You have to be very on-trend as a cybercrook – hence why coronavirus-themed phishing is this year's must-have look
(2020/09/17)
- Reference: 1600331411
- News link: https://www.theregister.co.uk/2020/09/17/f_secure_h1_2020_cybersecurity_report/
- Source link:
Coronavirus-themed malicious emails were the standout feature of online naughtiness in the first half of 2020, according to infosec firm F-Secure – though overall volumes of phishing did decrease a touch.
"Cyber criminals don't have many operational constraints, so they can quickly respond to breaking events and incorporate them into their campaigns," said Calvin Gan, a manager with F-Secure's Tactical Defense Unit, in a canned statement. "The earliest days of the COVID-19 outbreak left a lot of people confused or worried, and attackers predictably tried to prey on their anxieties."
Spam and other email-dependent lures mostly switched to using coronavirus-themed messaging in the first half of 2020, with finance being the most frequently spoofed industry in phishing emails seen by the Finnish company.
Observed attack attempts included an Emotet banking trojan campaign targeting Japan in January after the nation confirmed its first coronavirus infection. The email spreading it purported to be an official warning from a public health body.
Email accounted for just over half of observed infection attempts in the first six months of the year, up from 43 per cent last year. Exploit kit usage was virtually level year-on-year at 10 per cent in H1 2020 versus 9 per cent in H1 2019.
"We also saw atypical archive and compression file types, such as .gz and .ace, being used to get around mail gateways configured to detect malware executables enclosed in more conventional formats like .zip," said F-Secure in its full Attack Landscape H1 2020 report. The company added that its honeypots experienced 2.8 billion attack attempts between January and June, compared with 2.9 billion over the same period in 2019.
Diving down the stack, telnet and SSH were the two most frequently scanned ports that F-Secure had seen, while infostealers were the most common type of malware, with [1]the Lokibot banking trojan being the most popular malware family.
Intriguingly, the company also noted a spike in fake cloud email notifications targeting Office 365 users during April. "Notifications from cloud services are normal and employees are accustomed to trusting them. Attackers taking advantage of that trust to compromise targets is perhaps the biggest challenge companies need to address when migrating to the cloud," said Teemu Myllykangas, F-Secure director of B2B product management, in a statement.
F-Secure called for the entire IT industry to "work toward reducing the success rate of email as an attack vector, not only through technology enhancement, but also by companies evolving their cyber security strategies".
While it is true that most compromises nowadays come through basic attack vectors – typically, someone opening an email attachment that they shouldn't have – calling for the entire industry to fix a problem as old as email itself seems a little bold.
No harm in trying, though. ®
Get our [2]Tech Resources
[1] https://www.theregister.com/2017/06/27/ransomware_outbreak_hits_ukraine/
[2] https://whitepapers.theregister.com/
"Cyber criminals don't have many operational constraints, so they can quickly respond to breaking events and incorporate them into their campaigns," said Calvin Gan, a manager with F-Secure's Tactical Defense Unit, in a canned statement. "The earliest days of the COVID-19 outbreak left a lot of people confused or worried, and attackers predictably tried to prey on their anxieties."
Spam and other email-dependent lures mostly switched to using coronavirus-themed messaging in the first half of 2020, with finance being the most frequently spoofed industry in phishing emails seen by the Finnish company.
Observed attack attempts included an Emotet banking trojan campaign targeting Japan in January after the nation confirmed its first coronavirus infection. The email spreading it purported to be an official warning from a public health body.
Email accounted for just over half of observed infection attempts in the first six months of the year, up from 43 per cent last year. Exploit kit usage was virtually level year-on-year at 10 per cent in H1 2020 versus 9 per cent in H1 2019.
"We also saw atypical archive and compression file types, such as .gz and .ace, being used to get around mail gateways configured to detect malware executables enclosed in more conventional formats like .zip," said F-Secure in its full Attack Landscape H1 2020 report. The company added that its honeypots experienced 2.8 billion attack attempts between January and June, compared with 2.9 billion over the same period in 2019.
Diving down the stack, telnet and SSH were the two most frequently scanned ports that F-Secure had seen, while infostealers were the most common type of malware, with [1]the Lokibot banking trojan being the most popular malware family.
Intriguingly, the company also noted a spike in fake cloud email notifications targeting Office 365 users during April. "Notifications from cloud services are normal and employees are accustomed to trusting them. Attackers taking advantage of that trust to compromise targets is perhaps the biggest challenge companies need to address when migrating to the cloud," said Teemu Myllykangas, F-Secure director of B2B product management, in a statement.
F-Secure called for the entire IT industry to "work toward reducing the success rate of email as an attack vector, not only through technology enhancement, but also by companies evolving their cyber security strategies".
While it is true that most compromises nowadays come through basic attack vectors – typically, someone opening an email attachment that they shouldn't have – calling for the entire industry to fix a problem as old as email itself seems a little bold.
No harm in trying, though. ®
Get our [2]Tech Resources
[1] https://www.theregister.com/2017/06/27/ransomware_outbreak_hits_ukraine/
[2] https://whitepapers.theregister.com/
Re: An eight point plan
UCAP
The problem with point [2] is that very few people would know a fraudulent e-mail header if it leaped up and hit them on the head with a cluebat. That's the sort of knowledge that oldies lie myself (who have been using e-mail since the early days) have, but most youngsters sadly lack.
The problem with point [8] is that, in my experience, you can talk to executives until you are blue in the face, but all you are going to get is a glazed look. Of course they all get very interested when they have screwed up, the s**t has hit the fan and the bottom line is taking a hit, although most of their interest is limited to finding someone (anyone) else who can plausibly be blamed. There are a few exceptions to this rule, but they are far and few between.
An eight point plan
In no particular order:
[1] don't open an attachment of, or follow a link in, an email you're not expecting;
[2] verify email validity by inspecting the transport headers (ideally using automation)
[3] in corporate systems, remove and quarantine attachments to emails from outside the enterprise;
[4] either strip link anchors from email bodies at the gateway or expose them to view in the body;
[5] employ a mail filtering service either locally at the gateway or in the cloud;
[6] ditto for web requests;
[7] never rely on workstation-based protection alone against malware;
[8] educate everyone including the Executive in safe email usage.