A series of phishing campaigns Attack.Phishing is targeting airline consumers with messages crafted Attack.Phishing to trick Attack.Phishing victims into handing over personal or business credentials . A wave string of phishing campaigns Attack.Phishing is targeting airline consumers with messages crafted Attack.Phishing to trick Attack.Phishing victims into handing over personal or business credentials . The phishing messages pretend to be sent from Attack.Phishing a travel agency or a someone inside the target firm , they include a weaponized document or embed a malicious link . “ Over the past several weeks , we have seen a combination of attack techniques . One , where an attacker impersonates a travel agency or someone inside a company . Recipients are told an email contains an airline ticket or e-ticket , ” explained Asaf Cidon , vice president , content security services at Barracuda Networks . According to Barracuda Networks , aviation-themed phishing attacks Attack.Phishing contain links to spoofed Attack.Phishing airline sites , threat actors personalize Attack.Phishing the phishing page in a way to trick Attack.Phishing victims into providing business information . The attackers show a deep knowledge of the targets , hackers are targeting logistic , manufacturing and shipping industries . “ It ’ s clear there is some degree of advanced reconnaissance that takes place before targeting individuals within these companies , ” Cidon added . Recently the U.S. Computer Emergency Readiness Team issued an alert of phishing campaigns Attack.Phishing targeting airline consumers . “ US-CERT has received reports of email-based phishing campaigns Attack.Phishing targeting airline consumers . Systems infected through phishing campaigns Attack.Phishing act as an entry point for attackers to gain access Attack.Databreach to sensitive business or personal information. ” reads the US-CERT warning . “ US-CERT encourages users and administrators to review an airline Security Advisory ( link is external ) and US-CERT ’ s Security Tip ST04-014 for more information on phishing attacks Attack.Phishing . ” The US-CERT specifically references the security advisory published by Delta Air Lines that warned its consumers of fraudulent activities . “ Delta has received reports of attempts by parties not affiliated with us to fraudulently gather customer information in a number of ways including : fraudulent emails , social media sites , postcards , Gift Card promotional websites claiming to be Attack.Phishing from Delta Air Lines and letters or prize notifications promising free travel , ” states the Delta Air Lines warning . Barracuda confirmed that these campaigns have a high success rate : “ Our analysis shows that for the airline phishing attack Attack.Phishing , attackers are successful over 90 percent of the time in getting employees to open airline impersonation emails , ” concluded Cidon . “ This is one of the highest success rates for phishing attacks Attack.Phishing . ”

A series of phishing campaigns Attack.Phishing is targeting airline consumers with messages crafted Attack.Phishing to trick Attack.Phishing victims into handing over personal or business credentials . A wave string of phishing campaigns Attack.Phishing is targeting airline consumers with messages crafted Attack.Phishing to trick Attack.Phishing victims into handing over personal or business credentials . The phishing messages pretend to be sent from Attack.Phishing a travel agency or a someone inside the target firm , they include a weaponized document or embed a malicious link . “ Over the past several weeks , we have seen a combination of attack techniques . One , where an attacker impersonates a travel agency or someone inside a company . Recipients are told an email contains an airline ticket or e-ticket , ” explained Asaf Cidon , vice president , content security services at Barracuda Networks . According to Barracuda Networks , aviation-themed phishing attacks Attack.Phishing contain links to spoofed Attack.Phishing airline sites , threat actors personalize Attack.Phishing the phishing page in a way to trick Attack.Phishing victims into providing business information . The attackers show a deep knowledge of the targets , hackers are targeting logistic , manufacturing and shipping industries . “ It ’ s clear there is some degree of advanced reconnaissance that takes place before targeting individuals within these companies , ” Cidon added . Recently the U.S. Computer Emergency Readiness Team issued an alert of phishing campaigns Attack.Phishing targeting airline consumers . “ US-CERT has received reports of email-based phishing campaigns Attack.Phishing targeting airline consumers . Systems infected through phishing campaigns Attack.Phishing act as an entry point for attackers to gain access Attack.Databreach to sensitive business or personal information. ” reads the US-CERT warning . “ US-CERT encourages users and administrators to review an airline Security Advisory ( link is external ) and US-CERT ’ s Security Tip ST04-014 for more information on phishing attacks Attack.Phishing . ” The US-CERT specifically references the security advisory published by Delta Air Lines that warned its consumers of fraudulent activities . “ Delta has received reports of attempts by parties not affiliated with us to fraudulently gather customer information in a number of ways including : fraudulent emails , social media sites , postcards , Gift Card promotional websites claiming to be Attack.Phishing from Delta Air Lines and letters or prize notifications promising free travel , ” states the Delta Air Lines warning . Barracuda confirmed that these campaigns have a high success rate : “ Our analysis shows that for the airline phishing attack Attack.Phishing , attackers are successful over 90 percent of the time in getting employees to open airline impersonation emails , ” concluded Cidon . “ This is one of the highest success rates for phishing attacks Attack.Phishing . ”

A series of phishing campaigns Attack.Phishing is targeting airline consumers with messages crafted Attack.Phishing to trick Attack.Phishing victims into handing over personal or business credentials . A wave string of phishing campaigns Attack.Phishing is targeting airline consumers with messages crafted Attack.Phishing to trick Attack.Phishing victims into handing over personal or business credentials . The phishing messages pretend to be sent from Attack.Phishing a travel agency or a someone inside the target firm , they include a weaponized document or embed a malicious link . “ Over the past several weeks , we have seen a combination of attack techniques . One , where an attacker impersonates a travel agency or someone inside a company . Recipients are told an email contains an airline ticket or e-ticket , ” explained Asaf Cidon , vice president , content security services at Barracuda Networks . According to Barracuda Networks , aviation-themed phishing attacks Attack.Phishing contain links to spoofed Attack.Phishing airline sites , threat actors personalize Attack.Phishing the phishing page in a way to trick Attack.Phishing victims into providing business information . The attackers show a deep knowledge of the targets , hackers are targeting logistic , manufacturing and shipping industries . “ It ’ s clear there is some degree of advanced reconnaissance that takes place before targeting individuals within these companies , ” Cidon added . Recently the U.S. Computer Emergency Readiness Team issued an alert of phishing campaigns Attack.Phishing targeting airline consumers . “ US-CERT has received reports of email-based phishing campaigns Attack.Phishing targeting airline consumers . Systems infected through phishing campaigns Attack.Phishing act as an entry point for attackers to gain access Attack.Databreach to sensitive business or personal information. ” reads the US-CERT warning . “ US-CERT encourages users and administrators to review an airline Security Advisory ( link is external ) and US-CERT ’ s Security Tip ST04-014 for more information on phishing attacks Attack.Phishing . ” The US-CERT specifically references the security advisory published by Delta Air Lines that warned its consumers of fraudulent activities . “ Delta has received reports of attempts by parties not affiliated with us to fraudulently gather customer information in a number of ways including : fraudulent emails , social media sites , postcards , Gift Card promotional websites claiming to be Attack.Phishing from Delta Air Lines and letters or prize notifications promising free travel , ” states the Delta Air Lines warning . Barracuda confirmed that these campaigns have a high success rate : “ Our analysis shows that for the airline phishing attack Attack.Phishing , attackers are successful over 90 percent of the time in getting employees to open airline impersonation emails , ” concluded Cidon . “ This is one of the highest success rates for phishing attacks Attack.Phishing . ”

A series of phishing campaigns Attack.Phishing is targeting airline consumers with messages crafted Attack.Phishing to trick Attack.Phishing victims into handing over personal or business credentials . A wave string of phishing campaigns Attack.Phishing is targeting airline consumers with messages crafted Attack.Phishing to trick Attack.Phishing victims into handing over personal or business credentials . The phishing messages pretend to be sent from Attack.Phishing a travel agency or a someone inside the target firm , they include a weaponized document or embed a malicious link . “ Over the past several weeks , we have seen a combination of attack techniques . One , where an attacker impersonates a travel agency or someone inside a company . Recipients are told an email contains an airline ticket or e-ticket , ” explained Asaf Cidon , vice president , content security services at Barracuda Networks . According to Barracuda Networks , aviation-themed phishing attacks Attack.Phishing contain links to spoofed Attack.Phishing airline sites , threat actors personalize Attack.Phishing the phishing page in a way to trick Attack.Phishing victims into providing business information . The attackers show a deep knowledge of the targets , hackers are targeting logistic , manufacturing and shipping industries . “ It ’ s clear there is some degree of advanced reconnaissance that takes place before targeting individuals within these companies , ” Cidon added . Recently the U.S. Computer Emergency Readiness Team issued an alert of phishing campaigns Attack.Phishing targeting airline consumers . “ US-CERT has received reports of email-based phishing campaigns Attack.Phishing targeting airline consumers . Systems infected through phishing campaigns Attack.Phishing act as an entry point for attackers to gain access Attack.Databreach to sensitive business or personal information. ” reads the US-CERT warning . “ US-CERT encourages users and administrators to review an airline Security Advisory ( link is external ) and US-CERT ’ s Security Tip ST04-014 for more information on phishing attacks Attack.Phishing . ” The US-CERT specifically references the security advisory published by Delta Air Lines that warned its consumers of fraudulent activities . “ Delta has received reports of attempts by parties not affiliated with us to fraudulently gather customer information in a number of ways including : fraudulent emails , social media sites , postcards , Gift Card promotional websites claiming to be Attack.Phishing from Delta Air Lines and letters or prize notifications promising free travel , ” states the Delta Air Lines warning . Barracuda confirmed that these campaigns have a high success rate : “ Our analysis shows that for the airline phishing attack Attack.Phishing , attackers are successful over 90 percent of the time in getting employees to open airline impersonation emails , ” concluded Cidon . “ This is one of the highest success rates for phishing attacks Attack.Phishing . ”

A series of phishing campaigns Attack.Phishing is targeting airline consumers with messages crafted Attack.Phishing to trick Attack.Phishing victims into handing over personal or business credentials . A wave string of phishing campaigns Attack.Phishing is targeting airline consumers with messages crafted Attack.Phishing to trick Attack.Phishing victims into handing over personal or business credentials . The phishing messages pretend to be sent from Attack.Phishing a travel agency or a someone inside the target firm , they include a weaponized document or embed a malicious link . “ Over the past several weeks , we have seen a combination of attack techniques . One , where an attacker impersonates a travel agency or someone inside a company . Recipients are told an email contains an airline ticket or e-ticket , ” explained Asaf Cidon , vice president , content security services at Barracuda Networks . According to Barracuda Networks , aviation-themed phishing attacks Attack.Phishing contain links to spoofed Attack.Phishing airline sites , threat actors personalize Attack.Phishing the phishing page in a way to trick Attack.Phishing victims into providing business information . The attackers show a deep knowledge of the targets , hackers are targeting logistic , manufacturing and shipping industries . “ It ’ s clear there is some degree of advanced reconnaissance that takes place before targeting individuals within these companies , ” Cidon added . Recently the U.S. Computer Emergency Readiness Team issued an alert of phishing campaigns Attack.Phishing targeting airline consumers . “ US-CERT has received reports of email-based phishing campaigns Attack.Phishing targeting airline consumers . Systems infected through phishing campaigns Attack.Phishing act as an entry point for attackers to gain access Attack.Databreach to sensitive business or personal information. ” reads the US-CERT warning . “ US-CERT encourages users and administrators to review an airline Security Advisory ( link is external ) and US-CERT ’ s Security Tip ST04-014 for more information on phishing attacks Attack.Phishing . ” The US-CERT specifically references the security advisory published by Delta Air Lines that warned its consumers of fraudulent activities . “ Delta has received reports of attempts by parties not affiliated with us to fraudulently gather customer information in a number of ways including : fraudulent emails , social media sites , postcards , Gift Card promotional websites claiming to be Attack.Phishing from Delta Air Lines and letters or prize notifications promising free travel , ” states the Delta Air Lines warning . Barracuda confirmed that these campaigns have a high success rate : “ Our analysis shows that for the airline phishing attack Attack.Phishing , attackers are successful over 90 percent of the time in getting employees to open airline impersonation emails , ” concluded Cidon . “ This is one of the highest success rates for phishing attacks Attack.Phishing . ”

As thousands of freshmen move into their dorms for the first time , there are plenty of thoughts rushing through their minds : their first time away from home , what cringey nickname they 're gon na try to make a thing , if there are any parties before orientation kicks off . One thing that probably is n't on their minds is whether they 're going to get hacked . But that 's all Carnegie Mellon University 's IT department thinks about . Back-to-school season means hordes of vulnerable computers arriving on campus . The beginning of the semester is the most vulnerable time for a campus network , and every year , with new students coming in , schools have to make sure everything runs smoothly . Carnegie Mellon 's network gets hit with 1,000 attacks a minute -- and that 's on a normal day . Cybersecurity is an increasingly important aspect of our everyday lives , with technology playing a massive role in nearly everything we do . Universities have been vulnerable to attacks Attack.Databreach in the past , with cybercriminals stealing Attack.Databreach student and faculty databases and hackers vandalizing university websites . Students are often targets for hackers , even before they 're officially enrolled . Considering how much money flows into a university from tuition costs , along with paying for room and board , criminals are looking to cash in on weak campus cybersecurity . A bonus for hackers : Admissions offices often hold data with private information like student Social Security numbers and addresses , as well as their families ' data from financial aid applications . Phishing Attack.Phishing happens when hackers steal Attack.Databreach your passwords by sending Attack.Phishing you links to fake websites that look like Attack.Phishing the real deal . It 's how Russians hacked the Democratic National Committee during the presidential election , and it 's a popular attack to use on universities as well . The latest warning , sent Monday , called out malware hidden in a document pretending to be Attack.Phishing from Syracuse University 's chancellor . Digging through my old emails , I found about 20 phishing Attack.Phishing warnings that had gone out during the four years I 'd been there . Syracuse declined to comment on phishing attacks Attack.Phishing against the school , but in a 2016 blog post , it said the attacks were `` getting more frequent , cunning and malicious . '' The school is not alone . Duo Security , which protects more than 400 campuses , found that 70 percent of universities in the UK have fallen victim to phishing attacks Attack.Phishing . Syracuse , which uses Duo Security , fights phishing attacks Attack.Phishing with two-factor authentication , which requires a second form of identity verification , like a code sent to your phone . But it just rolled out the feature last year . Kendra Cooley , a security analyst at Duo Security , pointed out that students are more likely to fall for phishing attacks Attack.Phishing because they have n't been exposed to them as frequently as working adults have . Also , cybercriminals know how to target young minds . `` You see a lot of click-bait phishing messages like celebrity gossip or free travel , '' Cooley said . All students at Carnegie Mellon are required to take a tech literacy course , in which cybersecurity is a focus , said Mary Ann Blair , the school 's chief information security officer . The school also runs monthly phishing campaigns Attack.Phishing : If a student or faculty member falls Attack.Phishing for the friendly trap Attack.Phishing , they 're redirected to a training opportunity . When your network is being hit with at least two phishing attempts Attack.Phishing a day , Blair said , it 's a crucial precaution to keep students on guard . `` It 's just constantly jiggling the doorknobs to see if they 're unlocked , '' Blair said . `` A lot of it is automated attacks . '' It 's not just the thousands of new students that have university IT departments bracing for impact , it 's also their gadgets . `` All these kids are coming on campus , and you do n't know the security level of their devices , and you ca n't manage it , because it 's theirs , '' said Dennis Borin , a senior solutions architect at security company EfficientIP . A lot of university IT teams have their hands tied because they ca n't individually go to every student and scan all their computers . Borin 's company protects up to 75 campuses across the United States , and it 's always crunch time at the beginning of the semester . `` If I was on campus , I would n't let anybody touch my device , '' Borin said . `` So if somebody has malware on their device , how do you protect against an issue like that ? '' Instead of going through every single student , Borin said , his company just casts a wide net over the web traffic . If there 's any suspicious activity coming from a specific device , they 're able to send warnings to the student and kick him or her off the network when necessary . Keeping school networks safe is important for ensuring student life runs smoothly . A university that had only two people on its team reached out to EfficientIP after it suffered an attack . All of the school 's web services were down for an entire week while recovering from the attack , Borin said . Scam artists love to take advantage of timing , and the back-to-school season is a great opportunity for them . There was an influx of fake ransomware protection apps when WannaCry hit Attack.Ransom , as well as a spike in phony Pokemon Go apps stuffed with malware during the height of the game 's popularity . If there 's a massive event going on , you can bet people are flooding the market with phony apps to trick Attack.Phishing victims into downloading viruses . A quick search for `` back to school apps '' in August found 1,182 apps that were blacklisted for containing malware or spyware , according to security firm RiskIQ . Researchers from the company scanned 120 mobile app stores , including the Google Play store , which had more than 300 blacklisted apps . They found apps for back-to-school tools ; themes and wallpapers for your device ; and some apps that promised to help you `` cheat on your exams . '' Though most of the blacklisted apps are poorly made games , others pretend to help you be a better student . Other warning signs to watch out for when it comes to sketchy apps are poorly written reviews and developers using public domain emails for contacts , Risk IQ said . For any educational apps , like Blackboard Learn , you should always check the sources and look for the official versions . New students coming to school have enough to worry about . Let 's hope a crash course in cybersecurity is enough to ensure they make it to graduation without getting hit by hacks .

A Ukrainian cybercrime operation has made an estimated $ 50 million by using Google AdWords to lure Attack.Phishing users on Bitcoin phishing sites . The operation has been temporarily disrupted this month when Ukrainian cyber police shut down servers hosting some of the phishing sites , acting on information they received from Cisco 's Talos security division . No arrests were made , and it 's very likely that the group will make a comeback in the future . The group —which Cisco tracked internally under the codename of Coinhoarder— has been operating for years , but appears to have used the same scheme since February 2017 , possibly earlier . Crooks purchase so-called typosquatted domains that imitate Attack.Phishing the real Blockchain.info Bitcoin wallet management service . Coinhoarder operators then set up Attack.Phishing phishing pages on these domains that log users credentials , which they later use to steal funds from users ' accounts . According to Cisco , instead of using malvertising or spam campaigns , crooks buy legitimate ads via the Google AdWords platform and place links Attack.Phishing to their phishing sites at the top of Bitcoin-related Google search results . This trick is not only simple to execute but very effective . Cisco reported that based on DNS query data , ads for one domain roped in over 200,000 users . It is believed the group lured Attack.Phishing tens of millions of users to its phishing sites . It is unclear how many users tried to log in on the fake sites , but after tracking down various thefts reported on social media and involving some of the Coinhoarder groups typosquatted domains , Cisco says the group made around $ 50 million worth of Bitcoin in the past three years . For example , in one campaign that took place from September 2017 to December 2017 , the group made around $ 10 million , while in another campaign that lasted 3.5 weeks , the group made another $ 2 million . Researchers also point out that crooks used geo-targeting filters for their ads , targeting mostly Bitcoin owners in Africa . `` This threat actor appears to be Attack.Phishing standing up phishing pages to target potential victims African countries and other developing nations where banking can be more difficult , and local currencies much more unstable compared to the digital asset , '' researchers said in a report published yesterday . `` Additionally , attackers have taken notice that targeting users in countries whose first language is not English make for potentially easier targets . '' Cisco says it tracked down the phishing sites hosted on the servers of a bulletproof hosting provider located in Ukraine —Highload Systems . This is where Ukraine 's cyber police department intervened and took down servers . According to Cisco , the Coinhoarder group is by far the largest phishing operation Attack.Phishing that has targeted Blockchain.info , the biggest Bitcoin wallet service online . Bleeping Computer , too , has spotted increases in phishing campaigns Attack.Phishing targeting Blockchain.info in December 2016 and December 2017 . Among the new tricks detected by Cisco since our previous reports , crooks have started using Let 's Encrypt certificates to make their phishing sites load via HTTPS , and have also incorporated homograph attacks .

Bristol Airport authorities were recently forced to take their flight information system displays offline for two days to contain a ransomware attack Attack.Ransom . The authorities dismissed the ransom demand Attack.Ransom and decided to rebuild the affected systems . For two days , flight status information was displayed on whiteboards and there was an increase in announcements over the speakers . Similarly , in the last few months there have been several cyberattacks targeting hospitals , city administration and sporting events . The servers of the US-based PGA were reportedly hit by ransomware Attack.Ransom attacks right before the PGA Championship in the first week of August . A new ransomware called Everlasting Blue Blackmail Virus , which targets Windows PCs using spam and phishing campaigns Attack.Phishing , flashes former US President Barrack Obama ’ s image with the ransom message . Once the ransomware gains entry into the system , its looks for all .exe ( executable ) files and encrypts them , preventing users from running apps until the ransom is paid Attack.Ransom . Hot on the heels of the cyberattack Attack.Ransom on the town of Valdez in Alaska , Canadian town Midland in Ontario was hit by a ransomware attack Attack.Ransom in the first week of September . Hackers broke into the city database involving fire , water , and waste management and blocked access , demanding ransom Attack.Ransom . A major concern for cybersecurity experts is the fileless attacks , which are hard to detect . These attacks do not install a malicious software to infiltrate a victim ’ s computer , which makes it difficult for anti-virus solutions to detect them . According to Ponemon Institute , 35 % of all cyberattacks in 2018 were fileless , while security solution provider Carbon Black claims that fileless attacks accounted for 50 % of all successful data breaches Attack.Databreach targeting financial businesses . Fileless attacks target legitimate Windows tools such as PowerShell ( a scripting language which can provide hackers unrestricted access to Windows API ) and Windows Management Instrumentation ( used by admins ) . By latching on to these tools , hackers gain control over the PC and eventually the organization ’ s database . In another recent development , researchers at F-Secure have come across a new vulnerability affecting PCs . Dubbed as cold boot , the attack can be carried off using a special programme through a USB drive connected to a PC . Using the programme , the hacker can disable the memory overwriting by rebooting the system , without a proper shutdown . The attack can be used to break into company system which might have access to the company network .

“ Over the past several weeks , we have seen a combination of attack techniques . One , where an attacker impersonates a travel agency or someone inside a company . Recipients are told an email contains an airline ticket or e-ticket , ” said Asaf Cidon , vice president , content security services at Barracuda Networks . Attachments , he said , are documents rigged with malware or are designed to download it from a command and control server . Cidon said other aviation-themed phishing attacks Attack.Phishing contain links to spoofed Attack.Phishing airline sites . In these types of attacks , adversaries go to great lengths to spoof Attack.Phishing the airline ’ s site . “ It ’ s clear there is some degree of advanced reconnaissance that takes place before targeting individuals within these companies , ” Cidon said . Recent phishing campaigns Attack.Phishing , he said , are targeting logistic , shipping and manufacturing industries . Barracuda ’ s warning comes a week after the U.S. Computer Emergency Readiness Team issued an alert of similar attacks targeting airline consumers . It warned email-based phishing campaigns Attack.Phishing were attempting to obtain credentials as well . “ Systems infected through phishing campaigns act as an entry point for attackers to gain access Attack.Databreach to sensitive business or personal information , ” according to the US-CERT warning . Delta said some victims were sent Attack.Phishing emails that claimed to contain invoices or receipts inside attached documents . When asked about the warning , Delta declined to comment . More troubling to Barracuda researchers was the success rate adversaries are having with phishing campaigns Attack.Phishing it is tracking Attack.Phishing . “ Our analysis shows that for the airline phishing attack Attack.Phishing , attackers are successful over 90 percent of the time in getting employees to open airline impersonation emails , ” Cidon wrote in a research note posted Thursday . “ This is one of the highest success rates for phishing attacks Attack.Phishing ” . In June , Microsoft Malware Protection Center reported a resurgence in the use of Office document macro attacks . Researchers say crooks attempting to install malware and perpetrate credential-harvesting attacks Attack.Databreach are more likely to use social engineering to trick Attack.Phishing people into installing malware than to exploit vulnerabilities with tools such as exploit kits .

Just in time for President Trump ’ s meeting with Chinese President Xi Jinping this week , and following The US Secretary of State ’ s recent visit to China , Fidelis Cybersecurity made a troubling discovery of a possible cyber-espionage sponsored by that country , which it ’ s calling Operation Tradesecret . In late February , the Fidelis threat research team observed Scanbox malware embedded on specific webpages on the National Foreign Trade Council ( NFTC ) site , whose members are key private-sector players involved in lobbying US foreign trade policy . Scanbox provides multiple capabilities to threat actors . It can be used to determine the versions of applications , as well as other selected tools , such as JavaScript keyloggers , running on the target 's machine . Information gathered from this reconnaissance can be used in targeted phishing campaigns Attack.Phishing , with the goal of exploiting specific vulnerabilities on end-user devices . Indicators show the attackers are part of the global China-backed hacking group APT10 , whose actions have extended to organizations in Japan . Scanbox was previously reported to have been used by multiple Chinese actor groups , including those thought to be behind well-publicized , massive intrusions at Anthem Healthcare and the US Office of Personnel Management ( OPM ) breaches . “ In the research community , Scanbox has exclusively been known to have been used by threat actors associated with , or sponsored by , the Chinese government , ” researchers said in an analysis . “ Our most recent observation of the use of Scanbox was on a Uygher political site . Subsequent research has revealed artifacts suggesting that a similar campaign was conducted shortly after that involved a site masquerading as Attack.Phishing the Ministry of Foreign Affairs of Japan . In this case , the targets specifically appear to be the NFTC board of directors , who are participants in the dialogue around the composition of the new trade policy framework being formulated within the Trump administration . “ Since the strategic web compromise was observed on the registration page for the board of directors meeting , it can be surmised that the campaign targeted the individuals visiting the site to register for the meeting , ” Fidelis researchers noted . “ We observed a brief , targeted operation in which visitors to select webpages , including those used to register for specific meetings at the NFTC , were served reconnaissance malware known as the Scanbox framework , ” the firm noted . The link from the NFTC site was removed on March 2—but Fidelis believes that the operation had almost certainly concluded by that time .

More cybercriminals used object linking and embedding , or OLE packages , to deliver malware content during the first quarter of 2017 , according to cybersecurity technology and services company PhishMe Intelligence . The cyberthreat trend first was observed in December 2016 , closely associated to the delivery of the Ursnif botnet malware , PhishMe said . The OLE technique abuses Attack.Phishing Microsoft Office documents by prompting Attack.Phishing a victim to double-click an embedded icon to access some type of content . These objects are used to write a script application to the disk that facilitates the download and execution of a malware payload , PhishMe said . This method adds another set of techniques cybercriminals can use to evade anti-analysis and sandbox settings and to successfully infect computer systems , the company said . The threatening documents employ a similar look and feel to Microsoft Office documents using macro elements for malware delivery , but they do not feature the distinctive “ enable macros ” banner , PhishMe said . As a result , these documents defy the expectations for the delivery of malware that have been prominent in recent years . For example , a macro element can display icons or text that instruct a victim to “ enable editing ” in order to interact with a document and view content , but a document using the threatening OLE packages will not feature the characteristic yellow “ enable macros ” banner . The technique allows cybercriminals to deploy malicious files to a victim ’ s machine . Real and fake documents look similar , and the fake ones can fool Attack.Phishing even computer users who know what a macro looks like . A screen shot of the OLE Malware There are several reasons why these recent phishing campaigns Attack.Phishing distributing infected Microsoft OLE packages are particularly tricky Attack.Phishing to deal with , said Rohyt Belani , co-founder and CEO of PhishMe . “ First , because the malware is disguised as Attack.Phishing an unassuming Office document , threat actors can often use this technique to bypass the IT department ’ s sandbox environments , detection software or analysis tools that help identify malicious documents , attachments and links , ” Belani said . “ Second , since so many healthcare organizations rely on Microsoft Office applications to run their day-to-day business operations , security professionals can ’ t completely block Office documents entirely from e-mail systems . When technology layers fail and let these types of threats land in the inbox , there ’ s really one last line of defense to ensure these attacks don ’ t succeed – the employees themselves , Belani said . “ Humans , the end-users , are the linchpin for securing against attacks delivering sneaky payloads that easily bypass existing technology stacks , ” Belani said . “ We recommend healthcare CISOs seriously consider building strong phishing defense programs that transform employees into human sensors at the heart of the phishing defense strategy. ” Through behavioral conditioning , employees will become contextually aware of the e-mail content that enters their inbox , increasing their ability to recognize and report suspicious communications that very well may be phishing threats like OLE payloads , Belani said . “ By empowering employees to report suspicious e-mails directly to a healthcare organization ’ s security operations center , ” Belani added , “ this will drastically speed incident response capabilities to neutralize these threats before any major damage is inflicted . ”

A new ransomware-as-a-service ( RaaS ) has reportedly emerged , offering cybercriminals on the dark web the option of using ransomware created by someone else in exchange for subscription payments . According to a report by ZDNet , independent security researcher going by the Twitter handle Xylitol uncovered the Satan malware as part of the Gen : Trojan.Heur2.FU malware family . Satan now however has been launched as part of a RaaS platform , which allows prospective cybercriminals access to ransomware in exchange for 30 % of the revenues generated . Once a victim has been infected with Satan via either malicious links or phishing campaigns Attack.Phishing , the victim 's files are encrypted and the attackers instruct Attack.Ransom the victims about ransom demands Attack.Ransom . Satan reportedly contains a HTML file that claims that restoring the encrypted files are impossible . According to researchers , this claim is not unfounded , indicating that the only way victims can regain access to their stolen files is by paying up the demanded ransom Attack.Ransom . Satan 's ransom note instructs Attack.Ransom victims to install the Tor browser and then redirected to an .onion link to make the ransom payments . The ransom amount varies according to the specification of the cybercriminals using the RaaS platform . Those interested in the RaaS ' services must connect a Bitcoin wallet to their account and point out a cost for decryption . Satan RaaS comes with several features , including fee payment records , transaction tracking , ransomware version releases and more . The platform provides hackers with tips on how to customise ransomware demands . Satan also helps hackers learn how to set up gateway proxies , and how to test their malware on systems . The platform also provides hackers with the option of translating their malware into different languages .

For all the sophisticated tactics , techniques , and procedures employed by threat actors these days , phishing Attack.Phishing continued to be the top attack vector in 2016 , as it has been for some time . The big difference was that instead of targeting financial services companies , phishers increasingly targeted cloud storage service providers like Google and DropBox , security vendor PhishLabs said in a voluminous report on phishing trends released this week . Compared to 2013 , when barely 10 % of phishing attacks Attack.Phishing targeted cloud storage services , about 22.5 % of phishing attacks Attack.Phishing last year involved such companies . That was just barely below the 23 % of phishing scams Attack.Phishing involving financial brands , the company noted . What that means is that users are likely going to get more phishing emails this year trying to get them to part with credentials to their cloud storage credentials . `` Over the last four years , the number of phishing attacks Attack.Phishing targeting cloud storage services has skyrocketed , '' says Crane Hassold , senior security threat researcher at PhishLabs . `` Based on recent trends , it is likely that phishing attacks Attack.Phishing targeting cloud storage services will overtake financial institutions as the top target for phishers in 2017 . '' So far at least , almost all phishing attacks Attack.Phishing impacting this industry have involved only Google and DropBox . Many of the phishing campaigns Attack.Phishing targeting cloud storage providers contain lures Attack.Phishing saying that a document or picture has been shared with the victim and encourage them to sign in to their account in order to view it . A majority of the phishing pages involved in such campaigns Attack.Phishing have really been poor duplicates of the pages used by Google , DropBox , and other legitimate sites . Even so , `` based on the growing popularity of these types of attacks Attack.Phishing , phishers must still be having success compromising victim even with this lack of authenticity , '' Hassold says . The PhishLabs report is based on an analysis of some one million confirmed phishing sites spread across more than 170,000 unique domains , and also from the company ’ s handling of more than 7,800 phishing attacks Attack.Phishing per month in 2016 . The analysis showed an alarming increase across the board in phishing-related activities Attack.Phishing . The number of phishing sites in 2016 , for instance , was 23 % higher than the year before , while the volume of phishing emails grew by an average of 33 % across financial services , cloud storage/file hosting , webmail/online , payment services , and ecommerce sites . PhishLabs identified a total of 976 brands belonging to 568 organizations that cybercriminal used in phishing campaigns Attack.Phishing last year . The kind of data that phishers went after also broadened considerably last year . In addition to account credentials and personal data , phishers also used their phishing lures Attack.Phishing to try and snag financial , employment , and account security data like answers to challenge/response questions and mother ’ s maiden name . Ransomware 's Best Friend In 2016 , phishing Attack.Phishing also continued to be by far the most prevalent method for delivering ransomware on everything from end user systems to systems belonging to businesses , government agencies , schools , and critical infrastructure targets . The use of email as an authentication measure made it easier for phishers to mass harvest Attack.Databreach credentials for all email services on a single phishing site , instead of having to target email providers individually , Hassold says . `` Additionally , because a growing number of Web services are using email as a primary credential , phishers are able to multiply their profits by conducting password reuse attacks against these unsuspecting targets , '' he says . The easy availability of phish kits , or ready-to-use templates for creating working phishing sites , contributed to the problem . Many of these kits included sophisticated anti-detection mechanisms . Mechanisms included access control measures based on IP address , HTTP referrer , and hostname , whitelists , and blocklists . `` The big takeaway is that we ’ ve created ideal conditions for the mass harvesting Attack.Databreach of credentials via phishing attacks Attack.Phishing , '' Hassold notes . Unlike in the past where phishers were focused on immediate gains—by going after and selling access to financial accounts for instance—they are now trying to maximize the information they can compromise with the least effort .

The malware asks for Attack.Ransom 222 Bitcoin but will not honor promises to decrypt files after payment is made Attack.Ransom . The cost of ransomware reached close to $ 1 billion in 2016 , and it 's not hard to see why . The malware family , which targets everything from Windows to Mac machines , executes procedures to encrypt files and disks before demanding a ransom payment Attack.Ransom in return for keys to decrypt and unlock compromised machines . However , it is not only the general public which is being targeted with everything from hospitals to schools and businesses now in the firing line . As the prospect of losing valuable content on computer systems or facing widespread disruption to business operations is often too much to bear , many will simply give up and give in , paying the fee and unfortunately contributing to the cybercriminal 's operations . However , paying up Attack.Ransom does not guarantee that victims will get their files back , no matter how low or high the payment demand Attack.Ransom . This week , ESET researchers discovered that a Linux variant of KillDisk , linked to attacks against core infrastructure system in Ukraine in 2015 , is now being used against fresh Ukrainian financial targets . The ransomware demands Attack.Ransom a huge amount of money , but there is no underwritten protocol for decryption keys to be released once payment is made Attack.Ransom . Distributed through phishing campaigns Attack.Phishing targeting both Windows and Linux , once downloaded , the ransomware throws up a holding page referring to the Mr . Robot television show while files are being encrypted , the research team said in a blog post . Unsurprisingly , no-one has paid up yet , nor should they , ever . `` This new variant renders Linux machines unbootable , after encrypting files and requesting a large ransom Attack.Ransom , '' ESET says . `` But even if victims do reach deep into their pockets , the probability that the attackers will decrypt the files is small . '' Files are encrypted using Triple-DES applied to 4096-byte file blocks and each file is encrypted using different sets of 64-bit encryption keys . However , the ransomware does not store encryption keys either locally or through a command-and-control ( C & C ) server , which means that affected systems after reboot are unbootable , and paying the ransom Attack.Ransom is pointless . `` It is important to note -- that paying the ransom demanded Attack.Ransom for the recovery of encrypted files is a waste of time and money , '' the team said . `` Let us emphasize that -- the cyber criminals behind this KillDisk variant can not supply their victims with the decryption keys to recover their files , despite those victims paying Attack.Ransom the extremely large sum demanded Attack.Ransom by this ransomware . '' There is a weakness in the encryption used by the ransomware , which makes recovery possible -- at least when it comes to Linux infections . Earlier this week , researchers at Check Point revealed the latest exploits of the GoldenEye ransomware , a strain of malware which is targeting German HR companies . The malware is contained in phishing emails which appear to be from job applicants , and once downloaded and installed , demands Attack.Ransom $ 1000 in Bitcoin to unlock infected systems