PhishMe is SOC 2 compliant. Here’s how that helps you.
February 9, 2018 by Cofense in PhishingInformation security is important to everyone, in particular organizations that outsource operations to third-party vendors (like SaaS or cloud-computing providers). If data isn’t handled securely, an organization’s risk of exposure to data theft, extortion and malware increases dramatically.
Missing in Action: Several Prominent Malware of 2017
February 9, 2018 by Mollie Holleman in PhishingThus far in 2018, PhishMe Intelligence™ has observed a lull in multiple malware families that were prominent throughout 2017. There are several possible reasons for this hiatus.
Another wave of Brazilian malspam leads to banking trojan
February 9, 2018 by Cofense in PhishingIn October of 2017 we blogged about a phishing campaign specifically targeting Brazilian Portuguese- speaking users. Back then, the campaign distributed a malicious Chrome browser extension. More recently, we have observed a wave of emails that have remarkably similar characteristics. This time around, the malware of choice is a banking trojan.
Identify, Prioritize, and Respond to Phishing Threats Faster with PhishMe and ServiceNow
January 25, 2018 by Cofense in Malware AnalysisCyber Incident ResponseImprove the Phishing Incident Response Workflow with PhishMe Triage™ and ServiceNow® Security Operations Security leaders are bolstering their resiliency to phishing attacks. It starts with conditioning employees to recognize and report suspicious email. Take for example “Alice,” the CISO for a Fortune 100 company. Alice’s team regularly simulates real-world phishing on employees at all levels. The program involves behavioral conditioning that requires employees to report simulated and real attacks.
Love Hurts – But Catphishing Doesn’t Have To
January 24, 2018 by Cofense in Internet Security AwarenessFor the past few years we have discussed the power of emotion in phishing emails. This is never more valuable to understand than during the upcoming Valentine’s season. The traditions of gift giving to current partners and the romanticized notions of hearing from a secret admirer are so firmly ingrained in our minds that we become easy targets for scam artists.
Refocus Your Anti-Phishing From Vulnerability To Capability.
January 22, 2018 by Cofense in Internet Security AwarenessIn our 2017 Enterprise Phishing Resiliency and Defense Report, PhishMe® discusses the importance of moving past susceptibility as a key indicator of anti-phishing program success. We want to shift the conversation from vulnerability (susceptibility) to capability (resiliency). That is, what are an organization’s current anti-phishing capabilities—and how is positive behavior increasing them over time to build resiliency? The chart below tracks behavior among our clients’ users during phishing simulations. In it, resiliency equals users that “reported only” divided by “all that fell susceptible.” (The latter includes those that reported after falling for simulated phishes.) Figure 1 – Three-year Resiliency Trend...
PhishMe Clients Are Reporting Ransomware Emails. Are You?
January 19, 2018 by Cofense in Internet Security AwarenessWith the steady rise in ransomware attacks and success, it’s highly likely that related phishing variants will continue to permeate the landscape in 2018. While this is not a new threat, it’s one that you want to be truly prepared to face. With that in mind, we looked back into our 2017 data and what we found is good news for those clients running active threat ransomware simulations in their environment. Across 246 simulations and more than 712k emails, the aggregate resiliency score was 2.63. This means that for every susceptible user, there were more than 2 that reported the...
This Well-Trained User Caught a Phish
January 18, 2018 by Cofense in Malware AnalysisCyber Incident ResponseAs security professionals, we often view our users as a potential liability. I have plenty of first-hand experience that confirms the trope myself. But what if users could become a strength instead of a chronic risk?
New Enhancements Help Streamline Incident Response with PhishMe Triage
December 22, 2017 by Cofense in PhishingWith security analysts pulled in many directions, they must be able to prioritize and invoke incident response on ransomware, business email compromise (BEC), malware infections, and credential-based theft emails. The key to this is the automation and streamlining of the incident response. PhishMe Triage™ has been updated with new features to help security analysts and incident response teams streamline their processes and secure administrative access. Key Features this Release Tighter Integration – Authenticated API for integration across the incident response team Additional Security – Two-factor authentication for PhishMe Triage users More Accountability – Audit logs are generated for all users...
Zeus Panda Prominent in Italian-Language Phishing Throughout 2017
December 22, 2017 by Mollie Holleman in Malware AnalysisIn 2017, PhishMe® analyzed over 40 Italian-language phishing campaigns that targeted victims with Zeus Panda. This popular multipurpose banking trojan is primarily designed to steal banking and other credentials, but is capable of much more as it provides attackers with a great deal of flexibility. Although some variation was observed, many of these campaigns demonstrated a large degree of shared tactics, techniques and procedures (TTPs). Given the prolific nature of these campaigns, it is likely that Italian-language phish will continue to deliver Zeus Panda in 2018. Organizations should be alert to the indicators of compromise and phishing TTPs to prevent...