Email Phising Archives - CT Link Systems, Inc.

Security Advisory: Malicious Attacks using COVID 19 are becoming more widespread

Due to recent events, many of us have had to do significant life changes be it personal or work related. This has affected many of us globally and even created a trend that many are using to their advantage, such as people making profit off shipping masks to other countries. So, it comes to no surprise that many cyber criminals are also using this to their advantage. According to Trend Micro, there has been a surge of malicious attacks being detected that have been using the COVID 19 as a lure to infect unsuspecting users.

From the duration of January 1, 2020 – March 27, 2020, Trend Micro’s Smart Protection Network blocked more than 300,000 threats using the COVID 19. They found that 65% of the attacks were in the form of spam emails while other 35% were malware related or malicious URLs. Around 56% of malicious URLs are phishing attacks, so making sure your workforce is properly educated on how to spot these attacks is crucial in keeping your company safe. Around 80,000 files used in spam that had the keyword COVID were mostly Trojan files, the others were in different malware families, only a handful were ransomware related.

Defending your Workforce from COVID related threats

Below are a few tips in which your workforce can follow to help minimize the risk of falling for COVID related scams:

Use a company device for remote work if possible

If possible, use company issued devices. Personal devices may not have as much security controls then company owned devices. Do not use company devices for anything unrelated to work.

Prepare a backup solution at home

Preparing a backup with what you have on hand (USBs, external hard drives, etc.) is better than not preparing in case anything goes wrong.

Be wary of online scams

Unfortunately, there will be people using this crisis to scam or make money of people who are currently on high alert. Let us remember to always be vigilant and look out for suspicious emails or URLs, especially if they are unverified and currently using COVID in their filename or URL.

For those who wish to add more security to their current mobile workforce, Trend Micro’s Smart Protection suite and Worry-Free Business Security can help you detect and block these malicious threats.

As an added layer of defense, Trend Micro™ Email Security thwarts spam and other email attacks. The protection it provides is constantly updated, ensuring that the system is safeguarded from both old and new attacks involving spam, BEC, and ransomware.

To learn more about how to better protect your workforce with Trend Micro solutions, you can send an email to marketing@www.ctlink.com.ph and we would be happy to answer your inquiries!

Security Tips: Business Email Compromise (BEC) Schemes

Business Email Compromise (BEC) Schemes

In the past few years, millions of dollars have been lost to fraudsters and scammers. However, not all have been lost through malware attacks such as ransomware. Business email compromise (BEC) schemes are sophisticated attacks focused mostly on companies who do wireless transfers frequently. The FBI have estimated that nearly $750 million dollars have been lost to this type of schemes and affected more than 7,000 people between October 2013 and August 2015. Below are a few versions of the scheme:

The Bogus Invoice Scheme

Referred to as “The Bogus Invoice Scheme”, “The Supplier Swindle”, and “Invoice Modification Scheme”. This scam is usually done by using the name of established partners of the business, they impersonate being an employee of the established partner while asking for wire funds for invoice payments to their fraudulent account by using a spoofed email, telephone, or facsimile.

CEO Fraud

Also referred to as “CEO Fraud”, “Business Executive Scam”, “Masquerading”, and “Financial Industry Wire Frauds”. The scammers impersonate high-level executives (CFO, CEO, CTO, etc.), lawyers, or other types of legal representatives while urging the victim that they are handling confidential and time-sensitive matters then pressuring the victim into wire transferring funds to a separate account which they control.

Account Compromise

In this scam, an email account of an employee is hacked and then used to make requests for invoice payments to fraudster-controlled bank accounts. Messages are sent to multiple vendors identified from the employee’s contact list.

Data Theft

This scam usually involves compromising an email of a role-specific employees (usually HR) in the victim’s company, then using the said email to gather identifiable information of other employees and executives which is later used as a jump-off point for more damaging BEC attacks to the company later on.

Below are some quick prevention tips on how you can avoid these types of attacks:

Prevention tips

Carefully scrutinize all emails. Be wary of irregular emails that are sent from C-suite executives, as they are used to trick employees into acting with urgency. Review emails that request transfer of funds to determine if the requests are irregular.
Educate and train employees. While employees are a company’s biggest asset, they’re also usually its weakest link when it comes to security. Commit to training employees according to the company’s best practices. Remind them that adhering to company policies is one thing, but developing good security habits is another.
Verify any changes in vendor payment location by using a secondary sign-off by company personnel.
Stay updated on your customers’ habits including the details, and reasons behind payments.
Confirm requests for transfer of funds when using phone verification as part of two-factor authentication, use known familiar numbers, not the details provided in the email requests.

To learn more about BEC attacks, you can read a more in-depth article from our partner’s, Trend Micro, informative article here. If you have inquiries that you would like answered about this topic, you can also contact us at 893-9515 and we will be happy to help!