""/
Node Chats

Tips on how to work remotely safely – Karl Susman

In 2020, the year of remote working, cyber crime increased by 80%. That’s equal to an attack every 39 seconds.

To help you avoid getting caught out, expert Karl Susman, Susman Insurance Agency, Cyberman365 reseller, reveals his top 5 tips on how to work remotely safely in the Spring edition of Tort, Trial & Insurance Practice Law Journal from the American Bar Association.

These are essential and easy to implement tips that anyone working from home can do, such as making sure your computer automatically updates.

Check out the featured spread here:

""/
Cyber Threat Alert, Cyber Tips, Node Chats

New Linux Backdoor Discovered – Attacking Linux Endpoints and Servers

New backdoor malware targeting Linux operating systems has been discovered, hiding as a polkit daemon. It is has been named RedXOR for its network data encoding scheme based on XOR. 

Analysing the Tactics, Techniques, and Procedures (TTPs), RedXOR is thought to be developed by Chinese threat actors. The malware samples have low detection rates in VirusTotal, and is used in targeting attacks against legacy Linux systems.

There are also many similarities between RedXOR and the reported malware associated with Winnti umbrella threat group known as the PWNLNX backdoor, as well as to XOR.DDOS and Groundhog, two botnets attributed to Winnti by BlackBerry. The below samples can be used for reference:

The samples are both unstripped 64-bit ELF files called po1kitd-update-k. Similarities between the samples includes the use of old open-source kernel rootkits, both use the CheckLKM function, and both provide the attacker with a pseudo-terminal using Python pty shells and many other similarities.

The malware makes a remote connection to the command and control server over a TCP socket. The traffic is made to look like HTTP traffic. The command and control server instructs the malware to execute different commands returned in the JSESSIONID cookie. The malware can also be updated by the attacker by sending commands to the malware. The malware can also create new remote shells to get a pseudo-terminal (pty) interface and can perform network tunnelling.

How to Detect and Respond

Use the information below to detect and respond this threat. We suggest using the following indicators of compromise to ensure the RedXOR and the files it creates do not exist in your environment:

Indicators of Compromise

RedXOR Hashes
0a76c55fa88d4c134012a5136c09fb938b4be88a382f88bf2804043253b0559f
0423258b94e8a9af58ad63ea493818618de2d8c60cf75ec7980edcaa34dcc919

Network
update[.]cloudjscdn[.]com
158[.]247[.]208[.]230
34[.]92[.]228[].216

Process name
po1kitd-update-k

File and directories created on disk
.po1kitd-update-k
.po1kitd.thumb
.po1kitd-2a4D53
.po1kitd-k3i86dfv
.po1kitd-nrkSh7d6
.po1kitd-2sAq14
.2sAq14
.2a4D53
po1kitd.ko
po1kitd-update.desktop
S99po1kitd-update.sh


Follow these steps if you are a victim of this malware:

  1. Kill the process.
  2. Delete all files related to the malware.
  3. Make sure your machine is clean and running only trusted code.
  4. Contact the Experts for assistance if needed.

Node Prevent

When you purchase one of our cyber insurance policies you’ll receive vital cybersecurity updates such as this and online training courses to keep your employees up-to-date with the current cyber threats.

Data Breaches, Node Chats

How important is identity management for businesses?

Identity management is focused on protecting the identities of employees and clients. Compromised employees’ identities can be used by hackers to gain access and wreak havoc on unexpecting companies.

Cybersecurity insurance can help protect businesses from the negative impact of exposed identities.

One way we may protect our insured’s clients from identity theft after a data breach is by activating credit monitoring. If criminals try to use their leaked data to commit financial fraud this will be flagged and prevented.

5 stats that highlight the growing importance of identity security.

""/
Cyber Threat Alert, Node Chats, Phishing

Office 365 phishing campaign threatens C-level executives

An advanced Microsoft Office 365 phishing campaign is being launched at C-level executives, executive assistants, and financial departments.

Some of these attacks see newly-appointed, unannounced CEO’s as victims. In these cases, attackers try to take advantage of the executives during their transition period to gain unauthorized access to the account.

Attackers try to compromise any company account or a 3rd party partner and then use collected sensitive information to create more sophisticated attacks to phish C-level executives.

This campaign began in early December 2020 and is still ongoing as of March 2021. The attackers are leveraging phishing toolkits and many sophisticated methods.

Most of the phishing emails are sent from addresses with Microsoft-themed sender domains, with properly configured SPF records and are made to look like messages from the company, carrying fake alerts about “Important Service Changes”, “Important Security Policy Update”, etc.

The majority of the targeted email accounts used the format first name.last name@company domain, making full names in the attachments easy to automate. But even in cases where only initials appeared in the email address, the attackers still included the victim’s full name in the PDF attachment. This suggests the threat actors conducted additional prior research to carefully carry out spear phishing attacks.

Through malicious attachments, the victim is sent to a spoofed Microsoft-looking themed webpage with a fake Office 365 login page. If the victim enters their account credentials into the phishing portal, the attacker can then verify it was a valid Office 365 address. If after the victim enters their credentials, the victim may simply be redirected to the legitimate sign-in website like nothing ever happened.

How to Protect Yourself

Sophisticated phishing attacks are hard to detect with typical tools and methods because they do not use malware or malicious URLs that can be detected by antivirus. While it is important that you always use updated end-point protection and antivirus, mitigating this threat is hard. Here are some best practices:

  • End-user training, awareness, and education is critical so end-users know to verify a request as legitimate and stay alert for unexpected emails with links or attachments. For example, employees should be on the alert for poor spelling and grammar and spoofed app names, domain URLs and email addresses.
  • Implement two-factor authentication (2FA) for email. This is one of the best defences against phishing, because even if the attacker steals a user’s credentials, they won’t be able to gain access without the second factor.
  • Configure your email to filter out suspicious looking phishing emails. Depending on your email filter, this may be turned on by default.
  • Prohibit employees from being able to navigate to sites not whitelisted via a web filter. If you have a web filter, have your network administrator or authorized IT professional configure it to prohibit users from accessing unsafe and spoofed websites.

Node Prevent

When you purchase one of our cyber insurance policies we include Node Prevent, a free service with employee training, how to implement best practices and threat alerts such as these.

Node Chats

Node Chats: Raising Cyber Ethical Kids

“If kids have unfettered, unsupervised use of these smart devices, they’re playing in a global village.”

Cyberman365 edition! This episode we are changing it up with an episode centred around personal cyber risks your family may face.

Neil Gurnhill talks to Frederick Lane, attorney and author of multiple books on cybersafety, digital misconduct and personal privacy, about keeping your family safe in the digital age in the sixth episode of Node Chats.

Your podcast for all things cybersecurity brought to you by Node International, specialists in cyber insurance.

Watch the full episode here:

Node Chats

Node Chats – Are you weakest or strongest link?

We’re back with another episode of Node Chats, your podcast for all things cybersecurity.

Neil Gurnhill talks to Gabriel Friedlander, Founder of Wizer, about citizen cyber training in the second episode of Node Chats.

We cover remote job scams, how to teach your children to stay safe online and much more.

“You really have to educate people if you want to have a chance in fighting cyber crime.”

Gabriel Friedlander, Founder of Wizer

Wizer is a full security awareness platform with 1-minute videos, phishing simulation and gamification. Offering both free and optional paid add-ons for the community and employees alike.

Here are some quick tips on how to be cyber smart:

  • Use antivirus software.
  • Update your devices when needed.
  • Start questioning links, never click on a link you don’t trust.
  • Always use strong passwords— characters, numbers and letters.
  • Be careful what personal information you share, particularly on social media.
  • Teach children not to post or share personal information such as their photograph, address or age.

If you prefer just audio, make sure to check us out on other platforms:

Hit the follow button to be the first to know about the latest cybersecurity news.

If you’d still like to know more, comment or drop us a message, we’d love to hear what you think.

Node Chats

Node Chat Podcast Launches!

We are proud to announce the launch of Node Chats, your podcast for all things cybersecurity.

Neil Gurnhill kicks us off with a hot topic, inviting David Kruse, Director of Business Development at Tetra Defense, to discuss the evolving nature of ransomware.

Ransomware is a type of malicious software designed to block access to a computer system until a sum of money is paid.

A new organisation will fall victim to ransomware every 14 seconds in 2019, and every 11 seconds by 2021. (Source: Cyber Security Ventures)

This is a current, very real issue that affects large companies, small business and the everyday person.

Learn how to spot early signs that ransomware is on your network before encryption.

David talks about the factors that can influence early detection such as the level of information security systems that your company has in place to flag the invasion and the quality and skill of the person who compromised that network.

If you have a hacker that’s just a bull in a china shop and hasn’t quite figured out how to be more stealthy, you’ll see indicators of compromise all over the place.

David Kruse, Director of Business Development at Tetra Defense

Listen to the podcast for answers on everything ransomware, drop us a comment if you have any more questions and we’ll be happy to get back to you.

Don’t forget to subscribe to Node Chats and be the first to know about the latest cybersecurity news.

Find us on:

Recent Comments
    About Node International

    We provide leading comprehensive insurance coverage combined with essential cybersecurity prevention and detection tools.

    Related Links
    Cyber Insurance Newsletter

    Interested in Cyber Insurance?

    Privacy Settings
    We use cookies to enhance your experience while using our website. If you are using our Services via a browser you can restrict, block or remove cookies through your web browser settings. We also use content and scripts from third parties that may use tracking technologies. You can selectively provide your consent below to allow such third party embeds. For complete information about the cookies we use, data we collect and how we process them, please check our Privacy Policy
    Youtube
    Consent to display content from Youtube
    Vimeo
    Consent to display content from Vimeo
    Google Maps
    Consent to display content from Google
    Spotify
    Consent to display content from Spotify
    Sound Cloud
    Consent to display content from Sound