ALERT:  HTML Attachments

In the past, spam filters have been able to catch most of the malicious emails, based on the types of attachments they were sending (and trying to trick people into opening the attachments, which then downloads malicious files onto your device).  Most of the malicious attachments used in the past were “.DOC” or “.JS” files, used mainly for ransomware attacks.

Now, CyberCriminals are trying to trick spam filters into letting their malicious emails through, by sending .HTML attachments, also knows as “attackments”.

CyberCriminals are using these attackments for credentials “phishing” for a few reasons.  Namely:

1. Reduced chance of anti-virus detection:  Carefully crafted .HTML files can reduce the chances that phishing emails with these attachments will be stopped by email security software or devices.  .HTML files are not commonly associated with email-borne attacks (at least, not until recently).  .HTML files can be used to embed redirects that can evade antivirus scanners that check only URLs that appear in the bodies of emails.  .HTML files can also be used to deliver obscure web pages that might slip past scanners that do check .HTML attachments.
2. Users are familiar with these attachments, and usually don’t see them as harmful.  Users and employees may be familiar with .HTML attachments, as they are often used by banks and other financial institutions to send secure information and documents.  If your company routinely interacts with financial institutions, your employees may view .HTML attachments as simply routine and non-threatening.

Unfortunately, CyberCriminals have recently taken to using .HTML attachments to spoof bank login pages, popular online services, and secure messages from financial institutions (financial institutions often use “.HTML” attachments to send secure messages).

Your spam filters may miss these based on the “.HTML” file.

If you receive an email with an .HTML attachment, be wary!  

Do not open it unless you know 100% that it is legitimate, have requested the link to be sent, or have verified with the sender that the attachment is legitimate.

 

You can’t stop CyberCriminals from targeting your company or employees.

But you can be prepared for their arrival, and have full shields up.

Got CyberBugs?

Call 1-204-800-3166

For Cyber-Extermination!

#itthatworks

ALERT:  New Ransomware Also Steals Your Bitcoins

 

With the rash of new ransomware strains out there, you knew they were going to up the ante somehow…

 

CryptXXX is built by the same CyberCriminals that are behind the Revelton malware.  It is an attempt to one-up the release of the Locky ransomware by their CyberCriminal Competitors.

CryptXXX currently spreads through the Angler Exploit Kit which infects the PC with the Bedep Trojan, which drops information theft software on the PC, then adds professional-grad encryption adding a “.crypt” extension to the filenames.  

This ransomware encrypts files locally, and on all mounted drives, and demands $500 Bitcoin/PC to unlock the encrypted files.  However, they continue to add insult to injury by also stealing Bitcoins, as well as a large range of data.

CryptXXX tried to avoid detection through “random delayed” execution (which attempts to easily connect the infection to the delivery vector), anti-Virtual Machine, and anti-analysis functions (eg. checking CPU names in the registry, monitoring for mouse events).

The CyberCriminals behind this ransomware is highly skilled and experienced, which means this is professional-grade ransomware.  Proofpoint researchers report “Those [ransomware infections] associated with more experienced [CyberCriminals], (such as Locky) have become widespread quickly…Given Revelton’s long history of successful and large-scale malware distribution, we expect CryptoXXX to become widespread.  Based on the large number of translations available for the [Bitcoin] payment page, it appears that the Revelton team shares those expectations.”

The ransomware will initially be spread through drive-by downloads, but a deluge of phishing emails can be expected to follow shortly.

What Can You Do to Avoid Becoming a Ransomware Victim:

1. Backups.  Backups.  Backups.  Maintain current, and reliable backups of all pertinent files.  Nothing beats a good, reliable backup!  Backing up your data now can prevent a lot of expensive headaches in the future.
2. AntiMalware Software.  Regularly run AntiMalware software to block known strains of ransomware.
3. Update.  Update.  Update.  Keep all hardware, software, and Operating Systems up-to-date.  
4. Educate.  Educate.  Educate. Make sure employees and coworkers know about current viruses/malware, and what to look for.  Print & post our “Red Flag Emails” for easy reference on what to look for in scam emails.
5. Install Ad Blockers When Possible.  uBlock Origin is a great ad blocker for Chrome and other browsers.
6. Block Extensions via Email.  A good spam blocker will usually handle this for you.
7. Limit permissions.  Allow “Read/Write Access Only” when necessary.
8. Avoid mapping network shares.  If you have to use them, hide them whenever possible.  This is sometimes as simple as appending a “$” to your share name.

You can’t stop CyberCriminals from targeting your company or employees.

But you can be prepared for their arrival, and have full shields up.

Got CyberBugs?

Call 1-204-800-3166

For Cyber-Extermination!

#itthatworks

ALERT:  Prince’s Last Words

Yesterday, news broke that Prince (aka Prince Rogers Nelson) was found dead in his home in Minneapolis at age 57. 

CyberCriminals eager, as always, to take advantage of any tragedy, are up to their same tricks.  A series of email scams are currently being circulated, one of which is most likely to be a supposed video of Prince’s last words caught on video (this is a frequent scam to use after an especially unexpected celebrity death).

Whatever ploy is being used, you can be sure to end up with either infected computers at home or in the office, giving out personal information, or unleashing ransomware on the network.

Beware of any email, attachments, any social media, texts on your phone…anything.

Another heads-up:

With the recent eqrthquakes in Ecuador and Japan, there are charity scams rearing their ugly heads.  If you want to make donations, please go to your favorite charity website directly by opening your browser and typing in their link in the address bar.  DO NOT click on any links or open any attachments in emails.

You can’t stop CyberCriminals from targeting your company or employees.

But you can be prepared for their arrival, and have full shields up.

Got CyberBugs?

Call 1-204-800-3166

For Cyber-Extermination!

#itthatworks

ALERT:  Jigsaw Sinks to New Low…Even for Ransomware

Being infected by ransomware is bad enough.  Add in being taunted by old horror movie pictures while it slowly deletes your encrypted files, all while increasing the ransom demand, until you pay for the decryption key.  And if you reboot your PC, you’re punished with the instant deletion of 1,000 of your files.

Jigsaw, a new strain of ransomware tries to increase the pressure on victims to pay, by referencing the horror movie “Saw”.  In fact, the ransomware is named after the film’s fictional serial killer John Kramer’s nickname the “Jigsaw Killer”.  The ransomware, still drawing motivation from the horror movie, communicates with victims using a puppet called “Billy”, and uses the red clock to count down to deadlines imposed, which are both used by the killer in the movie.  However, in the case of the ransomware, the clock shows victims how much time is left before more files get deleted, and the ransom demand increases.  After 72 hours, the ransomware deletes every encrypted file on the PC.

How the ransomware attack unfolds, as seen on an infected PC. (Source:  Forcepoint.)

This latest version, in a long list of versions, “appears to have been coded on March 23 and to have been used in live attacks by the end of the month” states Andy Settle, head of special investigations at Ryatheon’s cybersecurity business Forcepoint.  “This malicious program starts encrypting your files while adding, with no irony, the ‘.FUN’ file extention.”  

“Using horror movie images and references to cause distress in the victim is a new low.”

Jason Sumalapao, malware analyst at Trend Micro, states in a blog post that the ransom note exists in both English and Portutuese-language versions, and that the lowest possible amount that victims can pay, before the demand starts increasing, ranges from $20 to $150 USD in bitcoins.

Jigsaw appears to be distributed through adware and “grayware” (potentially unwanted applications, such as free toolbars), as well as through ‘adult content’ sites, reports Trend Micro.  

Forcepoint states that the producers of Jigsaw attempted to prevent detection by writing the ransomware in ‘.NET’ code.  However, this attempt failed, and security researchers have been able to recover the encryption key, as well as 100 different bitcoin payment addresses.  This information has since been shared with authorities.  Since the encryption key was discovered, security researchers have been able to publish instructions on how to remove Jigsaw infections.  However, it’s probably not long before Jigsaw producers correct their coding error that lead to the discovery of the decryption key.

How to Avoid Jigsaw and Other Ransomware:

1. Backups.  Backups.  Backups.  Maintain current, and reliable backups of all pertinent files.  
2. AntiMalware Software.  Regularly run AntiMalware software to block known strains of ransomware.
3. Update.  Update.  Update.  Keep all hardware, software, and Operating Systems up-to-date.  
4. Educate.  Educate.  Educate.  Keep all employees and coworkers informed about current security threats, and what to look for.  Check out our ‘Red Flag Emails‘ for tips on what to look for in scam emails.
5. Install Ad Blockers When Possible.  uBlock Origin is a great ad blocker for Chrome and other browsers.
6. Block Extensions via Email.  A good spam blocker will usually handle this for you.

 

You can’t stop CyberCriminals from targeting your company or employees.

But you can be prepared for their arrival, and have full shields up.

Got CyberBugs?

Call 1-204-800-3166

For Cyber-Extermination!

#itthatworks

ALERT:  Emergency Flash Patch Battles Ransomware

Active CyberCriminal attacks are occurring that exploit a zero-day flaw in the Windows version of the Adobe Flash to install ransomware.

Security experts are warning all Adobe Flash users to either update Adobe Flash, or uninstall the browser plug-in software if you don’t use it.  Recent versions of Flash for Mac OS X, Linux, and Google ChromeOS are also at risk.

Adobe has released updated versions of Flash that fix the flaw, which has been named “CVE-2016-1019”.

Adobe states:  “Adobe is aware of reports that CVE-2016-1019 is being actively exploited on systems running Windows 10 and earlier with Flash Player version 20.0.0.306 and earlier.”

Adobe’s latest Flash update includes fixes for 24 flaws.  Adobe reports that many of the fixed flaws are considered “critical vulnerabilites” that “could potentially allow an attacker to take control of the affected system”.

The latest (fully-patched) version of the Flash Player Desktop Runtime is 21.0.0.213.  Adobe recommends all users upgrade immediately.

Remember to install updates regularly.  Updates plug known security holes that could be putting your computer system (and your business!) at risk!

 

You can’t stop CyberCriminals from targeting your company or employees.

But you can be prepared for their arrival, and have full shields up.

Got CyberBugs?

Call 1-204-800-3166

For Cyber-Extermination!

#itthatworks

ALERT:  Comcast Triple-Threat

More and more, legitimate-looking advertising served on major websites turn out to be malicious.  CyberCriminals pay for and post ads, which they hope you click on.  BUT if you click on the malicious ads, you are redirected to a compromised website which may infect your computer and/or disply pop-ups that claim your PC has a virus and provide a toll-free number for “Tech Support” who will “fix” your PC, but really just want your credit card information.

Comcast is the largest ISP in the U.S. and have thousands of business users.  This makes them a prime target for a social engineering attack by CyberCriminals.

Threat #1:  Malicious Ad

Comcast has a search page called Xfinity that serves tons of searches.  On this page is a malicious ad (served by Google) from “Sat TV Pro” which claims to compare Direct TV to Comcast TV.  If you click on the ad, you are redirected to a compromised site which has an Exploit Kit (EK) running.

Threat #2:  Infection

The EK first infects the workstation with ransomware, then redirects to a fake Xfinity site.

Threat #3:  Extortion

The fake Xfinity site pops up, with a message allegedly from “Comcast’s security plugin”.  The message states that the workstation is infection (which is correct, because they just did it!), and the user needs to call “tech support”, for which they provide a toll-free number.  If you call the toll-free number provided, you get fake “Tech Support”, which is actually scammers who try to get your credit card information to “fix” the box.  

How to Avoid This Scam

1. Keep updates up-to-date to avoid security holes.  
2. Use up-to-date software.  Old software versions may be cheaper and “familiar”, but they may no longer be supported by their manufacturer.  This means that the software manufacturer no longer releases security patches (to “patch” up known security holes).  This leaves your computer, and any computer on your network, vulnerable.  
3. Do not click on any suspicious ads or links (in ads or in emails).
4. Do not open emails or click on links from unknown senders.
5. Do not open emails or click on links from “uncharacteristic” emails from known senders.  Example – it’s unlikely that the CEO of your company, or your Great-Aunt Freda, would send you penis-enlargement information.
6. Make sure staff and employees know about current security alerts.  Not sure what they are?  Visit our ALERTS page to find out!
7. Provide Security Awareness Training for your employees.

 

Not sure if your company is safe?  Ask us for a FREE Network Security Assessment!

Check out our “Email Red Flags”  for what to watch for in suspicious emails. 

Ask us about our “Core Security Solutions” package!

You can’t stop CyberCriminals from targeting your company or employees.

But you can be prepared for their arrival, and have full shields up.

Got CyberBugs?

Call 1-204-800-3166

For Cyber-Extermination!

#itthatworks