{"data":{"news":{"items":[{"title":"New Research Reveals 70% Increase in Phising Attacks on Employees During the Pandemic","date":"2021-09-13 15:00:47","id":3085,"author":"Ming En Liew","blurb":"","blurb_image_uid":"https://dxfpracgmlczp.cloudfront.net/2021/09/1631246885441_Untitled design 9.jpg","blurb_expanded_image_uid":null,"article":"\n\t\n\n\n

Sophos has released new research titled Phishing Insights 2021, revealing insights into the experience and understanding of phishing around the world in 2020. Results find that phishing attacks have spiked during the pandemic, as millions of work-from-home employees become a prime target for cybercriminals.

\n\n

Of the 5,400 IT decision makers polled across 30 countries, 70% of IT teams reported an increased number of phishing emails hitting their employees in the span of 2020. For organisations struck by ransomware during the year, this number rose to 82% of IT teams.

\n\n

While most (97%) of Singaporean organisations run cybersecurity awareness progress to address phishing, Sophos finds that many are still unable to agree on what exactly phishing is, and awareness and education is still lacking.

\n\n

Many IT professionals are still unable to agree on a single definition of phishing; 73% of respondents believe it to be “emails that falsely claim to be from a legitimate organisation, usually combined with a threat or request for information.\" Meanwhile, approximately two-thirds consider emails with a malicious attachment to be phishing, and more than one-third think threadjacking (when attackers insert themselves into a legitimate email thread as part of an attack) is phishing.

\n\n

These results reveal that phishing awareness and education programs need to consider the wide range of perceived phishing definitions and include training for non-technical employees that explain the different facets of phishing and email attacks in general. The importance of which is underscored by Chester Wisniewski, principal research scientist at Sophos.

\n\n

He says, \"Phishing has been around for over 25 years and remains an effective cyberattack technique. One of the reasons for its success is its ability to continuously evolve and diversify, tailoring attacks to topical issues or concerns, such as the pandemic, and playing on human emotions and trust.

\n\n

$\"Phishing$
\nExample of how phishing can escalate into a multi-million dollar cybersecurity attack. (Source: Sophos)

\n\n

\"The temptation for organisations is to see phishing attacks as a relatively low-level threat, but that underestimates their power. Phishing is often the first step in a complex, multi-stage attack. According to Sophos Rapid Response, attackers frequently use phishing emails to trick users into installing malware or sharing credentials that provide access to the corporate network. The team has seen at first-hand how a seemingly innocuous email can ultimately lead to a multi-million-dollar ransomware attack. Cryptojacking, data - and even financial - theft are all potential outcomes after a phishing attack has opened a door for adversaries.

\n\n

\"The ideal would be to prevent phishing emails from ever reaching their intended recipient. Effective email security solutions can go a long way towards achieving this, but this should be complemented by alert and primed employees who are able to spot and report suspicious messages before they get any further.”

\n\n\n","article_image_uid":"https://dxfpracgmlczp.cloudfront.net/2021/09/1631467890601_Untitled design 9.jpg","article_expanded_image_uid":null,"article_image_caption":"","publications":"5","tags":"Cybersecurity,phishing,Sophos","category":"Others"},{"title":"Office 365 Phishing Campaign Exploits Samsung, Adobe And Oxford Servers","date":"2020-06-28 19:12:59","id":2283,"author":"","blurb":"","blurb_image_uid":"https://dxfpracgmlczp.cloudfront.net/2020/06/1593343080650_black-and-gray-digital-device-193003.jpg","blurb_expanded_image_uid":null,"article":"\n\t\n\n\n

Hackers are designing sophisticated phishing attacks impersonating household names in order to bypass security filters to gain foothold into corporate networks.

\n\n

Hackers hijack Oxford's email server to send malicious emails to victims
43% of these attacks targeted European companies, while the rest were seen in Asia and Middle East
Hackers utilise a Samsung domain hosted on an Adobe server that was left unused since 2018's Cyber Monday event

\n\n

Hackers hijacked Oxford University's email server to send malicious emails to victims. The emails contained links that redirected to an Adobe server used by Samsung in the past, enabling hackers to leverage the façade of a legitimate Samsung domain to successfully trick victims. Ultimately, victims were led down a deceitful path to share their Office 365 log-in credentials.

\n\n

Oxford's Email Server Hijacked

\n\n

In early April 2020, Check Point researchers began observing emails sent to victims titled "Office 365 Voice Mail". The emails alleged that an incoming voice-message was waiting in a victim's voice-portal, prompting users to click on a button that would allegedly take them to their Office 365 account to take further action. After the victims clicked the button, they were redirected to a phishing page masquerading as the Office 365 login page.

\n\n

Most of the emails came from multiple generated addresses belonging to legitimate subdomains from different departments at the University of Oxford. The email headers show that the hackers found a way to abuse one of Oxford's SMTP (simple mail transfer protocol) servers, an application that's primary purpose is to send, receive, and/or relay outgoing mail between email senders and receivers. The use of legitimate Oxford SMTP servers enabled hackers to pass the reputation check required by security measures for the sender domain.

\n\n

Redirections from Samsung's Trusted URL

\n\n

Over the past year, Google and Adobe open redirects have been used by phishing campaigns in order to add legitimacy to the URLs used in the spam emails. An open redirect is an URL on a web site that can be used by anyone to redirect users to another site. In this case, the links in the email redirected to an Adobe server previously used by Samsung during a 2018 Cyber Monday marketing campaign. In other words, the link embedded in the original phishing email is part of the trusted Samsung domain stem – one that unknowingly redirects victims to a website hosted by the hackers. By using the specific Adobe Campaign link format and the legitimate domain, the attackers increased the chances for the email to bypass email security solutions based on reputation, blacklists and URL patterns.

\n\n

Safety Tips for Office 365 Users

\n\n

Use different passwords for your cloud application. Segregation protects your assets when one is exposed.
Use cloud and mail security solutions. The fact these campaigns thrive proves native security solution are easy to bypass - use cloud and mail security solutions to remove threats getting into your email and protecting you cloud infrastructure.
Don't enter your credentials when you didn't expect to do it. Often, it's a scam in disguise.

\n\n

Check Point has informed Oxford University, Adobe and Samsung of its findings. Adobe took the relevant actions to prevent this type of attack through its server across all customers.

\n\n\n","article_image_uid":"https://dxfpracgmlczp.cloudfront.net/2020/06/1593343082985_black-and-gray-digital-device-193003.jpg","article_expanded_image_uid":null,"article_image_caption":"Article by Check Point Software Technologies","publications":"5","tags":"phishing,office 365","category":"Others"},{"title":"Facebook Most Imitated Brand for Phishing Attempts","date":"2020-02-10 13:31:04","id":1999,"author":"","blurb":"","blurb_image_uid":"https://dxfpracgmlczp.cloudfront.net/2020/02/1581313093953_neonbrand-bo8CqGmjjrI-unsplash.jpg","blurb_expanded_image_uid":null,"article":"\n\t\n\n\n

Check Point Research, the Threat Intelligence arm of Check Point® Software Technologies Ltd., a leading provider of cyber security solutions globally, has published its new Brand Phishing Report for Q4 2019. The report highlights the brands which were most frequently imitated by criminals in their attempts to steal individuals' personal information or payment credentials during Q4, which includes the busiest online shopping periods of the year.

\n\n

In a brand phishing attack, criminals try to imitate the official website of a well-known brand by using a similar domain name or URL and web-page design to the genuine site. The link to the fake website can be sent to targeted individuals by email or text message, redirected during web browsing, or triggered from a fraudulent mobile application. The fake website often contains a form intended to steal users' credentials, payment details or other personal information.

\n\n

Top Phishing Brands In Q4 2019

\n\n

The top brands are ranked by their overall appearance in brand phishing attempts:

\n\n

Facebook (related to 18% of all brand phishing attempts globally)
Yahoo (10%)
Netflix (5%)
PayPal (5%)
Microsoft (3%)
Spotify (3%)
Apple (2%)
Google (2%)
Chase (2%)
Ray-Ban (2%)

\n\n

Top Phishing Brands By Platform

\n\n

During Q4 there were significant differences in the brands being used in each phishing vector: for example the focus in the mobile vector was on major technology & social media brands as well as banks, while in the email vector, #2 was part of a shopping phishing campaign before Black Friday in November 2019.

\n\n

Email (27% of all phishing attacks during Q4)

\n\n

Yahoo
Rbs (Ray-Ban Sunglasses)
Microsoft
DropBox

\n\n

Web (48% of all phishing attacks in Q4)

\n\n

Spotify
Microsoft
PayPal
Facebook

\n\n

Mobile (25% of all phishing attacks in Q4)

\n\n

Chase Mobile Banking
Facebook
Apple
PayPal

\n\n

"Cybercriminals are using a variety of attack vectors to trick their intended victims into giving up personal information and login credentials or transferring money. Although this is often done using spam emails, we have also seen attackers obtain credentials to email accounts, study their victim for weeks and craft a targeted attack against partners and customers to steal money," said Maya Horowitz, Director, Threat Intelligence and Research, Check Point Software Technologies. "Over the last two years, incidences of this type of attack have spiked with the increased use of cloud-based email, which makes it easier for criminals to disguise themselves as a trusted party. Phishing will continue to be a growing threat in 2020."

\n\n

Check Point's Brand Phishing Report is powered by Check Point's ThreatCloud intelligence, the largest collaborative network to fight cybercrime which delivers threat data and attack trends from a global network of threat sensors. The ThreatCloud database holds over 250 million addresses analysed for bot discovery, more than 11 million malware signatures and over 5.5 million infected websites, and identifies millions of malware types daily.

\n\n\n","article_image_uid":"https://dxfpracgmlczp.cloudfront.net/2020/02/1581313097398_neonbrand-bo8CqGmjjrI-unsplash.jpg","article_expanded_image_uid":null,"article_image_caption":"Article by Check Point Research","publications":"5","tags":"phishing","category":"Others"}],"pageInfo":{"hasNextPage":false,"hasPreviousPage":false,"totalCount":3,"totalPages":0,"currentIndex":0}}}}