This is Security Awareness focused newsletter I put together for distribution internally at my company. Feel free to take and use for your own program.

Medusa Ransomware Analysis 

In June 2024, ReliaQuest detected the Medusa ransomware, which encrypted multiple hosts in a customer environment. Medusa, active since 2022, exploits unpatched vulnerabilities and hijacks legitimate accounts. The attack lifecycle includes initial access via a compromised VPN account, credential access through NTDS dumps, and lateral movement using RDP. Medusa employs living-off-the-land techniques, PowerShell for credential dumping, and service installations for persistence. Enhanced VPN configurations, endpoint visibility, and automated responses are critical to mitigating such ransomware threats. 

Key Takeaways: 

• Medusa exploits unpatched vulnerabilities and legitimate accounts. 

• Uses living-off-the-land techniques for stealth. 

• Mitigation includes enhanced VPN security, endpoint visibility, and automated responses. 

For detailed insights, read the full report here. 

 

 

Teen Sextortion on the Rise 

Overview: Sextortion targeting teenagers is on the rise, exploiting their trust and vulnerabilities on social media. Criminals pose as peers or love interests to coerce explicit images, which they then use for blackmail. 

Key Points: 

• Tactics: Attackers use fake profiles to build rapport and exchange fake explicit content. 

• Impact: Victims face severe emotional and psychological harm, sometimes leading to tragic consequences. 

• Preventive Measures: Educate teens on online safety, ensure open communication, and use strong privacy settings. 

Action Steps: 

• Educate yourself and your teens about sextortion. 

• Foster open discussions on online interactions. 

• Report incidents promptly. 

• Support victims without blame. 

For more details, visit KnowBe4 Blog. 

 

North Korean Fake IT Worker Infiltration Attempt 

In a recent incident, KnowBe4's SOC detected suspicious activities from a newly hired software engineer, later revealed to be a North Korean fake IT worker using AI to generate a fake identity. Despite rigorous hiring processes, including background checks and multiple video interviews, the individual bypassed security measures and attempted to load malware upon receiving their workstation. 

Key Takeaways: 

• Enhanced Vetting: Improve background checks and resume scanning for inconsistencies. 

• Background check appears inadequate. Names used were not consistent. 

• References potentially not properly vetted. Do not rely on email references only. 

• What to look for: Inconsistencies in information. 

• Discrepancies in address and date of birth across different sources 

• Conflicting personal information (marital status, "family emergencies" explaining unavailability) 

This case underscores the importance of robust hiring and security processes to prevent similar infiltration attempts. 

For a detailed account, visit the full article on KnowBe4's blog. 

 

Phish-Friendly Domain Registry ".top" Put on Notice 

The ".top" domain registry, managed by Jiangsu Bangning Science & Technology Co. Ltd., has been warned by ICANN for its failure to address phishing abuse. Findings revealed that over 4% of new ".top" domains from May 2023 to April 2024 were used for phishing. ICANN's notice demands immediate improvements, or the registry risks losing its license. This highlights the critical need for vigilant monitoring and prompt action against domain abuse to protect users from phishing threats. 

For more information, read the full article on Krebs on Security. 

 

CrowdStrike Phishing Attacks Appear in Record Time 

Recent IT outages have led to a surge in phishing sites exploiting the chaos. Within hours, domains like crowdstriketoken[.]com and crowdstrikefix[.]com emerged, targeting those affected by the outages. Cybercriminals quickly capitalized on the situation, registering 28 domains by early morning. The US Cybersecurity and Infrastructure Security Agency (CISA) urges caution, advising users to avoid suspicious links and verify communications through official channels. Stay vigilant and only rely on trusted sources for updates. 

Key Takeaways: 

• Phishing sites can appear rapidly during crises. 

• Always verify the authenticity of communication channels. 

• Use official websites and trusted sources for updates. 

• Be extra cautious of suspicious domains and links. 

For more details, visit KnowBe4's blog. 

 

Is Your Bank Really Calling? Protect Yourself from Financial Impersonation Fraud 

Summary: With the rise of sophisticated scams, distinguishing between legitimate bank communications and fraudulent attempts is increasingly challenging. Cybercriminals use stolen personal details to make their scams appear genuine, often creating a sense of urgency to exploit victims. 

Key Takeaways: 

• Red Flags: Requests for passwords or OTPs, suspicious links, pressure tactics, unsolicited calls. 

• Protection Tips: Verify calls by contacting your bank directly, trust your instincts, and avoid sharing sensitive information over the phone. 

Recommendations: Stay vigilant and regularly update your security awareness to safeguard against financial fraud. 

For more information, read the full article on KnowBe4 Blog. 

 

 

Building Security into the Redesigned Chrome Downloads Experience 

Google has revamped Chrome’s download interface, adding detailed warnings to protect users from malicious files. The new UI uses AI-powered verdicts from Google Safe Browsing to categorize files as "suspicious" or "dangerous," helping users make informed decisions.  

Key Takeaways: 

• Detailed download warnings improve user decision-making. 

• Enhanced Protection mode automatically scans suspicious files. 

• Stay vigilant and utilize Chrome’s built-in security features. 

For more details, visit Google's Security Blog. 

 

 

Olympics-Themed Scams: Stay Vigilant! 

With the Paris 2024 Olympics approaching, cybercriminals are ramping up their efforts to exploit the excitement. Recent reports show an 80-90% increase in cybercrime targeting French organizations, with scam tactics including typosquatting domains (e.g., oympics[.]com) and Olympic-themed lottery scams impersonating brands like Coca-Cola and Microsoft. These scams target users worldwide, emphasizing the need for heightened vigilance. Always scrutinize unexpected emails and offers, especially those that seem too good to be true. 

Key Takeaways: 

• Increased Cybercrime: Expect more cyber threats as the Olympics near. 

• Typosquatting: Watch out for fake domains mimicking official Olympic sites. 

• Lottery Scams: Be wary of unsolicited emails claiming lottery winnings. 

• Global Target: These scams can affect anyone, not just those in France. 

Stay safe and informed to protect yourself and your organization from these threats. 

For more details, visit KnowBe4's Blog. 

 

 

Beware of Generative AI Tool Scams 

Scammers are exploiting the growing interest in generative AI tools like ChatGPT. Researchers have observed a surge in suspicious domain registrations, especially around significant AI-related announcements. These domains often include keywords like "gpt" and "prompt engineering," and many are used for phishing and other malicious activities. 

Key Takeaways: 

• Suspicious Domains: Be cautious of new domains related to AI tools. 

• Phishing Risks: Verify the legitimacy of AI-related tutorials and tools. 

• Keyword Alerts: Watch out for terms like "gpt" in suspicious contexts. 

Stay alert and informed to protect yourself from these evolving threats. 

For more details, visit KnowBe4's Blog. 

 

 

QR Code Phishing: An Ongoing Threat 

QR code phishing, or "quishing," continues to rise as a significant cyber threat. Cybercriminals exploit QR codes to bypass email security filters and target users directly, often embedding malicious codes in PDFs or images. This method can deceive even vigilant users, leading to compromised personal and financial information. 

Key Takeaways: 

• Bypassing Filters: QR codes can slip through traditional email security. 

• Human Targeting: Scams aim at users’ mobile devices for data theft. 

• Red Flags: Be cautious of QR codes lacking context or asking for excessive permissions. 

Stay informed and cautious to protect against these sophisticated phishing attacks. 

For more details, visit KnowBe4's Blog. 

 

 

New Phishing Tactic: Chat Support Scams 

Cybercriminals are now using fake chat support to add credibility to phishing scams. By mimicking legitimate support chats on spoofed payment pages for platforms like Etsy and Upwork, scammers deceive users into providing sensitive information. These chat features, staffed by scammers posing as support agents, guide victims through the phishing process, making the scams more convincing and harder to detect. 

Key Takeaways: 

• Enhanced Deception: Scammers use fake chat support to build trust. 

• Phishing Risks: Verify the legitimacy of support chats on payment pages. 

• Increased Vigilance: Be cautious of unexpected support interactions. 

Stay informed and vigilant to protect against these sophisticated attacks. 

For more details, visit KnowBe4's Blog. 

 

 

OneDrive Pastejacking: A New Threat to Watch 

A recent discovery highlights a new threat called "pastejacking" targeting OneDrive users. This technique exploits the copy-paste functionality to inject malicious commands into users' clipboards, potentially leading to unauthorized data access or malware installation. Attackers embed harmful code into seemingly innocuous text or files, posing a significant risk to personal and organizational security. 

Key Takeaways: 

• Clipboard Manipulation: Be wary of copying text from unknown sources. 

• Vigilant Practices: Double-check clipboard content before pasting. 

• Update Security Measures: Ensure software is up-to-date to mitigate risks. 

Stay informed and cautious to protect against these evolving threats. 

For more details, visit Trellix's Blog. 

 

 

Fake Leaks of Crypto Wallet Seed Phrases: A Growing Threat 

Scammers are leveraging fake leaks of passwords and seed phrases to target cryptocurrency users. These sophisticated scams involve presenting victims with seemingly real data leaks, enticing them to use malicious crypto management apps. Once installed, these apps steal sensitive information, leading to significant financial losses. 

Key Insights: 

• Fake Data Leaks: Scammers create realistic-looking leaks to deceive users. 

• Malicious Apps: Avoid downloading crypto apps from unverified sources. 

• Increased Vigilance: Always verify the legitimacy of seed phrases and passwords. 

For more details, visit Kaspersky's Blog. 

 

 

Aveanna Healthcare Data Breach: Email Accounts Compromised 

Aveanna Healthcare has experienced a data breach affecting 11 email accounts. The breach, discovered on May 9, 2023, potentially exposed the personal and protected health information (PHI) of patients, including names, Social Security numbers, and medical details. Aveanna has since secured the compromised accounts and is offering affected individuals complimentary credit monitoring and identity protection services. 

Key Takeaways: 

• Data Exposed: Personal and PHI compromised. 

• Immediate Actions: Secure email accounts and monitor credit. 

• Preventive Measures: Implement robust email security protocols. 

For more details, visit HIPAA Journal.