Losses to phishing attacks increased by 76% last year, with almost one-third of companies losing money to successful phishing attacks according to Proofpoint’s recently published 2023 State of the Phish Report. In 2022, more than 4 out of 5 surveyed organizations experienced at least one successful phishing attack, with more than half of those organizations experiencing at least three successful phishing attacks. The data for the report came from a global survey of 7,500 working adults, 1,050 IT security professionals, and the results of more than 135 million simulated phishing emails over 12 months.

Phishing is one of the most commonly used initial access vectors in cyberattacks, commonly leading to costly account compromises, data breaches, and ransomware attacks. Phishing is usually associated with email, but 2022 saw a marked increase in telephone-oriented attack delivery (TOAD). These attacks typically involve emails urging the recipient to call a customer service hotline to resolve a security or account issue. Call centers are established – often in India – and the operators convince victims to install remote access software, install malware, or instruct them to transfer money.  Proofpoint says during peak times, more than 6000,000 TOAD messages were sent per day last year, with message volume averaging between 300,000  and 400,000 per day. TOAD attacks have increased steadily since 2021 due to the success of this technique. Since the initial contact occurs via email with no hyperlinks or attachments, email security solutions fail to quarantine or reject the messages ensuring a high delivery rate.

In response to the move by Microsoft to disable macros in Internet-delivered Office documents and increasing adoption of multi-factor authentication, cyber threat actors have had to get more creative and develop new techniques for malware delivery and phishing methods capable of bypassing MFA are being adopted at scale. Proofpoint reports an increase in MFA bypass by phishing-as-a-service providers, who now offer that capability in their off-the-shelf phishing kits. Rather than directing users to phishing websites, these adversary-in-the-middle attacks allow threat actors to present legitimate websites to victims and capture credentials and MFA codes/session cookies, allowing access to accounts that are protected by MFA. These attacks were conducted at scale in 2022 and pose a significant threat to organizations of all sizes.

The phishing simulation data highlights continued problems in human defenses and a lack of security awareness among employees. Teaching security best practices and training employees how to recognize threats such as phishing can significantly improve security posture and while more organizations are investing in training for employees, only 55% of organizations have a security awareness program for all employees and despite the benefits of conducting phishing simulations, only 35% of organizations use phishing simulations as part of the training process.

Awareness of cyber threats is improving but there is still a long way to go. For instance, 44% of people think emails are safe if they contain familiar branding, and even basic cybersecurity concepts are still poorly understood. One-third of working adults were unable to define malware, phishing, and ransomware, and there has been little change in understanding since 2021. One-third of people took risky actions such as clicking links in emails, opening attachments, or downloading malware, and alarmingly, 63% of the adults surveyed thought links in emails always direct them to the matching website or brand. Poor password practices also persist. 28% of users admit to reusing passwords for multiple work-related accounts, 26% save work passwords in their browsers, 16% manually rotate 1-4 passwords, and only 18% of respondents use a password manager.

The majority of surveyed organizations said they have implemented at least some form of security awareness training, but many are struggling to make those programs effective. 27% of respondents said failure rates to phishing emails have largely remained unchanged, even after conducting security awareness training. That suggests more time and effort needs to be put into training, especially as 80% of organizations admitted to providing only 2 hours or less of training each year. The full findings and recommendations are available in the Proofpoint report.

The post Losses to Phishing Attacks Increased by 76% in 2022 appeared first on HIPAA Journal.

Business Email Compromise scams are the biggest cause of losses to cybercrime. Over the past 5 years, more than $43 billion has been lost to the scams, according to the FBI’s Internet Crime Complaint Center (IC3). In its March 2022 report, the FBI said IC3 had received reports of $2.4 billion in losses to BEC attacks in the last year across almost 20,000 reported attacks, and attacks are continuing to increase. According to a new study by Abnormal Security, between H1 and H2 2022, there was an 81% increase in BEC attacks and a 147% increase in BEC attacks on small businesses over that same period. There are no signs of the attacks slowing, and in all likelihood, they will continue to increase.

BEC attacks target human weaknesses. The attackers use social engineering techniques to trick employees into making fraudulent wire transfers, changing bank account information for upcoming vendor payments, changing direct deposit information for employees, purchasing gift cards, and disclosing sensitive data. As with phishing attacks, fear and urgency are used to get employees to respond quickly without verifying the legitimacy of the request. These attacks typically use a compromised email account or the sender is spoofed, and that individual is impersonated. Many employees open these emails and an alarming percentage reply and engage with the scammers.

Email-based attacks, such as BEC, phishing, extortion, scams, and malware continue to increase. According to Abnormal Security, email attack volume increased by 22% overall, rising from an average of 85.13 attacks per 1,000 mailboxes in H1 2022 to 104.04 attacks per 1,000 mailboxes in H2 2022. While the increase in attacks is a cause of concern, more worrying is the number of employees that engage with the attackers and fail to identify and report email threats.

Abnormal Security monitored the email environments of hundreds of organizations between July and December 2022 and found the median open rate for text-based BEC attacks was 28% and the average read rate was 20%. While opening and reading these emails does not necessarily mean that the employee will ultimately be fooled by the scam, on average, 15% of the malicious emails were replied to.

Abnormal Security reports that while only 0.28% of employees engaged with more than one attack, more than one-third of replies were initiated by employees who had previously engaged with a scammer in an earlier attack. This could indicate a lack of training in response to the first attack to the failure of the employees to take their training on board. It is also possible that certain employees are targeted frequently due to their role in the organization, and the more BEC emails an individual receives, the greater the chance that they will eventually mistake an attack for a legitimate email request.

While employees in transportation were the most likely to reply to these attacks, the reply rates were also high in healthcare, which ranked third with a reply rate of 8.22%. Abnormal Security suggests the healthcare industry is particularly susceptible to these types of attacks, as the industry attracts people who have a strong desire to help others and there is often a high turnover rate in hospitals and large health systems, making it more likely that employees would not know their colleagues personally, which makes impersonation much easier.

The study also revealed an alarmingly low reporting rate for these emails. On average, only 2.1% of all known attacks are reported by employees to their security teams, and the majority of messages that are reported to the security team – 84% – are not malicious. The findings of the study highlight the importance of conducting ongoing security awareness training, with a strong emphasis on phishing and BEC attacks. Organizations should also consider conducting phishing and BEC attack simulations, as the data from these simulations indicate that this is one of the most effective ways of training. Organizations should make it as easy as possible for employees to report potential threats and reporting should be encouraged. A mail client add-on that allows single-click reporting of potentially malicious emails should be considered.

As Abnormal Security points out, even with training, employees are likely to make mistakes, so the best defense is to ensure that these malicious emails are blocked and do not land in inboxes, which means upgrading from a traditional email security solution to one that incorporates machine learning/AI algorithms capable of detecting small anomalies in email content.

“Because advanced email attacks like business email compromise and supply chain compromise exploit trusted email accounts and relationships, organizations need email security that can detect even small shifts in activity and content,” explained Abnormal Security in the report. “The most effective email security platforms baseline known-good behavior across employees and vendors, and then detect and remediate malicious emails in milliseconds to prevent end-user engagement.

The post 28% BEC Emails are Opened and 15% Get a Reply appeared first on HIPAA Journal.

Cybercriminals are increasingly using legitimate remote monitoring and management (RMM) software in their attacks, according to a recent joint alert from the Cybersecurity and Infrastructure Security Agency (CISA), the National Security Agency (NSA), and the Multi-State Information Sharing and Analysis Center (MS-ISAC).

The campaign was first identified in October 2022 and involves callback phishing. The emails used in this campaign are difficult for email security solutions to identify as malicious as they contain no malicious hyperlinks or attachments. The emails notify the recipient about an impending charge and a phone number is provided in the email for the user to call if they want to avoid the charge being applied.

The charges typically relate to a software solution that is coming to the end of a free trial. The user is told that the full price of the software will be charged to the user’s account if no action is taken. Due to the high cost of the software, there is a reasonably high chance that the number will be called. The call is answered and social engineering techniques are used to convince the user to navigate to a malicious domain and download software, which they are told is required to remove the software and prevent the charge. The software connects to a second-stage domain and downloads a portable version of legitimate remote access software such as AnyDesk and ScreenConnect. If executed, the software will connect to the attacker’s RMM server and provide the attacker with access to the user’s device.

The self-contained, portable versions of these remote access solutions do not require an installation, and as such do not require administrator privileges. Organizations may have security controls in place to prohibit the installation of this software on the network, but portable versions will bypass these security controls and will allow the attacker to access the user’s device as a local user. They can then move to other vulnerable machines within the local intranet or establish persistent access as a local user service.  One of the main aims of these attacks is to trick users into logging into their bank accounts to initiate a refund scam. The attackers remain connected while the user accesses their bank account, and the user’s bank account summary is modified to make it appear that an excess amount of money had been refunded. The user was then told to refund the excess to the operator of the scam.

CISA conducted a retrospective analysis of the federal civilian executive branch (FCEB) intrusion detection system (IDS) based on third-party reporting and identified malicious activity on two FCEB networks that had been compromised using this technique. Further analysis identified malicious activity on many other FCEB networks, which the agencies were able to link to a broader financially motivated phishing campaign, related to a typosquatting campaign uncovered by Silent Push that spoofed Amazon, Microsoft, Geek Squad, McAfee, Norton, and PayPal domains. Initially, this campaign involved helpdesk-themed emails that directed users to a website spoofing one of these brands, then they started conducting callback phishing attacks. The campaign has been active since at least June 2022.

While this campaign leverages AnyDesk and ScreenConnect, other types of RMM software could be packaged into self-contained portable executables. These types of attacks are far easier to conduct than creating custom malware that provides remote access and distributing that malware in phishing emails. The federal agencies encourage all FCEB agencies and network defenders at other organizations to review the Indicators of Compromise (IOCs) and mitigations provided in the security alert to protect against the malicious use of RMM software.

The post Feds Warn of Malicious Use of RMM Software in Callback Phishing Attacks appeared first on HIPAA Journal.

A malicious phishing campaign has been identified that is targeting healthcare providers. The emails have an Evernote-themed lure to trick recipients into downloading a Trojan file that generates a login prompt to steal credentials.

The Health Information Cybersecurity Coordination Center (HC3) has recently issued an alert about the campaign which has targeted several healthcare providers in the United States.  Malicious emails are sent to targeted organizations that contain a malicious link to an Evernote-themed website. The emails are personalized and the lures used in the phishing emails may vary; however, the emails seen by HC3 have the subject line “[Organization Name] [Date] Business Review” and have a Secure Message theme.

Evernote Phishing Campaign. Source: HC3

The link included in the email directs the user to the Evernote site, where they are prompted to download an HTML file – called message (3).html. The file includes JavaScript code that renders an Adobe or Microsoft-themed page that attempts to harvest Outlook, IONOS, AOL, or other credentials.

The credentials obtained in phishing campaigns such as this can give cyber threat actors access to email accounts, which can contain significant amounts of sensitive data, including protected health information. Compromised email accounts can be used to conduct phishing attacks internally and can give threat actors the foothold they need to conduct more extensive attacks on the organization. Many ransomware attacks start with phishing emails.

Protecting against phishing attacks requires a combination of measures, including email security solutions for blocking phishing emails, web filters for preventing access to malicious websites where malware is downloaded, and antivirus software for identifying Trojans and other malicious code. It is also important to provide regular security awareness training to the workforce on the risks of phishing and train employees on how to recognize phishing emails.

Further information on this phishing campaign, along with other recommended mitigations, can be found in the HC3 security alert.

The post Healthcare Providers Targeted in Evernote Phishing Campaign appeared first on HIPAA Journal.

Microsoft has warned of a large-scale phishing campaign targeting Office 365 credentials that bypasses multi-factor authentication (MFA). The campaign is ongoing and more than 10,000 organizations have been targeted by scammers in the past 10 months.

Microsoft reports that one of the phishing runs used emails with HTML file attachments, with the email telling the user about a Microsoft voicemail message that had been received. The HTML file had to be opened to download the message. The HTML file serves as a gatekeeper, ensuring the targeted user was arriving at the URL from a redirect from the original attachment.

The user is redirected to a website that hosts a popular open source phishing kit, which is used to harvest credentials. The user is told that they need to sign in to their Microsoft account to receive the voicemail message and after sign in an email will be sent to the user’s mailbox within an hour with the MP3 voicemail message attached. The user’s email address is auto-filled into the login window and the user only needs to enter their password.

This campaign is referred to as an adversary-in-the-middle (AiTM) phishing attack, as the phishing site sites between the targeted user and the genuine resource they are attempting to log into. Two different Transport Layer Security (TLS) sessions are used, one between the user and the attacker and another between the attacker and the genuine resource.

When credentials are entered on the attacker-controlled site, they are passed to the genuine resource. The response from the genuine resource is passed to the attacker, which is then relayed to the user. In addition to harvesting credentials, session cookies are stolen. The session cookie is injected into the browser to skip the authentication process, which still works even if multi-factor authentication is enabled. The phishing kit automates the entire process.

Source: Microsoft

Once the attacker has access to the user’s Office 365 email, the messages in the account are read to identify potential targets for the next phase of the attack. The attacker then sets up mailbox rules that mark certain messages as read and moves them to the archive folder to prevent the user from detecting their mailbox has been compromised. A business email compromise (BEC) scam is then conducted on the targets.

Message threads are hijacked, and the attacker inserts their own content to attempt to get the targeted individual to make a fraudulent wire transfer to an account under the control of the attacker. Since the emails are replies to previous communications, the recipient is likely to believe they are in a genuine conversation with the account owner, when they are only communicating with the attacker.

Microsoft said it takes as little as five minutes from the theft of credentials and session cookies for the first BEC email to be sent. With all replies to the request being automatically sent to the archive, the attacker can simply check the archive for any replies and does so every few hours. They are also able to identify any further potential targets to conduct BEC scams on. While the account compromise is automated, the BEC attacks appear to be conducted manually. Any emails sent or received are manually deleted from the archive folder and sent folder to avoid detection. BEC attacks such as this can involve fraudulent transfers of thousands or even millions of dollars.

Defending against these attacks requires advanced email security solutions that scan inbound and outbound emails and can also block access to malicious websites – an email security solution and a DNS filter for instance. Microsoft also recommends implementing conditional access policies that restrict account access to specific devices or IP addresses. Microsoft also recommends continuously monitoring emails for suspicious or anomalous activities, such as sign-in attempts with suspicious characteristics.

With respect to the MFA bypass, Microsoft stresses that while AiTM attacks can bypass MFA, MFA remains an important security measure and is effective at blocking many threats. Microsoft suggests making MFA implementations “phish-resistant” by using solutions that support Fast ID Online (FIDO) v2.0 and certificate-based authentication.

The post Over 10,000 Organizations Targeted in Ongoing MFA-Bypassing Phishing and BEC Campaign appeared first on HIPAA Journal.