Information Security

Clone Phishing

Clone PhishingClone phishing attacks are a new type of social engineering attack that can be more difficult to detect than typical phishing emails. Clone phishing attacks generally use a clone of a legitimate email to entice users to click a link or enter information. A standard clone phishing tactic would be an email that looks like it’s from PayPal on the same day of the month you typically receive your account balance notification. The email would look exactly like the one users receive every month and might even show a high or past-due balance to create urgency and make users more likely to click the link.

Another form of clone phishing can be a follow-up to an initial email. Clone phishing emails can appear to come from a company or colleagues inside your business if a business email compromise (BEC) has occurred. Hackers will resend the previous email and refer to updated links or resources in the new email. Since the attack is based on a previously received email, users are more likely to click on the new email to see what changed. Cloning the original email creates a more trusting environment where users are less likely to check links or email addresses. In the event of a business email compromise, the email could come from a real and trusted email address, increasing the likelihood that users will click the malicious link.

Like other phishing campaigns, the malicious links ask for personal information, login credentials, or credit card information which should be the first red flag for users. Criminals are also using clone phishing tactics to install malware which can be more challenging to detect.

Users should be aware of this new phishing tactic and be reminded to ‘think before you click’ especially during the holiday season. Like other phishing tactics, criminals try to create urgency with clone phishing to steal data. Click here to read our blog post on Holiday Phishing.

Quanexus IT Support Services for Dayton and Cincinnati

Request your free network assessment today. There is no hassle, or obligation.

If you would like more information, contact us here or call 937.885.7272.

Follow us on FacebookTwitter and LinkedIn and stay up to date on by subscribing to our email list.

Posted by Charles Wright in Back to Basics, Cybersecurity, Recent Posts, Small Business

Hive Ransomware

Hive ransomwareThe FBI and U.S. Cybersecurity and Infrastructure Security Agency (CISA) released an alert on the increased impact of Hive ransomware on businesses. “As of November 2022, Hive ransomware actors have victimized over 1,300 companies worldwide, receiving approximately US$100 million in ransom payments, according to FBI information.” from CISA alert. The attackers use Hive ransomware as a ransomware-as-a-service (RaaS) model and target a wide range of industries, from government and critical infrastructure to communication and manufacturing. However, the group targets Healthcare and Public Health (HPH) businesses by a large margin over all other sectors.

The group uses various attack vectors to infiltrate business networks. Investigation into the ransomware group has shown Hive gained access through remote desktop applications and virtual private networks (VPNs) with single-factor and multi-factor authentication (MFA) logins. The group also used traditional phishing emails with malicious logins to install malware. After gaining access, the group tried to cover its tracks by terminating processes related to backup and antivirus. They also deleted system logs that could help the company realize they have been infected.

The ransomware price is negotiated on the dark web, and criminals demand payment in Bitcoin. Hive actors also threaten to publish stolen data or reinfect business networks if the victim refuses to pay the ransom. “Hive actors have been known to reinfect—with either Hive ransomware or another ransomware variant—the networks of victim organizations who have restored their network without making a ransom payment.” from CISA alert.

The healthcare and public health sector was the leading industry targeted by ransomware in 2021 by a large margin. Financial services came in second with about one-third the number of attacks as healthcare. The healthcare sector is a favorite target for hackers because of the inconsistency of cybersecurity across the industry. Additionally, healthcare facilities store highly sensitive and personal data, so the probability of payment is higher when the criminal threatens to publish the data.

The alert listed several mitigations and preparations for a cyber incident, including monitoring external remote connections and implementing a recovery plan. Read the complete alert here.

Quanexus IT Support Services for Dayton and Cincinnati

Request your free network assessment today. There is no hassle, or obligation.

If you would like more information, contact us here or call 937.885.7272.

Follow us on FacebookTwitter and LinkedIn and stay up to date on by subscribing to our email list.

Posted by Charles Wright in Back to Basics, Cybersecurity, Information Security, Recent Posts, Small Business

Holiday Phishing

Holiday PhishingAs the holiday season quickly approaches, hackers are hard at work targeting businesses and consumers. Now is an excellent time to review traditional phishing methods and the evolution of tactics we’ve seen this year. Even though most people can recognize and avoid email phishing attacks, they still account for 90% of data breaches. This time of year, consumers look for deals in their emails, and criminals are getting much more strategic with phishing campaigns.

Hackers are trying to steal a wide variety of data with phishing techniques, including personal and financial information, login credentials for retail sites, or business login credentials to install malware and steal business data. Since the pandemic, shopping from work computers and accessing work data from personal computers has become such common practice criminals are using retail phishing tactics to attack business resources.

Email phishing is still the top phishing tactic, even with all the consumer education and email filtering. Phishing emails typically create urgency or work on the reader’s emotion to click a link. Phishing email campaigns target a large number of users, normally sent out to thousands of people, hoping a percentage will click on the link.

Spear phishing is the next most prominent type of phishing. Spear phishing campaigns target individual users with information pertinent to that person. Spear phishing emails may use your name, city, bank, workplace, or other publicly available information.

Smishing is the third most prominent type of phishing. Smishing uses text or SMS messages to initiate the attack. Common smishing techniques are fake discount deals, delivery confirmation, and password recovery.

All phishing attack vectors attempt to create urgency or work on the emotions of the user. They may offer a black Friday deal or say that your account needs attention because the password has been changed. A common vector is to ask the user to confirm an expensive online order or show a fake shipping confirmation for a retailer you frequent. The holiday season is a great time of year to remind employees and family members of the dangers and tactics of phishing campaigns.

Quanexus IT Support Services for Dayton and Cincinnati

Request your free network assessment today. There is no hassle, or obligation.

If you would like more information, contact us here or call 937.885.7272.

Follow us on FacebookTwitter and LinkedIn and stay up to date on by subscribing to our email list.

Posted by Charles Wright in Back to Basics, Cybersecurity, Information Security, Recent Posts, Small Business

LinkedIn Security Updates

LinkedIn Security UpdatesLinkedIn released some new security updates in an effort to combat fraud and bot accounts across the professional social media platform. LinkedIn is the most impersonated brand in phishing attacks by a considerable margin at 45% of impersonated attacks, with Microsoft as a distant second at 13%. Phishing on LinkedIn Messenger has also increased in popularity among criminals. Most phishing messages quickly ask users to take the conversation off LinkedIn and then attempt to steal money, information, or install spyware on the victim’s device.

LinkedIn also has a bot problem. The site started purging accounts early in October, and the move attracted attention online. Users who reported working for Amazon went from 1.2 million to 800,000, and users working for Apple went from 570,000 to 280,000 over the same 24-hour period. Cybersecurity professionals speculate that bot networks could generate broader attacks by connecting to industry professionals and scraping their public information.

LinkedIn introduced three security tools to help their professional community identify fraud and eliminate bots. The first tool is “About this profile,” which shows if the user has verified their phone number and work email address. The menu also indicates when the user joined the site, updated contact information, and profile photo. The move should help users identify fake accounts and make it more difficult for criminals to maintain multiple profiles.

Image from LinkedIn

The second tool LinkedIn identified is a photo scanner designed to flag AI-generated profile photos. Criminals are not just creating individual fake accounts to scrape the platform. To construct the droves of fake accounts needed, they are using AI-generated images as profile pictures.

The third tool is a messenger tool that alerts users and blocks the message when the potential criminal tries to move the conversation off the LinkedIn platform.

Image from LinkedIn

Example of new chat tool from LinkedIn shown above. The new tools aim to protect and educate users of the tactics used by criminals on the social media platform.

Quanexus IT Support Services for Dayton and Cincinnati

Request your free network assessment today. There is no hassle, or obligation.

If you would like more information, contact us here or call 937.885.7272.

Follow us on FacebookTwitter and LinkedIn and stay up to date on by subscribing to our email list.

Posted by Charles Wright in Cybersecurity, Information Security, Recent Posts, Small Business