Input: Search Free Trial Get Demo Analyzing behavior to protect against BEC attacks December 22, 2022 Understanding normal behaviors in email exchanges are key to combating advanced phishing and BEC attacks by John Stevenson Detecting Business Email Compromise BEC In the final part of our series of blogs on Business Email Compromise BEC, its time to look at how AI, ML, and NLP all have a part to play in helping to detect the sometimes-subtle behavioral anomalies that indicate the presence of a Business Email Compromise BEC attack. The primary motivation for a BEC attack is financial fraud. An analysis of the Cyren data lake of malicious emails reveals that in four out of five cases employee impersonation was used as a classic foot in the door technique to try and trick the unwary. This is frequently accompanied by requests to change payment details, update banking information, or steal credentials such as those giving access to Microsoft 365, Sharepoint, or similar. So far in this series weve looked at how robust email security solutions analyze message metadata and the language in email content to detect these attacks. Now lets see how adding contextual information and identifying behavioral anomalies gives the defender a real advantage over the attacker. Context is king When it comes to detecting a BEC message, some of the earliest clues to the fact that something malicious is happening dont necessarily come from individual messages but from combinations of messages. Consider an interchange that begins with a seemingly innocuous message asking if the recipient is in the office that day. Of itself, it is innocent enough but if the recipient responds positively, they implicitly accept that the sender is genuine and open the way for ensuing messages to set up the next stage in an attack. Context is king and a robust email security solution needs to be able to analyze email trails like this to identify indicators of an advanced phishing or BEC attack. Anomaly detection Were creatures of habit. We acquire and repeat patterns of behavior in every aspect of our life and work is no different. These patterns extend to whom we talk to, how we talk to them, and what we say. And they extend to email too! By baselining normal behaviors in email traffic we can detect the anomalies that might indicate the presence of a BEC attack. Consider the following email, one that is representative of the kind of malicious message we see from the Cyren data lake On the face of it, the message looks fine but there are a number of anomalies that a robust email security solution is able to identify. The sender has never sent the recipient an attachment before Theres an informational warning indicating that the person may not be who they claim to be The sender has not previously requested payment on an invoice The sender would not normally signoff with Regards The attachment contains a URL in the footer Taken together these behavioral anomalies help to inform the email security solution that the message is both malicious and fraudulent. Stopping BEC attacks in the inbox Twenty-five years ago, firewalls deployed on the network boundary were considered sufficient to repel attacks from intruders. Then it became clear that the bad guys were still getting in and that intrusion detection technologies were needed to look for their presence inside the network. The same change is now taking place in the world of email security. Modern BEC attacks use an array of techniques to evade detection and defraud the unwary. Sometimes a piece of zero-day malware is concealed in an image. Other times a harmless URL suddenly becomes active  or weaponized  days after delivery. Sophisticated phishing and BEC attacks like this, routinely evade detection by both the boundary email security defense and Microsofts native security controls. For this reason, its essential that a robust email security solution capable of dealing with BEC attacks, operates where it matters  inside the user inbox. About Cyren Inbox Security Cyren Inbox Security CIS is a modern Integrated Cloud Email Security SaaS solution that augments native Microsoft and traditional secure email gateway defenses. CIS utilizes AIMLNLP capabilities with behavioral analytics, and up-to-the-minute cyber threat intelligence, to automatically protect against, and manage the remediation of email threats that have successfully evaded all other defenses to reach the users Microsoft Office 365 inbox. Try it for Free Instant Data Classification Cyren URL Category Chacker Prev Using NLP techniques to protect against BEC attacks Company Partners Resources Investor Relations Products Freeware Demo Solutions Contact Us Privacy Management Service by Data443

Output: product_security_features,threat_prevention,data_protection,end_user_security


Input: Search Free Trial Get Demo Eine Erhöhung von 725  im Kryptowährungs-Mining bedroht mehr als nur Ihre CPU March 1, 2018 Wir haben hier im Cyren Security Lab das Kryptowährungs-Mining nachverfolgt und konnten einen massiven Anstieg in der Anzahl der Websites bestätigen, die Krypto-Mining-Skripts weltweit hosten. Auf Basis der Überwachung einer Probe von 500.000 Websites haben wir festgestellt, dass im viermonatigen Zeitraum vom letzten September bis Januar 2018 eine Erhöhung von 725  in der Anzahl der Domains verzeichnet werden konnte, die Skripts auf einer oder mehreren Seiten  wissentlich oder unwissentlich  ausführen. Beschleunigung der Wachstumsrate Nach einem Sprung um das Dreifache im Oktober hat die Anzahl neuer Mining-Websites im November ein Hoch erreicht. Danach hat sich die Zahl im Dezember und dann nochmals im Januar verdoppelt. Daher konzentrierte sich die Hälfte der Gesamtzunahme seit September auf die letzten beiden Monate, was darauf hinweist, dass die Ausbreitung des Krypto-Mining sich beschleunigt ein Trend, den wir weiter beobachten werden. Die Daten teilen uns mit, dass seit Januar 1,4  der Websites in der überwachten Probe Mining-Skripts ausführten. Wenn man den kometenhaften Anstieg von Kryptowährungs-Werten in den letzten Monaten zugrunde legt, ist der Aktivitätssprung bei der Produktion von Kryptowährungen nicht überraschend. Monero, die primäre Währung, die von Krypto-Mining-Skripts verwendet wird, konnte im gleichen Zeitraum einen Wertanstieg von fast 250  verzeichnen, was das Interesse geschürt hat. Monero bezeichnet sich selbst als sichere, private und nicht nachweisbare Kryptowährung, die eine Technologie einsetzt, welche es quasi unmöglich macht, Transaktionen nachzuverfolgen, die von einer Person oder IP-Adresse vorgenommen werden. Das erklärt, warum dies derzeit die Währung der Wahl im Bereich des Krypto-Mining ist. Auf jeden Fall werden durch unsere Ergebnisse die Vermutungen aller bestätigt und die phänomenale Ausbreitung von Mining-Skripts, über die wir zum ersten Mal letzten Oktober berichteten, wird quantifiziert siehe Malware führt Währungs-Mining mit Ihrer CPU durch . Wie sich Unternehmen selbst schützen Krypto-Mining steckt noch in den Kinderschuhen, und es wird erwartet, dass es exponentiell wachsen wird. Unternehmen müssen die Bedrohung jetzt angehen und sich davor schützen. Das URL-Klassifikationssystem von Cyren, was sowohl von Cyren Web Security als auch Cyren E-Mail Security verwendet wird, beinhaltet eine spezifische Kryptowährungs-Kategorie, um die Möglichkeit zu blockieren, zu einer Website zu surfen, die einen Krypto-Mining-JavaScript-Code ausführt, und die eine Meldung von Benutzerversuchen, auf solche Seiten zuzugreifen, ermöglicht. Cyren blockiert Coinhive-Miner wie JSCoinHive.A!Eldorado und JSCoinHive.B!Eldorado. Try it for Free Instant Data Classification Cyren URL Category Chacker Prev WARNING UK Tax Refund Phishing Scam Identified 725 increase in cryptocurrency mining threatens more than just your CPU Next Company Partners Resources Investor Relations Products Freeware Demo Solutions Contact Us Privacy Management Service by Data443

Output: product_security_features,end_user_security,threat_prevention


Input: Search Free Trial Get Demo Introduction  Security Best Practices for External Sharing on Content Collaboration Platforms January 12, 2018 Content Collaboration Platforms CCPs like Box, Citrix ShareFile, Dropbox, Egynte, Google Drive, and Microsoft OneDrive have come along way since the early 2010s when the two original innovators, Dropbox and Box, were just cloud storage with some nifty partial syncing. Today, they have taken center stage and are now considered vital to the real-time collaboration goals of the connected economy. Gartner predicts that by 2020, 80 of large and midsize organizations will have deployed at least one of these platforms as part of their content collaboration strategy. Gartner also recently renamed the category from Enterprise File Sync and Share EFSS to Content Collaboration Platforms to reflect its growing importance. Not surprisingly as these platforms have become more strategic they have also come under greater scrutiny regarding their security. For the most part they have made great strides with increased security controls for collaboration amongst their managed or internal users, but very real security challenges remain for collaboration with non-managed or external users. Sadly, data breaches are keeping pace with the torrent of data being put on to the cloud and the trend is not likely to change. The flavor of breaches that this blog series will focus on are not traditional hacks, but serious data leakage that stems from platform vulnerabilities, lax security procedures, misconfiguration or just ignorance remember Anthony Weiners use of Twitter for what he thought were private messages?. The blame is shared between vendors and users because both sides make mistakes so the advice will target reducing vulnerabilities from any source to keep your data secure. For example, in 2017 security researchers discovered that collaboration invitations to sensitive files from companies like Dell and Ford could be found on search engines. The issue was quickly corrected but it is likely that we will see more and more of these stories in the future. For many enterprises what happens to their files once they leave the walled garden of their cloud provider remains a troubling blindspot. Resolving this vulnerability will always be a challenge since enterprises will never have the same level of control over external users as they do over their own managed users. With that said there are steps that enterprises can take to mitigate the risk involved with external collaboration. The objective of this blog series is to examine the state of security for external sharing and collaboration for the leading Content Collaboration Platforms. Each week well review a different platform and make best security practice recommendations. First up in the series will be Box so stay tuned. Try it for Free Instant Data Classification Cyren URL Category Chacker Prev Blockchain and Data Security Box  Security Best Practices for External Sharing on Content Collaboration Platforms Next Company Partners Resources Investor Relations Products Freeware Demo Solutions Contact Us Privacy Management Service by Data443

Output: product_security_features,end_user_security,security_best_practices,data_protection,access_management,threat_prevention


Input: Search Free Trial Get Demo M-Files Partners with FileFacets to Unlock Information in Key Business Systems February 6, 2018 M-Files Partners with FileFacets to Unlock Information in Key Business Systems DALLAS AND OTTAWA, February 6, 2018 M-Files Corporation, the intelligent information management company, today announced a partnership with FileFacets, a data discovery and enterprise analytics company that also develops data connectivity and migration technology. Read the full press release Try it for Free Instant Data Classification Cyren URL Category Chacker Prev Financial Relationships  why they matter GDPR Arrives on May 25 What It Means for You Next Company Partners Resources Investor Relations Products Freeware Demo Solutions Contact Us Privacy Management Service by Data443

Output: compliance_certifications,data_protection


Input: Search Free Trial Get Demo Phishing with QR codes December 1, 2022 Dont Scan or be Scammed By Maharlito Aquino, Kervin Alintanahin and Dexter To In 1994, a type of the matrix barcode known as the Quick Response code, now widely known as QR code, was invented by Masahiro Hara from a Japanese company Denso Wave. The purpose of the barcode was to keep track of automotive parts manufactured by Denso Wave. Nowadays, QR codes are applied to a much broader context and are a commonly used to display text to mobile phone users, to connect to a wireless network, open a webpage on a mobile device, and more. Back in 2021, we reported the resurgence of phishing attacks leveraging QR codes to deliver phishing URLs to customers of a German bank . Today, we see a new phishing campaign targeting Chinese customers of a mobile payment service. The phishing emails masquerade as notifications of wage subsidies from the Ministry of Finance of the Peoples Republic of China, urging recipients to apply immediately. Figure 1. Phishing email containing a DOCX attachment translated The email contains a DOCX attachment in the OpenXML document format the attachment provides instructions on how to claim employment subsidies via a mobile payment service that is widely used in Southeast Asia. To ensure everyones safety, we have redacted parts of the QR code image in the screenshot below. Figure 2. Contents of document containing a malicious QR code Forward Notice on the Ministry of Finances 2022 Personal Labor Subsidy Application Notice Statement on the 2022 Fiscal Personal Labor Subsidy According to the joint issue of the Ministry of Finance, the State Administration of Taxation, the State Administration for Market Regulation, and the Administration for Industry and Commerce the 2022 Fiscal Labor Subsidy is now underway. Wage subsidy, epidemic subsidy, social security subsidy, medical insurance subsidy, graduate subsidy, living subsidy for intermediate and senior technicians, seniority subsidy, transportation subsidy, medical insurance, unemployment insurance, maternity insurance, etc. There will be an additional subsidy in the bank account. After receiving the notification, please use your mobile phone to scan the following QR code for verification and collection. The notice has been delivered to all units last week. If you have not completed the registration, please register as soon as possible. If it is not completed this week, it will be regarded as a waiver of the application! Scan WeChat and follow the prompts to receive QR CODE Sponsor General Office of the State Council Operation and maintenance unit China Government Network Operation Center Table 1. Translated body of the document Once a recipient scans the QR code on a mobile device, their mobile browser opens a link with a .cn domain and is immediately redirected to a .click domain. Figure 3. Landing page of the malicious QR code 2022 Subsidy Statement According to the joint issue issued by the Ministry of Finance, the State Administration of Taxation, the State Administration for Market Regulation, and the Administration for Industry and Commerce, the 2022 Subsidy is now available. Wage subsidies, epidemic subsidies, social security subsidies, medical insurance subsidies, graduate subsidies, living subsidies for middle and senior skilled workers, seniority subsidies, transportation subsidies, medical insurance, unemployment insurance, maternity insurance, etc. There will be an extra subsidy in the bank account. After receiving the notice, you must register to receive it within the same day. Overdue as a waiver Subsidy owners who have received the notification email, please follow the prompts to bind personal information for authentication and collection Table 2. Translation of the landing page prompt Clicking on the prompt loads the following phishing page. Figure 4. Phishing page targeting China UnionPay QuickPass Users Entering an invalid bank card number will result in a prompt that translates to The bank card number you entered is incorrect! Figure 5. Error Prompt When Entering an Invalid Bank Card Number When a valid bank card number is entered, the user is redirected to another page that requires additional information, which is commonly used to update banking information through customer support. Figure 6. The Phishing Page Gathering User Account Info This phishing site includes a lot of data validation, especially for the most important data, the bank card number. It is also worth noting that when the link from the QR code is accessed from a desktop browser, the user is prompted to use a mobile phone to access the link, as shown below. Figure 7. Error prompt clicking the QR code with a desktop browser Indicators of compromise SHA256 or URL Description Cyren Detection 4b77112e58e805c6d231a10d6f2a2c16f860457f296c8518f727e3423e88792f Phishing email DOCXQRPhish.A.gen!Camelot 4a99caed3ed7f7223c93807a34feb2626ed2939e0324a0213cddb373edfc7fa3 Phishing document DOCXQRPhish.A.gen!Camelot w.oszojpl.cn URL from QR code URL Category  Phishing  Fraud http91267669bfa7bc1a6fb463df29ba4885.yubhn.click Phishing Landing URL URL Category  Phishing  Fraud e1a8412d691f4329e384d6310b74e113069ff73325f91fc0c8f1a093683db81c Phishing Landing page HTMLQRPhish.A Try it for Free Instant Data Classification Cyren URL Category Chacker Prev Abusing Remote Administration Tools Using NLP techniques to protect against BEC attacks Next Company Partners Resources Investor Relations Products Freeware Demo Solutions Contact Us Privacy Management Service by Data443

Output: end_user_security,data_protection,threat_prevention


Input: Search Free Trial Get Demo Data443 Reports 125 Increase in Revenues, 184 Increase in Gross Profit for Q1 2023 May 16, 2023 RESEARCH TRIANGLE PARK, NC  May 16, 2023  via IBN Data443 Risk Mitigation, Inc . OTCPKATDS Data443 or the Company, a data security and privacy software company for All Things Data Security, today announces operating results for the first quarter ended March 31, 2023. Financial Highlights for the First Quarter 2023 Increased revenue by 125 year over year. Increased gross profit by 184 year over year. Decreased net loss by 60 year over year. Business Highlights for the First Quarter 2023 Achieved 98 customer renewals. Data443 Antivirus Protection Manager received its VB100 certification. Data443s Ransomware Recovery Manager named Best of Inexpensive Protection and Best for Kiosks in  The Best Ransomware Protection for 2023 . Secured an additional contract win from one of its largest fintech clients, which processes over 75 billion transactions amounting to more than 9 trillion annually. Secured an additional contract win with a long-time, multinational fintech client that provides payment technology and services to merchants, issuers and consumers, annually transferring over 10 million sensitive files for thousands of partners. Secured an additional contract win of 484,000 from one of the Big Four U.S.-based banks and largest fintech companies. Released the latest update to its award-winning Ransomware Recovery Manager product, offering more advanced features designed to help businesses and individuals quickly and easily recover from ransomware attacks First Quarter 2023 Financial Results Total revenues were 1,380,000 during the three months ended March 31, 2023, compared to 613,000 of revenue for the three months ended March 31, 2022  an increase of 125. Existing customer organic growth, new customer acquisitions and the Companys high renewal rate drove the revenue increase. Gross profit was 1,171,000 during the three months ended March 31, 2023, compared to 413,000 of gross profit for the three months ended March 31, 2022  an increase of 184. Gross margin was 85 in the first quarter of 2023 versus 67 in the first quarter of 2022. General and administrative expenses for the three months ended March 31, 2023, were 1,401,000, compared to 974,000 for the three months ended March 31, 2022  an increase of 427,000. The increase in general and administrative expenses was primarily due to an increase in professional service fees. Sales and marketing expenses were 32,000 for the three months ended March 31, 2023, compared to 120,000 for the three months ended March 31, 2022. The decrease in sales and marketing expenses was primarily due to a decrease in trade show events, related travel and marketing activity. The net loss for the three months ended March 31, 2023, was 738,000, compared to a loss of 1,833,000 for the three months ended March 31, 2022  a decrease of 60. The decrease in net loss was primarily due to the increase in recognized revenue and a decrease in interest expense. Cash Flow During the three months ended March 31, 2023, the Company generated 360,000 from operating activities, compared to 156,000 generated during the three months ended March 31, 2022. During the three months ended March 31, 2023, the Company used funds in investing activities of 81,000 to acquire property and equipment and advance payment for acquisition. During the three months ended March 31, 2022, the Company used funds in investing activities of 258,000 to acquire property and equipment. During the three months ended March 31, 2023, the Company had net cash outflows for financing activities of 171,000. By comparison, during the three months ended March 31, 2022, the Company had net cash outflows for financing activities of 920,000. Liquidity As of March 31, 2023, the Company had cash in the amount of 109,000 and other current assets in the amount of 2,891,000. Management Commentary Jason Remillard, Data443s founder and chief executive officer, commented Our first quarter results are a testament to our teams relentless drive, passion and commitment to better serving our existing enterprise clients and expanding our market reach. Our 125 revenue growth from a year ago clearly indicates that our efforts are resonating with our clients and the trust they place in us. We have attracted new customers while retaining existing ones, and we are further validated by our high customer renewal rates and eagerness to renew with larger and longer-term contracts. This has always been the ultimate vote of confidence in our company. We are proud of the relationships we have built with our customers and will continue to nurture these partnerships in the years to come. While we believe these strong Q1 results reflect that our business plan is working, we recognize that there is still work to be done. As we announced yesterday, we entered into a definitive agreement to acquire select assets from Cyren Ltd. We certainly understand what it takes to integrate acquisitions and onboard new customers to Data443, and we are very excited about the opportunities ahead of this important transaction. I want to thank our dedicated team, our customers and our shareholders for your unwavering support and belief in our vision. We are committed to unlocking our potential and seizing the opportunities ahead. To learn more about Data443, please watch the video introduction on the Companys YouTube channel  About Data443 Risk Mitigation, Inc. Data443 Risk Mitigation, Inc. OTC ATDS provides software and services to enable secure data across devices and databases, at rest and in flightin transit, locally, on a network or in the cloud. We are All Things Data Security. With over 10,000 customers in over 100 countries, Data443 provides a modern approach to data governance and security by identifying and protecting all sensitive data regardless of location, platform or format. Our framework helps customers prioritize risk, identify security gaps and implement effective data protection and privacy management strategies. Forward-Looking Statements This press release contains forward-looking statements. These statements are made under the safe harbor provisions of the U.S. Private Securities Litigation Reform Act of 1995. Forward-looking statements may be identified by use of terms such as expect, believe, anticipate, may, could, will, should, plan, project, intend, estimate, predict, potential, pursuant, target, continue or the negative of these words or other comparable terminology. Statements in this press release that are not historical statements, including statements regarding Data443s plans, objectives, future opportunities for Data443s services, future financial performance and operating results, and any other statements regarding Data443s future expectations, beliefs, plans, objectives, financial conditions, assumptions or future events or performance, or regarding the anticipated consummation of any transaction, are forward-looking statements. These statements are not guarantees of future performance and are subject to numerous risks, uncertainties and assumptions, many of which are difficult to predict or are beyond Data443s control. These risks, uncertainties and assumptions could cause actual results to differ materially from the results expressed or implied by the statements. They may relate to the outcome of litigation, settlements and investigations actions by third parties, including governmental agencies volatility in customer spending global economic conditions inability to hire and retain personnel loss of, or reduction in business with, key customers difficulty with growth and integration of acquisitions product liability cybersecurity risk anti-takeover measures in the Companys charter documents and the uncertainties created by global health issues, such as the ongoing outbreak of COVID, and political unrest and conflict, such as the invasion of Ukraine by Russia. These and other important risk factors are described more fully in the Companys reports and other documents filed with the Securities and Exchange Commission the SEC, including in Part I, Item 1A of the Companys Annual Report on Form 10-K filed with the SEC on Feb. 24, 2023, and subsequent filings with the SEC. Undue reliance should not be placed on the forward-looking statements in this press release, which are based on information available to the Company on the date hereof. Except as otherwise required by applicable law, Data443 undertakes no obligation to publicly update or revise any forward-looking statements, whether because of new information, future events or otherwise. DATA443 is a registered trademark of Data443 Risk Mitigation, Inc. All product names, trademarks and registered trademarks are property of their respective owners. All company, product and service names used in this press release are for identification purposes only. Use of these names, trademarks and brands does not imply endorsement. For further information Follow us on Twitter  Follow us on Facebook  Follow us on LinkedIn  Follow us on YouTube  Sign up for our Investor Newsletter  To learn more about Data443, please watch the Companys video introduction on its YouTube channel  Investor Relations Contact Matthew Abenante  919.858.6542 Corporate Communications IBN InvestorBrandNetwork Los Angeles, California www.InvestorBrandNetwork.com 310-299-1717 Office  SOURCE Data443 Risk Mitigation, Inc. View source version on accesswire.com  Try it for Free Instant Data Classification Cyren URL Category Chacker Prev Data443 Expands Its Global Customer, Technology Base with Transformative Acquisition of Select Israel-based Cyren Ltd. Assets Data443 Adds Antivirus and Ransomware Protection to Data Placement Manager DPM Next Company Partners Resources Investor Relations Products Freeware Demo Solutions Contact Us Privacy Management Service by Data443

Output: product_security_features,end_user_security,compliance_certifications,data_protection,threat_prevention,privacy_policy


Input: Search Free Trial Get Demo Day November 15, 2017 Enterprise Analytics Searching, Clustering, and Learning  Oh My! November 15, 2017 Enterprise Analytics Searching, Clustering, and Learning  Oh My! Have you ever put together a 1,000-piece puzzle without a picture to reference as you work? The task is time-consuming, frustrating, and seemingly impossible. After turning over each piece, you slowly begin to notice how the disparate shapes and images can Fake Invoice Carries Rescoms Malware November 15, 2017 Emails containing malicious attachments equipped with keyloggers and screen capture capabilities are targeting businesses worldwide, with noted attacks in Asia, Russia, and the Middle East. The campaign is designed to look like it comes from real affiliates and employees working for a well-known pharmaceutical distributor in order to make the Company Partners Resources Investor Relations Products Freeware Demo Solutions Contact Us Privacy Management Service by Data443

Output: threat_prevention,data_protection,privacy_policy


Input: Search Free Trial Get Demo Stealing Tax Refunds Soaring Worldwide November 9, 2017 There appear to be only two things that are certain in life death and cybercriminals trying to steal your tax refund. As governments have moved tax systems online to facilitate life for the taxpayer, refund scams using phishing and social engineering to obtain personal financial information have become epidemic, with criminals diverting any tax refund due or even gaining access to personal bank accounts to steal funds directly. The Malaysian Tax Fraud Phish  17 Banks! This weeks case study is from Malaysia, which has drawn particular attention due to the elaborate set of fraudulent banking pages created for the scam  in addition to the fake government refund landing page linked from the phishing email, there are fake login pages for no less than 17 ! Malaysian banks linked to the landing page. This week the Malaysian government went so far as to issue an official warning, alerting taxpayers to watch out for fraudulent emails containing information about overdue tax refunds. This phishing campaign appears to be leveraging the Malaysian Inland Revenue Boards move to facilitate tax payments through an online payment gateway known as Financial Process Exchange FPX. Cyren detects and blocks the following domain and IP addresses associated with the phishing threat lucyhanselman.nl and IP Address  95.211.13.70. A list of fraudulent phishing URLs detected and blocked by Cyren are provided at the end of the article. How It Works The scam arrives via email with an attached document containing instructions on how to claim an overdue tax refund. The phishing document is distributed using the Office Open XML document format .DOCX, with the malicious link to the phishing site landing page obfuscated as a shortened URL. We recently highlighted this URL-shortening obfuscation technique in the blog article Bank Phishing Scam Using Shortened Links.  Phishing document sent to Malaysian citizens containing a shortened URL used to obfuscate a malicious hyperlink. Once a user clicks on the shortened URL, he is redirected to a web page displaying a list of banks similar to the actual affiliate banks displayed on the real Malaysian Inland Revenue Boards web site. The fake landing page instructs the victim to choose his own bank from a list of 17. Top The list of FPX affiliate banks from the actual Malaysian government site   Bottom The phishing scams website with a list of 17 banks that are the same as the real government site. When the victim clicks on the fake bank logo, he is taken to a phishing page. As you can see from the examples below, the fake bank pages look highly legitimate, although a quick scan of the webpage names clearly shows an incorrect URL . Phishing page for AFFiNBank Phishing Page for Argo Bank A very real looking but fake Citibank login page. After accepting the victims login credentials, the criminal then attempts to collect more personal and sensitive information by redirecting the victim to a few more verification pages, each time asking the victim to enter a one time passwordPIN OTP to make the scam appear legitimate and convincing. Additional user information requested by this campaign includes E-mail address Phone number Last 4-digits of account ID Mothers Maiden Name After entering details, the phishing site then goes into a loop, requesting the victims Mothers maiden name over and over again. Think Before You Click! Prevent Financial Phishing With individuals and companies around the globe becoming targets and often victims of tax refund and banking phishing scams, it is critical to implement strong email gateway security which can prevent phishing emails from reaching users in the first place. Email gateway security also blocks access to phishing links as a second layer of protection. In addition, Cyren encourages anyone to think before you click. If you suspect fraud, type the address of your financial institution directly into your web browser. Other ways to test the reliability of a financial site include Look at the URL to see if it displays the financial organizations name, along with the lock icon to indicate you are using a secure connection. A fake online banking login page will not supply a security login icon or a correct URL address. Signed and verified online banking login page. Enter fake credentials. It may sound counter-intuitive to do this, but a fake online banking website will typically just accept any login credentials and then redirect the user to more phishing pages to collect other types of sensitive information. Legitimate banking sites will automatically recognize the fake credentials and display a message that says the user name and password are incorrect or cannot be found. Indicators of Compromise and Cyren Detection Cyren detects and blocks the following URLs associated with this threat HashURL Object TypePhishing Target Remarks 287ec5f40eeab28918ce7063ecb724a7f19f4f7647ff17906e105e85dc55688e Office Open XML Word Document Detected by Cyren as XMLPhish.J hxxpwww.jornalodiasp.com.brwp-adminimagesindex.php Phishing URL Blocked by OpenDNS 119cdd88a034ad906bfc154cc7280adae7b798419e84be7b24bd3fdca6a1228d Office Open XML Word Document Detected by Cyren as XMLPhish.K hxxpsbit.ly2yoWoSd Shortened Phishing URL hxxpmathieugagnon.cawp-contentuploads70afec4c3870416e8cfbd6e16464aa2f Phishing URL hxxplucyhanselman.nlPBdJrEydMEPSaffinonline.com AFFin Bank hxxplucyhanselman.nlPBdJrEydMEPSagroneti Agro Bank hxxplucyhanselman.nlPBdJrEydMEPSallianceonline.com.my Alliance Bank hxxplucyhanselman.nlPBdJrEydMEPSambank AmBank Group hxxplucyhanselman.nlPBdJrEydMEPSbislam Bank Islam hxxplucyhanselman.nlPBdJrEydMEPSirakyat.com.my Bank Rakyat hxxplucyhanselman.nlPBdJrEydMEPScimb CIMB Bank hxxplucyhanselman.nlPBdJrEydMEPScitibank.com.my Citi Bank hxxplucyhanselman.nlPBdJrEydMEPShlbconnect HongLeong Bank hxxplucyhanselman.nlPBdJrEydMEPSi-muamalat.com.my Bank Muamalat hxxplucyhanselman.nlPBdJrEydMEPSkfh.com.my Kuwait Finance House hxxplucyhanselman.nlPBdJrEydMEPSmbb MayBank hxxplucyhanselman.nlPBdJrEydMEPSocbcmysecure OCBC Bank hxxplucyhanselman.nlPBdJrEydMEPSpbeonline Public Bank hxxplucyhanselman.nlPBdJrEydMEPSrhb.com.my RHB hxxplucyhanselman.nlPBdJrEydMEPSscb Standard Chartered hxxplucyhanselman.nlPBdJrEydMEPSuob UOB Try it for Free Instant Data Classification Cyren URL Category Chacker Prev Locky Revived  A Roundup of New Variants Fake Invoice Carries Rescoms Malware Next Company Partners Resources Investor Relations Products Freeware Demo Solutions Contact Us Privacy Management Service by Data443

Output: product_security_features,end_user_security,data_protection,threat_prevention


Input: Search Free Trial Get Demo Fake Invoice Carries Rescoms Malware November 15, 2017 Emails containing malicious attachments equipped with keyloggers and screen capture capabilities are targeting businesses worldwide, with noted attacks in Asia, Russia, and the Middle East. The campaign is designed to look like it comes from real affiliates and employees working for a well-known pharmaceutical distributor in order to make the emails more convincing and lure the recipients into opening the attached document. The malware exploits two known Microsoft vulnerabilities CVE-2017-0199 and CVE-2017-8759 and includes obfuscation tools, such as sandbox detection. Cyren detects and blocks this threat as XMLCVE170199, CVE-2017-8759!Camelot,W32TinyDL.A and W32Rescoms.G. How It Works An email arrives from what appears to be a reputable person and company in the pharmaceutical industry containing an attachment that looks like an invoice or statement. Figure 1  Email Sample To initiate the installation of the main malware, this attack first exploits the Microsoft vulnerability CVE-2017-0199 to automatically update the document with malicious contentin this case, a file named free.doc accessed directly from the threat actors server. Figure 2 CVE-2017-0199 exploit automatically updates using free.doc directly from the threat actors server. Figure 3  MS Word prompts user to update document from linked files. The downloaded document contains a linked document object with hidden text that when executed exploits a second vulnerability known as CVE-2017-8759, which takes advantage of a vulnerability in MS Offices SOAP WSDL Parser. Figure 4  Hidden linked document object Figure 5 CVE-2017-8759 Exploit The CVE-2017-8759 exploit runs .Net code, which drops and installs an executable binary in the Windows temporary directory. This file which Cyren detects as W32TinyDL.A downloads the main malware component and saves it in LOCALAPPDATAavast.exe. Cyren detects the main malware component as W32Rescoms.G. AnalysisPayload W32Rescoms.G The Backdoor payload dump strings suggest that it is a variant of Remcos RAT. Checking the latest free version of the Remote Access Trojan reveals the different capabilities it can do on an infected system. Figure 6 Builder Options Figure 7 Installation Options Figure 8 Process Injection and Sandbox Detection Options Figure 9 Keylogging Options Figure 10 Screen Capture Options Figure 11 Remote Options Digging deeper on the backdoor payload, we can find the settings in the resource section of the file. Figure 11 1 st byte is the size of the RC4 key and the actual key next to it This version still uses the RC4 encryption and with the settings decrypted, it reveals that it will try to connect to the following remote host and use pass as the password. CC  infocolornido.publicvm.com port  2404 password  pass Mitigation With malware exploding around the globe, it is critical that companies put essential steps in place to protect from new and existing threats. Cloud-based Email and Web Security Email and web security gateways instantly filters and block malicious or unwanted email and malware threats for all users on your network, regardless of user location or device type. Patching It is common for threat actors to use recently disclosedpatched vulnerabilities since they know that companies are sometimes notoriously bad at updating and applying patches to their networks. The attack takes advantage of two known exploits that Microsoft has identified and provided fixes for. Updating software and applying patches is a critical step to safeguarding your networks.    Disabling Links In addition to cloud-based security and system patches, another option in this kind of threat scenario is to disable the automatic links at open function, also used successfully with the recent DDE vulnerability. Please note that we only tested it on Microsoft Word 2016. File-Options-Advanced-General- Uncheck Update automatic links at open. Indicators of Compromise SHA256URL DescriptionDetection Case 1 074ede6276def79b95c342289bc940deb05fdeaf4bc4896e7fc3c8f6578e6c57 E-mail, Subject Payment confirmation attached. 7b2c39c838c6629543f1185750b4e41612810722947b4818d15dbbaad99033e1 E-mail, Subject Payment confirmation attached 8505309fd4e78db3f6efdc49bae5b8e045d89d6dd665d245cfa0101b4d39a6bb Filename Nov Payment.docx, XMLCVE170199 hxxp23.92.211.215kfree.doc Link to CVE-2017-8759 exploit 7affc3737c52bf39a03e725184836efc647dd001ec90229d6c4ec887fb741fd6 CVE-2017-8759!Camelot hxxp23.92.211.215kxin.png Link to CVE-2017-8759 payload 60ce039c026d191d996448963aa186e96d50c445b7bb07360318393edbf7ccdb Filename xin.png, XMLDropExe.A 445a15c88ed27e01e668e17bd47c6793ba5361b98a903c40d1a1f22eeb453684 Filename TMPrandom.exe, W32TinyDL.A e5da506ab6ccb1b3d24cd1fc3030a3e7e65b29b75e92a02a6c2ff57e73ddf85e Filename avast.exe, W32Rescoms.G References  Case 2 hxxpa.pomfe.cowhmpqn.doc Download link 856cf2046fb797d83df6beb620956a9845a99f479ef134cec7db0743f462f958 Filename whmpqn.doc, CVE-2017-8759!Camelot 2a8da20bd8bac77805b4facd4fabb04a49b5f6c6af8085023ee64568463189dc Filename epraeb, CVE178759 3f065107b25dfd77e14ebef919419d00cde19d5372168161cb6d8ae7782eb32d Filename usa.exe, W32Injector.GAV References  Additional IOCs dd52fdd55f1835048fbe425a2123bf4d452773cbfaf567d6c30d2d59cd577fc hxxp23.92.211.215tutu.doc bfcc360a49eea396ca8d417c10fa84673fa5d70ccd4ccf20d195a28460b09dfd hxxp23.92.211.215kdd.doc 8505309fd4e78db3f6efdc49bae5b8e045d89d6dd665d245cfa0101b4d39a6bb hxxp23.92.211.215kfree.doc f4c98a007d77cca4172cd2ad93f42dbc0c5ec578bda44b537c9fb56480b10ed9 hxxp23.92.211.215re.doc 6837634e75a4e1966bdaef7f42f1ac765859da5777938660329ef151ab7e32d7 hxxp23.92.211.215knilo.doc 17f6e1b561f9c16d09848b49210a94cd6c82927771cb8be572155aac3570d1bb hxxpultrachem-tw.comnkl.doc Try it for Free Instant Data Classification Cyren URL Category Chacker Prev Stealing Tax Refunds Soaring Worldwide How Do You Know Your Email Security Is Working? Next Company Partners Resources Investor Relations Products Freeware Demo Solutions Contact Us Privacy Management Service by Data443

Output: threat_prevention,end_user_security,security_best_practices,incident_response,technical_documentation


Input: Search Free Trial Get Demo Day November 22, 2022 Abusing Remote Administration Tools November 22, 2022 The bad, worse and the horrible by Gunnar Guðmundsson and Axel Marinho Guðmundsson Introduction In this article, we look at a malware payload from an exploited Microsoft Word document. With a little Python scripting and deciphering we research a single sample and gather a few more versions to view a Company Partners Resources Investor Relations Products Freeware Demo Solutions Contact Us Privacy Management Service by Data443

Output: threat_prevention,technical_documentation,privacy_policy


Input: Search Free Trial Get Demo Blockchain  More than coin January 27, 2018 I read an interesting article today about some of the activities occurring at Davos this week. Robert Shiller made some interesting comments     however mostly centered around bitcoin itself. For sure  it has been a bumpy ride  and outside of hype and other reasons for the sudden interest  at its core we are talking about validations of blockchain and its ability to free information  whilst protecting it and giving owners control. Looks like there were over a dozen specific sessions on blockchain itself  which I find quite interesting considering this topic made agendas a few years back anywhere. More interesting to me from a product and compliance side was the joint announcement between Microsoft, Accenture and Hyperledger for the ID2020 Alliance   . Much more to come from this group  and I expect competing groups to crop up with different value propositions, etc. More interesting to us, is the blockchain conversation is starting to mature and get big enough  that is  having some large and lofty goals and encompassing truly needed user communities with capabilities that help on a very large scale call it  planet-wide. In this example, which I didnt know, over 1.1 billion people can not prove their identity  which as we know affects everything from immigration, work, safety, healthcare and more. Significant, game changing, mature. It will be interesting! Try it for Free Instant Data Classification Cyren URL Category Chacker Prev Box  Security Best Practices for External Sharing on Content Collaboration Platforms Final day to vote! Next Company Partners Resources Investor Relations Products Freeware Demo Solutions Contact Us Privacy Management Service by Data443

Output: compliance_certifications,security_best_practices,data_protection,privacy_policy


Input: Search Free Trial Get Demo New Scarab Ransomware Using Necurs-as-a-Service December 1, 2017 13.3 million Scarab ransomware emails detected in one day The new Scarab ransomware being distributed via email by the Necurs botnet appears to come from scanning devices or services like HP, Epson or Lexmark. While there are similarities to the Necurs-distributed Locky ransomware, Scarab seems to have been developed by a different malware author. Necurs began actively distributing Scarab on November 23rd Thanksgiving Day in the U.S.. Cyrens security cloud blocked 13.3 million emails containing the Scarab attachment that day. Ransomware-as-a-Service Necurs most recent scourge has similarities on the surface to earlier Necurs-connected ransomware. Analysts at the Cyren Security Lab note that the Visual Basic .vbs file that downloads the malicious content is similar to the downloads from Locky and Trickbot. But upon examining the actual Scarab ransomware see our How It Works breakdown below, appears very different from Locky, with indications that it was created by a different author. One of the most notable differences includes the lack of a TOR webpage for a ransom fee. Instead you send an email to  with the personal identifier. This suggests that the criminals behind the Necurs botnet might be offering a distribution service for ransomware authors, with the Necurs gang providing the .vbs file that downloads the ransomware payload, macros, and JavaScript. This approach enables the malware author to focus on developing the ransomware itself. What economic arrangement the two parties might have, we can only guess at. Cyren detects the Scarab files as the following EXE file  W32Ransom.Scarab.A Sha-256 7a60e9f0c00bcf5791d898c84c26f484b4c671223f6121dc3608970d8bf8fe4f VBS file  VBSDownldr.HM Sha-256 e6715117fd6995fafe48a3a60a2b1275ef21a63f7878de2cc031c8f1a0e5d771 Necurs A Brief History Its the botnet that keeps on giving. Known for its technical complexity, diverse distributions, and exceptional persistence, Necurs is one of the largest if not the largest botnets in the world, estimated to have up to 6 million bots networked. Its been behind the distribution of ransomwares like Locky and banking trojans like Dridex and Trickbot. Necurs periodically goes into hibernation, with little or no activitythen bang. For example, in 2016, the botnet went on hiatus for three weeks after the arrest of 50 Russian cyber criminals connected to a banking trojan, several of whom were believed to be behind Necurs operation. The botnet went quiet again in early 2017, but reactivated in March 2017 and has been active to varying degrees since then. How Scarab Works When the email arrives, the victim sees a subject line and attachment that appear to come from a variety of scanning sources, such as HP, Epson, and Lexmark. The email itself is targeted at businesses and spoofs the HP, Epson, or Lexmark domain name, so it appears to be coming from a printer located at the business. Figure 1 Scarab email attachment captured by Cyren appears as a scanned image from an HP printer. The Scarab emails each contain a .7zip file as an attachment. Extracting the file gives you a .vbs file that, in turn, downloads JHgd476.txt from one of these locations httpmiamirecyclecenters.comJHgd476 httpmiamirecyclecenters.comJHgd476 httphellonwheelsthemovie.comJHgd476 httphard-grooves.comJHgd476? Figure 2 Scarab encrypts files and appends each with ..scarab. The JHgd476.txt file is actually an .exe file with the extension .txt to help hide its true intent. Once downloaded, the .vbs then runs the .exe that is the Scarab ransomware. Once the ransomware payload has executed, the victim sees the following message on their computer screen Figure 3 Scarab uses a Visual Basic attachment to deliver the ransomware payload. This version of Scarab encrypts the files and appends the file name with a ..scarab extension. Figure 4 Victims are asked to email  and pay the ransom in bitcoins.. Several other notable things stand out with Scarab. First, the ransom note contains no monetary sum, only the instructions to contact the  address. In addition, while Cyren detected the 13.3 million Scarab emails as primarily targeting businesses, the distribution day of Thursday, November 23rd, Thanksgiving Day, in the United States, meant that if the ransomware made it into email boxes, the vast majority of American business employees likely didnt actually see the email until they returned to work five days later. Dont Be a Victim An ounce of prevention is worth a pound of cure, as they say. To avoid falling victim to ransomware scams like Scarab, consider using Cyrens cloud-based email security and web security capable of identifying and blocking threats as they emerge, before they reach users. Try it for Free Instant Data Classification Cyren URL Category Chacker Prev 10 Cyber Threat Terms Every IT Manager Should Know Analysten-Bericht Phishing-Angriffe sind ein Geschäftsproblem, kein IT-Problem Next Company Partners Resources Investor Relations Products Freeware Demo Solutions Contact Us Privacy Management Service by Data443

Output: product_security_features,end_user_security,data_protection,threat_prevention,technical_documentation


Input: Search Free Trial Get Demo Do You Know the New PII Rights under GDPR? December 12, 2017 Do You Know the New PII Rights under GDPR? What is your current address? What was the yearly salary of your last position? What is your Social Security national insurance number? Consider how many PII personally identifiable information questions your organization asks for background checks of individuals being vetted as a candidate for a new position. These questions increase dramatically after the candidate is selected. How many of these questions are PII-related? PII is any information used to distinguish one person or another. Entering ones name, bank account, address or telephone number are necessary tasks to interact with businesses. However, each entry increases the risk of exposing this information to the wrong person. In May 2018, the European Union General Data Protection Regulation GDPR takes effect. The first comprehensive attempt at establishing data compliance standards across national economies, GDPR establishes timelines to notify users of data breaches and penalties for non-compliance. The regulation also details specific rights for citizens to access their own data and understand why its being collected, processed, and stored. The Four Pillars of Data Subject Rights GDPR mandates organizations design and implement data protection into their systems and processes. They must be able to identify and secure this information across the data lifecycle from collection and processing to analyzing and storage. Organizations will now be held responsible and accountable by policies that protect your PII rights across four pillars Right to Access Who has my information and what is it being used for? Individuals have the right to know which PII is being collected and processed, where it is stored, and why the organization needs it. Right to Be Forgotten Why are you processing my information when I am not associated with your organization? Individuals have the right to cease the processing and dissemination of their data. They also have the right to have their data deleted from an organizations system. Right to Data Portability Why do I have to answer the same PII questions multiple times? The public has the right to retain and reuse data across different applications and services. Organizational data networks must comply with portability and security standards to safely transfer PII within and across systems. Right to Breach Notification How will I know if my information is compromised? When data is compromised, individuals have the right to be notified of the breach. Businesses are required to report breaches to authorities within 72 hours, and individuals will be notified as soon as possible thereafter. How Can FileFacets Help? FileFacets provides the platform and methodology to help businesses comply with the EUs GDPR. With years of experience in information governance, FileFacets provides the tools for acquiring data, and identifying and actioning of personal data from multiple sources.Through a sophisticated, yet simple interface, FileFacets allows businesses to scan multiple unstructured data sources and repositories networked and cloud-based shared drives, servers, enterprise content management systems, email, desktops, and laptops to locate and identify any personal data or sensitive data an organization may possess. FileFacets scans multiple sources and repositories to locate and identify any PII or sensitive data that your organization may possess. It will constantly run so any additional content with PII can be flagged and dealt with in a safe and secure manner. Try it for Free Instant Data Classification Cyren URL Category Chacker Prev FileFacets in MicroScope Article GDPR influencing channel relationships Chris Perram interviewed in article The Impact of Artificial Intelligence on Law Firms Next Company Partners Resources Investor Relations Products Freeware Demo Solutions Contact Us Privacy Management Service by Data443

Output: product_security_features,compliance_certifications,data_protection,access_management,incident_response,privacy_policy


Input: Search Free Trial Get Demo Locky wiederbelebt  eine Zusammenfassung der neuen Varianten October 31, 2017 Locky, die Ransomware, welche 2016 dominiert hat und dann in der ersten Jahreshälfte von 2017 verschwunden ist, wurde mit einer Reihe neuer Varianten in den vergangenen drei Monaten zu neuem Leben erweckt und fordert jetzt das Dreifache des Lösegelds. Ein möglicher Grund für sein Verschwinden und Wiederauftreten wurde im aktuellen SecurityWeek-Blog von Cyrens VP des Threat Research, Siggi Stefnisson, untersucht. 15.000 einzigartige Versionen pro Tag Das Necurs-Botnet, welches für die Distribution von Locky verantwortlich ist, schien Anfang 2017 offline zu gehen. Als dann die Command- und Control-Server im März wieder online gingen, lag der Fokus auf Kampagnen mit anderer schädlicher Malware, einschließlich der Distribution des Banking-Trojaners Dridex im März und April sowie  von April bis Juni  der Jaff-Ransomware. Im August startete die Locky-Distribution erneut mit den Lukitus- Finnisch für Verriegelung Locking und diablo6- Varianten, und das mit enormen Ausbrüchen. Danach wurde es einige Zeit still um Lukitus, bevor die neuen Varianten Ykcol Locky, rückwärts buchstabiert und Asasin herauskamen. Um eine Vorstellung von der Schwere und Raffinesse dieser neuen Kampagnen zu vermitteln Am 28. August entdeckte die Security-Cloud von Cyren über 130 Millionen Locky-Lukitus- E-Mails. Und in diesen 130 Millionen E-Mails tauchten über 15.000 einzigartige Versionen des VBS auf, das die Locky-Nutzlast herunterlädt  ein Versuch, die Entdeckung durch Sicherheitssysteme zu umgehen. Nachdem wir hier im Cyren Security Lab alle neuen Varianten untersucht haben, konnten wir feststellen, dass die tatsächliche Binärdatei, welche Dateien verschlüsselt, seit 2016 im Großen und Ganzen unverändert geblieben ist  mit Ausnahme von Verbesserungen, um Sandboxes und Antivirus-Anbieter zu vermeiden. Weiter unten zeigen wir Ihnen Screenshots und Taktiken auf, die bei jeder der neuen Varianten eingeführt wurden in umgekehrter chronologischer Reihenfolge des Erscheinens. Abbildung 1  Angriffskampagnen-Muster von April bis Juli für Jaff und die Reihenfolge der Distribution der diversen Locky-Varianten ab August bis heute. Locky Asasin Cyren Security Labs haben die aktuellste Variante von Asasin am 10. Oktober beobachten können  in Verbindung mit der fortlaufenden Distribution der .ykcol-Variante. Die neuesten VBS und Java-Scripts, die die .asasin-Variante herunterladen, weisen einige neue Merkmale auf. Das Java-Script, welches von einer .html-Datei heruntergeladen wird, nimmt einen Screenshot des Desktops des Opfers auf, speichert diesen als crumboqj.jpg und lädt ihn auf einen Remote-Server hoch. Abbildung 2  Locky .asasin schnappt sich den Bildschirm des Opfers und lädt ihn auf einen Remote-Server hoch. Die neueste VBS-Datei, die Locky herunterlädt, führt tatsächlich ein paar Checks auf dem Rechner durch, bevor es diesen infiziert. Die Funktion, die als Skywalker bekannt ist, untersucht den Ländercode, das Betriebssystem und welche Version des Betriebssystems auf dem Rechner läuft. Danach werden diese Informationen an einen Remote- Server gepostet. Der Server antwortet, indem er entweder die Nutzlast sendet oder nichts tut  je nach Ergebnis der Untersuchung, wie zum Beispiel Angaben zum Land, in dem der Rechner seinen Standort hat. Abbildung 3  Die Funktion Skywalker erfasst Informationen zum Rechner. Abbildung 4  Die Funktion Panda sendet die gesammelten Informationen an einen Remote-Server. Ykcol Locky rückwärts geschrieben erreicht 60 Millionen E-Mails pro Tag Der Locky-Angriff, der am 18. September begonnen hat, verwendete die neue .ykcol-Variante. Die Security-Cloud von Cyren erfasste an jenem Tag über 60 Millionen Spam-E- Mails, die diese neue Variante mit dem Betreff Rechnungsstatus und einen a.zip- bzw. .7-Anhang übermittelten, der ein Visual Basic Script mit dem Downloader enthielt. Abbildung 5 Malware-Muster- E-Mail Ykcol Die VBS-Datei lädt die ausführbare Binärdatei Locky herunter und führt sie aus. Locky verschlüsselt dann die Dateien auf dem Rechner des Benutzers. Abbildung 6 Die VBS lädt Locky von jedem beliebigen dieser Links herunter. Abbildung 7 Ykcol-Lösegeldforderung Geotargeting-Malware mit detectCountry Ländererkennung Ende September haben wir eine neue Version der VBS-Datei gesehen, die Locky übermittelt. Die neue VBS-Datei wurde genau wie die anderen als komprimierter E-Mail- Anhang übermittelt, enthielt aber einige zusätzliche URLs und ein paar Funktionen, die wir zuvor noch nicht gesehen hatten. Die Funktion detectCountry prüft, wo sich der Standort des Opfers befindet. Abbildung 8  Funktion detectCountry prüft, wo sich der Standort des Opfers befindet Falls sich das Opfer in Großbritannien, Australien, Luxemburg, Belgien oder Irland befindet, unternimmt das Script den Versuch, TrickBot den Banking-Trojaner herunterzuladen  wahrscheinlich weil TrickBot Kunden bestimmter Banken in diesen Ländern anvisiert. Falls sich das Opfer in anderen als den in der Aufzählung aufgelisteten Ländern befindet, lädt das Script die .ykcol-Variante von Locky herunter. Abbildung 9  Das Script prüft, ob das Opfer Locky oder TrickBot erhalten sollte Ransom-Forderung wird verdreifacht Um das Entschlüsselungstool herunterzuladen, muss das Opfer auf das TOR-Netzwerk zugreifen und sich auf die spezifische Onion-Site begeben, die in der Lösegeldforderung genannt ist. Dort muss das Opfer 0,5 BTC zahlen ca. 1800 USD, um das Tool zu erhalten. Dies ist bedeutend höher als die Lösegeldforderungen im Jahre 2016, welche in der Regel unter 500 USD lagen. Abbildung 10 Locky Entschlüsselungs-Site im TOR-Netzwerk Locky Lukitus erzielt hohes Volumen und kommt in Varianten vor Abbildung 11 Beispiel für Bitte drucken-E- Mail Am 28. August entdeckte die Security Cloud von Cyren über 130 Millionen schädlicher Anhänge in E-Mails mit angehängten VBS-Dateien, die die Locky-Nutzlast herunterladen. Unter diesen befanden sich über 15.000 einzigartige Versionen der VBS-Datei. Beim Ausführen der .vbs-Datei wird eine binäres ausführbare Datei heruntergeladen, die Dateien auf dem Rechner verschlüsselt und die neue Erweiterung .lukitus hinzufügt. Lukitus HTML-Anhang Eine weitere Methode, auf die wir gestoßen sind, war eine .html-Datei, die als Anhang gesendet wurde. Die .html-Datei hat einen iFrame, der eine .php-Webseite öffnet, welche eine andere .php enthält. Diese lädt eine JavaScript-Datei herunter. Das JavaScript lädt dann die binäre ausführbare Datei herunter die Locky- Binärdatei, und führt sie aus. Abbildung 12  Malware-E- Mail mit .html-Datei als Anhang Abbildung 13 Der schädliche Fluss des .html, der als Anhang übermittelt wird Cyren konnte zahlreiche E-Mails entdecken, die Locky verteilen, wobei die Domain der E-Mail verschleiert oder gefälscht ist. Gefälschte E-Mails von Dropbox und anderen großen Unternehmen, bei denen das Opfer die korrekte E-Mail- Adresse des Absenders sieht. Abbildung 14  Gefälschte Dropbox-E- Mail übermittelt Locky Muster, die für diese Analyse verwendet werden SHA-256 Locky asasin VBS 7eb4dbd104f209637258c33e18c4f458d89fb45919e566a210c79da30469d780 Locky lukitus VBS 18005919554cb9d907341b1c2052a75392e94cdb416faded4f0b67ef757526a1 EXE 3315a2d5e721d5651480de71849f677a1a8ee2d4c2d7118053f02c71fb580b23 Locky Ykcol VBS ad9ce3b94ca0b1217dd9e9a5a6439d66afab15372b183eb6f399137c12654792 EXE 3ebb3c50ea81e6897f130cd5582981ca6ee0a5432ebfe85fa522dc25fc462aaf Cyren entdeckt die Muster als VBSDownldr.HM Locky lukitus W32Locky.OC Locky Ykcol W32Locky.BX.gen!Eldorado Um in Sachen Ransomware auf den neuesten Stand zu kommen, besuchen Sie unsere Ransomware-Ressourcen- Seite und lesen Sie Cyrens fundierten, kostenlosen Sonderbericht zu Bedrohungen durch Rnsomware and Malware . Try it for Free Instant Data Classification Cyren URL Category Chacker Prev Bad Rabbit Ransomware is Rebuilt NotPetya Locky Revived  A Roundup of New Variants Next Company Partners Resources Investor Relations Products Freeware Demo Solutions Contact Us Privacy Management Service by Data443

Output: threat_prevention,technical_documentation


Input: Search Free Trial Get Demo Day December 8, 2022 Using NLP techniques to protect against BEC attacks December 8, 2022 How Natural Language Programming help combat phishing and BEC attacks by John Stevenson Business Email Compromise BEC Business Email Compromise BEC covers a range of email attacks that typically share a common core attribute. There is no obvious executable component, such as a URL or file attachment in the message Company Partners Resources Investor Relations Products Freeware Demo Solutions Contact Us Privacy Management Service by Data443

Output: product_security_features,end_user_security,security_best_practices


Input: Search Free Trial Get Demo Day January 12, 2018 Introduction  Security Best Practices for External Sharing on Content Collaboration Platforms January 12, 2018 Content Collaboration Platforms CCPs like Box, Citrix ShareFile, Dropbox, Egynte, Google Drive, and Microsoft OneDrive have come along way since the early 2010s when the two original innovators, Dropbox and Box, were just cloud storage with some nifty partial syncing. Today, they have taken center stage and are now considered Company Partners Resources Investor Relations Products Freeware Demo Solutions Contact Us Privacy Management Service by Data443

Output: security_best_practices,end_user_security


Input: Search Free Trial Get Demo Day February 1, 2018 Cryptocurrency phishing attack nets over 1 million in a few hours February 1, 2018 With tremendous money to be made in a short period of time, phishing has become commonplace within the cryptocurrency exchange world, particularly at the moment when a new currency comes along and debuts with its initial coin offering ICO, an event not unlike an initial public offering with corporate stock. Chris Perram on the Intralinks blog  Embracing Change A Companys Evolution From IG to AI February 1, 2018 Chris Perram on the Intralinks blog  Embracing Change A Companys Evolution From IG to AI Chris Perram, Information Governance IG specialist, is the founder of FileFacets, a SaaS platform that leverages Artificial Intelligence AI. Here Chris describes the market forces that drove the evolution of this technology shift.Read the Final day to vote! February 1, 2018 PROUD TO BE ANNOUNCED AS FINALISTS! HTTPSCYBERSECURITY-EXCELLENCE-AWARDS.COMCANDIDATESCLASSIDOCS-2 HTTPSCYBERSECURITY-EXCELLENCE-AWARDS.COMCANDIDATESCLASSIDOCS-3 HTTPSCYBERSECURITY-EXCELLENCE-AWARDS.COMCANDIDATESCLASSIDOCS-GDPRENGINE Company Partners Resources Investor Relations Products Freeware Demo Solutions Contact Us Privacy Management Service by Data443

Output: threat_prevention,compliance_certifications


Input: Search Free Trial Get Demo Day November 9, 2017 Stealing Tax Refunds Soaring Worldwide November 9, 2017 There appear to be only two things that are certain in life death and cybercriminals trying to steal your tax refund. As governments have moved tax systems online to facilitate life for the taxpayer, refund scams using phishing and social engineering to obtain personal financial information have become epidemic, with Company Partners Resources Investor Relations Products Freeware Demo Solutions Contact Us Privacy Management Service by Data443

Output: end_user_security,data_protection,threat_prevention


Input: Search Free Trial Get Demo Chris Perram on the Intralinks blog  Embracing Change A Companys Evolution From IG to AI February 1, 2018 Chris Perram on the Intralinks blog  Embracing Change A Companys Evolution From IG to AI Chris Perram, Information Governance IG specialist, is the founder of FileFacets, a SaaS platform that leverages Artificial Intelligence AI. Here Chris describes the market forces that drove the evolution of this technology shift. Read the Entire Post Try it for Free Instant Data Classification Cyren URL Category Chacker Prev Final day to vote! DropBox  Security Best Practices for External Sharing on Content Collaboration Platforms Next Company Partners Resources Investor Relations Products Freeware Demo Solutions Contact Us Privacy Management Service by Data443

Output: security_best_practices


Input: Search Free Trial Get Demo Analyzing message metadata to protect against BEC attacks November 17, 2022 Can analyzing message metadata help to protect organizations from becoming the victim of a successful BEC attack? Business Email Compromise BEC is an umbrella term spanning many forms of social engineering email attacks that typically share the common characteristic that there is no obvious payload, i.e., suspicious URL or malware-infected attachment. Instead, they rely on the techniques of trickery and impersonation to succeed. BEC attacks can be carefully crafted to evade traditional security defenses including Secure Email Gateways SEGs and Microsoft Office 365s native security controls. While they generally represent a relatively small percentage of the phishing problem by volume, they can represent a relatively large percentage by cost in terms of damage done. This year the Federal Bureau of Investigation FBI concluded that the global cost to business of BEC attacks over the last 5 years or so was an eye-watering 43 billion dollars. Stop BEC attacks in the inbox In our last blog, we looked at how a modern email security solution can help to combat BEC attacks by working in the inbox and using a combination of advanced analytics, Artificial Intelligence AIMachine Learning ML, and Natural Language Processing NLP techniques. Why in the inbox? Because vigilance in the inbox is the most effective way to combat evasive threats like BEC attacks that have evaded detection at the boundary andor by Microsoft security controls. In this session, we will zoom in on one of those techniques and look at some of the quickest and simplest mechanisms for identifying the possibility of a BEC attack. Indicators and anomalies in message metadata. Check metadata for indicators of a BEC attack Domain-based Message Authentication, Reporting, and Conformance DMARC helps to protect email senders and recipients from spam, spoofing, and phishing. Working in the inbox, an effective email security solution will use the results of DMARC policy checks performed by Microsoft Office 365 and contained in the message header. These can contain potential indicators that might suggest that the message is malicious. Another important check is for mismatches in the message metadata. Messages where the display name on the message appears to be internal and FROM address is external, or where the FROM address is internal and the REPLY-TO address is external, provide good indicators that all is not well. Crowd-sourced threat intelligence Overall, the solution should also take advantage of crowd-sourced threat intelligence feeds to identify IP addresses andor hostnames in message headers that might indicate a BEC attack. For example, Cyrens GlobalView is a world-leading threat intelligence service protecting 1 billion users across 195 countries with 575,000 collection points POPS around the globe. Leveraging up-to-the-minute intelligence from feeds such as GlobalView and other threat intelligence feeds is essential to the process of identifying indicators of an attack. Stop BEC attacks Good detection techniques are the backbone of an effective defense against BEC attacks but on their own, theyre not enough. Usually, an attack involves several key people in the organization receiving identical or similar messages over a short period of time. An effective modern email security solution, working in the inbox needs to be able to identify all the malicious messages with this shared DNA and remediate them all automatically, in a single action, to ensure good inbox hygiene is maintained. However, detection lies at the heart of combating BEC attacks and while the mechanisms employed by defenses are normally hidden under the hood, understanding the processes at work gives an insight into how an effective email security technology helps protect customers. In the next blog in this series, well look at another aspect of effective BEC detection. Using Natural Language Processing techniques NLP to parse message content for key indicators. About Cyren Inbox Security Cyren Inbox Security CIS is a modern Integrated Cloud Email Security SaaS solution that augments native Microsoft and traditional secure email gateway defenses. CIS utilizes AIMLNLP capabilities with behavioral analytics, and up-to-the-minute cyber threat intelligence, to automatically protect against, and manage the remediation of email threats that have successfully evaded all other defenses to reach the users M365 inbox. Try it for Free Instant Data Classification Cyren URL Category Chacker Prev Using AI to protect against BEC attacks Abusing Remote Administration Tools Next Company Partners Resources Investor Relations Products Freeware Demo Solutions Contact Us Privacy Management Service by Data443

Output: product_security_features,end_user_security,security_best_practices,threat_prevention


Input: Search Free Trial Get Demo Day January 27, 2018 Blockchain  More than coin January 27, 2018 I read an interesting article today about some of the activities occurring at Davos this week. Robert Shiller made some interesting comments    however mostly centered around bitcoin itself. For sure  it has been a bumpy ride  and outside of hype and other reasons for the sudden Company Partners Resources Investor Relations Products Freeware Demo Solutions Contact Us Privacy Management Service by Data443

Output: privacy_policy


Input: Search Free Trial Get Demo Day December 21, 2017 Facebook Users Hit With Coinminer Malware December 21, 2017 The value of Bitcoin virtual currency just hit a new all-time high, and with it an increasing number of malware threats are targeting users to borrow their PCs CPU for use in mining the precious cryptocurrency, something we last wrote about in October here. Once executed, a significant spike in Company Partners Resources Investor Relations Products Freeware Demo Solutions Contact Us Privacy Management Service by Data443

Output: end_user_security,threat_prevention,incident_response


Input: Search Free Trial Get Demo Box  Security Best Practices for External Sharing on Content Collaboration Platforms January 18, 2018 The Security Best Practices for External Sharing on Content Collaboration Platforms blog series examines the state of security for external sharing on the leading Content Collaboration Platforms CCP. Each week well review a different platform and make security best practice recommendations. Background Box is a California-based public company that was founded in 2005 by Aaron Levie while a student at the University of Southern California. Unlike some of its competitors, most notably Dropbox, Box began life focused on the enterprise, with the result that many of its security controls are built around the concept of a Box administrator. Boxs stated goal is to be the central repository for all enterprise content. As of early 2018, Box has more than 41 million users, across 80,000 businesses, including approximately 60 of the Fortune 500. External Sharing Security Issues Like most growing cloud companies, Box has had a few security issues. One of the more troubling ones was in early 2017 when a researcher discovered a vulnerability connected to Boxs Shared Links feature. This feature generates a URL each time an external user is invited by a managed user to collaborate. The URL can be used by anyone to access the shared file or folder. In some cases it was found that these URLs were indexed by Google and other search engines. By default the links were generated with editor-level permission granting the ability to view, download, upload, edit and rename the shared files. Blue Chip companies like Dell and Ford were found to have files exposed. The issue was quickly addressed by Box but this vulnerability underscores how collaborating beyond the walled garden of your enterprise CCP can be risky. Resolving this vulnerability will continue to be a challenge since enterprises will never have the same level of control over external users as they do over their own managed users. Four External Sharing and Collaboration Security Best Practices 1  Know your user types  Our first recommendation, identify your user base and make sure that users are appropriately categorized. In general, high-frequency, deeply collaborative partners should be managed users since they require more control and oversight, while ephemeral users at partners can be external users, but dont forget to set time outs on shared files. Train your users to migrate completely to the better security of managed users if they deem it necessary. Converting 90 of a team to multi-factor authentication, but leaving one as a recipient of an open link, is a common way to degrade your security. 2  Use collaborator settings wisely A collaborator is an individual who has been invited into a folder. External collaborators are individuals who have a Box account but are not under the control of your enterprise Box administrator. While your Box administrator does not have direct control over these types of users there are certain security practices that should be followed. These include controlling a collaborators access level. Not every collaborator should have full editing permission, many times view-only is more than sufficient. Another best practice is to set a default expiration date for all external collaboration. This way your enterprise can be assured that these relationships are finite and not left open-ended. Finally, its a good idea to make Restrict external collaboration the default for all your new managed users see below. This setting forces your users to think about who they should be collaborating with and to seek permission from their Box administrator before this type of sharing can be enabled. 3  Turn off or limit the Shared Links Feature Shared Links as mentioned earlier allow a user to quickly share content with individuals  both inside and outside of the enterprise. The external user does not need to have a Box account and Box does not keep a record of where these links are sent. As such Shared Links are probably the feature most open to abuse when it comes to external collaboration. As with Collaborators there are a range of steps your Box administrator can take to protect your enterprises content. These steps include enabling view-only access, adding a password andor an expiration date. The most effective step, however is to consider restricting sharing completely. We have learned that once a large number of shared links are in the wild it is hard to pull back the dangerous ones and keep open the good ones, since reporting is so limited. This and other settings are available in the Content  Sharing tab of the Box Admin Console see below. 4  Consider managing the identities of your external users. The Collaborative User approach is a very convenient and free option, but the security is left up to the recipient of the data, because it is their Box account not yours, and that does not always sit well with truly strict security organizations who want complete control of the security policies for their files. Also, some corporations prefer not to buy managed user licenses for non-employees. Resilient Access for Box was built to satisfy this need. Resilient provisions users for the sending entity which allows the sender to maintain full control over who and how each external user sees their data. All of the functionality of the Box experience is maintained for the recipient, but now the security and reporting requirements are easy to customize to meet strict as good as internal policies. See the short two minute video below for more detail on how Resilient can extend an enterprises security control to external users. Play video Other posts in the Security Best Practices for External Sharing blogseries Introduction Box  Security Best Practices Try it for Free Instant Data Classification Cyren URL Category Chacker Prev Introduction  Security Best Practices for External Sharing on Content Collaboration Platforms Blockchain  More than coin Next Company Partners Resources Investor Relations Products Freeware Demo Solutions Contact Us Privacy Management Service by Data443

Output: security_best_practices,data_protection,access_management,product_security_features,threat_prevention


Input: Search Free Trial Get Demo Day November 17, 2022 Analyzing message metadata to protect against BEC attacks November 17, 2022 Can analyzing message metadata help to protect organizations from becoming the victim of a successful BEC attack? Business Email Compromise BEC is an umbrella term spanning many forms of social engineering email attacks that typically share the common characteristic that there is no obvious payload, i.e., suspicious URL or malware-infected Company Partners Resources Investor Relations Products Freeware Demo Solutions Contact Us Privacy Management Service by Data443

Output: threat_prevention,security_best_practices,product_security_features


Input: Search Free Trial Get Demo Day March 2, 2018 Crazy numbers. March 2, 2018 I guess I am shocked at the numbers  but shouldnt be. Based on the conversations we have all week with EU based companies  many many are not ready for sure..  Company Partners Resources Investor Relations Products Freeware Demo Solutions Contact Us Privacy Management Service by Data443

Output: data_protection,privacy_policy


Input: Search Free Trial Get Demo Day December 1, 2022 Phishing with QR codes December 1, 2022 Dont Scan or be Scammed By Maharlito Aquino, Kervin Alintanahin and Dexter To In 1994, a type of the matrix barcode known as the Quick Response code, now widely known as QR code, was invented by Masahiro Hara from a Japanese company Denso Wave. The purpose of the barcode was Company Partners Resources Investor Relations Products Freeware Demo Solutions Contact Us Privacy Management Service by Data443

Output: end_user_security,security_best_practices,threat_prevention


Input: Search Free Trial Get Demo DropBox  Security Best Practices for External Sharing on Content Collaboration Platforms February 2, 2018 The Security Best Practices for External Sharing on Content Collaboration Platforms blog series examines the state of security for external sharing on the leading Content Collaboration Platforms CCP. Each week well review a different platform and make security best practice recommendations. Background Dropbox was founded in 2007 by MIT student Drew Houston, because as the story goes, he had become frustrated with his USB stick storage solution. He created a simple online service that allowed consumers to store all their files while syncing them to their computers and smartphones. Today, Dropbox has over half a billion global users with 1.2 billion files uploaded everyday. Although Dropbox began life as a consumer platform it has gradually shifted its focus to the enterprise. In 2013 it launched Dropbox Business and now has over 150,000 paying enterprise customers, that represent two-thirds of its billion dollar annual revenue. Dropbox has also recently launched DropBox Paper a collaboration service that allows its customers to create documents and projects. Its believed that Dropbox will continue adding features to Paper so that it can compete more effectively with Microsoft Office and Google G Suite. Dropbox is planning on going public in 2018 as a 10X Unicorn or higher. Dropboxs heritage as a consumer service has both helped and hindered it in the brutally competitive world of enterprise Content Collaboration Platforms CCP. On the positive side Dropbox has always garnered high praise for its simple and intuitive UI. Its widespread adoption by consumers has also assisted it in penetrating the enterprise market. More negatively it has had to play catch-up with more enterprise-focused companies like Box because the original Dropbox solution was not architected around the concept of an all-controlling administrator. External Sharing Security Issues As noted above DropBox has struggled with the perception that it was not originally intended for the enterprise. It certainly has had its fair share of security issues. In August 2016 Dropbox was forced to reset its members passwords because it was discovered that in 2012 over 68 million account passwords had been hacked. Many questioned why it took four years for Dropbox to take action. In another high-profile story former NSA contractor turned whistleblower, Edward Snowden, very publicly singled Dropbox out for criticism, saying that it was hostile to privacy and told users to get rid of it because of its readiness to turn over files to law enforcement. Finally, like other CCPs, Dropbox had the unprotected shared link inadvertently indexed on Google problem which led to exposed documents. These vulnerabilities underscore how collaborating particularly beyond the walled garden of your enterprise CCP can be risky. Mitigating this risk will continue to be a challenge since enterprises will never have the same level of control over external users as they do over their own users. Four External Sharing and Collaboration Security Best Practices for Dropbox 1  Structure your Team Folders and Groups carefully Our first security recommendation is to spend time structuring your team folders since they offer a more secure and controlled way for your organization to collaborate. Note team folders are different from regular shared folders because they are created by your admin and they automatically appear in a members Dropbox. These folders are accessed by groups. Groups are created and managed by admins and include lists of members who need access to the same information. Group members are automatically added to all team folders that the group has been invited into. Note groups can be created and managed either by admins or users. We recommend that groups be managed by admins so that you can keep a tight lid on who joins and leaves each group. The other key ability of a group admin is the ability to assign one of two roles editor or view-only to each member of a group. Since only editors can share content with collaborators outside of your group you should be highly selective as to who becomes an editor. All the team folder and groups settings can be accessed in the Admin Console see below. 2  Understand your sharing options Shared files and links are the Dropbox solution to email attachments. The main difference between them is that only people you invite to a shared file can view the file, while anyone with a link can view your files, no Dropbox account required. Because of this shared links should never be used for sensitive files since they only have security by obscurity and in todays breach-prone world, one can never bet on maintaining obscurity for the long haul. We recommend the shared file approach because it has easy-to-use security tools available, including permission levels dont make everyone an editor if you dont need to, passwords and expiration options, but tools only work if you train your users to use them. For the most part we recommend that admins are conservative with their security options. Its best to force users to seek permission to share externally rather than make it the default. All the shared files and sharing links settings can be accessed in the Admin Console see below. 3  Monitor the sharing activity of your members Dropbox has spent considerable resources improving their admin reporting capability with the result that their Activity area now offers very flexible and comprehensive reports. It is good practice to regularly monitor the sharing activities of your members. You can generate reports of activity across your Business account for a specific period by clicking Activity from within the Admin Console See below. Dropbox currently has 149 sharing-focused reports. Reports such as Added non-team members to a shared folder or Downloaded a filefolder from a link non-team member are a good place to start when monitoring external sharing. 4  Consider managing the identities of your external users Shared links and folders are convenient ways for external collaboration but unfortunately the security is ultimately left up to the recipient of the data, since they control their Dropbox account not you. For many organizations with sensitive data this situation is unacceptable. This leaves them with two options Provide their outside user with one of their own corporate Dropbox accounts so that they can impose their enterprise security policies on the external user. This however, for many organizations, is not all that appealing for both cost and security reasons. A better option is for your organization to manage the identities of your external users itself. Resilient Access was built to accomplish this. By provisioning all external users Resilient is able to maintain full control over who and how each external user sees your data. Also with this approach your organization has complete flexibility to go beyond Dropboxs own native security and add any type of MFA or other security measures. You can schedule a demo here to learn more about how we extend an enterprises security control to external users. Try it for Free Instant Data Classification Cyren URL Category Chacker Prev Chris Perram on the Intralinks blog  Embracing Change A Companys Evolution From IG to AI Great Analysis on Ripple Next Company Partners Resources Investor Relations Products Freeware Demo Solutions Contact Us Privacy Management Service by Data443

Output: product_security_features,security_best_practices,data_protection,access_management


Input: Search Free Trial Get Demo Business Email Compromise Imposter Attacks Are Not Going Away January 22, 2018 Business email compromise BEC attacks have been increasing in number over the last few years, driven by their relative success rate compared to other financially motivated attacks. They appear to be quite simple  the attacker sends an email to the intended victim, usually a member of the finance team, and requests that they transfer money to an account controlled by the attacker. But why would the victim do so? Well, the attacker has actually invested a fair amount of time and effort into crafting the attack. He uses various social engineering tactics to generate a sense of urgency. He has researched the target organisation, understands the chain of command and the email will appear to have been sent from a member of the leadership team, often the CEO, hence the alternative names for this type of attack  CEO fraud or imposter emails. Imposter emails reap major returns for cyber criminals In its last report, published in 2017, the FBI Internet Complaint Center, a body that companies report attacks to, named BEC as one of four Hot Topics. In the 3 years between Oct 2013 and Dec 2016, total losses reported by victims was 2.2bn. Compare this with total losses of almost 800m reported in just the last 7 months of 2016. We expect this upwards trend to continue when the next report is published. The 2017 Verizon Data Breach Investigations Report also calls out BEC as a major threat. In one reported incident, Leoni AG, the worlds 4 th largest manufacturer of wire and electrical cables, lost 40m. Detection of imposter emails has been a major challenge for email security providers The success of these attacks is based on the simplicity of the email that is sent. It will contain no malware, no attachment and no links, all of which are the traditional signs of an email that represents a threat of some kind. Imposter email attacks are typically low volume and targeted, rendering most defences that rely on traditional detection methods useless. The attacker ensures maximum success by hand-crafting each email to appeal to the target recipient and ensure maximum chance of success. Combine all of these characteristics and you have an email threat unlike any other, making imposter emails very difficult to detect. Recognising imposter emails is a major challenge for users If your email security infrastructure is not going to detect and block the attack, what can you do? Clearly, it is not malware, so your last line of defence technology, your endpoint protection, will not detect it. That leaves the unsuspecting recipient in the finance team. He has just received an email from the CEO telling him to send money to a business partner, so that they can deliver an urgently needed service or a product, and it needs doing NOW. How much time should this recipient spend trying to decide whether the email is a threat or not? How much training is enough? And how much reliance can an organisation realistically place on non-technical users? Some imposter emails use techniques that are easier for the recipient to recognise than others. Emails contain various fields that are displayed and can be spoofed, such as from name, reply to name or sender address. Some simple attacks will purport to have been sent from the CEO but the email address is an external one not related to the company. These can be easily spotted by checking that the actual sender email address matches the CEOs email address, rather than relying on the from field. More difficult to spot are lookalike domains. These attacks require a bit more effort from the attacker, who registers an email domain that reads like the target companys. It might be the same, except for a character being replaced, dropped or added. The CEOs name is then used to create a legitimate email address on this domain. The result is that all fields are valid and the senders name and email address match, but on closer inspection, they belong to a domain that just resembles the recipients companys own. Solve the problem and keep users productive All recommendations around information security start by suggesting a defence-in-depth strategy and protecting from imposter email threats is no different. You need to look at technology and non-technology based defences. Training users is essential, but do not rely on this practice alone, as it will have an impact on user productivity, as they spend time trying to understand whether an email contains a threat . Imagine a situation where a user has to process all their spam messages themselves. This is considered unacceptable by most organisations and users. As with spam, you need to adopt the best technology based solutions to prevent these emails reaching your users. Standards-based approaches such as Sender Policy Framework can help but have shortcomings and are not widely adopted. What is needed is an imposter detection capability that is fully integrated with existing email security. It should examine all of the email fields that might point to spoofing, the subject and body text to look for the tell-tale signs of social engineering, the senders email domain to determine whether there might be a close match with the companys own, signs that an external email is trying to look like an internal one and many others. It should also allow for input of a list of those users whose addresses an attacker might try and spoof. When the results of all of these tests are correlated, this imposter detection capability should determine the likelihood that an attack is underway and quarantine or tag emails as appropriate, based on this likelihood. Want to learn more about cloud-based email security . Contact us here . Try it for Free Instant Data Classification Cyren URL Category Chacker Prev Facebook Users Hit With Coinminer Malware Business E-Mail Compromise-Angriffe Imposter durch Betrüger lassen nicht nach Next Company Partners Resources Investor Relations Products Freeware Demo Solutions Contact Us Privacy Management Service by Data443

Output: product_security_features,end_user_security,security_best_practices,data_protection,threat_prevention


Input: Search Free Trial Get Demo Day February 21, 2018 GDPR Power to the People or What You Must Know about Data Subject Rights February 21, 2018 GDPR Power to the People or What You Must Know about Data Subject Rights As the May 25 date for GDPR General Data Protection Regulation implementation zooms closer, now is the time to review and understand your organizations responsibilities regarding the rights of data subjects also known as every person. Company Partners Resources Investor Relations Products Freeware Demo Solutions Contact Us Privacy Management Service by Data443

Output: compliance_certifications,data_protection,privacy_policy


Input: Search Free Trial Get Demo Day February 6, 2018 M-Files Partners with FileFacets to Unlock Information in Key Business Systems February 6, 2018 M-Files Partners with FileFacets to Unlock Information in Key Business Systems DALLAS AND OTTAWA, February 6, 2018 M-Files Corporation, the intelligent information management company, today announced a partnership with FileFacets, a data discovery and enterprise analytics company that also develops data connectivity and migration technology.Read the full press release Financial Relationships  why they matter February 6, 2018 Today we announced our banking relationship with Silicon Valley Bank   This is an important step in both the maturation and capabilities of Data443. SVB provides fantastic and personalize relationship management that is so important for tech companies. As we grow  our needs for services worldwide for everything from Company Partners Resources Investor Relations Products Freeware Demo Solutions Contact Us Privacy Management Service by Data443

Output: data_protection,privacy_policy