Input: Search Free Trial Get Demo Malicious Excel Add-in Variant Delivers Malware April 26, 2022 XLL is an Excel Add-in extension file that provides ways to use third-party tools and functions that are not available in Microsoft Excel. It is typically a Dynamic Link Library DLL file that can be loaded by Microsoft Excel provided the file uses the .xll extension. We have seen a surge of malware campaigns and attacks that were using XLL malware. Most of the malicious XLL files that we encountered utilized the open-source framework named Excel-DNA. Excel-DNA is a framework which allows you to create native XLL files using C or Visual Basic.NET. It also allows you to create user-defined functions, custom ribbons and many more. Palo Altos Unit 42 did a great job on the analysis of the first few malicious XLL files that utilized the Excel-DNA framework. Most Excel-DNA XLL malware that we have observed are simple downloaders or droppers, where the payloads are embedded within the XLL files themselves. The start of its malicious code is usually found in an overridden AutoOpen function from Excel-DNAs IExcelAddIn interface. Whenever an XLL file is opened by Excel, it invokes the xlAutoOpen function exported by XLL interface , which Excel-DNA passes to IExcelAddIn. AutoOpen. Typically, the final payload will either be downloaded or dropped onto the file system, before being executed. This typical malicious behavior is usually detected by endpoint security products. However, malware authors are always actively looking for ways to evade such detection. Recently, we detected improvements implemented in XLL malware to execute its payload without dropping the file to disk. Techniques like this are not totally new , however, this trick may have higher a chance of evading detection by endpoint security products. This post details this Excel-DNA XLL malware improvements in evading detection. Analysis Sample Sha256 2d9035fccfa410259c75bb54edc9c95c2d736e6bdf87832fc2062dcd89286b39 Our analysis begins with browsing through the resource section of the XLL file. Excel add-ins are usually compressed with LZMA algorithm and embedded in resource section. Looking at the resource named __MAIN__ from DNA directory, this contains the information of the modules to be loaded by Excel-DNA. We can see that a module named ENTER will be loaded. Lets extract this library and check the code. Figure 1. DNA Main XML Information The Enter Module Instead of using a customized Excel add-in library to automatically execute the malicious code via the xlAutoOpen function, this variant uses the Excel ribbon feature, which is supported in the Excel-DNA framework as an interface object. The inherited ExcelRibbon object is assumed to customize the applications ribbon interface. However, this module does not call the GetCustomUI function which loads the XML used to configure the appearance of the ribbon interface. Instead it takes advantage of this feature to execute a malicious function. The malicious function will be called in the librarys class constructor. Class constructor is a special member of a class that will be first executed whenever a new instance of that class is created. Figure 2. Class Constructor Looking at the handler function, first it will download some data from an obfuscated URL, which was hard-coded into the module. Its obfuscation is simple, each character was subtracted by a hard-coded key, in this case 2 integer value. Figure 3. Obfuscated URL As shown in Figure 3, we expect the file to be downloaded as an RTF document. Instead, it appears to be plaintext configuration data split into an array using  as the delimiter. Each element will be accessed through its index in the array. Figure 4 shows the actual split data and Table 1 shows the description by each index Figure 4. Downloaded Data Index Description 0 Decryption keys 1 URL to the encrypted MSIL download 2 Encrypted MSIL DLL injector 3 DLL class 4 Class method name 5 Target application path in reverse string Table 1. Data description by index Next, the encrypted data found in index 2 will be decrypted. The decryption is just a simple XOR using the decryption keys from index 0, and decoded with Base64. Figure 5. Decryption Function for Encrypted MSIL Application The decrypted data turns out to be an MSIL assembly named patent.dll. This component is just a simple injector, which will be reflectively loaded using the .NET Assembly.Load method. It simply means that this DLL will be loaded directly from memory so methods can be directly invoked without saving the file to disk. Another file will be downloaded from the URL specified in index 2, which is also encrypted and will be decrypted using the same function shown in Figure 5. Again, this one turns out to be another executable MSIL application, this time named ZxuiU.exe. This executable file will be loaded and injected into a target process by calling a method from the MSIL assembly named patent.dll. The values in index 3 and index 4 corresponds to the DLL class and method name respectively. And index 5 is the reverse string source path where it will be injected. Figure 6. Invoke Code Injector Injected MSIL EXE Component ZxuiU.exe Please take note that at this stage, the malware is already running and injected into a legitimate application, in this case CWindowsMicrosoft.NETFrameworkv4.0.30319aspnet_regbrowsers.exe. This malicious module is also a downloader, where strings are obfuscated so it will not easily be analyzed. Although it was just a simple base64 encoded, the authors implemented some tricks like reverse string, character concatenation, string replace, etc., so this base64 encoded string will not be easily spotted at a first glance. This malware will download another component MSIL assembly named BreadPlayer.Common.dll from the URL below. This DLL will also be reflectively loaded in memory so its methods can be invoked. hxxpscdn.discordapp.comattachments960145684319838258960211802254364722BreadPlayer.Common.dll Upon looking at this module, it appears to be a tool known as RunPE which is used for process hollowing. This tool is used by malware to hide and execute its code into a target legitimate process. At first glance, it is not obvious that it is a RunPE tool since all the common APIs used for this trick were hidden. This module implements Dynamic API resolving to make static analysis harder. Figure 8 shows resolving the common APIs used in process hollowing. Figure 7. APIs for Process Hollowing After the RunPE module has been downloaded and reflectively loaded, it will then proceed to downloading the final payload, which is executed as a newly created instance of a legitimate system process where the loader is currently running. This invokes the method from the RunPE module with the parameter of the downloaded final payload. Figure 8. Download RunPE and Final Payload The final payload downloaded is a Formbook malware, a popular information stealertrojan available as a Malware-as-a-Service on the dark web market since 2016. Conclusion Malware authors are always finding ways to improve their malware capabilities and evade detection. The malware analyzed in this post used multi-stage loading in their XLL malware to further evade detection. These evasion methods are that common which means the chances are still high that this malware could execute on the victims machine. Techniques used with this improved XLL malware have pros and cons. One of its advantages is that components and final payload will not be dropped in the disk, which could evade detection by security products. However, one of its disadvantages is that it needs to download multiple components and the final payload from different URLs its execution could possibly fail once a single URL is down. It is no surprise to us to find more upcoming improvements related to this Excel-DNA XLL malware due to its high functioning capabilities. Our team in Cyren will keep monitoring this and other evolving threats to help protect our customers from malware. Indicators of Compromise SHA256URL Cyren Detection 2d9035fccfa410259c75bb54edc9c95c2d736e6bdf87832fc2062dcd89286b39 W64Exclddn.LWSS-3552 0c425d6c6bce93fad4f32c275db574e8b3161a1ae55a9a957d50020b516d3e2c W64Exclddn.OMFP-6694 5f1beab27690a8ea9b9be78c5d34dd852dd3af4f5128feace84d1b2e10d73b59 W64Exclddn.TFNR-0460 d838c7ad537e71dab1b968088db4b08195429a5ba6c22fdacad992caf27082a0 W32Agent.DND.gen!Eldorado 3ef33bf0d2e2ce10b3d32bf82e78195acc2c4fd15cc5cd9a8c1226ea98ac6884 W32Trojan.ZQXR-7580 6c229a6e31cf525bc3d46c0f1d2cf52e6a1a2ced7b4cec7b8ba0fb1672dc38e8 W32Injector.QCUW-2488 2796fac226083d8b53551fc5cd97f1ab08a2a9b9c6989a594186b05f624e1e32 W32Trojan.SOAJ-7035 232a16efaec47e6d4fc8f5318ed9d9d58198daef519f30a5d9147d38f293638c W32Formbook.A.gen!Eldorado hxxpstransfer.shget52J99Oku7AxHxl-s.rtf hxxpstransfer.shgetKcWg0bJPqlepxl-s.rtf hxxpstransfer.shgetTWyTFSaj2xJUxl-s.rtf hxxpstransfer.shget0Bny60ku7AxHxl-r.txt hxxpstransfer.shgetTllEFRJPqlepxl-r.txt hxxpstransfer.shgetMqAftfaj2xJUxl-r.txt hxxpscdn.discordapp.comattachments960145684319838258960211802254364722BreadPlayer.Common.dll hxxp179.43.175.179nhtgbinleg2.exe Try it for Free Instant Data Classification Cyren URL Category Chacker Prev What Are Office 365 Safe Attachments? The Resurgence of Emotet Next Company Partners Resources Investor Relations Products Freeware Demo Solutions Contact Us Privacy Management Service by Data443

Output:
**Analysis of the Security Content on Malicious Excel Add-in**

1. **Key Security Features:**
   - The malicious Excel add-in (XLL) leverages the Excel-DNA framework to create native add-ins, enabling the embedding of malicious code without dropping files to disk, thus evading detection.
   - The XLL files use dynamic link libraries (DLLs) and override the AutoOpen function to execute malicious code upon opening Excel, highlighting the need for monitoring such initializations.
   - These features indicate sophisticated evasion techniques, underscoring the importance of advanced detection mechanisms for users.

2. **Compliance Implications:**
   - While specific certifications aren't mentioned, the implications of data breaches suggest compliance with regulations like GDPR, CCPA, and HIPAA. Organizations must ensure data protection measures are in place to avoid non-compliance penalties.
   - Regular security audits and staff training can help maintain compliance standards, mitigating risks associated with such attacks.

3. **User-Focused Security Recommendations:**
   - **Exercise Caution with Files:** Avoid opening unsolicited Excel files, especially those requesting macro enablement.
   - **Verify Add-ins:** Only use trusted add-ins and regularly audit them to prevent unauthorized access.
   - **Software Updates:** Keep all software, including Excel and security tools, updated to protect against vulnerabilities.
   - **User Training:** Educate users on phishing tactics and safe computing practices to reduce infection risks.

4. **Technical Security Implementation:**
   - The XLL files use the Excel-DNA framework to create add-ins, hijacking the AutoOpen function to execute malicious code. The multi-stage payload delivery includes obfuscated URLs and encrypted data, decrypting and executing in memory to avoid disk detection.
   - Techniques like Dynamic API resolving and process hollowing (using RunPE) obscure malicious activity, highlighting the need for robust endpoint detection and response (EDR) solutions.

5. **Data Protection Measures:**
   - **Encryption:** Protect sensitive data with encryption to ensure confidentiality even if accessed.
   - **Endpoint Security:** Utilize EDR solutions to monitor and block malicious activities in real-time.
   - **DLP Solutions:** Implement Data Loss Prevention tools to monitor and control data transfers.
   - **Regular Backups:** Maintain secure, offline backups to mitigate ransomware threats and data loss.

6. **Best Practices for End Users:**
   - **Be Cautious with Attachments:** Avoid interacting with suspicious email attachments or links.
   - **Verify Sources:** Ensure files and add-ins come from trusted sources before use.
   - **Antivirus Use:** Install and regularly update antivirus software to detect and block threats.
   - **Phishing Awareness:** Stay vigilant against phishing attempts, recognizing common tactics to prevent infection.

By understanding and implementing these strategies, users can enhance their security posture and reduce the risk of falling victim to such attacks.


Input: Search Free Trial Get Demo Malicious Excel Add-in Variant Delivers Malware April 26, 2022 XLL is an Excel Add-in extension file that provides ways to use third-party tools and functions that are not available in Microsoft Excel. It is typically a Dynamic Link Library DLL file that can be loaded by Microsoft Excel provided the file uses the .xll extension. We have seen a surge of malware campaigns and attacks that were using XLL malware. Most of the malicious XLL files that we encountered utilized the open-source framework named Excel-DNA. Excel-DNA is a framework which allows you to create native XLL files using C or Visual Basic.NET. It also allows you to create user-defined functions, custom ribbons and many more. Palo Altos Unit 42 did a great job on the analysis of the first few malicious XLL files that utilized the Excel-DNA framework. Most Excel-DNA XLL malware that we have observed are simple downloaders or droppers, where the payloads are embedded within the XLL files themselves. The start of its malicious code is usually found in an overridden AutoOpen function from Excel-DNAs IExcelAddIn interface. Whenever an XLL file is opened by Excel, it invokes the xlAutoOpen function exported by XLL interface , which Excel-DNA passes to IExcelAddIn. AutoOpen. Typically, the final payload will either be downloaded or dropped onto the file system, before being executed. This typical malicious behavior is usually detected by endpoint security products. However, malware authors are always actively looking for ways to evade such detection. Recently, we detected improvements implemented in XLL malware to execute its payload without dropping the file to disk. Techniques like this are not totally new , however, this trick may have higher a chance of evading detection by endpoint security products. This post details this Excel-DNA XLL malware improvements in evading detection. Analysis Sample Sha256 2d9035fccfa410259c75bb54edc9c95c2d736e6bdf87832fc2062dcd89286b39 Our analysis begins with browsing through the resource section of the XLL file. Excel add-ins are usually compressed with LZMA algorithm and embedded in resource section. Looking at the resource named __MAIN__ from DNA directory, this contains the information of the modules to be loaded by Excel-DNA. We can see that a module named ENTER will be loaded. Lets extract this library and check the code. Figure 1. DNA Main XML Information The Enter Module Instead of using a customized Excel add-in library to automatically execute the malicious code via the xlAutoOpen function, this variant uses the Excel ribbon feature, which is supported in the Excel-DNA framework as an interface object. The inherited ExcelRibbon object is assumed to customize the applications ribbon interface. However, this module does not call the GetCustomUI function which loads the XML used to configure the appearance of the ribbon interface. Instead it takes advantage of this feature to execute a malicious function. The malicious function will be called in the librarys class constructor. Class constructor is a special member of a class that will be first executed whenever a new instance of that class is created. Figure 2. Class Constructor Looking at the handler function, first it will download some data from an obfuscated URL, which was hard-coded into the module. Its obfuscation is simple, each character was subtracted by a hard-coded key, in this case 2 integer value. Figure 3. Obfuscated URL As shown in Figure 3, we expect the file to be downloaded as an RTF document. Instead, it appears to be plaintext configuration data split into an array using  as the delimiter. Each element will be accessed through its index in the array. Figure 4 shows the actual split data and Table 1 shows the description by each index Figure 4. Downloaded Data Index Description 0 Decryption keys 1 URL to the encrypted MSIL download 2 Encrypted MSIL DLL injector 3 DLL class 4 Class method name 5 Target application path in reverse string Table 1. Data description by index Next, the encrypted data found in index 2 will be decrypted. The decryption is just a simple XOR using the decryption keys from index 0, and decoded with Base64. Figure 5. Decryption Function for Encrypted MSIL Application The decrypted data turns out to be an MSIL assembly named patent.dll. This component is just a simple injector, which will be reflectively loaded using the .NET Assembly.Load method. It simply means that this DLL will be loaded directly from memory so methods can be directly invoked without saving the file to disk. Another file will be downloaded from the URL specified in index 2, which is also encrypted and will be decrypted using the same function shown in Figure 5. Again, this one turns out to be another executable MSIL application, this time named ZxuiU.exe. This executable file will be loaded and injected into a target process by calling a method from the MSIL assembly named patent.dll. The values in index 3 and index 4 corresponds to the DLL class and method name respectively. And index 5 is the reverse string source path where it will be injected. Figure 6. Invoke Code Injector Injected MSIL EXE Component ZxuiU.exe Please take note that at this stage, the malware is already running and injected into a legitimate application, in this case CWindowsMicrosoft.NETFrameworkv4.0.30319aspnet_regbrowsers.exe. This malicious module is also a downloader, where strings are obfuscated so it will not easily be analyzed. Although it was just a simple base64 encoded, the authors implemented some tricks like reverse string, character concatenation, string replace, etc., so this base64 encoded string will not be easily spotted at a first glance. This malware will download another component MSIL assembly named BreadPlayer.Common.dll from the URL below. This DLL will also be reflectively loaded in memory so its methods can be invoked. hxxpscdn.discordapp.comattachments960145684319838258960211802254364722BreadPlayer.Common.dll Upon looking at this module, it appears to be a tool known as RunPE which is used for process hollowing. This tool is used by malware to hide and execute its code into a target legitimate process. At first glance, it is not obvious that it is a RunPE tool since all the common APIs used for this trick were hidden. This module implements Dynamic API resolving to make static analysis harder. Figure 8 shows resolving the common APIs used in process hollowing. Figure 7. APIs for Process Hollowing After the RunPE module has been downloaded and reflectively loaded, it will then proceed to downloading the final payload, which is executed as a newly created instance of a legitimate system process where the loader is currently running. This invokes the method from the RunPE module with the parameter of the downloaded final payload. Figure 8. Download RunPE and Final Payload The final payload downloaded is a Formbook malware, a popular information stealertrojan available as a Malware-as-a-Service on the dark web market since 2016. Conclusion Malware authors are always finding ways to improve their malware capabilities and evade detection. The malware analyzed in this post used multi-stage loading in their XLL malware to further evade detection. These evasion methods are that common which means the chances are still high that this malware could execute on the victims machine. Techniques used with this improved XLL malware have pros and cons. One of its advantages is that components and final payload will not be dropped in the disk, which could evade detection by security products. However, one of its disadvantages is that it needs to download multiple components and the final payload from different URLs its execution could possibly fail once a single URL is down. It is no surprise to us to find more upcoming improvements related to this Excel-DNA XLL malware due to its high functioning capabilities. Our team in Cyren will keep monitoring this and other evolving threats to help protect our customers from malware. Indicators of Compromise SHA256URL Cyren Detection 2d9035fccfa410259c75bb54edc9c95c2d736e6bdf87832fc2062dcd89286b39 W64Exclddn.LWSS-3552 0c425d6c6bce93fad4f32c275db574e8b3161a1ae55a9a957d50020b516d3e2c W64Exclddn.OMFP-6694 5f1beab27690a8ea9b9be78c5d34dd852dd3af4f5128feace84d1b2e10d73b59 W64Exclddn.TFNR-0460 d838c7ad537e71dab1b968088db4b08195429a5ba6c22fdacad992caf27082a0 W32Agent.DND.gen!Eldorado 3ef33bf0d2e2ce10b3d32bf82e78195acc2c4fd15cc5cd9a8c1226ea98ac6884 W32Trojan.ZQXR-7580 6c229a6e31cf525bc3d46c0f1d2cf52e6a1a2ced7b4cec7b8ba0fb1672dc38e8 W32Injector.QCUW-2488 2796fac226083d8b53551fc5cd97f1ab08a2a9b9c6989a594186b05f624e1e32 W32Trojan.SOAJ-7035 232a16efaec47e6d4fc8f5318ed9d9d58198daef519f30a5d9147d38f293638c W32Formbook.A.gen!Eldorado hxxpstransfer.shget52J99Oku7AxHxl-s.rtf hxxpstransfer.shgetKcWg0bJPqlepxl-s.rtf hxxpstransfer.shgetTWyTFSaj2xJUxl-s.rtf hxxpstransfer.shget0Bny60ku7AxHxl-r.txt hxxpstransfer.shgetTllEFRJPqlepxl-r.txt hxxpstransfer.shgetMqAftfaj2xJUxl-r.txt hxxpscdn.discordapp.comattachments960145684319838258960211802254364722BreadPlayer.Common.dll hxxp179.43.175.179nhtgbinleg2.exe Try it for Free Instant Data Classification Cyren URL Category Chacker Prev What Are Office 365 Safe Attachments? The Resurgence of Emotet Next Company Partners Resources Investor Relations Products Freeware Demo Solutions Contact Us Privacy Management Service by Data443

Output:
### Detailed Analysis of Product Security Features

This analysis reviews the security features and capabilities of a malicious Excel Add-in (XLL) file that uses the Excel-DNA framework to deliver malware. The analysis focuses on key security aspects, user benefits, integration capabilities, compliance, best practices, and technical specifications.

---

### 1. **Key Security Features and Capabilities**

The malicious XLL file analyzed employs several advanced techniques to evade detection and execute its payload:

- **In-Memory Execution**: The malware avoids writing files to disk by loading and executing its payload directly in memory. This includes using reflective DLL injection to load a malicious MSIL (Microsoft Intermediate Language) assembly without dropping any files.

- **Multi-Stage Loading**: The malware uses a multi-stage approach to download and decrypt components. This includes:
  - Downloading an obfuscated URL to retrieve plaintext configuration data.
  - Decrypting and executing a malicious MSIL assembly (patent.dll) as an injector.
  - Loading another malicious component (ZxuiU.exe) into a legitimate process for execution.
  - Using a RunPE tool for process hollowing to hide its malicious activity.

- **Obfuscation and Anti-Analysis Techniques**: The malware employs string obfuscation, URL encryption, and dynamic API resolution to make analysis difficult. For example:
  - URLs are obfuscated by subtracting each character by a fixed integer value (e.g., 2).
  - Encrypted data is decrypted using a simple XOR operation with a key and decoded with Base64.
  - APIs are resolved dynamically to avoid static detection.

- **Endpoint Evasion**: By leveraging Excel's built-in features (e.g., ribbon customization and AutoOpen functions), the malware blends into legitimate Excel functionality, making it harder to detect.

---

### 2. **User Benefits and Protection Measures**

- **Advanced Threat Protection**: Endpoint security solutions that monitor in-memory activities, fileless malware, and unusual process behavior can detect and block this type of threat.

- **Containment of Malicious Activity**: Security products that prevent unauthorized process hollowing, code injection, and suspicious network communication can mitigate the impact of this malware.

- **Real-Time Monitoring**: Behavior-based detection mechanisms can identify the multi-stage payload execution and block malicious actions before they cause harm.

- **User Education**: Educating users about the risks of opening untrusted Excel files and attachments can prevent initial infection.

---

### 3. **Integration with Existing Security Systems**

The detection and mitigation of this type of XLL malware require integration with the following security systems:

- **Endpoint Detection and Response (EDR)**: EDR solutions can monitor for malicious in-memory activities, process hollowing, and suspicious API calls.

- **Network Traffic Analysis**: Monitoring network traffic for malicious URL requests and encrypted payloads can help detect the malware's communication with command-and-control (C2) servers.

- **Antivirus and Anti-Malware Solutions**: Traditional antivirus products can detect known variants of the malware using signatures, while advanced solutions can use heuristic analysis to identify unknown variants.

- **SIEM and Threat Intelligence**: Integrating with Security Information and Event Management (SIEM) systems and threat intelligence feeds can help organizations stay informed about XLL malware campaigns and update their defenses accordingly.

---

### 4. **Compliance and Certification Details**

To ensure effective protection against such threats, the following compliance and certification considerations are essential:

- **Data Protection Regulations**: Organizations must comply with regulations like GDPR, CCPA, or HIPAA to ensure proper handling of sensitive data that could be targeted by information-stealing malware like Formbook.

- **Industry Standards**: Compliance with standards such as NIST, ISO 27001, and PCI DSS can help organizations implement robust security controls to prevent and detect malware.

- **Product Certification**: Security solutions used to protect against XLL malware should be certified by independent testing organizations, such as AV-Test or NSS Labs, to ensure their effectiveness.

- **Regular Audits and Testing**: Organizations should conduct regular security audits and penetration testing to identify vulnerabilities that could be exploited by similar malware.

---

### 5. **Security Best Practices for Users**

To minimize the risk of falling victim to XLL malware, users and organizations should follow these best practices:

- **Avoid Untrusted Files**: Do not open Excel files or install add-ins from untrusted sources.

- **Use Antivirus Software**: Ensure endpoint security software is installed, updated, and configured to detect in-memory threats and fileless malware.

- **Enable Macro Blocking**: Disable macros in Microsoft Excel by default and only enable them for trusted files.

- **Monitor Network Traffic**: Use firewalls and intrusion detection systems to monitor for suspicious network activity related to encrypted payloads and C2 communication.

- **Regular Updates**: Keep all software, including Microsoft Excel and security solutions, up to date with the latest patches.

- **User Training**: Educate users about the risks of phishing and how to identify suspicious files or emails.

---

### 6. **Technical Specifications and Requirements**

To effectively detect and mitigate XLL malware, the following technical specifications and requirements are recommended:

- **Supported Platforms**: Ensure endpoint security solutions support Windows environments, as XLL malware primarily targets Windows systems.

- **Memory Protection**: Use solutions that provide memory protection, such as anti-exploitation and anti-injection technologies.

- **Network Monitoring**: Deploy network monitoring tools that can inspect encrypted traffic (e.g., HTTPS) for malicious payloads.

- **Performance Requirements**: Security solutions should have minimal performance impact to ensure they do not disrupt legitimate user activity.

- **Integration Capabilities**: Solutions should integrate with existing security ecosystems, such as SIEM, EDR, and firewalls, for comprehensive threat detection and response.

- **Threat Intelligence Feeds**: Keep threat intelligence feeds updated to stay informed about new XLL malware variants and Indicators of Compromise (IoCs).

---

### Conclusion

The analyzed XLL malware demonstrates the evolving nature of cyber threats, leveraging advanced evasion techniques to bypass traditional security measures. Organizations must adopt a multi-layered security approach, including endpoint protection, network monitoring, user education, and regular updates, to effectively mitigate such threats. By understanding the key security features and capabilities of this malware, organizations can improve their defenses and reduce the risk of infection.


Input: Search Free Trial Get Demo Malicious Excel Add-in Variant Delivers Malware April 26, 2022 XLL is an Excel Add-in extension file that provides ways to use third-party tools and functions that are not available in Microsoft Excel. It is typically a Dynamic Link Library DLL file that can be loaded by Microsoft Excel provided the file uses the .xll extension. We have seen a surge of malware campaigns and attacks that were using XLL malware. Most of the malicious XLL files that we encountered utilized the open-source framework named Excel-DNA. Excel-DNA is a framework which allows you to create native XLL files using C or Visual Basic.NET. It also allows you to create user-defined functions, custom ribbons and many more. Palo Altos Unit 42 did a great job on the analysis of the first few malicious XLL files that utilized the Excel-DNA framework. Most Excel-DNA XLL malware that we have observed are simple downloaders or droppers, where the payloads are embedded within the XLL files themselves. The start of its malicious code is usually found in an overridden AutoOpen function from Excel-DNAs IExcelAddIn interface. Whenever an XLL file is opened by Excel, it invokes the xlAutoOpen function exported by XLL interface , which Excel-DNA passes to IExcelAddIn. AutoOpen. Typically, the final payload will either be downloaded or dropped onto the file system, before being executed. This typical malicious behavior is usually detected by endpoint security products. However, malware authors are always actively looking for ways to evade such detection. Recently, we detected improvements implemented in XLL malware to execute its payload without dropping the file to disk. Techniques like this are not totally new , however, this trick may have higher a chance of evading detection by endpoint security products. This post details this Excel-DNA XLL malware improvements in evading detection. Analysis Sample Sha256 2d9035fccfa410259c75bb54edc9c95c2d736e6bdf87832fc2062dcd89286b39 Our analysis begins with browsing through the resource section of the XLL file. Excel add-ins are usually compressed with LZMA algorithm and embedded in resource section. Looking at the resource named __MAIN__ from DNA directory, this contains the information of the modules to be loaded by Excel-DNA. We can see that a module named ENTER will be loaded. Lets extract this library and check the code. Figure 1. DNA Main XML Information The Enter Module Instead of using a customized Excel add-in library to automatically execute the malicious code via the xlAutoOpen function, this variant uses the Excel ribbon feature, which is supported in the Excel-DNA framework as an interface object. The inherited ExcelRibbon object is assumed to customize the applications ribbon interface. However, this module does not call the GetCustomUI function which loads the XML used to configure the appearance of the ribbon interface. Instead it takes advantage of this feature to execute a malicious function. The malicious function will be called in the librarys class constructor. Class constructor is a special member of a class that will be first executed whenever a new instance of that class is created. Figure 2. Class Constructor Looking at the handler function, first it will download some data from an obfuscated URL, which was hard-coded into the module. Its obfuscation is simple, each character was subtracted by a hard-coded key, in this case 2 integer value. Figure 3. Obfuscated URL As shown in Figure 3, we expect the file to be downloaded as an RTF document. Instead, it appears to be plaintext configuration data split into an array using  as the delimiter. Each element will be accessed through its index in the array. Figure 4 shows the actual split data and Table 1 shows the description by each index Figure 4. Downloaded Data Index Description 0 Decryption keys 1 URL to the encrypted MSIL download 2 Encrypted MSIL DLL injector 3 DLL class 4 Class method name 5 Target application path in reverse string Table 1. Data description by index Next, the encrypted data found in index 2 will be decrypted. The decryption is just a simple XOR using the decryption keys from index 0, and decoded with Base64. Figure 5. Decryption Function for Encrypted MSIL Application The decrypted data turns out to be an MSIL assembly named patent.dll. This component is just a simple injector, which will be reflectively loaded using the .NET Assembly.Load method. It simply means that this DLL will be loaded directly from memory so methods can be directly invoked without saving the file to disk. Another file will be downloaded from the URL specified in index 2, which is also encrypted and will be decrypted using the same function shown in Figure 5. Again, this one turns out to be another executable MSIL application, this time named ZxuiU.exe. This executable file will be loaded and injected into a target process by calling a method from the MSIL assembly named patent.dll. The values in index 3 and index 4 corresponds to the DLL class and method name respectively. And index 5 is the reverse string source path where it will be injected. Figure 6. Invoke Code Injector Injected MSIL EXE Component ZxuiU.exe Please take note that at this stage, the malware is already running and injected into a legitimate application, in this case CWindowsMicrosoft.NETFrameworkv4.0.30319aspnet_regbrowsers.exe. This malicious module is also a downloader, where strings are obfuscated so it will not easily be analyzed. Although it was just a simple base64 encoded, the authors implemented some tricks like reverse string, character concatenation, string replace, etc., so this base64 encoded string will not be easily spotted at a first glance. This malware will download another component MSIL assembly named BreadPlayer.Common.dll from the URL below. This DLL will also be reflectively loaded in memory so its methods can be invoked. hxxpscdn.discordapp.comattachments960145684319838258960211802254364722BreadPlayer.Common.dll Upon looking at this module, it appears to be a tool known as RunPE which is used for process hollowing. This tool is used by malware to hide and execute its code into a target legitimate process. At first glance, it is not obvious that it is a RunPE tool since all the common APIs used for this trick were hidden. This module implements Dynamic API resolving to make static analysis harder. Figure 8 shows resolving the common APIs used in process hollowing. Figure 7. APIs for Process Hollowing After the RunPE module has been downloaded and reflectively loaded, it will then proceed to downloading the final payload, which is executed as a newly created instance of a legitimate system process where the loader is currently running. This invokes the method from the RunPE module with the parameter of the downloaded final payload. Figure 8. Download RunPE and Final Payload The final payload downloaded is a Formbook malware, a popular information stealertrojan available as a Malware-as-a-Service on the dark web market since 2016. Conclusion Malware authors are always finding ways to improve their malware capabilities and evade detection. The malware analyzed in this post used multi-stage loading in their XLL malware to further evade detection. These evasion methods are that common which means the chances are still high that this malware could execute on the victims machine. Techniques used with this improved XLL malware have pros and cons. One of its advantages is that components and final payload will not be dropped in the disk, which could evade detection by security products. However, one of its disadvantages is that it needs to download multiple components and the final payload from different URLs its execution could possibly fail once a single URL is down. It is no surprise to us to find more upcoming improvements related to this Excel-DNA XLL malware due to its high functioning capabilities. Our team in Cyren will keep monitoring this and other evolving threats to help protect our customers from malware. Indicators of Compromise SHA256URL Cyren Detection 2d9035fccfa410259c75bb54edc9c95c2d736e6bdf87832fc2062dcd89286b39 W64Exclddn.LWSS-3552 0c425d6c6bce93fad4f32c275db574e8b3161a1ae55a9a957d50020b516d3e2c W64Exclddn.OMFP-6694 5f1beab27690a8ea9b9be78c5d34dd852dd3af4f5128feace84d1b2e10d73b59 W64Exclddn.TFNR-0460 d838c7ad537e71dab1b968088db4b08195429a5ba6c22fdacad992caf27082a0 W32Agent.DND.gen!Eldorado 3ef33bf0d2e2ce10b3d32bf82e78195acc2c4fd15cc5cd9a8c1226ea98ac6884 W32Trojan.ZQXR-7580 6c229a6e31cf525bc3d46c0f1d2cf52e6a1a2ced7b4cec7b8ba0fb1672dc38e8 W32Injector.QCUW-2488 2796fac226083d8b53551fc5cd97f1ab08a2a9b9c6989a594186b05f624e1e32 W32Trojan.SOAJ-7035 232a16efaec47e6d4fc8f5318ed9d9d58198daef519f30a5d9147d38f293638c W32Formbook.A.gen!Eldorado hxxpstransfer.shget52J99Oku7AxHxl-s.rtf hxxpstransfer.shgetKcWg0bJPqlepxl-s.rtf hxxpstransfer.shgetTWyTFSaj2xJUxl-s.rtf hxxpstransfer.shget0Bny60ku7AxHxl-r.txt hxxpstransfer.shgetTllEFRJPqlepxl-r.txt hxxpstransfer.shgetMqAftfaj2xJUxl-r.txt hxxpscdn.discordapp.comattachments960145684319838258960211802254364722BreadPlayer.Common.dll hxxp179.43.175.179nhtgbinleg2.exe Try it for Free Instant Data Classification Cyren URL Category Chacker Prev What Are Office 365 Safe Attachments? The Resurgence of Emotet Next Company Partners Resources Investor Relations Products Freeware Demo Solutions Contact Us Privacy Management Service by Data443

Output:
**Security Guidance: Protecting Against Malicious Excel Add-ins**

**Introduction:**
Malicious Excel Add-ins, particularly those using the XLL format, pose significant security risks by delivering malware. This guidance helps users protect themselves through best practices, awareness, and proactive measures.

---

### **1. Security Best Practices**

- **Training and Awareness:**
  - Regularly educate users on the risks of opening unsolicited Excel files, especially those with macros or add-ins.
  - Inform users about the dangers of malicious attachments and phishing emails.

- **Software Updates:**
  - Ensure all software, including Excel and operating systems, is up-to-date to patch vulnerabilities.
  - Enable automatic updates for security software and operating systems.

- **Antivirus and Endpoint Protection:**
  - Use reputable antivirus software and enable endpoint detection and response (EDR) tools to detect and block malicious activity.

---

### **2. Data Protection Tips**

- **Backup Regularly:**
  - Schedule regular backups of important data to an encrypted, secure location, such as an external drive or cloud storage.

- **Secure Data Storage:**
  - Avoid storing sensitive data in easily accessible locations where malware might target it.

---

### **3. Safe Usage Guidelines**

- **Avoid Enabling Macros:**
  - Do not enable macros unless the file is from a trusted source and absolutely necessary.

- **Verify File Sources:**
  - Check the sender’s email address and look for spelling mistakes or odd requests before opening attachments.

- **Caution with Add-ins:**
  - Be cautious with third-party add-ins. Only install those from trusted sources.

- **Disable Unnecessary Features:**
  - Follow steps to disable macros and add-ins in Excel when not needed.

---

### **4. Steps to Disable Macros and Add-ins in Excel**

1. **Disable Macros:**
   - Open Excel, go to File > Options > Trust Center > Trust Center Settings.
   - Under Macro Settings, select "Disable all macros without notification."
   - Click OK to save changes.

2. **Disable Add-ins:**
   - Go to File > Options > Add-ins.
   - Under Excel Add-ins, select "Go..." and uncheck any suspicious or unnecessary add-ins.

---

### **5. Common Security Risks and Prevention**

- **Phishing Attacks:**
  - Be wary of emails with urgent requests or attachments. Verify the sender’s identity.

- **Malicious Attachments:**
  - Avoid opening files from unknown sources. Hover over links to check their destinations.

- **Fake Updates:**
  - Only download updates from official websites.

---

### **6. Privacy Protection Measures**

- **Strong Passwords:**
  - Use unique, complex passwords for all accounts and enable multi-factor authentication where possible.

- **Personal Information:**
  - Be cautious about sharing personal information online.

---

### **7. When to Seek Additional Security Support**

- **Suspected Infection:**
  - If you suspect your device is infected, disconnect from the internet and contact IT support.

- **Unusual Behavior:**
  - Report any unusual activity, such as unexpected pop-ups or slow performance, to your security team.

- **Suspicious Files:**
  - If you receive a file that seems suspicious, do not open it and inform your IT department.

---

**Conclusion:**
Vigilance is key to protecting against malicious Excel Add-ins. By following these guidelines, users can significantly reduce the risk of infection and data loss. Stay proactive and raise awareness within your organization to foster a secure environment.

**Note:** For detailed Indicators of Compromise (IOCs) such as file hashes and URLs, refer to the provided threat intelligence to stay informed and block malicious activities.


Input: Search Free Trial Get Demo Day April 18, 2018 3 GDPR Principles Accuracy, Retention, and Transparency April 18, 2018 3 GDPR Principles Accuracy, Retention, and Transparency We have shared many details around the GDPR enforcement date beginning 25 May 2018  and there is a lot of information out there. Perhaps a question continues to pop up Why the GDPR?GDPR codifies principles and practices to help secure the personal Company Partners Resources Investor Relations Products Freeware Demo Solutions Contact Us Privacy Management Service by Data443

Output:
**Analysis of Data443's Privacy Management Service and GDPR Compliance**

**1. Key Security Features and Benefits:**
   - **Accuracy:** Data443 ensures data correctness and updates, preventing privacy issues from incorrect data.
   - **Retention:** Clear policies on data storage duration, reducing breach risks and ensuring compliance.
   - **Transparency:** Clear communication with users about data usage, enhancing trust and informed consent.

**2. Compliance Certifications:**
   - GDPR compliance is highlighted, crucial for EU operations.
   - Likely adherence to ISO 27001 and SOC 2, common in security practices, though not specified.

**3. User-Focused Security Recommendations:**
   - Facilitating easy access, correction, or deletion of data, possibly via self-service portals.
   - Encouraging strong passwords and two-factor authentication for enhanced security.

**4. Technical Security Implementation:**
   - Use of encryption for data in transit and at rest.
   - Access controls to limit data handling.
   - Data loss prevention tools to monitor transfers.

**5. Data Protection Measures:**
   - Regular security audits and employee training on data handling.
   - Automated breach detection and incident response plans.

**6. Best Practices for Users:**
   - Regular review of privacy settings.
   - Caution with links/attachments to prevent phishing.
   - Keeping software updated to protect against vulnerabilities.

**Conclusion:**
While the content provides a good overview, more detailed information on certifications, technical specifics, and user tools would enhance Data443's security profile.


Input: Search Free Trial Get Demo Day April 18, 2018 3 GDPR Principles Accuracy, Retention, and Transparency April 18, 2018 3 GDPR Principles Accuracy, Retention, and Transparency We have shared many details around the GDPR enforcement date beginning 25 May 2018  and there is a lot of information out there. Perhaps a question continues to pop up Why the GDPR?GDPR codifies principles and practices to help secure the personal Company Partners Resources Investor Relations Products Freeware Demo Solutions Contact Us Privacy Management Service by Data443

Output:
**End-User Guidance on Data Security and Protection**

**1. Security Best Practices**

- **Use Strong Passwords:** Create unique, complex passwords for each account. Consider using a password manager to securely store them.
- **Regular Updates:** Keep software, apps, and devices updated to protect against vulnerabilities.
- **Two-Factor Authentication:** Enable 2FA for added security, especially for sensitive accounts.

**2. Data Protection Recommendations**

- **Encrypt Sensitive Data:** Use encryption for files and communications, especially when sharing.
- **Secure Backups:** Regularly back up data to a secure, offsite location.
- **Limit Access:** Restrict data access to only necessary individuals.
- **Accuracy and Retention:** Ensure data accuracy, keep it up-to-date, and retain only as long as necessary.

**3. Safe Usage Guidelines**

- **Email Caution:** Avoid suspicious emails and attachments. Verify senders before responding or clicking links.
- **Secure Connections:** Use VPNs for remote work and ensure Wi-Fi networks are secure.
- **Avoid Public Computers:** Refrain from accessing sensitive data on public devices.

**4. Common Security Risks and Prevention**

- **Phishing Awareness:** Recognize phishing attempts and report them.
- **Data Breach Monitoring:** Monitor accounts for suspicious activity and set up alerts.
- **Secure Devices:** Use antivirus software and enable firewalls.

**5. Privacy Protection Measures**

- **Respect Privacy:** Handle others' data with care and only for intended purposes.
- **Secure Disposal:** Permanently delete unnecessary data securely.

**6. When to Seek Help**

- **Incidents:** Report data breaches or lost devices/stolen credentials immediately.
- **Uncertainty:** Consult IT or security teams when unsure about handling data.

**Key Takeaways:**

- **Stay Vigilant:** Regularly monitor accounts and be cautious with emails.
- **Proactive Measures:** Use encryption, updates, and backups to stay secure.
- **Seek Help Early:** Don’t hesitate to ask for support in securing data or resolving incidents.

This guidance provides a balanced approach to data security, ensuring it's comprehensive yet easy to follow.


Input: Search Free Trial Get Demo Cryptocurrency Exchange Targeted by Fake Phishing Site July 17, 2018 With the news about the Israeli Bancor heist breaking recently in which cryptocurrencies worth 23.5 million were stolen using a compromised wallet, its fairly obvious that the criminal attraction to cryptocurrencies hasnt been affected by recent dips in the value of currencies like Bitcoin and Ethereum. In order to gain access to cryptocurrency wallets and exchanges, criminals appear to be dusting off every tool in their bag of tricks. In addition to the look-alike webpage phishing technique described below, we are also seeing bogus online ads with website names that use the IDN homograph technique, which involves creating a fake domain name that upon first glance appears very similar to the true domain name emails that contain promises of discounted cryptocurrencies, only to have the victim download ransomware the creation of imitation wallets and bitcoin stealing malware. Users of UK-based Luno intended victims As an example, last week we came across a web page blocked by Cyrens security cloud purporting to be the site for Luno, a service that facilitates the buying and storing of Bitcoin and Ethereum. With a link being distributed via email phishing campaigns, the spoofed web page comes with an embedded JavaScript code that loads remote content using an HTML inline frame iframe. The iframe in turn redirects to a sign-in page, which resembles the Luno sign-in page. As an extra touch to further the illusion that the fake website is legitimate, the title of the page on the tab is set to Luno and uses a favicon similar to the favicon used by the real Luno website. The fake Luno site on the left displays a sign-in Favicon identical to the actual Luno sign-in page right How to distinguish between the real and fake Luno sites The first indicator to any potential victim that the page is fake is the URL below, which is clearly different from the standard Luno login address. In addition, the URL displays a symbol of a padlock with a red line through it. In contrast to the real Luno URL, which displays a green padlock. On the Firefox browser, the grey padlock with a red line is an indicator that the site is using only partial encryption and is therefore open to attack. Google Chrome uses the red triangle instead of a green padlock to indicate that a site is either not secure or dangerous. However, assuming the intended victim doesnt notice the URL, there are a few more indicators that this Luno site isnt what it appears to be. The web page title shows Sign in  Luno, however, the sign-in form contains instructions about updating the account which doesnt appear on the real Luno page. Instead of asking for the users Luno account password, the form requests an Email password. Key indicators of the fraudulent Luno page are noted in the request for updated information and the email password. Fails dummy credentials test Remember that a standard technique to test the validity of a site is to enter dummy credentials a fake email address and password. A real website would instantly recognize that this login information isnt registered in their system, and would reject the attempt. However, the spoofed Luno page assumes the email address is real and opens up a new form asking for the Luno account password and phone number. Finally, after entering the fake information and clicking the Update button, the page actually redirects us to the real Luno website. The real Luno site only asks for an email address on the initial page and even includes a warning at the top about phishing. As you can see from the above screen shots, the fake site strongly resembles the true Luno site. One of the reasons for this is that the creators of the fake site used a JavaScript code that appears to be identical to the modules from the real Luno website. A deeper look at the file contents For the file detected as Phish.ADT, its content is encoded using the JavaScript escape function. Once decoded, we can clearly see the URL it will redirect to. The escape encoded file. The decoded redirect URL using iframe tag. For the URL redirect of the file detected as HTMLPhish.ACL, the fake site uses Base64 to encode the redirect URL from its body and uses the meta http-equiv tag to proceed with the redirection. The Base64 encoded redirect URL. Protect your users from phishing Regardless of whether the cybercriminal is trying to lure your users to a fake cryptocurrency site or a spoofed Microsoft login site, protecting from phishingone of the most common crimes against businessesis critical. Consider deploying a cloud-based email gateway that offers time-of-click URL analysis and protection from business email compromise, as well as a web security gateway to stop attempts to access malicious URLs, new and zero-day malware downloads, and communications with botnet CC servers. Indicators of Compromise Cyren identifies the Luno phishing threat as follows CyrenWebSecurity Found BUZZARD2364.GETLARK.HOSTING - Phishing Exact Password stealing trojan HTMLPhish.ACL  71CD24F925491862AD90FAEB54BC3CED010982C6260F632745D28CA75F79E457 Exact Password stealing trojan HTMLPhish.ADT  R.PHPDSAFGDSGHDSGDGDSADSAKJYUDADHJF Exact Password stealing trojan HTMLPhish.ADT  SIGNIN.PHP CyrenWebSecurity Found CURLEW2365.GETLARK.HOSTING - Phishing Exact Password stealing trojan Phish.ADT  73454F72C47D7B075F68FC4D21F26610281D41B4B357DAF7A02B4369E88BA2D2 Exact Password stealing trojan HTMLPhish.ADT  R.PHPSDASFFFD223AS3SGSGSGDDDSG Exact Password stealing trojan HTMLPhish.ADT  SIGNIN.PHP For more information on the security implications of the cryptomining phenomenon for businesses view Cyrens On-Demand Webinar, The Downsides and Dangers of Cryptocurrency Mining . Try it for Free Instant Data Classification Cyren URL Category Chacker Prev Data Breach Report Underscores Phishing Risk for Manufacturers Exponierte Daten von Automobilherstellern verdeutlicht die Sicherheitsrisiken durch Zulieferer Next Company Partners Resources Investor Relations Products Freeware Demo Solutions Contact Us Privacy Management Service by Data443

Output:
**Analysis of the Phishing Attack Targeting Luno Cryptocurrency Exchange**

1. **Key Security Features and Their Benefits to Users:**
   - **Phishing Detection and Real-Time URL Analysis:** The use of cloud-based email gateways and web security gateways provides real-time analysis of URLs, blocking access to malicious sites and stopping phishing attempts before they reach users.
   - **Malware Detection:** Features that identify and block zero-day malware downloads and communications with botnet command and control (C2) servers enhance protection against sophisticated threats.
   - **These features benefit users by providing an additional layer of defense, reducing the risk of falling victim to phishing and malware attacks.**

2. **Compliance and Regulatory Adherence:**
   - **Regulatory Compliance:** While specific certifications like GDPR or SOC 2 are not mentioned, Luno, as a cryptocurrency exchange, is likely compliant with relevant financial regulations, ensuring a secure environment for users.
   - **Compliance ensures that the platform adheres to industry standards, offering users reassurance of data and transaction security.**

3. **User-Focused Security Recommendations:**
   - **Verify URLs and SSL Certificates:** Users should check for "https" and a green padlock in the URL, indicating a secure connection.
   - **Be Cautious with Credentials:** Avoid providing sensitive information on unfamiliar sites. Test with dummy credentials to gauge site legitimacy.
   - **Educate Yourself:** Recognize phishing indicators such as typos, generic greetings, and urgent requests. Stay informed about common phishing tactics.

4. **Technical Security Implementation Details:**
   - **Attacker Techniques:** The fake site used iframes, JavaScript, and encoded URLs (Base64 and JavaScript escape) to redirect victims to malicious pages.
   - **Defense Measures:** Implementing advanced threat detection tools and regularly updating security protocols can mitigate these sophisticated attacks.

5. **Data Protection Measures:**
   - **Email and Web Gateways:** These tools scan links and block malicious content, preventing phishing attempts and protecting data.
   - **Such measures ensure that even if a user interacts with a phishing email, the system intervenes to block potential threats.**

6. **Best Practices for End Users:**
   - **Vigilance and Education:** Users should be trained to spot phishing attempts, avoid suspicious links, and never click on unverified attachments or links.
   - **Regular Updates:** Keeping software updated patches vulnerabilities and strengthens security against potential exploitation.
   - **Encourage users to adopt multi-layered security practices, including strong passwords and two-factor authentication, to enhance personal and financial security.**

**Conclusion:**
The phishing attack on Luno underscores the importance of a multi-layered security approach, combining advanced technical measures with user education. By understanding the tactics used and implementing robust security practices, both organizations and individuals can effectively mitigate the risks posed by phishing and similar threats.


Input: Search Free Trial Get Demo Cryptocurrency Exchange Targeted by Fake Phishing Site July 17, 2018 With the news about the Israeli Bancor heist breaking recently in which cryptocurrencies worth 23.5 million were stolen using a compromised wallet, its fairly obvious that the criminal attraction to cryptocurrencies hasnt been affected by recent dips in the value of currencies like Bitcoin and Ethereum. In order to gain access to cryptocurrency wallets and exchanges, criminals appear to be dusting off every tool in their bag of tricks. In addition to the look-alike webpage phishing technique described below, we are also seeing bogus online ads with website names that use the IDN homograph technique, which involves creating a fake domain name that upon first glance appears very similar to the true domain name emails that contain promises of discounted cryptocurrencies, only to have the victim download ransomware the creation of imitation wallets and bitcoin stealing malware. Users of UK-based Luno intended victims As an example, last week we came across a web page blocked by Cyrens security cloud purporting to be the site for Luno, a service that facilitates the buying and storing of Bitcoin and Ethereum. With a link being distributed via email phishing campaigns, the spoofed web page comes with an embedded JavaScript code that loads remote content using an HTML inline frame iframe. The iframe in turn redirects to a sign-in page, which resembles the Luno sign-in page. As an extra touch to further the illusion that the fake website is legitimate, the title of the page on the tab is set to Luno and uses a favicon similar to the favicon used by the real Luno website. The fake Luno site on the left displays a sign-in Favicon identical to the actual Luno sign-in page right How to distinguish between the real and fake Luno sites The first indicator to any potential victim that the page is fake is the URL below, which is clearly different from the standard Luno login address. In addition, the URL displays a symbol of a padlock with a red line through it. In contrast to the real Luno URL, which displays a green padlock. On the Firefox browser, the grey padlock with a red line is an indicator that the site is using only partial encryption and is therefore open to attack. Google Chrome uses the red triangle instead of a green padlock to indicate that a site is either not secure or dangerous. However, assuming the intended victim doesnt notice the URL, there are a few more indicators that this Luno site isnt what it appears to be. The web page title shows Sign in  Luno, however, the sign-in form contains instructions about updating the account which doesnt appear on the real Luno page. Instead of asking for the users Luno account password, the form requests an Email password. Key indicators of the fraudulent Luno page are noted in the request for updated information and the email password. Fails dummy credentials test Remember that a standard technique to test the validity of a site is to enter dummy credentials a fake email address and password. A real website would instantly recognize that this login information isnt registered in their system, and would reject the attempt. However, the spoofed Luno page assumes the email address is real and opens up a new form asking for the Luno account password and phone number. Finally, after entering the fake information and clicking the Update button, the page actually redirects us to the real Luno website. The real Luno site only asks for an email address on the initial page and even includes a warning at the top about phishing. As you can see from the above screen shots, the fake site strongly resembles the true Luno site. One of the reasons for this is that the creators of the fake site used a JavaScript code that appears to be identical to the modules from the real Luno website. A deeper look at the file contents For the file detected as Phish.ADT, its content is encoded using the JavaScript escape function. Once decoded, we can clearly see the URL it will redirect to. The escape encoded file. The decoded redirect URL using iframe tag. For the URL redirect of the file detected as HTMLPhish.ACL, the fake site uses Base64 to encode the redirect URL from its body and uses the meta http-equiv tag to proceed with the redirection. The Base64 encoded redirect URL. Protect your users from phishing Regardless of whether the cybercriminal is trying to lure your users to a fake cryptocurrency site or a spoofed Microsoft login site, protecting from phishingone of the most common crimes against businessesis critical. Consider deploying a cloud-based email gateway that offers time-of-click URL analysis and protection from business email compromise, as well as a web security gateway to stop attempts to access malicious URLs, new and zero-day malware downloads, and communications with botnet CC servers. Indicators of Compromise Cyren identifies the Luno phishing threat as follows CyrenWebSecurity Found BUZZARD2364.GETLARK.HOSTING - Phishing Exact Password stealing trojan HTMLPhish.ACL  71CD24F925491862AD90FAEB54BC3CED010982C6260F632745D28CA75F79E457 Exact Password stealing trojan HTMLPhish.ADT  R.PHPDSAFGDSGHDSGDGDSADSAKJYUDADHJF Exact Password stealing trojan HTMLPhish.ADT  SIGNIN.PHP CyrenWebSecurity Found CURLEW2365.GETLARK.HOSTING - Phishing Exact Password stealing trojan Phish.ADT  73454F72C47D7B075F68FC4D21F26610281D41B4B357DAF7A02B4369E88BA2D2 Exact Password stealing trojan HTMLPhish.ADT  R.PHPSDASFFFD223AS3SGSGSGDDDSG Exact Password stealing trojan HTMLPhish.ADT  SIGNIN.PHP For more information on the security implications of the cryptomining phenomenon for businesses view Cyrens On-Demand Webinar, The Downsides and Dangers of Cryptocurrency Mining . Try it for Free Instant Data Classification Cyren URL Category Chacker Prev Data Breach Report Underscores Phishing Risk for Manufacturers Exponierte Daten von Automobilherstellern verdeutlicht die Sicherheitsrisiken durch Zulieferer Next Company Partners Resources Investor Relations Products Freeware Demo Solutions Contact Us Privacy Management Service by Data443

Output:
**Security Advisor Guidance on Data Security and Protection**

1. **Security Best Practices**
   - **Verify Websites:** Always check the URL of a website. Look for "https" and a padlock icon. For example, the fake Luno site had a different URL and a red padlock, indicating it wasn't secure.
   - **Use Security Tools:** Employ a reputable antivirus and keep it updated. Consider a web security gateway for added protection.
   - **Keep Software Updated:** Regularly update browsers and plugins to protect against vulnerabilities.

2. **Data Protection Recommendations**
   - **Strong Passwords:** Use unique, complex passwords for each account. Avoid reusing passwords.
   - **Enable Two-Factor Authentication (2FA):** Add an extra security layer to your accounts where possible.
   - **Encrypt Sensitive Data:** Protect sensitive information with encryption, especially when transmitting data.

3. **Safe Usage Guidelines**
   - **Be Cautious with Links:** Avoid clicking on suspicious links or downloading attachments from unknown sources.
   - **Enable Alerts:** Set up transaction alerts for your financial accounts to detect unauthorized activity early.
   - **Test Dummy Credentials:** Enter fake login details to test if a site is legitimate. Legitimate sites will reject unknown credentials.

4. **Common Security Risks and Prevention**
   - **Phishing Attacks:** Educate yourself to recognize phishing attempts, which may come via email, fake websites, or malicious ads.
   - **Fake Sites:** Look out for slightly altered URLs or names, like the fake Luno site, which mimicked the real one.
   - **Unsafe Wi-Fi:** Avoid accessing sensitive accounts on public Wi-Fi; use a VPN if necessary.

5. **Privacy Protection Measures**
   - **Share Data Selectively:** Only provide personal information to trusted sites. Be wary of requests for unnecessary details.
   - **Use Privacy Tools:** Consider using privacy-focused browsers and ad-blockers to minimize tracking.

6. **When to Seek Additional Security Support**
   - **If Unsure:** Contact support if a website or email seems suspicious.
   - **After a Potential Breach:** If you suspect your account has been compromised, change passwords immediately and monitor for unauthorized activity.

By following these guidelines, you can enhance your security posture and protect against threats like phishing attacks. Stay informed and proactive to safeguard your digital assets.


Input: Search Free Trial Get Demo Überprüfen Sie die Wirksamkeit Ihrer E-Mail-Security-Lösung July 31, 2019 Erreichen Phishing-E-Mails immer wieder Ihre Benutzer und möchten Sie einmal quantifizieren, wie effektiv Ihre E-Mail-Sicherheit tatsächlich ist? E-Mail ist der Hauptangriffsweg, um ein Unternehmen mit Malware zu infizieren, und wird heutzutage fast immer mit Phishing in Verbindung gebracht. Es ist also immer sinnvoll, sich einen Überblick darüber zu verschaffen, ob Ihre Sicherheit gut oder schlecht funktioniert. Bei Cyren wissen wir, wie aufschlussreich es sein kann, Lösungen neu zu bewerten. Die Email Sicherheits-Analysen, die wir 2018 für Unternehmen durchgeführt haben, zeigten, dass trotz der Verwendung einer E-Mail-Sicherheitslösung durchschnittlich 7,2 der E-Mails, die den End-User erreichten, entweder Spam oder eine Bedrohung enthielten. So finden Sie es heraus Führen Sie eine Cyren GAP-Analyse durch. Cyren hat Unternehmen dabei geholfen, ihre E-Mail-Sicherheit auf bestmögliche Weise zu bewerten, indem ein Vergleichstest mit den vorhandenen Lösungen durchgeführt wurde. Jetzt haben wir die Verfügbarkeit dieses kostenlosen Dienstes erweitert. In 2018 haben wir mit mehrere Unternehmen Gap-Analysen durchgeführt und insgesamt 2,7 Millionen E-Mails geprüft. Obwohl alle diese Email von der vorhandenen E-Mail-Sicherheitslösung gescannt und als sauber klassifiziert würden, haben wir festgestellt, dass durchschnittlich 6,9 Spam waren. Das ist für den User natürlich Ärgerlich, aber nicht ganz so ein Problem wie die Anzahl der Phishing- 7.014 E-Mails und Malware-Bedrohungen 978 E-Mails, die an den User ausgeliefert wurden. Auch wenn nur ein kleiner Prozentsatz der gesamten zugestellten E-Mails böswillig ist, ist es angesichts des enormen E-Mail-Volumen kein akzeptables Risiko, Hunderte oder Tausende von böswilligen E-Mails zu erhalten. Es ist sicherlich etwas, das Sie versuchen sollten, in den Griff zu bekommen. Wir haben einen vollständigen Bericht mit aggregierten Ergebnissen der E-Mail-Sicherheitsbewertung aus dem Jahr 2018 zur Verfügung gestellt. Besuchen Sie auch unsere Gap Analyse-Webseite oder laden Sie unser Gap Analyse-Datenblatt herunter, um weitere Informationen zur Durchführung Ihres eigenen Tests zu erhalten. Sie können mit unterschiedlichsten Ergebnisse rechnen! Während die oben genannten Durchschnittsergebnisse nützlich sind, so ist eine wichtige Erkenntnis aus unsere Studie, dass sich die Ergebnisse erheblich unterscheiden und dass mehrere Faktoren die Leistung der E-Mail-Sicherheit in einer bestimmten Organisation beeinflussen, wie die folgende Tabelle zeigt entnommen aus dem GAP-Aalyse-Bericht siehe oben Die Ergebnisse unterschieden sich sogar zwischen Unternehmen, die denselben Onpremise- oder Cloud-Anbieter verwenden, da die Leistung durch Realitätsfaktoren beeinflusst wird. Fazit Machen Sie Ihre eigene GAP-Analyse, um die möglichen Auswirkungen auf Ihr Unternehmen zu verstehen. Unbewusst ist ungeschützt! Viele Sicherheitsexperten gehen davon aus, dass ihre E-Mail-Sicherheit ausreichend ist, bis ein Benutzer eher mehrere  meldet, dass sie eine Phishing-E-Mail erhalten haben oder dass deren End Point-Schutz eine Bedrohung erkannt hat. Schlimmer ist es natürlich, wenn Ihre SIEM, Endpoint Detection and Response- EDR- oder DLP-Lösungen auf einen Network Breach hinweisen. Und dass kommt ziemlich häufig vor  laut Osterman Research hatten 70 Prozent aller Organisationen und 78 Prozent, die Office 365 verwendeten, haben letztes Jahr einen erfolgreichen Angriff erlebt. Vorausgesetzt, Sie haben das Glück, und Sie haben das Budget für diese Verteidigungsmechanismen, und die Leute sind soweit geschult, um die Warnungen verstehen und können richtig auf sie reagieren. Wenn Sie zu der glücklichen Minderheit gehören, die in letzter Zeit keinen Angriff gesehen hat, und davon ausgehen, dass Ihre E-Mail-Sicherheit in Ordnung ist, sollten Sie die Statistiken berücksichtigen, dass 25 aller Verstöße einen Monat lang unentdeckt bleiben, währenddessen die bösen Jungs auf Ihre Daten zugreifen. Durch die Kommodifizierung von E-Mail-Security hat die Branche den Fokus verloren Machen E-Mail-Sicherheitsanbieter genug, um Unternehmen, ihre Mitarbeiter und deren Daten zu schützen, oder sind viele zu selbstgefällig geworden? Die jüngsten erfolgreichen, hochkarätigen Ransomware-Angriffe lässt auf Letzteres schließen. Aber wie ist es so weit gekommen? Vor 10 Jahren war die E-Mail-Sicherheitsbranche lebhaft und bereit für zahlreiche Akquisitionen größerer Sicherheitsanbieter, die ihre Portfolios erweitern wollten. Die wesentliche Änderung erfolgte, als die größten E-Mail-Dienstleister einige der größeren SaaS-E-Mail-Sicherheitsanbieter erwarben, um ihr Angebot durch E-Mail-Security zu erweitern. Sie haben diese Technologien integriert und konnten aufgrund ihrer Größe E-Mail-Sicherheit zu einem Bruchteil des damaligen Marktpreises anbieten. Das Ergebnis war, die Kommodifizierung vom E-Mail-Security. Etwa zur gleichen Zeit wurden E-Mail-Bedrohungen gut verstanden und als unter Kontrolle empfunden. Anbieter, die mit der E-Mail-Sicherheit keinen finanziellen Gewinn mehr erzielen konnten, haben ihr Innovations- und Entwicklungsbudget auf andere Lösungen und Services übertragen. Jetzt zahlen wir alle den Preis für diese mangelnde Investition Dies bringt uns zurück zu heute, wo dieser Mangel an Investitionen offensichtlich ist. Die Welt hat sich verändert und Cyberkriminelle haben einfache und risikoarme Wege gefunden, um mit Ransomware und Phishing -Angriffen Geld zu verdienen. Jede Woche gibt es einen weiteren Bericht über einen erfolgreichen Angriff, und dies sind nur die, die entdeckt und gemeldet werden. Die Malware-Autoren und Angreifer entwickeln ihre Ausweichtechniken ständig weiter, um selbst die höchst entwickelten Abwehrmechanismen zu überwinden. Herkömmliche E-Mail-Sicherheitsinfrastrukturen haben Probleme mitzuhalten  mit offensichtlichen Konsequenzen. Möchten Sie mehr über cloudbasierte E-Mail-Sicherheit und Archivierung erfahren? Kontaktieren Sie uns bei Interesse hier ! Try it for Free Instant Data Classification Cyren URL Category Chacker Prev Test the Effectiveness of Your Email Security Open Source Ransomware Targets Fortnite Users Next Company Partners Resources Investor Relations Products Freeware Demo Solutions Contact Us Privacy Management Service by Data443

Output:
**Comprehensive Analysis of Cyren's Email Security Content**

**1. Key Security Features and Their Benefits:**
- **GAP Analysis:** Cyren offers a GAP Analysis tool to evaluate existing email security solutions, identifying vulnerabilities that other tools might miss. This feature helps organizations understand their security gaps, crucial for preventing phishing and malware attacks. Benefits include enhanced threat detection and improved security posture.

**2. Compliance Certifications and Regulatory Adherence:**
- The content does not explicitly mention certifications like ISO 27001 or GDPR compliance. However, given the critical nature of email security in data protection, adherence to such regulations is implied. It is essential for organizations to ensure their solutions comply with relevant standards.

**3. User-Focused Security Recommendations:**
- Conduct a GAP Analysis to assess security effectiveness. Regular testing of email security solutions is advised. Emphasize user training to recognize and respond to threats, enhancing overall security awareness.

**4. Technical Security Implementation Details:**
- Cyren's solutions integrate with existing infrastructure, both on-premise and cloud-based. The GAP Analysis provides aggregated data and customized reports. Specific technical details like encryption methods or integrations with SIEM or EDR are not mentioned, which could be an area for improvement.

**5. Data Protection Measures:**
- The content highlights preventing phishing and malware emails, indicating robust scanning and detection mechanisms. Handling large email volumes without compromising security is a key data protection measure.

**6. Best Practices for End Users:**
- While not explicitly listed, best practices include vigilance in emails, avoiding suspicious links/attachments, and reporting phishing attempts. Regular training and awareness programs are essential for enhancing user seguridad.

**Conclusion:**
The content effectively communicates the importance of email security and offers valuable tools like the GAP Analysis. However, it could be enhanced by including details on compliance, technical implementation, and explicit end-user best practices. Additionally, providing actionable steps post-analysis would strengthen user engagement and improvement in security posture.


Input: Search Free Trial Get Demo Überprüfen Sie die Wirksamkeit Ihrer E-Mail-Security-Lösung July 31, 2019 Erreichen Phishing-E-Mails immer wieder Ihre Benutzer und möchten Sie einmal quantifizieren, wie effektiv Ihre E-Mail-Sicherheit tatsächlich ist? E-Mail ist der Hauptangriffsweg, um ein Unternehmen mit Malware zu infizieren, und wird heutzutage fast immer mit Phishing in Verbindung gebracht. Es ist also immer sinnvoll, sich einen Überblick darüber zu verschaffen, ob Ihre Sicherheit gut oder schlecht funktioniert. Bei Cyren wissen wir, wie aufschlussreich es sein kann, Lösungen neu zu bewerten. Die Email Sicherheits-Analysen, die wir 2018 für Unternehmen durchgeführt haben, zeigten, dass trotz der Verwendung einer E-Mail-Sicherheitslösung durchschnittlich 7,2 der E-Mails, die den End-User erreichten, entweder Spam oder eine Bedrohung enthielten. So finden Sie es heraus Führen Sie eine Cyren GAP-Analyse durch. Cyren hat Unternehmen dabei geholfen, ihre E-Mail-Sicherheit auf bestmögliche Weise zu bewerten, indem ein Vergleichstest mit den vorhandenen Lösungen durchgeführt wurde. Jetzt haben wir die Verfügbarkeit dieses kostenlosen Dienstes erweitert. In 2018 haben wir mit mehrere Unternehmen Gap-Analysen durchgeführt und insgesamt 2,7 Millionen E-Mails geprüft. Obwohl alle diese Email von der vorhandenen E-Mail-Sicherheitslösung gescannt und als sauber klassifiziert würden, haben wir festgestellt, dass durchschnittlich 6,9 Spam waren. Das ist für den User natürlich Ärgerlich, aber nicht ganz so ein Problem wie die Anzahl der Phishing- 7.014 E-Mails und Malware-Bedrohungen 978 E-Mails, die an den User ausgeliefert wurden. Auch wenn nur ein kleiner Prozentsatz der gesamten zugestellten E-Mails böswillig ist, ist es angesichts des enormen E-Mail-Volumen kein akzeptables Risiko, Hunderte oder Tausende von böswilligen E-Mails zu erhalten. Es ist sicherlich etwas, das Sie versuchen sollten, in den Griff zu bekommen. Wir haben einen vollständigen Bericht mit aggregierten Ergebnissen der E-Mail-Sicherheitsbewertung aus dem Jahr 2018 zur Verfügung gestellt. Besuchen Sie auch unsere Gap Analyse-Webseite oder laden Sie unser Gap Analyse-Datenblatt herunter, um weitere Informationen zur Durchführung Ihres eigenen Tests zu erhalten. Sie können mit unterschiedlichsten Ergebnisse rechnen! Während die oben genannten Durchschnittsergebnisse nützlich sind, so ist eine wichtige Erkenntnis aus unsere Studie, dass sich die Ergebnisse erheblich unterscheiden und dass mehrere Faktoren die Leistung der E-Mail-Sicherheit in einer bestimmten Organisation beeinflussen, wie die folgende Tabelle zeigt entnommen aus dem GAP-Aalyse-Bericht siehe oben Die Ergebnisse unterschieden sich sogar zwischen Unternehmen, die denselben Onpremise- oder Cloud-Anbieter verwenden, da die Leistung durch Realitätsfaktoren beeinflusst wird. Fazit Machen Sie Ihre eigene GAP-Analyse, um die möglichen Auswirkungen auf Ihr Unternehmen zu verstehen. Unbewusst ist ungeschützt! Viele Sicherheitsexperten gehen davon aus, dass ihre E-Mail-Sicherheit ausreichend ist, bis ein Benutzer eher mehrere  meldet, dass sie eine Phishing-E-Mail erhalten haben oder dass deren End Point-Schutz eine Bedrohung erkannt hat. Schlimmer ist es natürlich, wenn Ihre SIEM, Endpoint Detection and Response- EDR- oder DLP-Lösungen auf einen Network Breach hinweisen. Und dass kommt ziemlich häufig vor  laut Osterman Research hatten 70 Prozent aller Organisationen und 78 Prozent, die Office 365 verwendeten, haben letztes Jahr einen erfolgreichen Angriff erlebt. Vorausgesetzt, Sie haben das Glück, und Sie haben das Budget für diese Verteidigungsmechanismen, und die Leute sind soweit geschult, um die Warnungen verstehen und können richtig auf sie reagieren. Wenn Sie zu der glücklichen Minderheit gehören, die in letzter Zeit keinen Angriff gesehen hat, und davon ausgehen, dass Ihre E-Mail-Sicherheit in Ordnung ist, sollten Sie die Statistiken berücksichtigen, dass 25 aller Verstöße einen Monat lang unentdeckt bleiben, währenddessen die bösen Jungs auf Ihre Daten zugreifen. Durch die Kommodifizierung von E-Mail-Security hat die Branche den Fokus verloren Machen E-Mail-Sicherheitsanbieter genug, um Unternehmen, ihre Mitarbeiter und deren Daten zu schützen, oder sind viele zu selbstgefällig geworden? Die jüngsten erfolgreichen, hochkarätigen Ransomware-Angriffe lässt auf Letzteres schließen. Aber wie ist es so weit gekommen? Vor 10 Jahren war die E-Mail-Sicherheitsbranche lebhaft und bereit für zahlreiche Akquisitionen größerer Sicherheitsanbieter, die ihre Portfolios erweitern wollten. Die wesentliche Änderung erfolgte, als die größten E-Mail-Dienstleister einige der größeren SaaS-E-Mail-Sicherheitsanbieter erwarben, um ihr Angebot durch E-Mail-Security zu erweitern. Sie haben diese Technologien integriert und konnten aufgrund ihrer Größe E-Mail-Sicherheit zu einem Bruchteil des damaligen Marktpreises anbieten. Das Ergebnis war, die Kommodifizierung vom E-Mail-Security. Etwa zur gleichen Zeit wurden E-Mail-Bedrohungen gut verstanden und als unter Kontrolle empfunden. Anbieter, die mit der E-Mail-Sicherheit keinen finanziellen Gewinn mehr erzielen konnten, haben ihr Innovations- und Entwicklungsbudget auf andere Lösungen und Services übertragen. Jetzt zahlen wir alle den Preis für diese mangelnde Investition Dies bringt uns zurück zu heute, wo dieser Mangel an Investitionen offensichtlich ist. Die Welt hat sich verändert und Cyberkriminelle haben einfache und risikoarme Wege gefunden, um mit Ransomware und Phishing -Angriffen Geld zu verdienen. Jede Woche gibt es einen weiteren Bericht über einen erfolgreichen Angriff, und dies sind nur die, die entdeckt und gemeldet werden. Die Malware-Autoren und Angreifer entwickeln ihre Ausweichtechniken ständig weiter, um selbst die höchst entwickelten Abwehrmechanismen zu überwinden. Herkömmliche E-Mail-Sicherheitsinfrastrukturen haben Probleme mitzuhalten  mit offensichtlichen Konsequenzen. Möchten Sie mehr über cloudbasierte E-Mail-Sicherheit und Archivierung erfahren? Kontaktieren Sie uns bei Interesse hier ! Try it for Free Instant Data Classification Cyren URL Category Chacker Prev Test the Effectiveness of Your Email Security Open Source Ransomware Targets Fortnite Users Next Company Partners Resources Investor Relations Products Freeware Demo Solutions Contact Us Privacy Management Service by Data443

Output:
**Analysis of Cyren's Email Security Features**

1. **Key Security Features and Capabilities**
   - **GAP Analysis Service**: Cyren offers a free GAP analysis to evaluate the effectiveness of a company's current email security. This service identifies gaps by detecting threats that existing solutions miss, such as spam, phishing, and malware.
   - **Advanced Threat Detection**: Utilizes cloud-based email security to identify sophisticated threats, including ransomware and phishing attacks, which traditional solutions may overlook.
   - **URL Categorization**: Enhances security by categorizing URLs to block access to malicious websites, preventing users from inadvertently downloading malware.
   - **Instant Data Classification**: An open-source tool that aids in quickly identifying and classifying sensitive data, enhancing data protection measures.

2. **User Benefits and Protection Measures**
   - **Visibility into Security Gaps**: Provides clear insights into the effectiveness of current email security, allowing companies to address vulnerabilities proactively.
   - **Enhanced Protection**: Reduces the risk of successful cyberattacks by identifying and blocking threats that bypass traditional security measures.
   - **Regulatory Compliance**: Helps organizations meet compliance standards by securing sensitive data and providing audit trails, though specific certifications are not detailed in the content.

3. **Integration with Existing Security Systems**
   - While the content doesn't specify integrations with systems like SIEM, EDR, or DLP, it's inferred that such integrations are likely, given the nature of enterprise security solutions. Users may need to consult product documentation for specific integration details.

4. **Compliance and Certification Details**
   - Specific certifications (e.g., ISO 27001, GDPR) are not mentioned. For detailed compliance information, users should refer to Cyren's official resources or contact support.

5. **Security Best Practices for Users**
   - Regular Security Assessments: Periodically test and evaluate email security to stay ahead of emerging threats.
   - Continuous Monitoring: Actively monitor security systems to detect and respond to threats promptly.
   - User Education: Train employees to recognize and report suspicious emails to reduce the risk of successful phishing attacks.
   - Solution Updates: Keep security solutions updated to protect against the latest threats.

6. **Technical Specifications and Requirements**
   - The service is cloud-based, utilizing global threat intelligence for comprehensive protection. Compatibility with major email providers is likely, but specific technical requirements such as OS support or bandwidth needs are not detailed in the provided content. Users should consult Cyren's technical documentation for precise specifications.

This analysis highlights Cyren's robust email security offerings, emphasizing the importance of proactive security measures, user education, and regular assessments. For a comprehensive understanding, users are encouraged to explore Cyren's official resources and support channels.


Input: Search Free Trial Get Demo Überprüfen Sie die Wirksamkeit Ihrer E-Mail-Security-Lösung July 31, 2019 Erreichen Phishing-E-Mails immer wieder Ihre Benutzer und möchten Sie einmal quantifizieren, wie effektiv Ihre E-Mail-Sicherheit tatsächlich ist? E-Mail ist der Hauptangriffsweg, um ein Unternehmen mit Malware zu infizieren, und wird heutzutage fast immer mit Phishing in Verbindung gebracht. Es ist also immer sinnvoll, sich einen Überblick darüber zu verschaffen, ob Ihre Sicherheit gut oder schlecht funktioniert. Bei Cyren wissen wir, wie aufschlussreich es sein kann, Lösungen neu zu bewerten. Die Email Sicherheits-Analysen, die wir 2018 für Unternehmen durchgeführt haben, zeigten, dass trotz der Verwendung einer E-Mail-Sicherheitslösung durchschnittlich 7,2 der E-Mails, die den End-User erreichten, entweder Spam oder eine Bedrohung enthielten. So finden Sie es heraus Führen Sie eine Cyren GAP-Analyse durch. Cyren hat Unternehmen dabei geholfen, ihre E-Mail-Sicherheit auf bestmögliche Weise zu bewerten, indem ein Vergleichstest mit den vorhandenen Lösungen durchgeführt wurde. Jetzt haben wir die Verfügbarkeit dieses kostenlosen Dienstes erweitert. In 2018 haben wir mit mehrere Unternehmen Gap-Analysen durchgeführt und insgesamt 2,7 Millionen E-Mails geprüft. Obwohl alle diese Email von der vorhandenen E-Mail-Sicherheitslösung gescannt und als sauber klassifiziert würden, haben wir festgestellt, dass durchschnittlich 6,9 Spam waren. Das ist für den User natürlich Ärgerlich, aber nicht ganz so ein Problem wie die Anzahl der Phishing- 7.014 E-Mails und Malware-Bedrohungen 978 E-Mails, die an den User ausgeliefert wurden. Auch wenn nur ein kleiner Prozentsatz der gesamten zugestellten E-Mails böswillig ist, ist es angesichts des enormen E-Mail-Volumen kein akzeptables Risiko, Hunderte oder Tausende von böswilligen E-Mails zu erhalten. Es ist sicherlich etwas, das Sie versuchen sollten, in den Griff zu bekommen. Wir haben einen vollständigen Bericht mit aggregierten Ergebnissen der E-Mail-Sicherheitsbewertung aus dem Jahr 2018 zur Verfügung gestellt. Besuchen Sie auch unsere Gap Analyse-Webseite oder laden Sie unser Gap Analyse-Datenblatt herunter, um weitere Informationen zur Durchführung Ihres eigenen Tests zu erhalten. Sie können mit unterschiedlichsten Ergebnisse rechnen! Während die oben genannten Durchschnittsergebnisse nützlich sind, so ist eine wichtige Erkenntnis aus unsere Studie, dass sich die Ergebnisse erheblich unterscheiden und dass mehrere Faktoren die Leistung der E-Mail-Sicherheit in einer bestimmten Organisation beeinflussen, wie die folgende Tabelle zeigt entnommen aus dem GAP-Aalyse-Bericht siehe oben Die Ergebnisse unterschieden sich sogar zwischen Unternehmen, die denselben Onpremise- oder Cloud-Anbieter verwenden, da die Leistung durch Realitätsfaktoren beeinflusst wird. Fazit Machen Sie Ihre eigene GAP-Analyse, um die möglichen Auswirkungen auf Ihr Unternehmen zu verstehen. Unbewusst ist ungeschützt! Viele Sicherheitsexperten gehen davon aus, dass ihre E-Mail-Sicherheit ausreichend ist, bis ein Benutzer eher mehrere  meldet, dass sie eine Phishing-E-Mail erhalten haben oder dass deren End Point-Schutz eine Bedrohung erkannt hat. Schlimmer ist es natürlich, wenn Ihre SIEM, Endpoint Detection and Response- EDR- oder DLP-Lösungen auf einen Network Breach hinweisen. Und dass kommt ziemlich häufig vor  laut Osterman Research hatten 70 Prozent aller Organisationen und 78 Prozent, die Office 365 verwendeten, haben letztes Jahr einen erfolgreichen Angriff erlebt. Vorausgesetzt, Sie haben das Glück, und Sie haben das Budget für diese Verteidigungsmechanismen, und die Leute sind soweit geschult, um die Warnungen verstehen und können richtig auf sie reagieren. Wenn Sie zu der glücklichen Minderheit gehören, die in letzter Zeit keinen Angriff gesehen hat, und davon ausgehen, dass Ihre E-Mail-Sicherheit in Ordnung ist, sollten Sie die Statistiken berücksichtigen, dass 25 aller Verstöße einen Monat lang unentdeckt bleiben, währenddessen die bösen Jungs auf Ihre Daten zugreifen. Durch die Kommodifizierung von E-Mail-Security hat die Branche den Fokus verloren Machen E-Mail-Sicherheitsanbieter genug, um Unternehmen, ihre Mitarbeiter und deren Daten zu schützen, oder sind viele zu selbstgefällig geworden? Die jüngsten erfolgreichen, hochkarätigen Ransomware-Angriffe lässt auf Letzteres schließen. Aber wie ist es so weit gekommen? Vor 10 Jahren war die E-Mail-Sicherheitsbranche lebhaft und bereit für zahlreiche Akquisitionen größerer Sicherheitsanbieter, die ihre Portfolios erweitern wollten. Die wesentliche Änderung erfolgte, als die größten E-Mail-Dienstleister einige der größeren SaaS-E-Mail-Sicherheitsanbieter erwarben, um ihr Angebot durch E-Mail-Security zu erweitern. Sie haben diese Technologien integriert und konnten aufgrund ihrer Größe E-Mail-Sicherheit zu einem Bruchteil des damaligen Marktpreises anbieten. Das Ergebnis war, die Kommodifizierung vom E-Mail-Security. Etwa zur gleichen Zeit wurden E-Mail-Bedrohungen gut verstanden und als unter Kontrolle empfunden. Anbieter, die mit der E-Mail-Sicherheit keinen finanziellen Gewinn mehr erzielen konnten, haben ihr Innovations- und Entwicklungsbudget auf andere Lösungen und Services übertragen. Jetzt zahlen wir alle den Preis für diese mangelnde Investition Dies bringt uns zurück zu heute, wo dieser Mangel an Investitionen offensichtlich ist. Die Welt hat sich verändert und Cyberkriminelle haben einfache und risikoarme Wege gefunden, um mit Ransomware und Phishing -Angriffen Geld zu verdienen. Jede Woche gibt es einen weiteren Bericht über einen erfolgreichen Angriff, und dies sind nur die, die entdeckt und gemeldet werden. Die Malware-Autoren und Angreifer entwickeln ihre Ausweichtechniken ständig weiter, um selbst die höchst entwickelten Abwehrmechanismen zu überwinden. Herkömmliche E-Mail-Sicherheitsinfrastrukturen haben Probleme mitzuhalten  mit offensichtlichen Konsequenzen. Möchten Sie mehr über cloudbasierte E-Mail-Sicherheit und Archivierung erfahren? Kontaktieren Sie uns bei Interesse hier ! Try it for Free Instant Data Classification Cyren URL Category Chacker Prev Test the Effectiveness of Your Email Security Open Source Ransomware Targets Fortnite Users Next Company Partners Resources Investor Relations Products Freeware Demo Solutions Contact Us Privacy Management Service by Data443

Output:
### Sicherheitsexperten-Ratschläge: Schützen Sie Ihre E-Mails und Daten

Um Ihre E-Mail-Sicherheit zu gewährleisten und Ihre Daten zu schützen, folgen Sie bitte den folgenden praktischen Empfehlungen:

1. **Verbessern Sie Ihre E-Mail-Sicherheit:**
   - **Durchführen Sie eine GAP-Analyse:** testen Sie die Wirksamkeit Ihrer aktuellen E-Mail-Sicherheitslösung, um mögliche Schwachstellen zu identifizieren.
   - **Nutzen Sie fortschrittliche Technologien:** Integrieren Sie AI-gestützte Lösungen, um neue Bedrohungen wie Phishing und Malware effektiv zu bekämpfen.

2. **Schulen Sie Ihre Mitarbeiter:**
   - **Phishing-Schulungen:** Lehren Sie Ihre Mitarbeiter, gefährliche E-Mails zu erkennen und richtig zu reagieren.
   - **Regelmäßige Schulungen:** Achten Sie darauf, dass Schulungen aktuell und praxisnah sind, um die Awareness zu erhöhen.

3. **Schützen Sie Ihre Daten:**
   - **Datensicherung:** Sichern Sie regelmäßig kritische Daten und stellen Sie sicher, dass Backups leicht wiederhergestellt werden können.
   - **Verschlüsselung:** Verwenden Sie Verschlüsselung für sensible Informationen, um sie vor unbefugtem Zugriff zu schützen.

4. **Sichere Nutzerrichtlinien:**
   - **Starken Passwörtern:** Ermutigen Sie Ihre Mitarbeiter, starke und einzigartige Passwörter zu verwenden, und implementieren Sie eine Zwei-Faktor-Authentifizierung.
   - **Administratorenrechte:** Beschränken Sie Administrative Rechte auf das absolute Minimum, um die Angriffsfläche zu reduzieren.

5. **Überwachung und Protokollierung:**
   - **Regelmäßige Audits:** Überprüfen Sie regelmäßig die Sicherheitsprotokolle, um verdächtige Aktivitäten frühzeitig zu erkennen.
   - **Automatisierung von Sicherheitsmaßnahmen:** Setzen Sie automatisierte Tools ein, um E-Mails auf Malware und Phishing zu scannen.

6. **Suchen Sie Unterstützung, wenn nötig:**
   - **Sicherheitsexperten:** Wenn Sie Zweifel an Ihrer aktuellen Sicherheitslage haben, ziehen Sie Fachleute zu Rate.
   - **Konsequente Reaktion bei Vorfällen:** Reagieren Sie sofort, wenn ein Angriff vermutet wird, und isolieren Sie betroffene Systeme, um die Ausbreitung zu verhindern.

### Fazit:
Investieren Sie kontinuierlich in verbesserte Sicherheitsmaßnahmen und die Schulung Ihrer Mitarbeiter, um Cyber-Bedrohungen effektiv zu bekämpfen. Ignorieren Sie nicht die Bedeutung regelmäßiger Datensicherungen und einer robusten Wiederherstellungsstrategie. Nur so können Sie Ihre Daten und Ihre Integrität bestmöglich schützen.


Input: Search Free Trial Get Demo Chris Perram on FinTech Financials RegTech Show April 10, 2018 Chris Perram on FinTech Financials RegTech Show Recently, Chris appeared on FinTech Financials The RegTech Show to talk about how the incoming GDPR regulations will change the Finance Industry, and about organising data during this mercurial period. Watch the video here Try it for Free Instant Data Classification Cyren URL Category Chacker Prev Congratulations, Youre Our New DPO! Now What? 3 GDPR Principles Accuracy, Retention, and Transparency Next Company Partners Resources Investor Relations Products Freeware Demo Solutions Contact Us Privacy Management Service by Data443

Output:
**Analysis of Security-Related Content**

**1. Security Features and Benefits:**

- **Instant Data Classification:** This tool enables automatic sorting of data, enhancing efficiency and reducing errors. It aids in quickly identifying sensitive information, which is crucial for compliance with regulations like GDPR.

- **Cyren URL Category Checker:** This tool scans URLs to assess safety, protecting users from malicious links and phishing attempts, thereby enhancing security when browsing.

**2. Compliance and Regulatory Adherence:**

- The content emphasizes GDPR compliance through discussions on the FinTech show and structured data management by appointing a DPO, highlighting the company's commitment to regulatory standards.

**3. User-Focused Security Recommendations:**

- **Data Classification:** Users should adopt tools to classify data effectively for proper handling.
- **GDPR Training:** Providing resources or guides helps users understand and implement compliance measures.
- **Regular Audits and Updates:** Ensures ongoing compliance and adaptability to changing regulations.

**4. Technical Security Implementation:**

- Clarity is needed on whether solutions are cloud-based or on-premises. Details on encryption methods, access controls, and system integration would provide further insight into solution robustness.

**5. Data Protection Measures:**

- **Classification and DLP:** Tools help monitor data movement to prevent unauthorized access.
- **Secure Storage:** Encryption protects data at rest and in transit.

**6. Best Practices for End Users:**

- Caution with links and attachments, regular system updates, and strong passwords are essential.
- Encouraging users to report suspicious activities and stay informed about data protection regulations is crucial.

**Summary:**
The content effectively highlights key aspects of GDPR compliance and security tools but lacks specific technical details and depth. Enhancing with more detailed explanations, certifications, and clear calls to action would improve user engagement and understanding.


Input: Search Free Trial Get Demo Chris Perram on FinTech Financials RegTech Show April 10, 2018 Chris Perram on FinTech Financials RegTech Show Recently, Chris appeared on FinTech Financials The RegTech Show to talk about how the incoming GDPR regulations will change the Finance Industry, and about organising data during this mercurial period. Watch the video here Try it for Free Instant Data Classification Cyren URL Category Chacker Prev Congratulations, Youre Our New DPO! Now What? 3 GDPR Principles Accuracy, Retention, and Transparency Next Company Partners Resources Investor Relations Products Freeware Demo Solutions Contact Us Privacy Management Service by Data443

Output:
**Comprehensive Security Guidance**

1. **Security Best Practices**
   - **Encryption**: Use SSL/TLS for data in transit and AES for data at rest.
   - **Regular Updates**: Keep all software and systems updated to protect against vulnerabilities.
   - **Data Classification**: Utilize tools like Cyren URL Category Checker to classify data and apply appropriate protection.

2. **Data Protection Recommendations**
   - **Data Minimization & Purpose Limitation**: Collect only necessary data and use it solely for intended purposes.
   - **Access Control**: Restrict data access to authorized personnel.
   - **Backups**: Regularly back up data to prevent loss.
   - **DPO Role**: Appoint a Data Protection Officer to oversee GDPR compliance and data strategies.

3. **Safe Usage Guidelines**
   - **User Training**: Conduct regular sessions and phishing simulations to educate employees.
   - **Strong Passwords & MFA**: Enforce password policies and use Multi-Factor Authentication.
   - **Data Restriction**: Limit sensitive data usage to business-only contexts.

4. **Common Security Risks & Prevention**
   - **Phishing**: Educate users to recognize and avoid phishing attempts by verifying senders and not clicking suspicious links.
   - **Insider Threats**: Monitor access and implement clear policies to mitigate risks.
   - **Ransomware**: Prevent through regular backups and user education.

5. **Privacy Protection Measures**
   - **Transparency & Consent**: Clearly inform customers on data usage and obtain consent.
   - **Privacy Policies**: Maintain clear policies and offer easy consent management.
   - **Third-Party Data Sharing**: Ensure partners have contractual agreements for data protection.

6. **When to Seek Additional Support**
   - **Expert Consultation**: Consult with experts for complex data handling or compliance concerns.
   - **Incident Response**: Engage professionals for breach containment and management.

This structured approach ensures clarity and practicality, making it accessible for all users to implement effective security measures.