Linux Professional Institute

Tactical malware infection process

Script kiddies, scammers and hacker are implementing new ways and strategic advancements on customers, businesses and the corporate world, searching for bits and bytes. The most recent technique observed by our researchers is the “hijacking” of legitimate invoices sent by companies so that the account number is changed to that of the scammers. Some cases we have seen involved scammers attacking the email server to change the details on the invoices. Others were just fake invoices emails sent without the need to hack the email server, but which were effective provided they went out before the legitimate invoices." First, the user will receive an email disguised as routine notification, most commonly an INVOICE, BILL or RECEIPT.

Unfortunately this email normally includes attachments, typically JavaScript (JS) file or Office file containing malicious macros. After the user Open the email with the attachment, it then executes a PowerShell script to download malware onto the users system. In addition the downloaded malware when initiated is typically a ransomware. Office macro downloaders (W97M.Downloader and variants) and JavaScript downloaders (JS.Downloader and variants) are the most commonly used downloaders.

Did you know the largest malware spamming operations tend to rely on social engineering tricks. Also the groups involved in mass-mailing campaigns continually refine their tactics in a bid to stay one step ahead of email security systems. However, this figure does still mean that the majority of inbound business emails are spam. Spam is generally considered to be any unsolicited email that is sent in bulk and in some cases may not contain malicious threats. Spam emails can just be annoying or unwanted or they may lead to sites that carry out click fraud. By tricking users with tactical keywords like “Invoice” “Order,” “Payment,” and “Bill”

Email malware hit businesses of all sizes. However, small- to medium-sized businesses were the most impacted, according to the figures. CG-Canada research found scammers to be an evolution of the famous Nigerian 419 scams; almost half of the email addresses analyzed had Nigerian IP addresses. Emails are sent Monday to Friday, following a standard working week, and generally contain innocuous subject lines, featuring words such as “Request,” “Payment,” “Urgent,” etc. Other tactic is to disguise emails as coming from a scanner, printer, or multifunction device (MFD).
 

Another tactic is to disguise malicious spam campaigns as some kind of email delivery failure 

message. Spamming operations using JavaScript and Office macro downloaders are operated by different cyber criminal groups. Malware groups can hire either (or both) channels to deliver their threats. While major email threat groups are relying primarily on the use of first-stage downloaders to install their final payload, typically ransomware. Office documents containing malicious macros were the most common form of downloader being used in spam campaigns. However, there was a shift and, since then, JavaScript downloaders have dominated. This increase in email malware is linked to ongoing activity by mass-mailing malware groups,

Best practices

• Always keep your security software up to date to protect yourself against ransomware.

• Keep your operating system and other software updated. Software updates will frequently include patches for newly discovered security vulnerabilities that could be exploited by ransomware attackers. Email is one of the main infection methods.

• Delete any suspicious-looking email you receive, especially if they contain links and/or attachments.

• Be extremely wary of any Microsoft Office email attachment that advises you to enable macros to view its content. Unless you are absolutely sure that this is a genuine email from a trusted source, do not enable macros and instead immediately delete the email.

• Backing up important data is the single most effective way of combating ransomware infection. Attackers have leverage over their victims by encrypting valuable files and leaving them inaccessible. If the victim has backup copies, they can restore their files once the infection has been cleaned up.

• Using cloud services could help mitigate ransomware infection, since many retain previous versions of files, allowing you to “roll back” to the unencrypted form.

Browse with confidence knowing your internet browser is safe and secure. Many users thinks its okay to surf the web on outdated programs and machines. However it’s users who follows inexperience advices normally suffers from attacks on their machines or devices. The amount of misconfigured browser surfing the internet today is staggering.

Confidence browsing is term stating how secure your browsing experience is while on the net. The big five of browsers have collaborated and decided to stand on internet crimes and defend those who can’t. Opera, Google Chrome, Microsoft internet Edge, Mozilla Firefox and Apple Safari all agreed with dispatching bug bounty programs that gather reliable data and eradicate the issue.

Although the big five urge users to be vigilant, some unwillingly fall under the specifications for the guideline to systems and devices. But some of the big five still carry support for certain types of browsers. Continuing try to reduce the use of older systems and devices on the internet. Because an infected system or device can attack hundreds if not thousands.

Follow the guidelines, abide by your software updates terms and confidence browse. Rid yourself of the trouble of falling victim to cyber crime. And enjoy your reading, movies or that long distant video chat you are eager to receive. Rely on a well configured, updated and secure browser and stay focus on what you do best.

Lack of knowledge played an significant role for vulnerabilities across the internet. Like the “low-hanging fruit”, the “scape goat”. That once been exploited by scammers, phishing and other malicious programs. The brook is dry for the actors are no longer there. Like so are the big five who address these issues and problems on a daily basis.

Best Practices: Regularly assess your website for any vulnerabilities. Scan your website daily for malware. Set the secure flag for all session cookies. Secure your websites against man-in-the-middle (MITM) attacks and malware infection. Choose SSL Certificates with Extended Validation to verify protection and display the green browser address bar to website users. Display recognized trust marks in highly visible locations on your website. Be picky about your plugins. The software you use to manage your website may come with vulnerabilities too. The more third-party software you use, the greater your attack surface, so only deploy what’s absolutely necessary. Email: Malware, spam, and phishing Page 24 istr-22-2017-en.pdf

Bit hunters are users who search the internet with modified computer, softwares and external hardwares. These hunter quarry are like cryptic money, identity information and so on. Study shows how organizations, corporations or small businesses actually expose their experience with cyber-attack. Cyber-attack claims over hundreds of businesses with loss time, resources out of pocket expenses and paying ransom. Resulted from the attacks on digital information, cyber security awareness training. 

Ninety six percent of survey shown how the take away from cyber security training was nearly effective. How can we retain information, how fast, are we adapting to constant changes. Only twenty two percent of who conducted training actually made a difference with monthly performance rate increase.

Cyber security training is inevitable; as of now only forty one percent of respondents holds a training certificate.

Amongst those service provides that were victimized, only thirteen percent acknowledged the damage done by cyber crimes. Victims also suffers damages to their reputations. "The law of defamation protects a person’s reputation from harm that is unjustified" however, cyber crimes are difficult to prove.

Canadians deserve a better internet, which indicated that only 19 per cent of Canadians would continue to do business with an organization if their personal data were exposed in a cyber-attack.

Forty three per cent of respondents were unaware of the mandatory breach requirements of PIPEDA. Of those businesses that were subject to a data breach, only fifty eight per cent reported it to a regulatory body; 48 per cent to their customers; forty per cent to their management and twenty one per cent to their board of directors. forty three per cent of respondents who said they didn’t employ dedicated cybersecurity resources cited lack of resources as the reason.

Protect you digital information, bit miners lurks behind every clicks. A lot has happened since the last cybersecurity survey. The good news is that more attention, time and resources are being directed towards cybersecurity. The Canadian Centre for Cyber Security entered the scene, the federal government unveiled its CyberSecure cyber certification program, and the revamped