In 2020, the year of remote working, cyber crime increased by 80%. That’s equal to an attack every 39 seconds.
To help you avoid getting caught out, expert Karl Susman, Susman Insurance Agency, Cyberman365 reseller, reveals his top 5 tips on how to work remotely safely in the Spring edition of Tort, Trial & Insurance Practice Law Journal from the American Bar Association.
These are essential and easy to implement tips that anyone working from home can do, such as making sure your computer automatically updates.
Check out the featured spread here:
New backdoor malware targeting Linux operating systems has been discovered, hiding as a polkit daemon. It is has been named RedXOR for its network data encoding scheme based on XOR.
Analysing the Tactics, Techniques, and Procedures (TTPs), RedXOR is thought to be developed by Chinese threat actors. The malware samples have low detection rates in VirusTotal, and is used in targeting attacks against legacy Linux systems.
There are also many similarities between RedXOR and the reported malware associated with Winnti umbrella threat group known as the PWNLNX backdoor, as well as to XOR.DDOS and Groundhog, two botnets attributed to Winnti by BlackBerry. The below samples can be used for reference:
The samples are both unstripped 64-bit ELF files called po1kitd-update-k. Similarities between the samples includes the use of old open-source kernel rootkits, both use the CheckLKM function, and both provide the attacker with a pseudo-terminal using Python pty shells and many other similarities.
The malware makes a remote connection to the command and control server over a TCP socket. The traffic is made to look like HTTP traffic. The command and control server instructs the malware to execute different commands returned in the JSESSIONID cookie. The malware can also be updated by the attacker by sending commands to the malware. The malware can also create new remote shells to get a pseudo-terminal (pty) interface and can perform network tunnelling.
How to Detect and Respond
Use the information below to detect and respond this threat. We suggest using the following indicators of compromise to ensure the RedXOR and the files it creates do not exist in your environment:
Indicators of Compromise
File and directories created on disk
Follow these steps if you are a victim of this malware:
When you purchase one of our cyber insurance policies you’ll receive vital cybersecurity updates such as this and online training courses to keep your employees up-to-date with the current cyber threats.
Identity management is focused on protecting the identities of employees and clients. Compromised employees’ identities can be used by hackers to gain access and wreak havoc on unexpecting companies.
Cybersecurity insurance can help protect businesses from the negative impact of exposed identities.
One way we may protect our insured’s clients from identity theft after a data breach is by activating credit monitoring. If criminals try to use their leaked data to commit financial fraud this will be flagged and prevented.
5 stats that highlight the growing importance of identity security.
An advanced Microsoft Office 365 phishing campaign is being launched at C-level executives, executive assistants, and financial departments.
Some of these attacks see newly-appointed, unannounced CEO’s as victims. In these cases, attackers try to take advantage of the executives during their transition period to gain unauthorized access to the account.
Attackers try to compromise any company account or a 3rd party partner and then use collected sensitive information to create more sophisticated attacks to phish C-level executives.
This campaign began in early December 2020 and is still ongoing as of March 2021. The attackers are leveraging phishing toolkits and many sophisticated methods.
Most of the phishing emails are sent from addresses with Microsoft-themed sender domains, with properly configured SPF records and are made to look like messages from the company, carrying fake alerts about “Important Service Changes”, “Important Security Policy Update”, etc.
The majority of the targeted email accounts used the format first name.last name@company domain, making full names in the attachments easy to automate. But even in cases where only initials appeared in the email address, the attackers still included the victim’s full name in the PDF attachment. This suggests the threat actors conducted additional prior research to carefully carry out spear phishing attacks.
Through malicious attachments, the victim is sent to a spoofed Microsoft-looking themed webpage with a fake Office 365 login page. If the victim enters their account credentials into the phishing portal, the attacker can then verify it was a valid Office 365 address. If after the victim enters their credentials, the victim may simply be redirected to the legitimate sign-in website like nothing ever happened.
How to Protect Yourself
Sophisticated phishing attacks are hard to detect with typical tools and methods because they do not use malware or malicious URLs that can be detected by antivirus. While it is important that you always use updated end-point protection and antivirus, mitigating this threat is hard. Here are some best practices:
When you purchase one of our cyber insurance policies we include Node Prevent, a free service with employee training, how to implement best practices and threat alerts such as these.
“If kids have unfettered, unsupervised use of these smart devices, they’re playing in a global village.”
Neil Gurnhill talks to Frederick Lane, attorney and author of multiple books on cybersafety, digital misconduct and personal privacy, about keeping your family safe in the digital age in the sixth episode of Node Chats.
Your podcast for all things cybersecurity brought to you by Node International, specialists in cyber insurance.
Watch the full episode here:
We’re back with another episode of Node Chats, your podcast for all things cybersecurity.
Neil Gurnhill talks to Gabriel Friedlander, Founder of Wizer, about citizen cyber training in the second episode of Node Chats.
We cover remote job scams, how to teach your children to stay safe online and much more.
“You really have to educate people if you want to have a chance in fighting cyber crime.”Gabriel Friedlander, Founder of Wizer
Wizer is a full security awareness platform with 1-minute videos, phishing simulation and gamification. Offering both free and optional paid add-ons for the community and employees alike.
Here are some quick tips on how to be cyber smart:
If you prefer just audio, make sure to check us out on other platforms:
Hit the follow button to be the first to know about the latest cybersecurity news.
If you’d still like to know more, comment or drop us a message, we’d love to hear what you think.
We are proud to announce the launch of Node Chats, your podcast for all things cybersecurity.
Neil Gurnhill kicks us off with a hot topic, inviting David Kruse, Director of Business Development at Tetra Defense, to discuss the evolving nature of ransomware.
Ransomware is a type of malicious software designed to block access to a computer system until a sum of money is paid.
A new organisation will fall victim to ransomware every 14 seconds in 2019, and every 11 seconds by 2021. (Source: Cyber Security Ventures)
This is a current, very real issue that affects large companies, small business and the everyday person.
Learn how to spot early signs that ransomware is on your network before encryption.
David talks about the factors that can influence early detection such as the level of information security systems that your company has in place to flag the invasion and the quality and skill of the person who compromised that network.
If you have a hacker that’s just a bull in a china shop and hasn’t quite figured out how to be more stealthy, you’ll see indicators of compromise all over the place.David Kruse, Director of Business Development at Tetra Defense
Listen to the podcast for answers on everything ransomware, drop us a comment if you have any more questions and we’ll be happy to get back to you.
Don’t forget to subscribe to Node Chats and be the first to know about the latest cybersecurity news.
Find us on:
We provide leading comprehensive insurance coverage combined with essential cybersecurity prevention and detection tools.
Interested in Cyber Insurance?
Necessary cookies are absolutely essential for the website to function properly. This category only includes cookies that ensures basic functionalities and security features of the website. These cookies do not store any personal information.
Any cookies that may not be particularly necessary for the website to function and is used specifically to collect user personal data via analytics, ads, other embedded contents are termed as non-necessary cookies. It is mandatory to procure user consent prior to running these cookies on your website.