Input: Search Free Trial Get Demo Day July 13, 2022 Data443 Returns to Sponsor Black Hat USA Conference July 13, 2022 Ransomware Recovery, Sensitive Data Protection  Device Identification Primary Themes for Thousands of Press and Attendees Research Triangle Park, NC, July 13, 2022  Data443 Risk Mitigation, Inc. Data443 or the Company OTCPK ATDS, the leading data security and privacy software company for ALL THINGS DATA SECURITY, today announced its Company Partners Resources Investor Relations Products Freeware Demo Solutions Contact Us Privacy Management Service by Data443

Output: data_protection,privacy_policy,incident_response


Input: Search Free Trial Get Demo A view from the exhibition floor three takeaways from Infosecurity Europe June 10, 2019 This years Infosecurity Europe again made me realise that I am privileged to work in such an exciting industry. As always, there was a lot of hype to cut through, but once you did, there were great insights to be found. Here are my top three takeaways from walking the floor. 1. Too few vendors were talking about email security The 2019 Verizon Data Beach Investigations Report recognises phishing as number one in a list of Top threat action varieties in breaches and email as the most common point of entry for malware. Why then, were so few companies talking about email security? Even those with market leading products and services seemed to be avoiding the subject. The migration to cloud email platforms is changing email security and I expect it will have a far higher profile next year. Watch out for an emerging category of service, Inbox Detection and Response IDR, that is going to change the way we protect users from phishing attacks. Only a few of the start-up vendors in this space were exhibiting this year, but expect to see more next year. 2. Its all about the user This segues nicely to my next takeaway  are we giving up on technology and placing too much emphasis on the user? Every information security professional understands the concept of technology, people and process controls, and a people-centric security strategy, but are we relying too heavily on users? One thing is for sure, there was no shortage of choice for those looking for companies to help train users in cyber security awareness and more specifically, phishing awareness. The problem is that while continuous training does help, there are numerous studies that suggest training does not move the needle sufficiently. A recent Osterman Research survey demonstrated this 93 of respondents provide users with phishing awareness training, yet 44 suffered a successful phishing attack. Clearly, we need a better mechanism to engage users at the point of risk, when they open an email. Again, there are emerging technologies that do this, providing users with the help they need and reinforcing the training they are given. Expect to see more vendors offering these services at next years event. 3. Vendors should be clearer about how they are solving a problem Walking the floor, far too often, I found myself standing and staring at a booth to try and understand what the exhibiting vendor was selling. Too many vendors were vague about the problem they are solving and even more so about how they do solve it. As an industry, we need to get better at articulating how we help and how we differentiate ourselves from others. As a marketer, I fully understand that I need to demonstrate the value my products and services bring, but I also need to explain in very clear terms how the technology actually does this. My number one action from Infosec is to review how we at Cyren tell our story. We like to educate and ran a number of presentations on our booth. If you missed them, I have condensed them to 5 minutes each and recorded them. You can access them by clicking the links below. Evasive malware insight into tactics  defences Evasive phishing insight into tactics Phishing kits democratizing evasive phishing Try it for Free Instant Data Classification Cyren URL Category Chacker Prev Its Back! Facebook Cryptominer Worm Reemerges Attack Exploits Vulnerability in Half of Email MTAs Globally Next Company Partners Resources Investor Relations Products Freeware Demo Solutions Contact Us Privacy Management Service by Data443

Output: product_security_features,end_user_security,threat_prevention,technical_documentation


Input: Search Free Trial Get Demo Day August 27, 2018 Release 1.0.14 is now available of The WordPress GDPR Framework August 27, 2018 THIS WEEK WE RELEASED ANOTHER UPGRADE TO OUR MOST RECENT PRODUCT CAPABILITY  THE WORDPRESS GDPR FRAMEWORK. Changelog 1.0.14 RELEASED AUG 29 Make Cookie Popup Optional 1.0.13 RELEASED AUG 28 Proper update  upload failure on previous promo 1.0.12 RELEASED AUG 27 Change comment consent text Add english canada to supported Company Partners Resources Investor Relations Products Freeware Demo Solutions Contact Us Privacy Management Service by Data443

Output: data_protection,privacy_policy,compliance_certifications


Input: Search Free Trial Get Demo Not-Really-Password-Protected Evasion Technique Resurfaces October 26, 2018 Today we came across an e-mail with an Excel Workbook attachment, which upon first inspection appears to be password-protected. The presence of the EncryptedPackage stream in an OLE2 document indicates that it is protected by a password, which obviously would require the user to enter one in order to open the document properly. Or at least thats what the bad guys would like email or AV scanners to think. Figure 1 Looking at the e-mail, which is couched as a very generic price quote request, the sender did not provide any password for the attachment, so what gives? Figure 2 Sounds like something weve already seen a few years back, six years to be exact. Do you remember VelvetSweatshop and the infamous CVE-2012-0158 exploit which took advantage of the Microsoft Excel default password hidden feature to evade detection? Well, this malware campaign will surely bring you back to those old days. First lets try to open the document to see if Microsoft Office will be able to load it properly. Figure 3 Figure 4 And sure thing, Microsoft Office Excel was able to open the document with no problems at alland no request to enter a password. So lets take a look at whats happening in the background. Exploits Office Vulnerability CVE-2017-11882 The first thing youll notice is the presence of EQNEDT32.EXE being loaded by svchost.exe. This behavior indicates a possible exploitation of CVE-2017-11882 Microsoft Office Memory Corruption Vulnerability. Figure 5 Digging a little deeper, we debugged the exploit shellcode to see what this document really does in the background. Sure enough, this sample does indeed exploit CVE-2017-11882 and attempts to download and execute an executable payload supposedly saved as PUBLICvbc.exe in the affected computers system, as shown in the screenshots below. Figure 6 Figure 7 VelvetSweatshop Default Password Ploy Still Being Used We also decrypted the email attachment and confirmed that this document is taking advantage of the old Microsoft Office hidden feature that uses a default password to load encrypted documents, as shown in the lines of code in the screenshot below. Figure 8 Unfortunately, the download link from this exploit sample was inaccessible as of this writing, so we are not able to provide an analysis of its payload. Indicators of Compromise and Cyren Detection SHA256 Object Type Remarks Cyren Detection 04ee59add6c2df247f97a17eab8594a2a28b7e17e7ce3e9cc5c334ae0ac265de EML Subject Prices required  CVE1711882 fe5568568d4930866d29699b46e11711c462bfcefd05589e98c6b5250da074ff EML Subject Prices required  CVE1711882 73675e415abe136fa06070d5781d5d0d84c415111b0c65d43910e44146124642 XLS Password-protected VelvetSweatsho CVE1711882  URL Saved to PUBLICvbc.exe Payload Inaccessible as of this writing Prevention and Mitigation We remind readers that Microsoft issued a patch for the CVE-2017-11882 exploit in 2017. Outdated software, operating systems, browsers, and plugins are major vectors for malware infections. Try it for Free Instant Data Classification Cyren URL Category Chacker Prev Police Phishing Attack Targets Bank Credentials Fileless Malware Already Targeting Holiday Suppliers Next Company Partners Resources Investor Relations Products Freeware Demo Solutions Contact Us Privacy Management Service by Data443

Output: data_protection,access_management,threat_prevention,technical_documentation


Input: Search Free Trial Get Demo Covid AgentTesla April 17, 2020 With the world under threat of the COVID-19 aka corona virus, many cybercriminals are taking this opportunity to blend in the chaos. Here we have an email posing to have an order of masks. An important personal protection equipment that is on a very high demand as of this moment. Infection Chain Overview RTF Attachment Once the file is opened, it will try to exploit a vulnerability in Microsoft Word to download and execute a file. hxxpbit.ly2J9KXAM which resolves to hxxpposqit.netGE5091203.jpg 5091203.jpg The downloaded .jpg file is actually a PE Executable file. It is a .NET file so we can use DnSpy to analyze its code. Once executed, it will decrypt a DLL fileDKaQso.dll using AES from its resource and will load and execute it using Assembly.Load and InvokeMember methods. Resource section object named AL is the encrypted DKaQso.dll. Key and IV used to decrypt the file Execute X on DKaQso.dll DKaQso.dll The DLL file contains another 3 files in its resource. The 2 image files contain 1 DLL file each. 1.bmp - LOL.dll which is embedded in an image. SourceTIASK .bmp- 26.dll. which is compressed and embedded in image. IsConsoleEnabledsANCK - AgentTesla binary payload which is compressed and encrypted. It uses the Bitmap Class to get the embedded DLL in the BMP file which is a form of Steganography.Here we have an image of a snippet code which gets the first pixel and get the color.B property.The byte is equal to 0x4D which is equal to M, the start of the MZ header in PE files.It will perform a loop on each pixel and get the byte in the color.B property to form the the DLL file. In the case of 26.dll, once the file is taken out of the image, it will be decompressed. LOL.dll Once loaded and executed, the files task is to create a persistence mechanism for the malware. It checks for files and folders related to Anti-Malware vendors and creates the necessary files for its persistence mechanism. If the following files exist in the system, it will create .js file in the startup folder CProgram FilesAVAST SoftwareAvastavastUI.exe CProgram Files x86AVAST SoftwareAvastavastUI.exe CProgram FilesAVGAntivirusAVGUI.exe CProgram Files x86AVGAntivirusAVGUI.exe Content of the .js file var nPiCCaK  new ActiveXObjectShell.Application nPiCCaK.ShellExecuteMALWARE PATH, , , Open, 1 If the following folder exist in the system, it will create a shortcut link in the startup folder. CProgram Files x86KasperSky Lab FilesKasperSky Lab - folder path contains the string If windows Windows Defender exist in the system, it will create a registry entry that is linked to the malware executable path SOFTWAREMicrosoftWindowsCurrentVersionRun 26.dll This DLL is responsible for injecting the payload on Regasm.exe. It checks for the following directory related to Anti-Malware vendors CProgram FilesAVAST Software CProgram Files x86AVAST Software It also checks for the following strings related to Anti-Malware vendors BullGuard a2guard drweb vssery AVGUI bdagent odscanui bdredline It also checks for Windows Defender Payload The main payload of this infection chain is a variant of AgentTesla. The strings used by this malware is encrypted using AES. Using the info of its decryption routine,we can try and decrypt the strings it uses. Here we have the SMTP account and server it uses. SHA256 Description Detection 0cddd9b85decde446a800c9d3dee489758f39e5131c9dc4f0c06622f9370e82d email 27d601ef1a2b340b6b644493a627064f60ad8a95271248e00f7bb54a59abb069 RTF attachment  COVID 19 NEW ORDER FACE MASKS.doc CVE-2017-11882.C.gen!Camelot 69f559b9cd5b586e4a2c0bba58be74b85124a230bef6035739a325cf57066e2f downloaded payload W32MSIL_Kryptik.AIA.gen!Eldorado Try it for Free Instant Data Classification Cyren URL Category Chacker Prev File-less almost and Confused Covid-19 Exposes a Newly Remote Workforce to More Evasive Phishing Attacks Next Company Partners Resources Investor Relations Products Freeware Demo Solutions Contact Us Privacy Management Service by Data443

Output: threat_prevention,technical_documentation


Input: Search Free Trial Get Demo Day April 20, 2022 Ransomware protect yourself or pay April 20, 2022 Cyren offers ransomware protection from cyber-attacks through powerful cloud-based email security services. What is ransomware? Ransomware is a cyber attack that encrypts your files until you pay. This type of attack is malware that employs encryption  holding a victims information at ransom. A user or organizations data is first Office 365 Phishing, BEC,  Ransomware Survey Highlights April 20, 2022 Reading a complete report is not for everyone. If that includes you, here are the key takeaways from the 2022 Osterman report on Phishing, BEC, and Ransomware Threats for Microsoft 365 Customers. Less than half the organizations ranked their currently deployed email security solutions effective. Respondents felt least confident in Company Partners Resources Investor Relations Products Freeware Demo Solutions Contact Us Privacy Management Service by Data443

Output: threat_prevention,end_user_security,security_best_practices,data_protection,technical_documentation


Input: Search Free Trial Get Demo Data443 Returns to Sponsor Black Hat USA Conference July 13, 2022 Ransomware Recovery, Sensitive Data Protection  Device Identification Primary Themes for Thousands of Press and Attendees Research Triangle Park, NC, July 13, 2022  Data443 Risk Mitigation, Inc . Data443 or the Company OTCPK ATDS , the leading data security and privacy software company for ALL THINGS DATA SECURITY, today announced its return to the Black Hat USA Conference in Las Vegas, Nevada on August 10  11. As the world reopens and cybersecurity risks continue unabated, we are happy to return to Las Vegas for another opportunity to meet thousands of new prospective customers and press members, commented Data443 CEO  Founder Jason Remillard. Ransomware protection and recovery are top of mind for everyone at all technology and business leadership levels this year, and we are hearing from many organizations that other providers ransomware recovery and protection platforms are not delivering for them and fully meeting their critical needs  usually because they are lacking both in capabilities and core functionality. What differentiates our products in the marketplace is being inclusive of all layers of the technology stack, supporting virtually any cloud provider, any virtualization solution, and protecting laptops, desktops, and servers. Our Ransomware Recovery Manager and Data Identification Manager combine to deliver best of class capabilities for virtually any industry segment  protecting our most valuable assets against physical and electronic threats. We are proud to support native cloud vendors such as Microsoft  Azure, Google  Cloud Platform GCP, and Amazon  Web Services AWS, as well as virtualization platforms, such as VMWare  , Citrix  , and Oracle  . concluded Mr. Remillard. Data443 offers free trials of all its technologies on its shopping cart system at  Further production information is available at  About Black Hat For more than 20 years, Black Hat has provided attendees with the very latest in information security research, development, and trends. These high-profile global events and trainings are driven by the needs of the security community, striving to bring together the best minds in the industry. Black Hat inspires professionals at all career levels, encouraging growth and collaboration among academia, world-class researchers, and leaders in the public and private sectors. Black Hat Briefings and Trainings are held annually in the United States, Europe, and Asia. More information is available at blackhat.com . Black Hat is brought to you by Informa Tech. About Data443 Risk Mitigation, Inc. Data443 Risk Mitigation, Inc. OTC ATDS  is an industry leader in All Things Data Security, providing software and services to enable secure data across local devices, networks, cloud, and databases, at rest and in flight. With over 10,000 customers in over 100 countries, Data443 provides a modern approach to data governance and security by identifying and protecting all sensitive data regardless of location, platform, or format. Our industry-leading framework helps customers prioritize risk, identify security gaps, and implement overall data protection and privacy management strategies. For more information, please visit  To learn more about Data443, please watch our video introduction on our YouTube channel  Forward-Looking Statements The statements contained in this release that are not historical facts are forward-looking statements as defined in the Private Securities Litigation Reform Act of 1995. Words such as may, will, could, should, expect, plan, project, intend, anticipate, believe, estimate, predict, potential, pursuant, target, continue, and similar expressions are intended to identify such forward-looking statements. The statements in this press release that are not historical statements, including statements regarding Data443s plans, objectives, future opportunities for Data443s services, future financial performance and operating results and any other statements regarding Data443s future expectations, beliefs, plans, objectives, financial conditions, assumptions or future events or performance that are not historical facts, are forward-looking statements within the meaning of the federal securities laws. These statements are not guarantees of future performance and are subject to numerous risks, uncertainties, and assumptions, many of which are beyond Data443s control, and which could cause actual results to differ materially from the results expressed or implied by the statements. These statements are not guarantees of future performance and involve risks, uncertainties and assumptions that are difficult to predict, and include, without limitation, results of litigation, settlements and investigations actions by third parties, including governmental agencies volatility in customer spending global economic conditions ability to hire and retain personnel loss of, or reduction in business with, key customers difficulty with growth and integration of acquisitions product liability cybersecurity risk anti-takeover measures in our charter documents and, the uncertainties created by the ongoing outbreak of COVID-19. These and other important risk factors are described more fully in our reports and other documents filed with the Securities and Exchange Commission the SEC, including in i Part I, Item 1A. Risk Factors, in our Registration Statement on Form 10 filed with the SEC on January 11, 2019 and amended on April 24, 2019 ii Part I, Item 1A. Risk Factors, in our Annual Report on Form 10-K filed with the SEC on March 31, 2022 and, iii subsequent filings. Undue reliance should not be placed on the forward-looking statements in this press release, which are based on information available to us on the date hereof. Except as otherwise required by applicable law, we undertake no obligation to publicly update or revise any forward-looking statements, whether because of new information, future events, or otherwise. DATA443 is a registered trademark of Data443 Risk Mitigation, Inc. All product names, trademarks and registered trademarks are property of their respective owners. All company, product and service names used in this press release are for identification purposes only. Use of these names, trademarks and brands does not imply endorsement. For f urther i nformation Follow us on Twitter  Follow us on Facebook  Follow us on LinkedIn  Follow us on YouTube  Signup for our Investor Newsletter  Investor Relations Contact Matthew Abenante  919.858.6542 Try it for Free Instant Data Classification Cyren URL Category Chacker Prev Data443 Announces Broad Support for Leading Open-Source Cloud Unix Leader Data443 Reports Second Quarter and First Half 2022 Results and Provides Corporate Update Next Company Partners Resources Investor Relations Products Freeware Demo Solutions Contact Us Privacy Management Service by Data443

Output: product_security_features,end_user_security,data_protection,threat_prevention,incident_response


Input: Search Free Trial Get Demo Day April 7, 2022 IRS Scams 2022 April 7, 2022 Tax scams are so prevalent that the United States Internal Revenue Service has published a very long FAQ page to warn people of the risks. As we approach the peak of the income tax season in the United States, we can expect cyber-criminals to increase their efforts to intercept tax Company Partners Resources Investor Relations Products Freeware Demo Solutions Contact Us Privacy Management Service by Data443

Output: end_user_security,security_best_practices,threat_prevention


Input: Search Free Trial Get Demo Fileless Malware Already Targeting Holiday Suppliers October 31, 2018 It gets earlier and earlier. The first Yuletide-related malware campaign has already been spotted. Theres always an expected and monumental amount of consumer spam and phishing in the run-up to Black Friday and then Christmas itself, but weve found one malware author getting into the Christmas spirit in late October by targeting backdoor-delivering emails at the Yuletide supply chain, specifically Christmas goods suppliers whose preparations for the year-end commercial convulsion are well underway. According to the National Retail Federation, for some retailers the holiday season can represent as much as 30 percent of annual sales, and goods manufacturers and wholesalers in general are keen to take advantage, not to mention seasonal merchandise suppliers. Fileless Malware from Known Author The email being sent for this campaign Figure 1 uses the subject line Christmas Order with a made-up reference number, and proceeds to ask for pricing and delivery terms for items allegedly listed in an attachment, with the admonition that delivery is needed by November 20 th . This last detail is a classic social engineering tactic, intending to give a sense of urgency to the recipient. Opening the apparently .doc attachment, the user is asked to double-click an icon in order to view the contents. In doing so, a standard Windows security warning appears about running unverified software, and, unfortunately for those who ignore the warning, proceeding further detonates a RAR SFX self-extracting archive, which runs a first-level AutoIt Script Loader Module. This in turn is used to decode and load a second-level payload. A step-by-step analysis of the deployment sequence is provided further below. The final executable payload is a variant of the NetwiredRC backdoor. This payload uses the same custom Caesar Cipher and key used in a variant we recognized, as we covered it in one of our blog articles earlier this year , so it is safe to assume that the same culprit is behind this attack wave. Once installed, the backdoor has many capabilities, including but not limited to logging key strokes, stealing cookied login credentials stored in multiple browsers, and stealing email login credentials. Since the entire installation sequence is injected to a target process and is not saved to disk, it can be classified as a fileless malware. Fileless malware is a technique that has been a growing topic in security circles, and according to Cyren detection stats there has been a 350 percent increase in its use since 2016. Even though its a bit of a misnomer and not actually literally fileless, and is overhyped as undetectable, it is part of a general trend in increasing malware evasiveness. Although fileless methods have a lengthy history, its appearing more now because detection methods have been catching up with other techniques, application whitelisting wont stop it, and it makes attribution more difficult. If you need a good overview on fileless malware, we recommend this recorded webinar from a colleague of ours, which looks at the concept applied to ransomware, but the techniques described apply to malware generally, or this blog , which summarizes the concept. Figure 1 Email soliciting proposals Figure 2 Bait document that induces a click Supply Chain Hack Target Isnt Necessarily You The target of the email would appear to be smaller potential suppliers, but keep well in mind that that isnt necessarily the ultimate target. The massive 2014 hack into Home Depot resulting in 56 million stolen credit and debit card details and 53 million stolen email addresses, was credited to inadequate security at a small third-party vendor, as were the more recent hacks into Amazon Web Services and Wendys, as well as last Julys massive car manufacturers data leak . A 2017 study by the Ponemon Institute, found that 56 of large breaches were the result of an initial breach into a third-party vendor, possible because many smaller suppliers are often granted access to their customers corporate data and even network login credentials. Another well-known manufacturing industry example was examined here. How it Works Self-extracting RAR Archive As alluded to above, the loaded software is actually a RAR SFX, which contains several files having random filenames. Viewing the contents, we can see the files along with the SFX description and configuration settings Figure 3 Self-extracting archive with variable settings highlighted Highlighted in the screenshot are the variable settings for the self-extraction process UpdateU7WS52 Pathtemp42057438 Setupjsr.exe cecrmq The Path variable tells the SFX to extract the archive contents into the folder temp42057438 , while the Setup variable auto-executes the file jsr.exe , with the argument cec-rmq . The auto-executed file, jsr.exe , in this case is a copy of the AutoIt stand-alone script interpreter, which loads the file cec-rmq, which is a malicious AutoIt script. To make the AutoIt script difficult to read, cecrmq is filled with a lot of comments, which in this case could be considered as plain garbage. Once the garbage is cleaned up, we can see that the actual code is just around 70 lines. Figure 4 Comparative screenshots, showing script after removal of obfuscating garbage code First Level Script AutoIt Script Loader Module The first level script is a loader module, which is used to decode and load a 2 nd level payload, summarized as follows 1. Upon execution of the AutoIt script, cecrmq , it searches for a file named qch.pdf , which upon further inspection is actually a configuration INI file containing several variables used by the malicious script. The configuration file also includes two 2 pieces of encoded data, which are decoded at run-time. Shown below is a snippet of the cleaned up configuration file. 2. The first piece of encoded data, marked by sData and esData, is decrypted by the script using an arbitrary shellcode embedded in the script. This arbitrary shellcode is an ARC4-based decryption algorithm, loaded by the script using the CallWindowProc API. The cipher key, 869, used in the decryption process is read by the script from the sK variable in the configuration file. 3. The decrypted data, which is another AutoIt script, is updated to replace the string  Settings File Name  to the file name of the configuration file  qch.pdf  before saving it to a randomly named file in the same directory as itself and executing it afterwards with the AutoIt interpreter  jsr.exe  as shown in the code snippet below. AutoIt Script Payload Deletes Itself When Done The decrypted script is responsible for the actual malicious behavior which could be summarized as follows 1. For persistence, it creates an Auto-Start registry entry for jsr.exe and cecrmq, to ensure that its loader module automatically runs even after the system is restarted. 2. Decrypts the second piece of encoded data from the configuration file marked by Data and eData with ARC2 decryption algorithm using the ADVAPI32 APIs. The cipher key, nkk , is fetched from the Keys variable in the configuration file. 3. The script then searches for a target host executable, where the malicious payload will be injected. If Microsoft .NET Framework is installed in the system, the script would choose RegSvcs.exe as its host and will fallback to the default web browser if neither v2.0.50727 or v4.0.30319 is found in the system. Additionally, if the variable eos is set in the configuration file, the script runs a copy of the target host executable in the Windows temporary directory using either RegSvcs.exe or firefox.exe as the file name. 4. Using an arbitrary shellcode embedded in the script, the target host executable is run in suspended mode where the malicious payload executable is then injected and executed, via the CallWindowProcW API. Finally, after performing all needed operations, the script deletes itself to hide its presence in the system. Indicators of Compromise and Cyren Detection SHA256 Object Type Remarks Cyren Detection 941dcfb0631499270999e60e701f585a915fcaa0487395e8b587383214d7dae8 DOCX File name Christmas Order RefCH1189177110.doc Contains Embedded RARSFX W32Trojan3.ANEJ 4d20a76022d131afba68715a76289f813457e050fd11161361d09bc2157ebcf0 Win32 EXE File name Christmas Order RefCH1189177110.exe W32Trojan3.ANEJ 831fef7b31e47988b19f6cd92102bd767086377765f487e14c9d881480435c0e Win32 EXE Injected Executable W32Trojan.BIA.gen!Eldorado Try it for Free Instant Data Classification Cyren URL Category Chacker Prev Not-Really-Password-Protected Evasion Technique Resurfaces Evasive Phishing is Targeting Office 365 Next Company Partners Resources Investor Relations Products Freeware Demo Solutions Contact Us Privacy Management Service by Data443

Output: data_protection,threat_prevention,technical_documentation


Input: Search Free Trial Get Demo How to Identify Apple Phishing Email Scams March 26, 2019 Recently, a lot of phishing campaigns have been moving the embedded links from the body of an email into an attachment, to increase the odds of evading detection. We theorize this is a kind of social engineering ploy to move the user along quickly and get them into a clicking frame of mind. During recent analysis of samples of malicious PDF attachments, we have seen a lot of Apple-themed phishing content, and thought it might be instructive to share how rich and varied the world of Apple phishing has become. From purchases in the app store to a range of activities using ones Apple ID, threat actors have developed many ways to entice users to click on that malicious link. Without the proper phishing protection , these attacks can lead to the theft of precious Apple credentials. Types of Apple phishing email themes Weve classified the variety of Apple phishing email themes, which are used by cybercriminals to induce users to open the attachment, into six thematic areas Apple ID  PDFs that directly approach the user regarding the status of their credentials. Apple App Store  PDFs that are disguised as Apple App Store invoices, purchases or notifications. Apple iTunes  PDFs that are disguised as Apple iTunes purchases, subscriptions or notifications. Apple Gift Cards  PDFs that are disguised as purchase invoices of Apple Gift Cards. Apple Pay  PDFs that are disguised as Apple Pay notifications. Apple Generic  PDFs that were not automatically identified as any of the above themes, these may have been flagged because the PDF text or images contain strings related to Apple such as Apple Inc. or apple.com or simply the Apple logo. Below is a pie chart showing a breakdown of what weve been seeing during the start of 2019. It shows that a straightforward appeal to get the user to reset or confirm their Apple ID is used in the majority of cases, or 56 percent of the time. In second place come attempts thematically related to Apple iTunes, seen just over 30 percent of the time. Apple App Store, Apple Gift Card, and Apple Pay themed appeals add up to roughly 11 percent of the credential phishing attempts, leaving around 2 percent in the somewhat grab-bag generic Apple category. Figure 1  Breakdown of topical approaches used to phish Apple ID credentials from users Below are example PDFs, illustrating the various themes used. Did you buy that app? Cyber thieves are leveraging popular apps like games with in-app purchasing functionality. In this scenario, the customer will get an Apple phishing email about a subscription they didnt sign up for. They will be annoyed and highly motivated to cancel the phony subscription. And, of course, in order to cancel, the first step is to log in with ones Apple ID credentials at a spoofed web page, which the criminals immediately capture. Figure 2  A fake in-app purchase receipt enticing the user to cancel the purchase. Figure 3  Another fake in-app purchase receipt enticing the user to cancel the purchase after giving login credentials, of course. Figure 4  A fake subscription confirmation receipt enticing the user to cancel the purchase. Thank you for buying that gift card, song orMacBook? The same essential tacticyouve just bought this, but the terms of purchase allow you to still cancel but you better do it quicklyis not limited to app purchases, of course. Given the breadth of e-commerce offerings Apple has, the principle is applied to everything from music subscriptions to large purchases like MacBooks to the recipients surprise and likely total annoyance!. Figure 5  A fake music subscription confirmation receipt trying to lead the user to cancel the purchase. Figure 6  This fake gift card receipt has a strange REPORT TRANSACTIONS call-to-action. Figure 7  This fake MacBook purchase receipt also has an unusual call-to-action focusing on cancelation. It wasnt you, so could you cancel Oddly enough, another Apple phishing email tactic is to purport to report unauthorized account activity to the email recipient, but then put the onus of canceling the transaction on the victim. Figure 8  Another example of the cancel payment theme, which allegedly reports account fraud that the recipient must log in to undo. Did you do something wrong? For security-related issues, Apple like everybody else is known to send notifications to its users. Threat actors like to send fake notifications because they can be effective in creating a sense of urgency, something cyber thieves seek to create. Thematically these notification scams can be divided into two categories 1. Warnings about suspected account compromise, including unauthorized device access or the classic unusual login attempts. 2. Accusations that youve committed a usage policy violation, i.e., that youve violated the terms of service. Some example fraudulent emails are shown below. Account compromise, unauthorized device access, or unusual login attempts Figure 9  Example notification regarding a purchase from a new device. Figure 10  Notice alleging use from a suspicious location. Figure 11  Your Apple ID has been locked with a Verify Update call-to-action. Figure 12  Another example of enticing users with an unlock your account theme. Policy violation Figure 13  A policy violation example. Figure 14  Another example of your account has been disabled. Got hooked by an Apple phishing email? If a target clicks on one of the links in these phishing examples, most of the time it leads the target to a fake Apple website. Below is an image of an actual example of an Apple phishing website. Checking the code of the phishing site, it is AES-256 encrypted and uses an enc.js to decrypt the contents. This is a common tactic to hide the original code of the phishing page, and is used as an evasive tactic, that is to say, to make detection by security systems more difficult. It is notable that the fake website may look exactly like the real Apple login page, so we highly recommend users make sure that they are accessing verified links before entering their account credentials. This can be done by checking webpage certificates, using a URL category checker or by simply checking that the website domain is apple.com, and by having effective, automated phishing protection in place. Try it for Free Instant Data Classification Cyren URL Category Chacker Prev Emotet From a Banking Trojan to One of the Most Advanced Botnets Phishing Targeting Real Estate Firms Next Company Partners Resources Investor Relations Products Freeware Demo Solutions Contact Us Privacy Management Service by Data443

Output: end_user_security,security_best_practices,threat_prevention,technical_documentation


Input: Search Free Trial Get Demo Phishing Targeting Real Estate Firms April 24, 2019 Stories about real estate hacking and particularly phishing have appeared with increasing frequency in newspaper and blog headlines. Stories like the cybercriminals who stole client contact information from a DC-area real estate company, and with the information then created a  business email compromise  BEC scam, which resulted in 1.5 million being stolen in a phishing wire fraud scheme from a couple about to close on a home. Lets take a closer look at real estate phishing scams and tactics below. Real Estate Phishing Tactics Just like most cybercrime, real estate phishing usually starts off by acquiring sensitive information. People dont willingly give out this type of information but are often tricked into doing so. Methods for real estate phishing typically include cybercriminals directing users to click on a suspicious link. Alternatively, they could redirect them to a spoofed webpage that could easily compromise your real estate business. Here are a few specific tactics to look out for. Whaling and Business Email Compromise BEC The type of attack most commonly used on real estate companies is business email compromise  BEC  wire fraud or imposter email attacks called whaling . These types of phishing attacks can take several forms. In the simplest rendition, the hacker may be after internal corporate data. They will send an email pretending to be someone that the recipient knows, such as a trusted partner or vendor, or even someone that works at the same real estate company. The perpetrator may request user names and passwords to corporate networks, a list of employee W2s or email addresses, the names and email addresses for current clients, or even proprietary data, such as competitive market research. Often this type of information can be sold on the black market or used as a starting point for additional phishing attacks. Spear Phishing and Social Engineering Spear phishing and social engineering are highly targeted attacks that use psychological manipulation involving a small pool of victims. They then divulge information or take inappropriate actions. Fraudsters could apply pressure using a sense of urgency and repercussion if instructions are not followed. An example of this would be an email from a real estate agent requesting a wire transfer from the buyer. If the wire transfer is not made in time then the deal could fall apart. Vishing While most phishing attacks come via email, vishing voice phishing comes in the form of phone calls. Vishing is one of the fastest-growing fraud strategies in the United States. Fraudsters understand that most real estate deals require phone call verification before funds are wire transferred. Scammers will call the victim or leave a voicemail with specific transaction details in order to protect both parties from fraud. This instantly builds the fraudsters credibility and reduces any suspicion that the victim may have. Vishing scams have become more convincing due to technological advancements that allow phone numbers to be spoofed. Fraudsters can create fake phone numbers to match your local area and act as a trusted party, such as a real estate firm or attorney. As most businesses phone numbers are available online, the possibilities are endless. A Complete Breakdown of a Real Estate Phishing Scam When money is at stake, particularly the large sums often seen during real estate transactions, hackers turn to more insidious criminal tactics. If the criminal has obtained the user name and password for the real estate agents email through an earlier phishing attack, they may engage in a BEC scam, whereby they send an email directly from the agents account to a current customer about to close on a property. Pretending to be the agent, the criminal provides closing instructions, including fraudulent wire transfer details. The customer, not suspecting anything, transmits the money to the criminals account. Unfortunately, in many instances, these large sums of money, often down payments, are lost forever unless the scam is discovered quickly enough to halt the wire transfer. In a similar version, the criminal may pretend to be someone from the settlement company or the sellers agentrepresentative, and send a phishing email directly to the buyers agent. As in the other scenario, this email includes closing instructions, including fraudulent wire transfer details, which the buyers agent may then pass along to the home buyers. Common Real Estate Scams Organizations dont always fall victim to a phishing attack directly, often times they could become a victim indirectly because of partners or associates. Below are examples of real estate scams that may affect customers and landlords, real estate firms, and property management groups. Fake Lender Representatives A scammer can pose as a mortgage or lending officer and convince a real estate seller that they have a buyer for the property that theyre trying to sell. In order to receive the proceeds from the fictitious lending officer, the sellers banking information is required. This type of scam can be done via vishing or phishing . Lockbox Rental Scam These types of rental scams are notorious on Craigslist. Scammers will act as the landlord and provide access to lockboxes so renters can take tours of the home without the landlord present. If renters like the property then the scammer will request a deposit. By this time, the renters think they have a new place to live in, but the actual landlord has no recollection of making this deal. Its still unknown how scammers are able to obtain lockbox codes, but its likely that landlords recycle or use easy-to-guess codes for their lockboxes. Fake Invoices Lets face it, technology has been a double-edged sword in modern society. Even though it makes our processes more efficient, it can also make us less diligent. Scammers have gotten better at creating documents and invoices, building websites, and crafting emails. In a busy real estate office where team members are multitasking on the phone and forwarding paperwork, its easy for a team to forward invoices to your accounts team without realizing its not legitimate. Benefits of Real Estate Anti-Phishing Solutions Cybercriminals already know that the real estate industry is the primary facilitator for high volume, high dollar figure wire transfers. That specific industry is also known for owning a vast amount of highly sensitive personal information, such as customer names, addresses, emails, social security numbers, and banking data. Couple this with the fact that real estate agents often work in highly dispersed locations, such as their car or a café, using unprotected smartphones to connect to corporate networks, and you have the makings of an almost perfect crime. Thats why advanced cybersecurity protection is so critical. You Dont Get Protection From Browsers, Email Clients, and Online Freebie Security Solutions The story of the massive Target Corporation breach is one that most people have heard of. What is less well known is that the malicious email at the source of this highly destructive attack came from one of Targets small business partnersan HVAC companyand it probably wouldve been blocked had the HVAC vendor been using an effective email security service, instead of a downloaded freebie security tool that did not include real-time updates to protect its entire system, including access to all the passwords and portals for its various large clients. Free downloadable security tools are designed for individual consumers and do not offer the type of protection businesses need. Since threats are evolving constantly, real-time security updates are key. Once a threat has been launched, a business only has seconds to block it. If your security tools, or email client such as Gmail or Office 365, or browser arent updated constantlyin real-timethen the protection simply isnt there. Training Alone Isnt the Answer Email threats come in a variety of different shapes and sizes. Some are relatively easy to spot, others are highly curated so they appear entirely legitimatefor example, imposter emails. If a fake email arrives in your accounting department, pretending to be from your CEO with wire transfer directions, how much time do you think your accounting manager is going to take to investigate and confirm the authenticity of the email? Chances are if the email appears to come from the CEO or another high-level executive, the target employee will get right on the task and transfer the money. In these instances, training your employees to spot fake or dangerous emails may simply be asking too much. Since operational activities with most real estate companies today take place in the cloud, an automated, systematic approach to security is keyone in which threats are evaluated and blocked in real-time, without relying on the human factor. Final Thoughts With the operational and transactional components of real estate growing by leaps and bounds in an online cloud environmentand cyberattacks growing at an even faster rateno real estate business wants to be at the center of a data breach that costs a customer their entire life savings and dreams for the future. Real estate businesses need to view cyberattacks as a critical business risk. Learn more about Cyrens anti-phishing solution for enterprises or contact us today for more information. Try it for Free Instant Data Classification Cyren URL Category Chacker Prev How to Identify Apple Phishing Email Scams Its Back! Facebook Cryptominer Worm Reemerges Next Company Partners Resources Investor Relations Products Freeware Demo Solutions Contact Us Privacy Management Service by Data443

Output: product_security_features,end_user_security,security_best_practices,data_protection,threat_prevention,incident_response


Input: Search Free Trial Get Demo Its Back! Facebook Cryptominer Worm Reemerges May 20, 2019 Digmine Campaign Redux Back in 2017, we wrote a blog about a malware spreading on Facebook, which, it turns out, continues to be relevant todayreferring to both the blog and the malware. At the time we had set ourselves the task of analyzing part of the 2017 Digmine campaign that installed a cryptominer payload, and lo and behold! just last month this campaign re-emerged on Facebook with a new variant that also uses the files section of Facebook groups, and on the face of it employs tactics similar to those used two years ago. We decided to monitor a sample and do a breakdown in order to discover if there is any new behavior we might alert you to. Figure 1  Screenshot of new Digmine malware variant, which masquerades as a video in a Facebook groups files The earliest sample from this new campaign we came across video_47368.bz  6fc606d08ffd45da89a52d873f489274b3ced6502998f2b2a608ae2cb34e9a0b Cyren detects as W32AutoIt.IM.gen!Eldorado, and was uploaded on April 20. It was very similar to the second variant we studied in 2017, with we have discovered a few added checks done before downloading the payload. The specific step-by-step of this new variant is Checks if its PID is not equal to AutoItPID Pings google.com in intervals of 500 secs until it sucessfully gets ping response Checks if the filename of the executed malware contains the following strings updater video play app Checks its active window title to see if it has the following strings Start cmd.exe Program Manager ChecksCreates registry entry HKCUSoftwareUnzip , Installed , Yes as part of its installation routine Sends out system information to its CC server hxxpsusu.icuapplogin.php User-Agent  Unzip Active window title File name of executed malware OS version CPU Architecture Installation status Creates directory APPDATAUSERNAME Downloads the following Via unzip response header 7za.exe  legitimate 7z standalone executable Via zip response header files.7z  password protected 7z archive containing malware components Chrome extension component manifest.json background.js  detected by Cyren as JSKromAgent.B!Eldorado Crypto miner component update-x86.exe  detected by Cyren as W32CoinMiner.AR!Eldorado update-x64.exe  detected by Cyren as W64CoinMiner.AR!Eldorado config.json Extracts malware components using downloaded 7za.exe with password hardcoded in the AutoIt executable Copies itself to APPDATAUSERNAMEapp.exe Finds active Chrome windows and closes them Forcefully terminates chrome processes Performs registry modifications HKLMSoftwareMicrosoftWindowsCurrentVersionPoliciesAssociations, LowRiskFileTypes  .exe HKCUSoftwareMicrosoftWindowsCurrentVersionPoliciesAssociations, LowRiskFileTypes  .exe Installs auto-start registry entry RegWriteHKCUSoftwareMicrosoftWindowsCurrentVersionRun, Google Updater, REG_SZ, APPDATAUSERNAMEapp.exe Executes chrome.exe with the following arguments to load its own chrome extension from the downloaded 7z archive ShellExecutechrome.exe, enable-automation disable-infobars load-extensionAPPDATAUSERNAME, , SW_MAXIMIZE Searches for Chrome applications shortcuts and updates them to include the above chrome parameters Executes the extracted update-x86.exeupdate-x64.exe depending on the machines architecture, which is a crypto miner application Changes in the new campaign Reviewing some of the uploaded samples, aside from changing the CC server it connects to, some minor changes were made to the initial downloader. Some of the CC it is using during this new campaign are hxxpfusu.icuapplogin.php hxxpsusu.icuapplogin.php hxxpkeke.icuapplogin.php hxxpqoqo.icuapplogin.php hxxpluru.icuapplogin.php hxxpgaga.icuapplogin.php hxxpnini.icuapplogin.php We also note that a new registry check was added HKCUSoftwareUnzip , Trust , yesno They also created some minor changes in the obfuscation of the AutoIt script. StringLen,StringMid and StringInStr functions were not obfuscated in the variant in 2017. These functions were used to deobfuscate the script used in the Execute function. In this new update, the developers have hidden these strings and added more arrays for obfuscation. The 2017 script and the 2019 script are shown below for comparison. Earlier script Updated script Campaigns temporary end? A second variant of this new campaign video_23150.bz  d09c1ec8f75d13b08d50d23002b3e69229d21678866eb0a11062d7504c016337, which is detected by Cyren as W32Dropper.DE.gen!Eldorado, connects to hxxpwhizzup.icu and now uses AHK_Request as the User-Agent. This second variant is no longer a compiled Autoit executable, but now a compiled AutoHotKey executable. It writesmodifies the following registry keys HKCUSoftwareMicrosoftWindowsCurrentVersionRunExtension_Service CUsersActive UserAppDataRoamingServiceApp.exe -b HKLMSOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem EnableLUA, 0 HKLMSYSTEMControlSet001servicesgupdate Start,4 HKLMControlSet001servicesgupdatem Start,4 HKLMSYSTEMControlSet001servicesGoogleChromeElevationService Start,4 HKLMSOFTWAREPoliciesMicrosoftWindows Defender DisableAntiSpyware,1 Drop files in the APPDATA folder ServiceApp.exe  detected by Cyren as W32Dropper.DE.gen!Eldorado, malware copy pZip.dll  non-malicious component Downloads ServiceApp.zip, which contains the following Manifest.json Background.js  detected by Cyren as JSKromAgent.C!Eldorado, a chrome extension which downloads a file in hxxpwhizzup.icubibgohlo The bibgohlo is a script used to propagate malware through Facebook, which Cyren detects as JSKromAgent.C. Here is an image of the code it uses to upload Additional CC for this variant hxxpnameking.icu hxxpncdn.space Behavior Overview Weve included a map below of the behavior described above that you can click on to expand and view Want to learn more about cloud-based email security and archiving ? Contact us here ! Try it for Free Instant Data Classification Cyren URL Category Chacker Prev Phishing Targeting Real Estate Firms A view from the exhibition floor three takeaways from Infosecurity Europe Next Company Partners Resources Investor Relations Products Freeware Demo Solutions Contact Us Privacy Management Service by Data443

Output: threat_prevention,technical_documentation


Input: Search Free Trial Get Demo Police Phishing Attack Targets Bank Credentials October 12, 2018 In a sophisticated criminal scheme, an email impersonating the Icelandic police was sent to thousands of Icelanders this past weekend, falsely requesting the recipient come in for questioning. Since it directly involved impersonating the authorities, who say this is the largest cyberattack to hit the country of Iceland, and included an extremely realistic spoofed website for the Lögreglanthe Icelandic policeyou can be sure it has attracted their full attention. The objective of the email attack, which began October 6 th , is the delivery of a Remote Access Trojan RAT, with keylogging and password stealing capabilities. To motivate the recipient, the email threatens that an arrest warrant may be issued in the event of non-compliance, and conveniently provides a link for more information about the case. Figure 1 The domain in the email looks like the real thing Lookalike Domain and Website Several measures taken by the deceptive email campaigns author create the illusion of authenticity for many recipients. First, the criminals use a technique called script spoofing, or an internationalized domain name IDN homograph, which involves creating a lookalike domain name using similar characters to the actual URL address. In this case, the real Icelandic police use the domain www.logreglan.is . However, the attacker registered a domain name of www.logregian.isusing a lower case i which on first glance, may appear like a lower case L or l. For the URL link in the body of the email, the attackers switched the lower case i for a capital i or I, so the i actually looks like a small Lmaking it indistinguishable from logreglan to almost any web user. In addition, the domain used in the attack was registered in Iceland through a compromised account by the Icelandic domain registration ISNIC authority. When the victim clicks on the fake URL, he is taken to a website that is a near perfect imitation of the official web site of the Icelandic police. A data entry box is provided for an Icelandic social security number. And, this is where things get a bit scary. In a typical phishing attack, the fake website capturing the data has no idea whether the victim is entering real or fake information. In fact, one of the tests that security professionals often suggest if youre unsure of about the validity of a website is to enter false informationfor example, a fake email address or fake bank account number. A real website will be able to distinguish if fake information is entered and will flag the error. However, in the case of this attack, if the victim happens to enter the wrong social security number or a number in the incorrect format, an alert appears telling the victim that the number is not correct. And, then after the correct social security number is entered, the victim is taken to a new page where the victims actual name is displayed. Backend data and website interaction adds to realism In Iceland a persons social security number or name is available for online public consultation through local banksto get a name, you need a social security number to get a social security number you need a name. Normally, you must be logged into your online bank to be able to query a social security number, but in this case, the attacker appears to have solved this constraint in some manner. While it remains unknown exactly how the criminal obtained this information, one hypothesis is that they were using a database that was leaked many years ago. Figure 2 The fake Icelandic police landing page where victims were asked to enter their correct social security number To further create a sense of authenticity, the victim is asked to type in an authentication number contained in the email that was sent to him, as shown in Figure 2 below. Figure 3 The recipients name and social security number are shown, and then they enter an authentication number from the email The next page automatically downloads a password protected .rar file, but the password for the file shown on the website is always the same. The file is supposed to include documents related to the case, but instead triggers a Remote Access Trojan RAT with keylogging and password-stealing abilities. The page where the .rar file is downloaded The extracted .rar file is a .scr file Windows Screensaver disguised as a word document with a long name, so the file extension is hidden. The file name is Boðun í skýrslutöku LRH 30 Óktóber.scr which translates roughly to Called in for questioning by the police on October 30 th . Figure 3 The .rar file and the .scr file that are disguised as a Word document When the file from the .rar archive that looks like a word document is executed, a file called Yfirvold.exe is dropped in APPDATARoamingYfirvold. Yfirvold in Icelandic means authorities. Yfirvold.exe and Boðun í skýrslutöku LRH 30 Óktóber.scr are actually the same file. The .scr part is just to drop and hide Yfirvold.exe in APPDATA. Yfirvold.vbs is also dropped in AppDataRoamingMicrosoftWindowsStart MenuProgramsStartup. The .vbs file is placed in the Windows Startup folder. So, if the victim reboots his machine the .vbs script will execute Yfirvold.exe. Yfirvold.vbs Remote Access Trojan Steals Passwords Yfirvold.exe is a remote access trojan RAT with password-stealing and keylogging capabilities. After execution, it starts collecting sensitive information stored in browser cookiessuch as user names and passwordsfrom the victims computer. Figure 4 The malware collects passwords and cookies from Chrome, Firefox and Internet Explorer The malware then initiates a keylogger and collects input from the victims keyboard and stores it in logs that are then uploaded to the attackers command and controller server. The servers that the malware connects to are located in Germany and Holland. KeyLogger Started The attacker is able to access the infected computer since the malware has remote access capabilities. The malware uses code and components from a known remote access software called the Remote Control  Surveillance Software or REMCOS from breaking-security.net. The malware uses code and components from REMCOS software The malware specifically targets Icelanders since it checks if the victim is accessing the largest online banks in Iceland. And with its remote access connection and keylogging capabilities, it is able to do much damage with that information and access. Strings from memory show domains of some of the largest banks in Iceland Icelandic law enforcement believe attack was inside job The Icelandic police have stated that this is Icelands largest cyber-attack so far, and have confirmed that many targeted recipients fell for this attack. Its not known whos behind this attack, but based on the text from the email, the text on the website, and that the attacker has the data from Icelandic registries, they believe it points to an inside job by a local. File and Detection Information Files Boðun í skýrslutöku LRH 30 Óktóber.scr SHA256 53cf32ce0c34df94422c43e295e928c69c7b1b2090cf6943000470f7e0128d67 Yfirvold.exe SHA256 53cf32ce0c34df94422c43e295e928c69c7b1b2090cf6943000470f7e0128d67 Yfirvold.vbs SHA2563898E59003C03CED233DB5F5046C55355B418A4F21BCAE38F67E8D6F6972B9BD Cyren detects the files as W32Trojan.XJYK-3836 Connections the.shadesoul.online  IP 178.162.212.214  Germany iam.shadesoul.online  IP 213.152.161.219  Netherlands heis.shadesoul.online  IP 109.202.107.147  Netherlands Try it for Free Instant Data Classification Cyren URL Category Chacker Prev Survey Says 44 of Companies Phished This Year Not-Really-Password-Protected Evasion Technique Resurfaces Next Company Partners Resources Investor Relations Products Freeware Demo Solutions Contact Us Privacy Management Service by Data443

Output: end_user_security,incident_response,technical_documentation


Input: Search Free Trial Get Demo File-less almost and Confused April 17, 2020 Amidst the crisis the world is going through because of the Covid-19 pandemic, malicious actors continue to take advantage of the situation to lure unsuspecting online consumers into installing malware into their systems. We have recently found reports of malicious Powerpoint slides being sent through email, which are disguised as business opportunities or transactions. Figure 1.0 Email sample with Business Inquiry mentioning Covid-19 Figure 1.1 Email sample with Request-for-Quotation theme Analysis Once an unsuspecting user opens the PowerPoint slide attached to the email, PowerPoint will prompt the user about a potential security concern and lets user choose whether to enable or disable macros. If user chooses to enable macros, the malicious VBA macro is automatically executed upon closing of the PowerPoint slide, which is triggered by the use of a built-in VBA event named Auto_Close. The VBA code simply runs mshta to load and execute a malicious HTML application HTA with the use of a shortened URL hxxpsbit.ly8bz529ep5dc64gf2zxvd, which redirects to a pastebin link hxxpspastebin.comrawRi1gJLPQ. Figure 2.0 Behavior Tree It is good to point out that all HTA payloads used in this campaignattack uses the same obfuscation as shown below Figure 3.0 Obfuscated 1 st -level payload A quick de-obfuscation reveals code written in VBScript Figure 4.0 De-obfuscated 1 st -leval payload revealing VBScript code In just a few lines this initial payload attempts to execute a second level HTA payload from hxxppastebin.comrawBswfq2VB before creating auto-start entries, which in turn automatically executes the same second-level HTA payload without having to save any files to disk, hence making it file-less in a sense. Scheduled Task Task name Pornhub Runs every 80 minutes Runs mshta httppastebin.comrawBswfq2VB Autorun Registry Hive HKCUSoftwareMicrosoftWindowsCurrentVersionRun Key START Value mshta httppastebin.comraw7dhzBwcm There at least three 3 different second-level payload links used, but the de-obfuscated form reveals the same VBScript code as shown below Figure 5.0 De-obfuscated 2 nd -level payload To put it into context, the 2 nd -level payload writes additional registry entries. The first one, being another auto-start registry entry, which executes VBScript code via mshta 1. This VBScript code executes a Powershell script, which is written as a registry entry too. Autorun Registry Hive HKCUSoftwareMicrosoftWindowsCurrentVersionRun Key bin Value call to mshta, executing VBScript code Powershell Script Hive HKCUSoftware Key suckmyass Value Powershell script The Powershell script, as shown below, stored in the registry runs a quick check for internet-connectivity before proceeding to download and execute its final payload. Figure 6.0 Powershell script stored in the registry modified to be more readable Figure 6.1 Hex-encoded .Net Assembly Executable from hxxpspastebin.comraw5hRrW1Tr Figure 6.2 Base64 encoded Powershell script from hxxpspastebin.comrawqmxGASHG Figure 6.3 Decoded Powershell script with hex-encoded Gzip archive containing a .Net Assembly library, which is loaded by the Powershell script from the registry Final Payload Analysis The final payload consists of two 2 components, the first one is a .Net Assembly Library with an internal filename of Apple.dll and the second one, which is a .Net Assembly executable with an internal filename of success47a.exe . The .Net Assembly Library named Apple.dll is protected with ConfuserEx v1.0.0 as identified and de-obfuscated by the tool named de4dot2. Figure 7.0 ConfuserEx detection from de4dot Having it de-obfuscated, we can now look at what it actually does using dnSpy3. From the Powershell script, we saw that it calls the FreeDom method from the class named Givara with msbuild.exe and the hex-encoded .Net Assembly executable. Figure 8.0 Preview of de-obfuscated Apple.dll To keep it short, Apple.dll is process injector component, which loads msbuild.exe if it exists in the system and injects the decoded .Net Assembly executable into it. Unfortunately, the .Net Assembly executable that we were able to download from the pastebin link appears to do nothing. This might be an attempt for a file-less attack and it is possible that the content from the pastebin link has yet to be updated with a presumably malicious executable or future variants may use new links containing active and malicious payloads. Indicators of Compromise Object Type SHA256URL Email ca3a56dd0b2a7a380502c891d7d619be1dd84fed6f81092bbb64c51ecb4e7f93 PP97M b26b606e87bb985ba4009047ecddd651fb31b6bc4f923be7bbad4e63783a8ad7 MSHTA URL     Base64 Encoded Powershell Script  Hex Encoded .Net Assembly  Gzip Archive c887bcc57d2b164e601757e285ff34c330533fbb1712ecabf182f80f7d76985d .Net Assembly Library 7405ccc472d41a2d3dbe289a92f1c129d50633d0271609e07b5bb280ef5bb08b Email ebf6e8ac15d2803ffd12380e06973ff9999083f610c2f7246968e8e1fe7ca70e PP97M 0ae61a6caeae1c088a6be224604afa492910ef63be16262552d8e5c30cf72164 MSHTA URL     Base64 Encoded Powershell Script  Hex Encoded .Net Assembly  Gzip Archive c887bcc57d2b164e601757e285ff34c330533fbb1712ecabf182f80f7d76985d .Net Assembly Library 7405ccc472d41a2d3dbe289a92f1c129d50633d0271609e07b5bb280ef5bb08b 1  2  3  Try it for Free Instant Data Classification Cyren URL Category Chacker Prev Schützen Sie sich mit tiefgehender E-Mail-Sicherheit Email Security Defense-in-Depth vor Evasive Phishing Covid AgentTesla Next Company Partners Resources Investor Relations Products Freeware Demo Solutions Contact Us Privacy Management Service by Data443

Output: product_security_features,end_user_security,threat_prevention,technical_documentation


Input: Search Free Trial Get Demo Crypter Malware A Deep Dive Into NSIS-Based Crypters March 6, 2022 We have been observing that malware is being distributed via NSIS-based crypter . Malware such as FormBook, AgentTesla, GULoader, just to name a few, have been using NSIS as their loader. We have seen several ways of obfuscation implemented with the installer that decrypts and directly loads the malware into memory without dropping its file to the disk. What is NSIS? A quick overview of NSIS Nullsoft Scriptable Install System it is an open-source script-driven tool that can be used to create Windows software installers. This tool is flexible and can let you bundle several components such as executable files EXE, DLL, configs, etc., together with a script that allows you to control the logic of its installation. Although a lot of legitimate developers are using it, threat actors take advantage of using this to spread malware. In this article, we will re-visit the NSIS-based crypter that we came across in the past couple of years. We will also include an in-depth analysis of a recent NSIS-based crypter variant that we encountered. What is Crypter Malware? A crypter is a specific type of software that has the ability to encrypt, obfuscate, and manipulate different kinds of malware. This makes it harder to detect by security programs. Crypters are used by cybercriminals in order to create malware that bypasses security programs by presenting itself as being a harmless program until it is installed. Types of Crypters A crypter contains a specific crypter stub, which is the code used to encrypt and decrypt forms of malicious code. Depending on the stub the crypter uses, they can be classified as staticstatistical or polymorphic. Staticstatistical crypters utilize stubs to make each encrypted file unique. Having separate stubs for each of these clients makes it easy for malicious actors to modify a stub once it is detected by a security software. Polymorphic crypters are more advanced than static crypters. They use algorithms with random variables, data, keys, decoders, and more. For this reason, one input source file will never produce an output file that is identical to the output of another source file. How Crypters Spread Malicious Code Cybercriminals build or buy crypters on the underground market in order to encrypt malicious programs then reassemble code into an actual working program. They then send these programs as part of an attachment within phishing emails and spammed messages. Unknowing users open the program, which will force the crypter to decrypt itself and then release the malicious code. Crypter Evolution During our continuous monitoring of this crypter , we observed 3 different variants in the past year. Let us take a quick look at the overview of some variants weve seen. Note A NSIS-based installer package is an archive that can be unpacked using 7zip. For each sample, we are going to use the older version of 7zip 15.05 since newer versions do not support the unpacking of NSIS.nsi script used to control the installation tasks. Variant 1 Variant 1 NSIS Package Structure This variant consists of an encrypted payload 9pmuxhk1iu03tej275 and a shellcode kvrgxxmwpsiu, both using random file names. Looking at the script, we see that the shellcode will be copied to newly allocated memory using the kernel32 functions CreateFile and ReadFile. The shellcode will be executed using the Call function exported by System.dll plugin. This shellcode is responsible for decrypting and loading the final payload. Variant 1 NSIS.nsi Code Snippet This variant consists of an encrypted payload 9pmuxhk1iu03tej275 and a shellcode kvrgxxmwpsiu, both using random file names. Looking at the script, we see that the shellcode will be copied to newly allocated memory using the kernel32 functions CreateFile and ReadFile. The shellcode will be executed using the Call function exported by System.dll plugin. This shellcode is responsible for decrypting and loading the final payload. Variant 2 Variant 2 NSIS Package Structure Aside from uninstall.exe, this variant also contains an additional encrypted shellcode splitting its execution into two 2 stages. The first stage shellcode fsbkkvdwiinqth is executed the same way as the first variant, which decrypts the second stage shellcode u58asrazgajcg2qv9. The second stage shellcode eventually decrypts and loads the final malware payload from the encrypted payload 6wgd9oc89v. Variant 3 Variant 3 NSIS Package Structure This variant consists of a custom DLL extension mvbdioqy.dll and encrypted payload jav16vrhevoza7ci1qf0, both making use of random file names. The DLL contains at least 1 exported function which is executed using the CallInstDLL , which is an NSIS scripting instruction used to call a function name inside an NSIS extension DLL. Variant 3 NSIS.nsi Code Snippet A randomly named DLL function, in this case xxsybdzh, is used to decrypt and execute another embedded shell code within the DLL, which is then used to decrypt and load the final malware payload from jav16vrhevoza7ci1qf0. Shellcode Decryption Routine There are other variants of these DLL plugins. Please take note that the decryption algorithm used to decrypt the shellcode varies in different samples. As shown in the image above, the decrypted shellcode is executed as a function call. However, in other variants, the shellcode is executed using Windows API calls, which accept an application-defined function as a parameter, in this case, the parameter is the decrypted shellcode. Shown below is a variant, which uses the Windows API GrayStringA to execute the shellcode third line from the bottom. Execute shellcode through API with application-defined function There are other DLLs that contain multiple exported functions using random function names. It is apparent that this is an attempt to confuse analysts in picking the right function to look at. However, looking through the  NSIS.nsi script will help analysts identify the export function that contains the malicious code. Random Export Function Names Analyzing all the variants mentioned above, the decryption of the final payloads varies with each sample, but malware payload is loaded using a similar method. Analysis Now lets dig deeper on how this NSIS-based cryptor works. We will be using the most recent cryptor variant we have seen, which is utilized by FormBook and AgentTesla malware. Techniques used are not that trivial, but we deem worthy to dig into. NSIS Package Files Extracted NSIS Installer Package The package did not contain any DLL plugins . But we can see that it contains an executable file lzxupx.exe and 2 randomly named files 8yhm36shrfdb7m and mhwrt. Shown below are the contents of these files. Contents of 2 unknown files Lets take a look at the NSIS script NSIS.nsi  and check how these files will be used. As shown in the following code snippet of the NSIS script, we can see that the EXE file will be executed with a parameter pointing to one of the randomly named files line number 92 in the image below. NSIS script snippet EXE Analysis lzxupx.exe Lets look at the behavior of the EXE from the NSIS package. Loading this in IDA Interactive Disassembler and looking at the Pseudocode, we can see that its code is short and simple. We can summarize the code flow as follows Open the file passed in the parameter. In this case, the file mhwrt Read the file content to the newly allocated memory Decrypt file content shellcode in memory Jump to the memory that contains the decrypted shellcode Based on the information that we had on the different NSIS-based crypter variants mentioned earlier, we can infer that this EXE is only used to decrypt and execute another shellcode. To confirm, we manually decrypted it in a debugger. Next, lets look at how the shellcode works. IDA psuedocode of EXE file Decrypted shellcode Decrypted Shellcode Analysis Learn how Cyren Inbox Security offers a new layer of automated security. Get the Demo Stack-based wide string The shellcode also employs API hashing to make the analysis a bit more tedious and by hiding the imported Windows API functions, making static analysis more difficult. Resolve API by hash After loading all imported functions by API hash, these functions are used to read the file content of 8yhm36shrfdb7m and decrypt the data using its own custom decryption routine. Running it in a debugger, the decrypted data turns out to be its final payload. Decrypt final payload Custom decryption routine Before loading the decrypted payload, it will attempt to drop a copy of itself in the APPDATA directory using its hardcoded folder and file name, which vary in different samples. Before dropping its copy, it sleeps for a few seconds if the target path already exists, then proceeds with its loading mechanism. It also sets up its persistence by adding the following registry entry HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun Name  hardcoded from shellcode Data  path of drop copy Loading the Decrypted Payload The crypter creates a suspended process, where the malware payload is injected as a new instance of the current executable. Techniques used for process injection depend on whether the payload has Base Relocation Size or not. If it has, the Portable Executable Injection PE Injection technique will be used for process injection. When injecting a PE into another process, it is going to have a new base address which is unpredictable. PE Injection will rely on Base Relocation values to dynamically fix the addresses of its PE. Base relocation size checking On the other hand, if the payload contains Base Relocation values, another popular approach named Process Hollowing is used. In this technique, the targets process memory will be unmapped and replaced with the content of the payload. This sample, it uses the following APIs. GetThreadContext NtUnmapViewOfSection NtWriteVirtualMemory SetThreadContext NtResumeThread To make it stealthier, low-level APIs Nt  calls are implemented via direct syscall using its own custom function. Calls to syscall need to have a syscall ID that corresponds to an API function stored in the EAX register. This syscall ID, however, changes between Operating System versions. It uses the famous  Hells Gate  technique to dynamically retrieve the syscall ID on the host. The basic concept of this technique is reading through the mapped NTDLL in memory, finding the syscall ID and then directly using syscall to call the low-level API function. Security products that rely on user-space API hooks may not be able to monitor this kind of system-level behavior. This crypter takes advantage of this trick to read and map a copy of NTDLL in newly allocated memory. It traverses the starting pointer address of a low-level API function to retrieve the syscall ID. Figure 11 shows the logic of how it retrieves the syscall ID, MOV EAX opcode, while Figure 12 shows the starting opcode of a low-level API function from NTDLL. Logic to find syscall ID Opcode of low-level function from NTDLL This crypter was set up to be compatible with both 32-bit and 64-bit machines. Applications run on a 64-bit machine will be executed in 64-bit mode regardless of whether or not the application is 64-bit. A 32-bit application will be emulated through WoW64 which serves as its transition routine for switching to 64-bit mode. However, a 32-bit application cannot perform a direct syscall. The  Heavens Gate  technique was used to make direct syscalls on 64-bit hosts. It has 2 methods to make direct syscalls. If the process runs as WoW64, meaning a 32-bit application running on 64-bit OS, it will perform the Heavens Gate technique, otherwise, it will make direct syscalls. Using Heavens Gate Condition Once the running 32-bit application switches to 64-bit mode, a syscall will be performed. After the syscall was called, the process saves the return values and switches back to 32-bit mode. Figure 14 shows the Heavens Gate transition to 64-bit while Figure 15 shows the syscall in 64-bit mode and switches back to 32-bit mode. Heavens Gate switch to 64-bit mode 64-bit syscall and switch back to 32-bit mode Final Thoughts NSIS-based crypters have been around for several years and continue to evolve as threat actors package their malware taking advantage of the NSIS Installers flexibility. The improvements over the years include changes to the installer package structure, non-trivial decryption routines, and loading mechanisms that are used to evade detection. Throughout this evolution, our team at Cyren has improved our solutions to help protect customers from ever-changing threats. We hope that this article raises awareness among users and researchers alike about our continuous fight against the bad guys. Indicators of Compromise SHA256 Cyren CARO Name 04221ea5442e33394e9f00798fe023cb14a43156b507347afb0f493a4e6bd43f W32Injector.AUI.gen!Eldorado 0f3a91f7d87bb4ba6a504b5c049d48336bfbe9b192bc4387e354dbfc15b445af W32Trojan.NGKY-4538 3a40a59413bd829e0ff1142e6b4d374ceddd29564534f274232fa9cef4c51d8d W32Trojan.MEXI-8787 6e6e18a85c523bfffd1b5293b978832f7387fda9b9eee87d3d8e98666fe020c9 W32Fragtor.O.gen!Eldorado 75fc63da15ced7d4464a189fb4c9c8aba534057a0147fbe63a945c2c10ecb2be W32Ninjector.J.gen!Camelot 76d07b33364445e08dd5306a4e98d34edb6895a8269e9bb5aa9ef80e1cb83b2e W32Injector.AUI.gen!Eldorado 88d97538adda1f29e2f088883d64db0776c2f7e9c80a2a789785c4af970ec129 W32Injector.AUI.gen!Eldorado a56d3a1adeb3011f7c1795cd161865908e895dd9623fff42795bfae8932038ea W32Ninjector.B.gen!Eldorado See Cyren in action with the Cyren Inbox Security demo. Get the Demo Try it for Free Instant Data Classification Cyren URL Category Chacker Prev Glossary of Cyber Security Terms and Terminologies Please Approve This Account Takeover Next Company Partners Resources Investor Relations Products Freeware Demo Solutions Contact Us Privacy Management Service by Data443

Output: threat_prevention,technical_documentation


Input: Search Free Trial Get Demo Day March 7, 2022 Please Approve This Account Takeover March 7, 2022 The pandemic has changed the way we live, the way we work. The world is becoming increasingly digitized as more employees embrace a remote work model. Along with these changes, phishing attacks are growing by the minute and businesses, big and small, face the need to implement robust email security, Company Partners Resources Investor Relations Products Freeware Demo Solutions Contact Us Privacy Management Service by Data443

Output: product_security_features,end_user_security,data_protection,threat_prevention


Input: Search Free Trial Get Demo Jason Skinner, an expert on cloud, collaboration and digital transformation, joins Resilient as an Advisor August 8, 2018 I am pleased to be working with Jason to help bring Resilient Access to additional audiences. In his new role as National Director at Crayon Software Experts, LLC CRAYONNO, a 1.5 billion NOK market cap Norwegian solutions company he will help customers innovate with Box, Facebook, Microsoft and many other larger technology vendors.  Ethan Ayer Try it for Free Instant Data Classification Cyren URL Category Chacker Prev IAM Concept of the Week FIDO 2.0 New Release is now available of The WordPress GDPR Framework Next Company Partners Resources Investor Relations Products Freeware Demo Solutions Contact Us Privacy Management Service by Data443

Output: product_security_features,end_user_security,compliance_certifications,security_best_practices,data_protection,access_management,threat_prevention,privacy_policy


Input: Search Free Trial Get Demo What is a Zero-Day Phishing Attack? Identifying Vulnerabilities  More April 25, 2022 Zero-day is a term that broadly describes a series of recently discovered cybersecurity vulnerabilities hackers utilize to attack systems. This term, zero-day, often refers to the fact that the developers have just learned about the flaw. Hackers will exploit flaws they find before developers even have a chance to address them. This can also be associated with the fact that there are zero days to fix the exploit. Similarly, a zero-day phishing threat in particular is one that has not been seen before and does not match known malware signatures. This can make it almost impossible to detect with traditional signature-matching solutions. In this post, we explore the risk of zero-day phishing threats and how your business can protect against them. So, What Exactly is the Risk of a Zero-Day Phishing Threat? Cyber threats are continually increasing with dozens of new zero-day phishing threats originating each and every day. Protecting your network , as well as applications, and data involves having an advanced threat prevention system in place where you can test untrusted files, links, and emails before they reach your email network. Because vendors are unaware of what a zero-day phishing attack can do, they can often get through traditional phishing software, where no patch exists to stop these attacks. Zero-day phishing attacks pose higher risks to users for the following reasons Speed Cybercriminals often race to exploit vulnerabilities so they can cash in on their schemes as quickly as possible. Response Time Vulnerable, exploited systems will remain exposed until a patch is created by the vendor to stop these attacks from happening. Hyper-Targeted Zero-day vulnerabilities typically involve highly-targeted phishing attacks. These kinds of attacks can focus on old vulnerabilities or completely new ones. Who Is Being Targeted in Zero-Day Phishing Attacks? The targets, while highly focused on in an attack, can range significantly. For this reason, any organization using email can be a target for zero-day vulnerability or attack. This can range from massive corporations like Microsoft, which was famously attacked in 2021, to much smaller organizations. If you use email for any kind of communication, your network is a potential target for zero-day vulnerability. How to Protect Against Zero-Day Phishing Attacks Protecting against zero-day phishing attacks can be extremely difficult. Here are some of the best methods for protecting your business. Virtual Local Area Networks Using virtual local area networks can help you segregate areas of the network. IPsec Implementing IPsec can help you apply encryption and authentication to your network traffic. Network Access Control Using network access control can help prevent machines from going rogue and gaining access to important parts of enterprise environments. Protect Wi-Fi Locking down on wireless access points, or using a security scheme can help protect against wireless-based attacks. Keep Everything Up-To-Date Keeping all your systems patched and up to date is very important. Even though patches wont stop one of these zero-day attacks, keeping your network resources fully patched can make it much more difficult for a phishing attack to succeed. When a zero-day patch becomes available, you will want to apply it as soon as possible. Scanning Performing regular vulnerability scannings can help you lock down against any enterprise network vulnerabilities discovered. Limit Apps Limiting your applications can help you limit the amount of data youre putting at risk. Firewall Using a firewall can help you monitor and block any suspicious activity, like zero-day phishing attacks. Education Educating yourself on zero-day phishing attacks and seeking out different solutions is important to the health of your network. Examples of Zero-Day Attacks  Exploits Zero-day exploits happen more often than you think, especially for large companies. Here are a few of the most notable attacks in the past few years. Google Chrome in 2021 Google Chrome was the victim of several zero-day threats, which were attributed to a JavaScript bug. Zoom in 2020 Hackers utilized a vulnerability on the popular video conferencing platform which allowed them to remotely control PCs. These vulnerabilities were reportedly being sold online for 500,000. Apple in 2020 Hackers were compromising devices from remote locations due to a bug in Apples iOS software. In order to avoid these future exploits, Apple has offered to pay 2 million to any person that finds a vulnerability in iOS. Microsoft Windows in 2019 Microsoft Windows software was exploited for government agencies across Eastern Europe. This resulted in suspicious apps being installed, as well as data being changed, and programs being compromised. Final Thoughts Zero-day phishing attacks are not going away any time soon. As the world continues to become increasingly digital, companies large and small need to be prepared to protect their organizations and employees from fraud. Ready to learn more about how you can protect your business from zero-day phishing attacks? Get a demo with the Cyren team today. Try it for Free Instant Data Classification Cyren URL Category Chacker Prev Ransomware protect yourself or pay What Are Office 365 Safe Attachments? Next Company Partners Resources Investor Relations Products Freeware Demo Solutions Contact Us Privacy Management Service by Data443

Output: product_security_features,end_user_security,security_best_practices,access_management,threat_prevention


Input: Search Free Trial Get Demo Office 365 Phishing, BEC,  Ransomware Survey Highlights April 20, 2022 Reading a complete report is not for everyone. If that includes you, here are the key takeaways from the 2022 Osterman report on Phishing, BEC, and Ransomware Threats for Microsoft 365 Customers. Less than half the organizations ranked their currently deployed email security solutions effective. Respondents felt least confident in their ability to prevent BEC attacks followed by mass-mailed phishing campaigns. Its alarming that such a large proportion of organizations feel this way about their current solutions, considering how damaging a successful breach can be. One would expect organizations to feel less confident preventing BEC attacks due to the nature of delivery. BEC attacks are harder to detect as they do not involve malware or malicious URLs that can be more easily analyzed. 89 of organizations experienced one or more successful breach types during the past 12 months. There was a significant increase in the average number of successful breaches compared to the 2019 Osterman Report , rising from 11.3 to 21.6. In addition, Microsoft 365 credentials were the most frequent breach type, occurring almost three times more often than any other incident. A few things might help explain this The vast increase in the volume and frequency of email-borne threats throughout the pandemic Highly targeted phishing, business email compromise, and ransomware are becoming more sophisticated and elusive every year. Only 22 of organizations in this study managed to analyze all reported messages, leaving ticking time bombs in users inboxes. If less than half the organizations are not confident in their currently deployed email security solutions, then the chances are they are vulnerable. 98 of organizations have given their users a way to report suspicious messages. Great stuff, but somebody must investigate these suspicious messages. Time  Money 60 of organizations only train their users on email threats 1-2 times per year. In all walks of life, the harder you work at something, the better you will become. Unfortunately, at this frequency, employees are not going to feel confident enough to apply their training, and therefore the quality of forwarded messages will likely be not as high. 84 of organizations reported that security awareness training has massively increased the number of messages reported as suspicious at a 41 false-positive rate. And there you have it. If, at any point, users are not sure whether something is malicious or clean, they will report it to the help desk or SOC. A further reason the number of alerts is so high is that users often feel victimized as the problem by organizations. This perception creates a culture of fear resulting in users reporting messages to be on the safe side. The number 1 concern for security managers is the time it takes to respond to and remediate threats not blocked by current security measures. Not surprisingly, considering the amount of time and salary costs of analysts required to remediate successful attacks, remove confirmed threats from mailboxes, and investigate suspicious messages. Cost of breach There was an average of 20.6 breaches per year in the U.S and 22.7 breaches per year in the U.K. It took an average of 197 hours to recover from a successful breach in the U.S and 148 hours in the U.K. The average salary plus benefits used was U.S  121,744 or 60.87 per hour U.K  49,661 or 24.84 per hour The total annual average cost to recover from a successful attack is Number of breaches  number of hours per breach  hourly pay U.S  247,022 U.K  83,419 Cost of removing confirmed threats Analysts in the U.S had to remove confirmed threats from mailboxes 22.4 times per 1,000 mailboxes per year and 21.4 times in the U.K. The Osterman Research team assumed that each attack affects 10 of mailboxes or 100 and that it takes 15 minutes to clean up each mailbox. The total annual cost of removing threats from mailboxes before they cause a breach was Number of removal workflows  15 minutes  number of affected mailboxes U.S  34,087 U.K  13,284 Cost to investigate suspicious messages Osterman Research team assumed 5 minutes to investigate a suspicious message Organizations had an average false positive rate of 41 We know from Cyrens data that analysts in a 1,000 user organization receive a minimum of 6,170 alerts per year. The cost to investigate alerts is Number of alerts  .08  hourly pay U.S  30,045 U.K  12,256 Total Operational Costs to Manage Email-borne Threats Successful breach costs  removal of confirmed threats costs  investigation costs U.S  311,154 U.K  107,959 Curious to know how much phishing investigation and incident response costs your organization? Try our incident response calculator . et_pb_textet_pb_columnet_pb_rowet_pb_section Try it for Free Instant Data Classification Cyren URL Category Chacker Prev IRS Scams 2022 Ransomware protect yourself or pay Next Company Partners Resources Investor Relations Products Freeware Demo Solutions Contact Us Privacy Management Service by Data443

Output: threat_prevention,end_user_security,incident_response,data_protection,security_best_practices,access_management


Input: Search Free Trial Get Demo Survey Says 44 of Companies Phished This Year October 5, 2018 The third annual Cyren-Osterman Research U.S. security survey shows a significant increase in phishing emails getting through to users and in the number of successful phishing attacks suffered by businesses during the past 12 months, among many topics covered in the 16-page report,  IT Security at SMBs 2017 Benchmarking Survey , available for free download. The survey, which was concluded in September, focuses on the current web and email security status and priorities of IT and security managers at organizations with 100 to 5,000 employees. The survey results allow security personnel to benchmark their own security posture and planning against their peers, including data on the priority placed on different email and web security features, what capabilities organizations have deployed, and how successfullyor unsuccessfullytheir current security is performing across different threat types. Phishing emails and successful attacks a rising tide Nearly half of respondents to the survey said that more mass phishing and spear-phishing emails are getting through their security and reaching users inboxes, with an estimated increase during the past 12 months of 23 for general phishing and 25 for spearphishing. This increase in phishing emails reaching users appears to be having serious consequences44 or organizations said that they suffered a successful phishing attack in the past year, up from 30 in the 2017 survey. And not just one attackrespondents said that they suffered an average of 11.7 successful phishing attacks during the period. Not surprisingly, phishing was ranked as the second-highest threat concern by the managers surveyed, with ransomware retaining its position from 2017 as the threat type of greatest concern. Security spending up for half Forty-nine percent of organizations reported that their IT security budgets grew a robust 18 over the prior year, essentially matching the 17 increase reported in 2017. No organization surveyed reported a decrease in their security budget. The combination of poorer security performance and increased spending appears to be feeding an interest in new solutions, with two-thirds of respondents indicating an extremely strong interest in deploying specialized new services capable of improving phishing and ransomware protection, as well as providing improved sandboxing protection from increasingly evasive threats. Figure 1 Other malware infections were the top source of breaches, with phishing in second. Preference for cloud-based SaaS surpassed on-premises in 2018 The preference in terms of deployment model for security solutions was nearly equally divided in 2017, but the momentum has clearly shifted towards cloud-based security, with 42 of respondents preferring SaaS security, up from 29 in 2017 and 21 in 2016. Twenty-eight percent said they preferred on-premises solutions this year. Figure 2 Preference for cloud-delivered security has surpassed on-premises appliances. Other conclusions from the survey data which are covered in the report include Nearly two-thirds have an email security layer in the cloud Sixty-two percent of businesses rely on SaaS security for their email, up from 57 a year ago, considering together those who reported using a third-party SaaS secure email gateway 35 percent, compared to 28 percent in 2017 and those who have contracted an advanced security module from their hosted email service provider 27 percent. Cloud-based web security is moving up the adoption curve Thirty-seven percent reported that they subscribe to SaaS web security, up from 34 percent in 2017. Security effectiveness and speed of defenses are most desired capabilities The misgivings around security performance were also apparent in the rankings of desired capabilities in new security solutions. Security effectiveness 82 indicating highest importance and speed of defenses applied to new threats 72 were given significantly more weight by managers than cost and other considerations like visibility and reporting features. The report is available for free download . Try it for Free Instant Data Classification Cyren URL Category Chacker Prev Die DSGVO der EU hat das Interesse an E-Mail-Archivierung erneuert Police Phishing Attack Targets Bank Credentials Next Company Partners Resources Investor Relations Products Freeware Demo Solutions Contact Us Privacy Management Service by Data443

Output: product_security_features,end_user_security,data_protection,threat_prevention


Input: Search Free Trial Get Demo Day April 24, 2019 Phishing Targeting Real Estate Firms April 24, 2019 Stories about real estate hacking and particularly phishing have appeared with increasing frequency in newspaper and blog headlines. Stories like the cybercriminals who stole client contact information from a DC-area real estate company, and with the information then created a business email compromise BEC scam, which resulted in 1.5 million Company Partners Resources Investor Relations Products Freeware Demo Solutions Contact Us Privacy Management Service by Data443

Output: data_protection,incident_response


Input: Search Free Trial Get Demo Day October 5, 2018 Survey Says 44 of Companies Phished This Year October 5, 2018 The third annual Cyren-Osterman Research U.S. security survey shows a significant increase in phishing emails getting through to users and in the number of successful phishing attacks suffered by businesses during the past 12 months, among many topics covered in the 16-page report, IT Security at SMBs 2017 Benchmarking Survey, Company Partners Resources Investor Relations Products Freeware Demo Solutions Contact Us Privacy Management Service by Data443

Output: threat_prevention,security_best_practices