Information Security

EDR and XDR Cybersecurity

Today on the blog, Jack talks through EDR and XDR security solutions for your business and why they are an evolution of the antivirus layer in the security stack.

Quanexus IT Support Services for Dayton and Cincinnati

Request your free network assessment today. There is no hassle, or obligation.

If you would like more information, contact us here or call 937.885.7272.

Follow us on FacebookTwitter and LinkedIn and stay up to date on by subscribing to our email list.

Posted by Charles Wright in Cybersecurity, Information Security, Recent Posts, Small Business

Hive Ransomware

Hive ransomwareThe FBI and U.S. Cybersecurity and Infrastructure Security Agency (CISA) released an alert on the increased impact of Hive ransomware on businesses. “As of November 2022, Hive ransomware actors have victimized over 1,300 companies worldwide, receiving approximately US$100 million in ransom payments, according to FBI information.” from CISA alert. The attackers use Hive ransomware as a ransomware-as-a-service (RaaS) model and target a wide range of industries, from government and critical infrastructure to communication and manufacturing. However, the group targets Healthcare and Public Health (HPH) businesses by a large margin over all other sectors.

The group uses various attack vectors to infiltrate business networks. Investigation into the ransomware group has shown Hive gained access through remote desktop applications and virtual private networks (VPNs) with single-factor and multi-factor authentication (MFA) logins. The group also used traditional phishing emails with malicious logins to install malware. After gaining access, the group tried to cover its tracks by terminating processes related to backup and antivirus. They also deleted system logs that could help the company realize they have been infected.

The ransomware price is negotiated on the dark web, and criminals demand payment in Bitcoin. Hive actors also threaten to publish stolen data or reinfect business networks if the victim refuses to pay the ransom. “Hive actors have been known to reinfect—with either Hive ransomware or another ransomware variant—the networks of victim organizations who have restored their network without making a ransom payment.” from CISA alert.

The healthcare and public health sector was the leading industry targeted by ransomware in 2021 by a large margin. Financial services came in second with about one-third the number of attacks as healthcare. The healthcare sector is a favorite target for hackers because of the inconsistency of cybersecurity across the industry. Additionally, healthcare facilities store highly sensitive and personal data, so the probability of payment is higher when the criminal threatens to publish the data.

The alert listed several mitigations and preparations for a cyber incident, including monitoring external remote connections and implementing a recovery plan. Read the complete alert here.

Quanexus IT Support Services for Dayton and Cincinnati

Request your free network assessment today. There is no hassle, or obligation.

If you would like more information, contact us here or call 937.885.7272.

Follow us on FacebookTwitter and LinkedIn and stay up to date on by subscribing to our email list.

Posted by Charles Wright in Back to Basics, Cybersecurity, Information Security, Recent Posts, Small Business

Holiday Phishing

Holiday PhishingAs the holiday season quickly approaches, hackers are hard at work targeting businesses and consumers. Now is an excellent time to review traditional phishing methods and the evolution of tactics we’ve seen this year. Even though most people can recognize and avoid email phishing attacks, they still account for 90% of data breaches. This time of year, consumers look for deals in their emails, and criminals are getting much more strategic with phishing campaigns.

Hackers are trying to steal a wide variety of data with phishing techniques, including personal and financial information, login credentials for retail sites, or business login credentials to install malware and steal business data. Since the pandemic, shopping from work computers and accessing work data from personal computers has become such common practice criminals are using retail phishing tactics to attack business resources.

Email phishing is still the top phishing tactic, even with all the consumer education and email filtering. Phishing emails typically create urgency or work on the reader’s emotion to click a link. Phishing email campaigns target a large number of users, normally sent out to thousands of people, hoping a percentage will click on the link.

Spear phishing is the next most prominent type of phishing. Spear phishing campaigns target individual users with information pertinent to that person. Spear phishing emails may use your name, city, bank, workplace, or other publicly available information.

Smishing is the third most prominent type of phishing. Smishing uses text or SMS messages to initiate the attack. Common smishing techniques are fake discount deals, delivery confirmation, and password recovery.

All phishing attack vectors attempt to create urgency or work on the emotions of the user. They may offer a black Friday deal or say that your account needs attention because the password has been changed. A common vector is to ask the user to confirm an expensive online order or show a fake shipping confirmation for a retailer you frequent. The holiday season is a great time of year to remind employees and family members of the dangers and tactics of phishing campaigns.

Quanexus IT Support Services for Dayton and Cincinnati

Request your free network assessment today. There is no hassle, or obligation.

If you would like more information, contact us here or call 937.885.7272.

Follow us on FacebookTwitter and LinkedIn and stay up to date on by subscribing to our email list.

Posted by Charles Wright in Back to Basics, Cybersecurity, Information Security, Recent Posts, Small Business

LinkedIn Security Updates

LinkedIn Security UpdatesLinkedIn released some new security updates in an effort to combat fraud and bot accounts across the professional social media platform. LinkedIn is the most impersonated brand in phishing attacks by a considerable margin at 45% of impersonated attacks, with Microsoft as a distant second at 13%. Phishing on LinkedIn Messenger has also increased in popularity among criminals. Most phishing messages quickly ask users to take the conversation off LinkedIn and then attempt to steal money, information, or install spyware on the victim’s device.

LinkedIn also has a bot problem. The site started purging accounts early in October, and the move attracted attention online. Users who reported working for Amazon went from 1.2 million to 800,000, and users working for Apple went from 570,000 to 280,000 over the same 24-hour period. Cybersecurity professionals speculate that bot networks could generate broader attacks by connecting to industry professionals and scraping their public information.

LinkedIn introduced three security tools to help their professional community identify fraud and eliminate bots. The first tool is “About this profile,” which shows if the user has verified their phone number and work email address. The menu also indicates when the user joined the site, updated contact information, and profile photo. The move should help users identify fake accounts and make it more difficult for criminals to maintain multiple profiles.

Image from LinkedIn

The second tool LinkedIn identified is a photo scanner designed to flag AI-generated profile photos. Criminals are not just creating individual fake accounts to scrape the platform. To construct the droves of fake accounts needed, they are using AI-generated images as profile pictures.

The third tool is a messenger tool that alerts users and blocks the message when the potential criminal tries to move the conversation off the LinkedIn platform.

Image from LinkedIn

Example of new chat tool from LinkedIn shown above. The new tools aim to protect and educate users of the tactics used by criminals on the social media platform.

Quanexus IT Support Services for Dayton and Cincinnati

Request your free network assessment today. There is no hassle, or obligation.

If you would like more information, contact us here or call 937.885.7272.

Follow us on FacebookTwitter and LinkedIn and stay up to date on by subscribing to our email list.

Posted by Charles Wright in Cybersecurity, Information Security, Recent Posts, Small Business