Data Breaches, Node Chats

How important is identity management for businesses?

Identity management is focused on protecting the identities of employees and clients. Compromised employees’ identities can be used by hackers to gain access and wreak havoc on unexpecting companies.

Cybersecurity insurance can help protect businesses from the negative impact of exposed identities.

One way we may protect our insured’s clients from identity theft after a data breach is by activating credit monitoring. If criminals try to use their leaked data to commit financial fraud this will be flagged and prevented.

5 stats that highlight the growing importance of identity security.

Cyber Threat Alert, Phishing

Watch out for the newest phishing scam

Attackers have developed two new business email compromise (BEC) phishing techniques that evade email security filters by manipulating Microsoft 365’s automated email responses.

  1. First the read receipts is manipulated.
  2. Then the target victims out-of-office (OOO) replies are redirected.

Both were seen being used in the United States in December 2020 during the holidays.

Step 1 – “Disposition-Notification-To” Read-Receipt Notification

With the read-receipts attack, the attacker creates an email and changes the “Disposition-Notification-To” email header to create a read-receipt notification from Microsoft 365 to the recipient.

The email should get caught by email security filters, but since it is created from the internal system, the read receipt is sent to the target, bypassing traditional security filters and is sent to the employee’s inbox,

Step 2 – Out-of-Office (OOO) Attack

With the OOO attack, a the attacker creates a BEC email impersonating someone inside the company. The attacker changes the “Reply-To” email header so that if the target has an OOO message turned on, that OOO notification (that includes the original text) is directed to someone else within the organisation.

Again, the message most likely will not be caught by email security filters, because it originates from the original target’s account, not externally.

Business Email Compromise (BEC) is Still a Serious Email Threat

BEC emails are used to steal money from companies, often by impersonating an employee, vendor or customer in an email or mobile message. It often involves the attacker asking to pay a fake invoice, recurring payment or wire transfer.

The amount of BEC attacks continues to grow. According to Abnormal Security’s Quarterly BEC Report, BEC attacks rose by 15 percent quarter-over-quarter in Q3 of 2020.

BEC attacks rose by 15% quarter-over-quarter in Q3 of 2020.

Abnormal Security’s Quarterly BEC Report,

The average BEC attack volume per week during that time increased in six out of eight industries. The largest increase in BEC attacks was 93 percent in the energy/infrastructure sector. The highest number of weekly BEC attacks were in retail/consumer goods and manufacturing and technology. The study found these BEC campaigns used mostly invoice and payment fraud, with a 155 percent Quarter on Quarter.

The study found these BEC campaigns used mostly invoice and payment fraud, with a 155 percent Quarter on Quarter.


As email-security gets better, so do cybercriminals. For example, in early January a campaign was launched that leveraged Google’s Forms survey tool to create an ongoing conversation between the email recipient and the attacker which set up victims for future BEC attacks.

Microsoft and Office 365 are Big Targets

The Microsoft Office 365 cloud environment is a big target for BEC compromise as well.

Once hackers compromise an Office 365 environment, these BEC scammers can leverage trusted communications. For example, attackers can send an illegitimate email from the CEO’s official account to socially engineer employees, customers, or partners.

Attackers can also search through emails, chat histories and files to steal passwords or other important data. They can also set up forwarding rules to get access to emails without needing to sign in again. Furthermore, they could plant malware or malicious links into commonly used and trusted documents. The goal here is to manipulate something everyone trusts to bypass prevention controls that could trigger alerts to ultimately steal or hold files and data for ransom.

Protecting Against BEC Attacks

BEC attacks are hard to detect with typical tools and methods because they do not use malware or malicious URLs that can be detected by antivirus, so mitigating this threat can be difficult. Traditionally, the best defence for these kinds of attacks is end-user training and awareness so end-users can verify a request is indeed legitimate. It is also always a good idea to implement 2FA for email, configure your email to filter out suspicious looking phishing emails, and use updated end-point protection and antivirus.

Cyber Threat Alert, Node Chats, Phishing

Office 365 phishing campaign threatens C-level executives

An advanced Microsoft Office 365 phishing campaign is being launched at C-level executives, executive assistants, and financial departments.

Some of these attacks see newly-appointed, unannounced CEO’s as victims. In these cases, attackers try to take advantage of the executives during their transition period to gain unauthorized access to the account.

Attackers try to compromise any company account or a 3rd party partner and then use collected sensitive information to create more sophisticated attacks to phish C-level executives.

This campaign began in early December 2020 and is still ongoing as of March 2021. The attackers are leveraging phishing toolkits and many sophisticated methods.

Most of the phishing emails are sent from addresses with Microsoft-themed sender domains, with properly configured SPF records and are made to look like messages from the company, carrying fake alerts about “Important Service Changes”, “Important Security Policy Update”, etc.

The majority of the targeted email accounts used the format first name.last name@company domain, making full names in the attachments easy to automate. But even in cases where only initials appeared in the email address, the attackers still included the victim’s full name in the PDF attachment. This suggests the threat actors conducted additional prior research to carefully carry out spear phishing attacks.

Through malicious attachments, the victim is sent to a spoofed Microsoft-looking themed webpage with a fake Office 365 login page. If the victim enters their account credentials into the phishing portal, the attacker can then verify it was a valid Office 365 address. If after the victim enters their credentials, the victim may simply be redirected to the legitimate sign-in website like nothing ever happened.

How to Protect Yourself

Sophisticated phishing attacks are hard to detect with typical tools and methods because they do not use malware or malicious URLs that can be detected by antivirus. While it is important that you always use updated end-point protection and antivirus, mitigating this threat is hard. Here are some best practices:

  • End-user training, awareness, and education is critical so end-users know to verify a request as legitimate and stay alert for unexpected emails with links or attachments. For example, employees should be on the alert for poor spelling and grammar and spoofed app names, domain URLs and email addresses.
  • Implement two-factor authentication (2FA) for email. This is one of the best defences against phishing, because even if the attacker steals a user’s credentials, they won’t be able to gain access without the second factor.
  • Configure your email to filter out suspicious looking phishing emails. Depending on your email filter, this may be turned on by default.
  • Prohibit employees from being able to navigate to sites not whitelisted via a web filter. If you have a web filter, have your network administrator or authorized IT professional configure it to prohibit users from accessing unsafe and spoofed websites.

Node Prevent

When you purchase one of our cyber insurance policies we include Node Prevent, a free service with employee training, how to implement best practices and threat alerts such as these.

Cyber Threat Alert, News

Cyber Threat Alert: Dangerous Microsoft Exchange Exploits

Does your organisation run a Microsoft Exchange Server? If so read on!

What Happened?

Microsoft has detected multiple zero day exploits attacking on-premises versions of Microsoft Exchange Server. In these attacks, the threat actor accesses on-premises Exchange servers (and the associated email accounts) and installs additional malware to retain unauthorized access to the environment.

What is Affected?

The vulnerabilities affect Microsoft Exchange Server. Exchange Online is NOT affected.

The versions affected are:

  • Microsoft Exchange Server 2013
  • Microsoft Exchange Server 2016
  • Microsoft Exchange Server 2019

What to Do

If you run any of the affected versions, IMMEDIATELY apply these updates to affected systems to protect against these exploits. Externally facing Exchange servers should be updated first and then update all affected Exchange Servers.

Node Prevent

When you purchase one of our cyber insurance policies you’ll receive vital cybersecurity updates such as this and online training courses to keep your employees up-to-date with the current cyber threats.


Data Privacy Day, advice for businesses

According to a Pew Research Center study, 79% of U.S. adults report being concerned about the way their data is being used by companies.

By respecting your consumers’ privacy you’ll increase trust and enhance reputation and growth in your business.

How can you protect customer data:

  1. If you collect it, protect it. Data breaches lead to financial loss, reputational damage and diminishing customer trust. By following reasonable security measures you can keep individuals’ personal information safe from inappropriate and unauthorized access. Only collect personal data for relevant and legitimate purposes and make sure it’s processed in a fair manner.
  2. Consider adopting a privacy framework. Research and adopt a privacy framework in your business to help you manage risk and create a culture of privacy in your organisation. You may find the following frameworks useful:
  3. Conduct an assessment of your data collection practices. Which privacy laws and regulations apply to your business? Make sure you fully understand the requirements and educate your employees of their and your organisation’s obligations to protecting personal information. 
  4. Transparency builds trust. Be open and honest about how you collect, use and share consumers’ personal information. Communicate clearly what privacy means to your organisation and how you achieve and maintain privacy. How would the consumer expect their data to be used? Create design settings to protect their information by default.
  5. Maintain oversight of partners and vendors. If someone provides services on your behalf, you are also responsible for how they collect and use your consumers’ personal information.

Find out more here.


Healthcare suffers a 51% spike in web app attacks in response to COVID-19 vaccine

The healthcare sector experienced a surge in web application attacks in December when the distribution of the first COVID-19 vaccines began, according to new data from Imperva.

Attacks increased 51% last month from November, an industry increasingly targeted by cyber-criminals over the past year due to the global pandemic.

Web application attacks are serious weaknesses or vulnerabilities that allow criminals to gain direct and public access to databases with the goal of using the sensitive data within. Many of these databases contain valuable information such as personal data and financial details, meaning they are frequently targeted.

Four specific web application attacks saw the largest increases in December:

1.) Cross-site scripting (XSS) detections
2.) SQL injection attacks
3.) Remote code execution/remote file inclusion
4.) Protocol manipulation attack

How can healthcare organisations reduce web application attacks?

1.) Web Application Firewalls (WAFs): A vital defence for critical applications and data. WAF controls access to web applications using rules designed to recognise and restrict suspicious activity, such as SQLi, XSS and exploitation of vulnerabilities. By continuously updating the rules they are prepared to catch the latest attack and exploitation techniques before they can harm important resources.

2. Vulnerability Scanning and Security Testing: The fact web applications connect external users to data and services easily makes them big targets for attackers. Scanning and testing databases, networks and applications can help find where the vulnerabilities are and how to mitigate them.

3. Secure Development Training: Provide your developers, testers, project managers and architects with the latest information regarding secure software development. Ensure there is a baseline of security awareness so staff can confidently design, build and deploy secure software and applications.

Terry Ray, Imperva, said that 2020 has been an “unprecedented year” of cyber activity, with global healthcare organizations (HCOs) experiencing 187 million attacks per month on average. That’s almost 500 attacks per HCO each month, a 10% increase year-on-year.

The US, Brazil, UK and Canada were the top countries targeted last year.

Ray believes that Healthcare’s reliance on third-party applications to save time and money may have exposed them.

“While there are sometimes business advantages to third-party applications, the risks include: patching only on the vendor’s timeline, known exploits that are widely publicized and constant zero-day research on widely used third-party tools and APIs.”

Ray also highlighted how exploiting web application vulnerabilities is the most common cyber attacks directed at healthcare organisations.

“Reliance on JavaScript APIs and third-party applications creates a threat landscape of more complex, automated, and opportunistic cybersecurity risks that are increasingly challenging for all organizations to detect and stop. And while ransomware attacks commonly land healthcare organizations in the news, it’s only the vulnerable application front-end to all healthcare data that experiences the variety and volume of daily attacks noted above.”

In just the first three days of 2021, Imperva saw a 43% increase in data leakage.

Cyber Threat Alert

5 Cyber Threats You Will Encounter In 2021

Here are our predictions for 2021 based on statistics collected from 2020.

We warned of ransomware, phishing and remote worker security last year but they won’t be disappearing from our top threats any time soon.

Newcomers AI-driven threats and Cloud threats grow as we rely on these services more and more.

Find our article on the top cyber threats of 2020 here.

Prevention and detection are key to avoiding these cyber threats.

Insurance is necessary but shouldn’t be your only line of defence. Actions need to be taken to help avoid cyber attacks in the first place.

We provide prevention and detection tools with our insurance in the hope you never have to experience a cyber attack. But if the worse should happen we will be there to help you fix it.

Learn more by checking out our in depth articles on some of the cyber threats:


SolarWinds Breach: What you need to know

SolarWinds, a popular IT security vendor with 300,000 global customers (including many small to medium size businesses and their Managed Service Providers), has suffered a major compromise.
If your organization uses the SolarWinds Orion Platform, READ ON. If you’re not sure, ask someone in your organization that does.
Even if you don’t use the SolarWinds Orion Platform, one of your business partners may be among the 18,000 organizations potentially affected by this breach. 

SolarWinds, a popular IT security vendor with 300,000 global customers (including many small to medium size businesses and their Managed Service Providers), has suffered a major compromise.
If your organization uses the SolarWinds Orion Platform, READ ON. If you’re not sure, ask someone in your organization that does.
Even if you don’t use the SolarWinds Orion Platform, one of your business partners may be among the 18,000 organizations potentially affected by this breach. 

We strongly recommend you contact all business partners with whom you share sensitive business information or allow access into your IT environment to ensure that, if they use the affected platforms, they are taking the recommended actions below.

If you are allowing an affected partner access into your IT environment, we recommend disabling that access until the issue has been remediated.

Indeed, the Cybersecurity and Infrastructure Security Agency (CISA) has advised everyone that uses the SolarWinds Orion monitoring software to assume they’ve been “compromised by threat actors and assume that further persistence mechanisms have been deployed.”

What Happened?
The compromise allowed hackers to inject malicious code into legitimate software released by SolarWinds for its Orion platform, a suite of network management tools.

This malicious code is a backdoor that communicates with command-and-control servers operated by a malicious third party.

This supply chain attack has been connected with the recent FireEye and U.S. Department of Homeland Security (DHS) hacks.

Affected organizations may have been compromised by malicious hackers as early as May 2020.

What/Who is Affected?
The compromised platforms are SolarWinds® Orion® Platform software builds for versions 2019.4 HF 5, 2020.2 with no hotfix installed, and 2020.2 HF 1.

The known affected products for these Orion Platforms are:

  • Application Centric Monitor (ACM)
  • Database Performance Analyzer Integration Module*(DPAIM*)
  • Enterprise Operations Console (EOC)
  • High Availability (HA)
  • IP Address Manager (IPAM)
  • Log Analyzer (LA)
  • Network Automation Manager (NAM)
  • Network Configuration Manager (NCM)
  • Network Operations Manager (NOM)
  • Network Performance Monitor (NPM)
  • NetFlow Traffic Analyzer (NTA)
  • Server & Application Monitor (SAM)
  • Server Configuration Monitor (SCM)
  • Storage Resource Monitor (SRM)
  • User Device Tracker (UDT)
  • Virtualization Manager (VMAN)
  • VoIP & Network Quality Manager (VNQM)
  • Web Performance Monitor (WPM)

SolarWinds said Orion update versions 2019.4 through 2020.2.1 (released between March 2020 and June 2020) also contain the malware.
If your organization uses any of the affected Orion affected platforms/products, we recommend you immediately investigate what versions you are running and take the below steps.

What to Do 
Affected organizations should immediately power down or disconnect from their network SolarWinds Orion products, versions 2019.4 through 2020.2.1 HF1.

SolarWinds recommends the following immediate actions.

  • All customers with any of the above affected products for Orion Platform v2020.2 with no hotfix or 2020.2 HF 1 to upgrade to Orion Platform version 2020.2.1 HF 2 as soon as possible. This version is available here.
  • SolarWinds asks customers with any of the below products listed as known affected for Orion Platform v2019.4 HF 5 to update to 2019.4 HF 6, which is available for download here.
  • The hotfix release 2020.2.1 HF 2 is now available in the SolarWinds Customer Portal at
  • All customers should update to release 2020.2.1 HF 2, as this release replaces the compromised component and provides several additional security enhancements.

If you cannot upgrade immediately, SolarWinds recommends installing your Orion Platform behind firewalls, disabling internet access for the Orion Platform, and limiting the ports and connections to only what is necessary. For more information, read SolarWinds Orion Platform best practices configurations and the entire SolarWinds security advisory.

Cyber Tips, Tech

Happy Thanksgiving! Stay Safe With Our 5 Simple Cyber Tips!

We wish you all the best over the holiday season!

As Black Friday approaches, more people are shopping online than ever before, and consequently, scams and cyber-crime are skyrocketing. 

We would like to share our five useful tips to help identify and avoid cyber scams over the holidays.  

Any last minute submissions? We have underwriters working as usual over the holiday period so don’t hesitate to get in touch. 

Feel free to download and share!

Want more? Drop us an email, we would love to share our creative content with you. 

Recent Comments
    About Node International

    We provide leading comprehensive insurance coverage combined with essential cybersecurity prevention and detection tools.

    Related Links
    Cyber Insurance Newsletter

    Interested in Cyber Insurance?

    Privacy Settings
    We use cookies to enhance your experience while using our website. If you are using our Services via a browser you can restrict, block or remove cookies through your web browser settings. We also use content and scripts from third parties that may use tracking technologies. You can selectively provide your consent below to allow such third party embeds. For complete information about the cookies we use, data we collect and how we process them, please check our Privacy Policy
    Consent to display content from Youtube
    Consent to display content from Vimeo
    Google Maps
    Consent to display content from Google
    Consent to display content from Spotify
    Sound Cloud
    Consent to display content from Sound