Phish Found in Proofpoint-Protected Environments Week ending January 8, 2021

100% of the phish seen by the Cofense Phishing Defense Center (PDC) have been found in environments protected by secure email gateways (SEGs), were reported by humans, and analyzed and dispositioned by Cofense Triage.

Cofense solutions enable organizations to identify, analyze and quarantine email threats in minutes.

Are phishing emails evading your Proofpoint secure email gateway? The following are examples of phishing emails recently seen by the PDC in environments protected by Proofpoint.

TYPE: Trojan 

DESCRIPTION: Information on staffing updates-themed email found in environments protected by Proofpoint deliver TrickBot via attached Microsoft Office macroladen spreadsheets. 

TYPE: Trojan 

DESCRIPTION: Finance or response-themed email found in environments protected by Proofpoint deliver Microsoft Office macroladen documents directly attached or via attached passwordprotected archives. The documents download Emotet. 

TYPE: Credential Phish 

DESCRIPTION: Notification-themed email found in environments protected by Proofpoint deliver credential phishing via embedded links. 

Malicious emails continue to reach user inboxes, increasing the risk of account compromise, data breach, and ransomware attack. The same patterns and techniques are used week after week.

Recommendations

Cofense recommends that organizations train their personnel to identify and report suspicious emails. Cofense PhishMe customers should use SEG Miss templates to raise awareness of these attacks. Organizations should also invest in Cofense Triage and Cofense Vision to quickly analyze and quarantine the phishing attacks that evade secure email gateways.

Interested in seeing more? Search our Real Phishing Threats Database.

All third-party trademarks referenced by Cofense whether in logo form, name form or product form, or otherwise, remain the property of their respective holders, and use of these trademarks in no way indicates any relationship between Cofense and the holders of the trademarks. Any observations contained in this blog regarding circumvention of end point protections are based on observations at a point in time based on a specific set of system configurations. Subsequent updates or different configurations may be effective at stopping these or similar threats.

The Cofense® and PhishMe® names and logos, as well as any other Cofense product or service names or logos displayed on this blog are registered trademarks or trademarks of Cofense Inc.

Phish Found in Proofpoint-Protected Environments – Week ending December 18, 2020

100% of the phish seen by the Cofense Phishing Defense Center (PDC) have been found in environments protected by secure email gateways (SEGs), were reported by humans, and analyzed and dispositioned by Cofense Triage.

Cofense solutions enable organizations to identify, analyze and quarantine email threats in minutes.

Are phishing emails evading your Proofpoint secure email gateway? The following are examples of phishing emails recently seen by the PDC in environments protected by Proofpoint.

TYPE: Credential Phish 

DESCRIPTION: Notification-themed emails found in environments protected by Proofpoint, Microsoft ATP and Symantec deliver credential phishing via an embedded link. 

TYPE: Trojan 

DESCRIPTION: FedEx-spoofed emails found in environments protected by Proofpoint and Microsoft ATP deliver Async RAT via a OneDrive embedded link. 

TYPE: Ransomware 

DESCRIPTION: Copyright violation-themed emails found in environments protected by Proofpoint and Microsoft ATP deliver Makop ransomware via an ALZ attachment. 

Malicious emails continue to reach user inboxes, increasing the risk of account compromise, data breach, and ransomware attack. The same patterns and techniques are used week after week.

Recommendations

Cofense recommends that organizations train their personnel to identify and report suspicious emails. Cofense PhishMe customers should use SEG Miss templates to raise awareness of these attacks. Organizations should also invest in Cofense Triage and Cofense Vision to quickly analyze and quarantine the phishing attacks that evade Secure Email Gateways.

Interested in seeing more? Search our Real Phishing Threats Database.

All third-party trademarks referenced by Cofense whether in logo form, name form or product form, or otherwise, remain the property of their respective holders, and use of these trademarks in no way indicates any relationship between Cofense and the holders of the trademarks. Any observations contained in this blog regarding circumvention of end point protections are based on observations at a point in time based on a specific set of system configurations. Subsequent updates or different configurations may be effective at stopping these or similar threats.

The Cofense® and PhishMe® names and logos, as well as any other Cofense product or service names or logos displayed on this blog are registered trademarks or trademarks of Cofense Inc.

Cofense Now has Automated Phishing Detection and Response Capability

Auto Quarantine can identify and automatically remove malicious emails from recipients’ inboxes – often before users see or have a chance to open them. Auto Quarantine is powered by the Cofense Intelligence network of Cofense researchers, the Phishing Defense Center (PDC) team of analysts, and millions of people around the world identifying and reporting suspected phish. This high degree of automation significantly reduces the time to identify and resolve attacks, provides protection from threats that bypassed the secure email gateways (SEGs) every day, and lessens a security analyst’s time spent hunting malicious email.  

How it Works 

The Cofense team closely monitors the threat landscape and is able to leverage a global network of over 25 million human sensors identifying and reporting on suspicious emails, and a team of advanced researchers and intelligence analysts to create an unparalleled view of threats happening in real time around the world. The moment a threat is identified, Cofense analysts generate an Indicator of Compromise (IOC) tuned to stopping that threat. With Vision’s Auto Quarantine feature, these IOCs are used to identify malicious emails that have bypassed the SEG seconds after they are received. When a match is found, the email is auto quarantined where it can then be examined and, if appropriate, removed permanently. Current Cofense Vision users are observing several such threats being automatically addressed every day, thus significantly reducing the window of vulnerability to active email-borne threats like ransomware, business email compromise (BEC), malware attacks and credential theft.  

Here are some real customer stories: 

Fortune 500 Retail Organization: 

A large retail customer was an early adopter of Cofense Vision with Auto Quarantine. The account team provided an email to the customer with a recently identified public malicious phishing link. The email completely bypassed all the existing email security controls.  But within seconds, and before the recipient could open the email, Vision identified the email as a threat and auto quarantined it. This happened without any human intervention. 

Large, Full-service Mortgage Provider: 

This enterprise organization deployed Vision with the new Auto Quarantine feature across its organization.  During the first week, Vision identified six separate phishing campaigns. Each of these campaigns contained approximately 500 phishing emails that had bypassed existing email security technology and made it to recipient inboxes. The Vision Auto Quarantine functionality immediately quarantined the thousands of emails without analyst interaction and, before a recipient could open the email, quickly and effectively reduced risk to the organization. Prior to Vision, the team did not have visibility into the extent of phishing campaigns, nor any systematic way to identify and remove them.  

Global Construction Company: 

When this global construction company enabled Auto Quarantine, they saw an immediate impact.  A phishing campaign disguised as a Microsoft Teams invitation to a holiday party appeared shortly after Auto Quarantine was configured. The email was immediately identified as a phishing campaign and more than 200 emails were auto quarantined.  After the initial detection, the company continued to be targeted with the same phishing campaign and the auto quarantine functionality in Vision has continued to detect and remove several dozen more attacks. 

 In addition to the Auto Quarantine feature, Vision, a key component of the Cofense PDR platform, has additional enhancements that include:  

  • Reduced remediation time:Cofense Vision actively scans new and existing emails and automatically quarantines malicious emails in near real time. Updates to the user interface enabling Approve and Reject actions in more places in the UI, thus saving valuable time spent on threat remediation and IOC management, and reducing risk to the organization.   
  • Flexibility: Cofense Vision can be set to quarantine emails containing IOC matches automatically or, for more control, operator approval can be required. Cofense Vision also lets teams define an allowed IOCs list – a list of indicators that an organization knows to be safe.   
  • Visibility: Complete visibility into all events associated with Auto Quarantine. The Cofense Vision Audit page contains entries for configuration changes, creation of quarantine jobs, operator approvals, changes to the allowed IOCs list, and any updates to IOCs.   
  • Network effect: The power of Cofense Intelligence services provides IOCs in real time – the moment they are vetted and released by Cofense.  

 Andfor customers of the Managed Phishing Detection and Response (PDR) service, if a threat is found in one customer’s environment, that intelligence is used to detect and quarantine attacks in other customer environments. 

Phishing threats are human-developed, which is why Cofense is helping organizations out-human the phishing threat. By continuously updating our solutions with capabilities to remove real-world threats before anyone in the organization even sees them, Cofense is greatly reducing the risk of a phishing attack. 

Learn more about Cofense Vision and Auto Quarantine, here. 

All third-party trademarks referenced by Cofense whether in logo form, name form or product form, or otherwise, remain the property of their respective holders, and use of these trademarks in no way indicates any relationship between Cofense and the holders of the trademarks. Any observations contained in this blog regarding circumvention of end point protections are based on observations at a point in time based on a specific set of system configurations. Subsequent updates or different configurations may be effective at stopping these or similar threats. 
The Cofense® and PhishMe® names and logos, as well as any other Cofense product or service names or logos displayed on this blog are registered trademarks or trademarks of Cofense Inc. 

 

Strategic Analysis: Agent Tesla Expands Targeting and Networking Capabilities

A new iteration of the Agent Tesla keylogger has expanded on its data harvesting capabilities and exfiltration efforts in phishing campaigns primarily targeting India and ISPs. Cofense Intelligence recently alerted customers to Agent Tesla’s high volume compared to other keylogger families from January to August this year. The newest iteration of the keylogger added to that volume, likely as threat actors moved to adopt the updated version.

Threat actors who transition to this version of Agent Tesla gain the capability to target a wider range of stored credentials, including those for web browser, email, VPN and other services. This may indicate an increased interest in stolen credentials for a more specialized segment of the market or a particular kind of product or service. The update also includes networking capabilities that create a more robust set of exfiltration methods, including the use of the Telegram messaging service—adding to an overall trend of abusing trusted platforms to evade network-based detection. For Cofense Intelligence customers, technical details of these and other updates are available in the full report in ThreatHQ.

Figure 1: Top regions targeted by the different versions of Agent Tesla.

Figure 2: Top industries targeted by the different versions of Agent Tesla.

From August to December of this year, the newest iteration of Agent Tesla largely followed the same pattern as the older version in terms of targeted industries and regions. Figure 1 shows that both versions preferred to target email accounts in India more than any other region. The United States and Brazil were also among the top three most targeted regions. Figure 2 shows that Agent Tesla overwhelmingly targeted internet service providers (ISPs) over other industries. Utilities and financial services rounded out the top three targeted industries.

ISPs could be considered a major target for threat actors because of the other industry verticals that rely on them for essential functions. A compromised ISP could give threat actors access to organizations that have integrations and downstream permissions with the ISP. Subscribers would also be at risk, as ISPs often hold emails or other critical personal data that could be used to gain access to other accounts and services. In at least one incident, attackers reportedly targeted subscriber data of a compromised ISP in Austria.

Agent Tesla has been a major force within the phishing-threat landscape for years and has steadily evolved, likely in response to threat actors’ demands and improvements in network defenses. The variety of infection chains that use this keylogger family as its final payload are too numerous to list, which shows the versatility of this particular family. The fact that older versions of Agent Tesla keylogger are still successful today likely indicates that threat actors will be slow to adopt the newest version. However, once threat actors realize the benefits gained from updating to the newest version, they may transition more quickly as the new features might be necessary. Despite the dangerous capabilities of both versions of Agent Tesla, organizations can protect themselves by educating their employees and keeping proper mitigations in place.

All third-party trademarks referenced by Cofense whether in logo form, name form or product form, or otherwise, remain the property of their respective holders, and use of these trademarks in no way indicates any relationship between Cofense and the holders of the trademarks. Any observations contained in this blog regarding circumvention of end point protections are based on observations at a point in time based on a specific set of system configurations. Subsequent updates or different configurations may be effective at stopping these or similar threats.
The Cofense® and PhishMe® names and logos, as well as any other Cofense product or service names or logos displayed on this blog are registered trademarks or trademarks of Cofense Inc.

Phishing Emails Found in Proofpoint-Protected Environments

100% of the phish seen by the Cofense Phishing Defense Center (PDC) have been found in environments protected by secure email gateways (SEGs), were reported by humans, and analyzed and dispositioned by Cofense Triage.

Cofense solutions enable organizations to identify, analyze and quarantine email threats in minutes.

Are phishing emails evading your Proofpoint secure email gateway? The following are examples of phishing emails recently seen by the PDC in environments protected by Proofpoint.

TYPE: Trojan

DESCRIPTION: Finance-themed emails found in environments protected by Ironport, O365-ATP, Mimecast, Proofpoint and Symantec deliver the Dridex banking trojan via Microsoft Office macro-laden documents downloaded from embedded links.

TYPE: Agent Tesla Keylogger 

DESCRIPTION: Bank-spoofing emails found in environments protected by Proofpoint deliver an Agent Tesla Keylogger binary in an attached .iso archive.
Note: these are in the German language. 

TYPE: Credential Phish 

DESCRIPTION: Finance-themed emails found in environments protected by Proofpoint and Ironport deliver credential phishing via an attached HTM file. 

Malicious emails continue to reach user inboxes, increasing the risk of account compromise, data breach, and ransomware attack. The same patterns and techniques are used week after week.

Recommendations

Cofense recommends that organizations train their personnel to identify and report suspicious emails. Cofense PhishMe customers should use SEG Miss templates to raise awareness of these attacks. Organizations should also invest in Cofense Triage and Cofense Vision to quickly analyze and quarantine the phishing attacks that evade Secure Email Gateways.

Interested in seeing more? Search our Real Phishing Threats Database.

All third-party trademarks referenced by Cofense whether in logo form, name form or product form, or otherwise, remain the property of their respective holders, and use of these trademarks in no way indicates any relationship between Cofense and the holders of the trademarks. Any observations contained in this blog regarding circumvention of end point protections are based on observations at a point in time based on a specific set of system configurations. Subsequent updates or different configurations may be effective at stopping these or similar threats.

The Cofense® and PhishMe® names and logos, as well as any other Cofense product or service names or logos displayed on this blog are registered trademarks or trademarks of Cofense Inc.

2020 Phishing Email Attacks: 5 Predictions. 1 Pandemic. What Really Happened?

Last year, right about this time, we thought about the upcoming year and what we could expect to see from threat actors. We also had great hopes for leveraging the 20/20 Vision theme as we looked forward.  (I mean, how could we not tap into this theme with the launch of our own product appropriately named, Cofense Vision™ ?)  

And yet, here we are, looking back to determine how well we did with our predictions.  

 #1 Surgical Ransomware Attacks. Attackers will continue to choose their targets carefully to reap big payouts. Last year, we saw ransomware targeting state and local governments, with ransom payments escalating. This year, we saw a shift in tactics used by threat actors, sifting out data to ensure payment. In late October, we saw the U.S. authorities warn the healthcare industry with an alert of threat actors targeting the sector. Cofense quickly dug into the threat only to find the tactics were being used across multiple industry sectors. Read the Flash Alert post here. 

😐 #2 Healthcare and Genetic Testing Companies Will be Rich Targets for Monetizing Data. Genetic testing companies will be the healthcare industry’s bullseye. While we missed the mark with this prediction, we did see some healthcare entities targeted in data breaches, along with genetic testing facilities. Perhaps this would’ve been different if the focus hadn’t shifted to another world health concern. 

 #3 Elite Attacks on Cryptocurrency. Protecting cryptocurrency will require humans and technology. With greater focus on the cryptocurrency market and increasing value, we anticipated this would be a rich target for threat actors looking to rob the virtual bank – either targeting the exchanges or the individuals. As recently as November, we heard about Liquid confirming their exchange had suffered an attack. 

❌ #4 Info-Warfare that Tests Human Intuition. Whether fraud-for-profit or fake news, expect info to be more weaponized than ever. Heading into the U.S. presidential election, there was much anticipation of a repeat of the 2016 chain of events, beginning with a phishing email. With a greater focus from many entities within the public sector, as well as social media sites being more diligent and exacting tighter controls, we didn’t see an impact this year – which is a positive!

 #5 SIM-Jacking Aimed at Cryptocurrency and More. These inside jobs are another way to jack consumers, including you. Near the end of last year, we started to learn of incidents where telecom employees were making a quick buck to perform a simple task of swapping out a SIM card in order to gain access to an individual’s cryptocurrency account. Without fail, with the value of cryptocurrency continuing to climb, we did indeed see more of this threat.

But we can’t talk about 2020 without a mention of this year’s black swanthe coronavirus pandemic. While nobody could’ve predicted the pandemic, it was certainly a theme that threat actors didn’t shy away from in their lures and tactics. When it came to phish related to COVID, threat actors elevated their confidence by spoofing many of the legit authorities the world trusted for news from WHO to the CDC, while also targeting economic relief backing such as the U.S. Paycheck Protection Program (PPP) or UK HMRC.

All third-party trademarks referenced by Cofense whether in logo form, name form or product form, or otherwise, remain the property of their respective holders, and use of these trademarks in no way indicates any relationship between Cofense and the holders of the trademarks. Any observations contained in this blog regarding circumvention of end point protections are based on observations at a point in time based on a specific set of system configurations. Subsequent updates or different configurations may be effective at stopping these or similar threats. 

The Cofense® and PhishMe® names and logos, as well as any other Cofense product or service names or logos displayed on this blog are registered trademarks or trademarks of Cofense Inc.

Phish Found in Proofpoint-Protected Environments – Week ending December 4, 2020

100% of the phish seen by the Cofense Phishing Defense Center (PDC) have been found in environments protected by secure email gateways (SEGs), were reported by humans, and analyzed and dispositioned by Cofense Triage.

Cofense solutions enable organizations to identify, analyze and quarantine email threats in minutes.

Are phishing emails evading your Proofpoint secure email gateway? The following are examples of phishing emails recently seen by the PDC in environments protected by Proofpoint.

TYPE: Remote Access Trojan 

DESCRIPTION:  Finance-themed emails found in environments protected by Proofpoint deliver NanoCore RAT via embedded links. The embedded Dropbox links download a .Z archive that contains a NanoCore RAT executable. 

TYPE: Agent Tesla Keylogger 

DESCRIPTION: Inquiry-themed emails found in environments protected by Proofpoint deliver Agent Tesla keylogger via embedded links. The embedded Microsoft OneDrive links download a .RAR archive that contains an Agent Tesla executable. 

 

TYPE: Trojan 

DESCRIPTION:  Finance-themed emails found in environments protected by O365-ATP and Proofpoint deliver the banking trojan Dridex via Office macro laden documents downloaded from embedded links. 

Malicious emails continue to reach user inboxes, increasing the risk of account compromise, data breach, and ransomware attack. The same patterns and techniques are used week after week.

Recommendations

Cofense recommends that organizations train their personnel to identify and report suspicious emails. Cofense PhishMe customers should use SEG Miss templates to raise awareness of these attacks. Organizations should also invest in Cofense Triage and Cofense Vision to quickly analyze and quarantine the phishing attacks that evade Secure Email Gateways.

Interested in seeing more? Search our Real Phishing Threats Database.

All third-party trademarks referenced by Cofense whether in logo form, name form or product form, or otherwise, remain the property of their respective holders, and use of these trademarks in no way indicates any relationship between Cofense and the holders of the trademarks. Any observations contained in this blog regarding circumvention of end point protections are based on observations at a point in time based on a specific set of system configurations. Subsequent updates or different configurations may be effective at stopping these or similar threats.

The Cofense® and PhishMe® names and logos, as well as any other Cofense product or service names or logos displayed on this blog are registered trademarks or trademarks of Cofense Inc.

You Must Quarantine! Fake Office 365 Email Leads to Curiosity

By Kian Mahdavi, Cofense Phishing Defense Center

The Cofense Phishing Defense Center (PDC) has discovered a recent phishing campaign that has targeted Office 365 users and includea convincing Microsoft quarantine notification reference. The campaign was found in an environment protected by Microsoft’s own secure email gateway (SEG).  

Threat actors continue to leverage standard Microsoft notifications to entice the recipient into interacting with the email. We noticed two variants of this campaign.

The first example displayed above in Figure 1 showcases a fairly persuasive “Digest Summary Notification.” It displays the same HTML used within the legitimate notifications sent. However, if we look past the display name and dive a little deeper into the actual “from” address, we can see that it belongs to a compromised account belonging to an environmental firm: wettle@redacted [.]com. We can only assume the attacker was hoping the reader wouldn’t notice the domain has no relation to Microsoft.

The example in question also illustrates a move away from the traditional narrative used to lure recipients. This attacker has opted out of using urgency language with terms such as “urgent” or “you must.” As a result, the reader may overlook the threat and become curious enough to engage with the email, opting to review the “important message.”   

Should the user hover over the “Review” option, the URL path will clearly display the redirect that has no relation to Office or Microsoft. It will instead direct the user to “googleads,” taking them immediately to the phishing landing page. We can assume the reason for this is to evade detection and bypass existing security measures with whitelisted URLs.

Figure 2  Encoded body of email 

The second campaign is a little more unusual at first glance as the entire email body has been encoded. The attacker may have done this to evade existing security controls, assuming that, once the email was opened, it would decode to reveal the email message in plain textThe email message did not decode, revealing a rather confusing layout and raising red flags immediately. This may have been caused by a bug in the threat actors toolkit. We later decoded the text to reveal several links of which most were benign, to which we narrowed down the malicious link through trial and error that led to the matching phishing landing page below:   

 hXXps://authsignin[.]website[.]yandexcloud[.]net/ 

As seen above in Figure 3, the phishing landing page has been carefully designed to replicate the official Office 365 login page, luring users into thinking they are authenticating via a genuine service. Assuming users logged in with their true Microsoft credentials, their personal data could unfortunately be in the hands of the threat actor. 

 Attackers are always exploring new sophisticated tools and techniques, as demonstrated in the above examples, to bypass the SEG. Cofense PDC uses human detection and auto response to remediate and quarantine such threats, and continues to evolve to stay ahead of the latest phishing and malware threats. 

Indicators of Compromise 

 

Network IOC   IP 
hXXps://googleads[.]g[.]doubleclick[.]net/pcs/click?xai=AKAOjssIdZGtK2LGw4coQMwtQcONuf8cVZUVHUrlFgT33_wiLCuxpoweUvHdBH9neY4iW-CZh2SzgITptx6j64F0B2pEU0uoeRfmKTeyn7LSG5Irubqjv6IFl9MeqTp84ZT99WRJlZDMgrwUaUI7QjgNwL22AVveJm980wuVNryiILT2WhxCPmcY8M7PVIOygAXT_382p7PUn7bIByn2OjlTfCiaqta3tAhZWCuROeXZPznm5cGhgUYspVywPb8Y8GbuT5pyEUyF89icmqe5zg&sig=Cg0ArKJSzFtr0kI2Y6Ll&adurl=https:%2F%2Fauthsignin.website%E2%80%8B.yandexcloud.net%23  172[.]217[.]7[.]226 
hXXps://authsignin[.]website[.]yandexcloud[.]net/  213[.]180[.]193[.]247 
hXXps://auth-1304164361[.]cos[.]ap-seoul[.]myqcloud[.]com/index.html  119[.]28[.]148[.]128 

119[.]28[.]148[.]172 

119[.]28[.]148[.]150 

hXXps://authsignin[.]website[.]yandexcloud[.]net/  213[.]180[.]193[.]247 
All third-party trademarks referenced byCofensewhether in logo form, name form or product form, or otherwise, remain the property of their respective holders, and use of these trademarks in no way indicates any relationship betweenCofenseand the holders of the trademarks. Any observations contained in this blog regarding circumvention of end point protections are based on observations at a point in time based on a specific set of system configurations. Subsequent updates or differentconfigurations may be effective at stopping these or similar threats.
  
TheCofense® and PhishMe® names and logos, as well as any otherCofenseproduct or service names or logos displayed on this blog are registered trademarks or trademarks ofCofenseInc.    

Cofense Phishing Detection and Response Platform

The phishing story is not new. In fact, if anything, we are far more aware of phishing threats than we’ve ever been. Here are some things to think about: 

  • Attackers are human and constantly innovating to bypass technology 
  • 96% of breaches start with a phish 
  • Phish are easily bypassing gateway technology 
  • Business email accounts are routinely compromised (BEC) 
  • Many organizations are forced to pay ransomware bounties 
  • Large financial losses are occurring from compliance fines, loss of customers, IP theft, and recovery costs 
  • SOC analysts are overwhelmed performing incident response 
  • Awareness training can be ineffective if it is not aligned with real threats 
  • Artificial Intelligence that is deployed to detect phish is failing 

We’ll stop there – it’s 2020 after all, and there’s been enough bad news. So, here’s something good: 

Today, Cofense introduced its Phishing Detection and Response (PDR) platform, a solution designed specifically for enterprise organizations. As phishing attacks continue to become more sophisticated, persistent, and adaptive to legacy security defenses, demand for an extensive phishing defense solution is at an all-time high, and the need is critical. The Cofense PDR platform provides a comprehensive approach to stop phishing attacks through globally crowd-sourced phishing intelligence from 25 million people, combined with advanced automation.   

Cofense’s PDR platform can be deployed as an integrated suite of products or as comprehensive managed PDR service through our Phishing Defense Center (PDC). Both options effectively stop phishing attacks and combat the acuity of attackers through a combination of people and automated technology that quickly reduces and removes the risk.  

Cofense’s PDR platform is the most holistic solution on the market, and includes: 

  • PhishMe: Completely rearchitected to address the needs of enterprise-size organizations, users can more easily and efficiently run phishing simulations and manage their security awareness program; carefully crafted simulations based on real – not theoretical – phish immerse users in the experience of being phished from end to end, improving an organization’s resiliency to attacks. 
  • Triage: The first phishing-specific orchestration, automation and response solution that helps identify active phishing attacks in progress; suspected phish are rapidly clustered and analyzed by SOC analysts who queue indicators for remediation. 
  • VisionDriven by automation, Vision quickly identifies all recipients of phishing attacks and automatically quarantines and removes the threat from all mailboxes; enables SOC and IR teams to proactively hunt for unreported threats, IOCs and TTPs, and creates transparent audit and governance of mitigation actions. 
  • Reporter: Report suspicious emails and notify security teams in real time — with just one click. Users flag potential threats and the original email and other valuable information is sent directly to an organization’s SOC be quickly analyzeand the attack stoppedInstant feedback reinforces user training, strengthening the front line of defense. And with quick deployment and PC, Mac, and mobile device compatibility, it’s easy to get any team up and running. 
  • Intelligence: Proprietary global collection sources provide an extensive real-time view into threat campaigns observed in the wild; delivers high-fidelity, phishingspecific alerts and intelligence, providing accurate and timely assessments of both the current phishing threat landscape and emerging trends. Information from the Intel solution can be easily integrated with existing SOARs, SIEMs and TIPs.

Cofense Managed PDR 

  • For enterprise organizations that prefer to seek managed solutions, the Cofense PDC team delivers Managed PDR, handling the entire phishing detection and response process. Security operators gain the expertise and resources — and the peace of mind — needed to proactively defend against current or emerging threats with unparalleled outcomes when they engagCofense’s Managed PDR. In fact, you can read about how the PDC team stopped and removed an attack in less than 10 minutes.

 With the Cofense PDR Platform, you get:  

  • A global network of 25 million people actively identifying and reporting suspected phish 
  • Automation technology to quickly analyze, verify and quarantine phish throughout an organization 
  • Shared intelligence across teams and with others in a global network  
  • Effective, real-world phish simulation training 
  • Solutions delivered as integrated products or managed service 

 The Cofense combination of human detection with automated response and intelligence allows organizations to detect phish in their environment, educate employees on how to identify and report phish, and respond quickly to remediate the threats before there is harm done to their organization. Cofense is the only PDR platform, and the only one to provide all of these capabilities in one solution. Our goal is to enable every company to defend itself against phishing threats. And with the strength of our global Cofense network, together we can OutHuman the Threat.  

Learn more about Cofense and PDR, here.  

All third-party trademarks referenced by Cofense whether in logo form, name form or product form, or otherwise, remain the property of their respective holders, and use of these trademarks in no way indicates any relationship between Cofense and the holders of the trademarks. Any observations contained in this blog regarding circumvention of end point protections are based on observations at a point in time based on a specific set of system configurations. Subsequent updates or different configurations may be effective at stopping these or similar threats.  
The Cofense® and PhishMe® names and logos, as well as any other Cofense product or service names or logos displayed on this blog are registered trademarks or trademarks of Cofense Inc.