing actors it’s a gold rush. The real winners from modern phishing have taken a chapter out of the entrepreneur’s handbook: The Lean Startup. For them, phishing isn’t about artisanal fraud and refined skills, it’s about starting cheap, failing quickly, and getting their head back in the game. It’s horrendously brilliant. In a world where SOCs are constantly grinding to block that IP, scan for that hash, disable macros, etc., automated solutions just can’t keep up. When it comes to phishing, speed is king....
An Analyst’s View of Surging PowerShell-based Malware
August 13, 2018 by Marcel Feller in Malware AnalysisPhishing Defense CenterOver the past couple of weeks, the Cofense™ Phishing Defence Center (PDC) has observed a rise in PowerShell-based malware. PowerShell is a very powerful scripting language that is legitimately used in many organisations. PowerShell is packed with almost endless capabilities, most of which are particularly interesting to threat actors who wish to abuse PowerShell for malicious purposes.
Another Tax-Rebate Phishing Scam, This Time in Canada
August 7, 2018 by Dilen Thakuri in Phishing Defense CenterThe CofenseTM Phishing Defense Center has observed a phishing email targeting Canadian taxpayers, similar to HMRC scams we recently reported in the United Kingdom. It’s the latest in a surge of tax-rebate phishing scams seen across the globe, prompting tax-collection agencies to issue consumer warnings.
Customer Satisfaction Survey Leads to Credential Phishing
July 31, 2018 by Marcel Feller in Phishing Defense CenterThe CofenseTM Phishing Defense Center (PDC) has observed a phishing campaign masquerading as a Customer Satisfaction Survey from Cathay Pacific. Fake surveys are an old tactic, but the PDC has recently seen an increase in their use. Examining the following email will show you what to look out for. At first look, the email appears to be a legitimate Satisfaction Survey. It is not uncommon to receive a reward for completing a survey, so that alone is not an Indicator of Phishing (IoP). However, as shown in Figure 1, the “Click here – Participate and Win” link feels out of...
A Very Convincing Tax-Rebate Phishing Campaign Is Targeting UK Users
July 19, 2018 by Milo Salvia in Phishing Defense CenterThe Cofense™ Phishing Defence Center has observed a convincing new phishing campaign targeting taxpaying UK nationals. The threat actors posing as Her Majesty’s Revenue and Customs (HMRC) have imitated the Government Gateway tool which is commonly used by UK citizens to access government services online. The threat actor attempts to convince victims that they are due a tax rebate of £458.21 using the lure below.
This “Man in the Inbox” Phishing Attack Highlights a Concerning Gap in Perimeter Technology Defenses
July 18, 2018 by Nick Guarino in Phishing Defense Center“Man in the Inbox” phishing attacks come from compromised email accounts. They look like someone from within a business, for example the HR director, sent an email directing employees to do something legitimate—like logging onto a fabricated page to read and agree to a corporate policy. When employees log on, the attackers harvest their credentials. These attacks are yet another example of increasingly sophisticated credential phishing.