Fake Job Scam Used to Serve Up Malware

fake recruiters, Linkedin, malicious websites, Ophtek, phishing_email, update security software, verify identities, webcams, , , , ,
28
Jan 2025

Threat actors are highly innovative – one recent attack tricked victims into addressing fake webcam and microphone issues to gain system access.

We’re constantly advised to be aware of phishing emails, infected documents, and malicious websites, but what happens when threat actors take a different approach? Well, they increase their chances of breaching your defenses. This is why it’s crucial to keep up to date with developments in the world of cybersecurity. This latest attack targeted professionals on LinkedIn, but it could easily be used in other environments.

Ophtek wants to keep you secure from these types of threats, so we’re going to summarize this attack and show you how to stay safe.

The Interview from Hell

Job interviews are always stressful affairs, but at least they don’t hit you financially. However, there is an exception – the LinkedIn attack. With 1 billion members, LinkedIn is hugely popular and this makes it the perfect target for a threat actor.

Victims are approached on LinkedIn by fake recruiters who claim to be working for crypto firms such as Kraken and Gemini. On offer is the opportunity of a number of high-ranking roles at these firms, and the victims has been specially chosen to apply. Victims who take the bait and then posed a series of long-form questions relating to the crypto industry e.g. which crypto trends will have the most impact in the next 12 months.

It may, at first, seem like any other job interview, but the final question posed requires an answer filmed on video. This is where the breach begins. The threat actor will issue an error message stating that there’s an access issue for the victim’s camera and microphone. The problem is apparently caused by a cache issue but, luckily, the ‘interviewer’ has a set of instructions to fix the error. Unfortunately, following these instructions simply hands the threat actor access to the victim’s PC, where their crypto wallet is likely to be targeted.

How to Stay Safe on LinkedIn

You may have a LinkedIn account, and even if you don’t, it’s important that you know how to defend against a similar attack. The three main ways you can protect your PC are:

For more ways to secure and optimize your business technology, contact your local IT professionals.

Read More

The 5 Best IT Security Practices to Adopt for 2025

AI, cybercrime, Employee Training, Ophtek, secure IoT, security practices, supply chain security, zero trust architecture, , , , , ,
21
Jan 2025

2025 promises to be an exciting year for businesses, but cybercrime will remain a major threat. That’s why strengthening your cybersecurity is essential.

With the costs of cybercrime expected to hit $10.5 trillion in 2025, it’s evident that tackling cybercrime is a major priority for all businesses. However, it’s easy to become complacent with the quality of your defenses. You may feel that 2024 was a quiet year for you in terms of malware, so why change anything? Well, it’s this complacency that threat actors prey upon. Therefore, you need to constantly evolve your defenses to remain safe.

Start Enhancing Your Cybersecurity Today:

You may be wondering where to start, but this is where Ophtek has your back. We’ve pooled our resources and knowledge to bring you the 5 best IT security practices to adopt in 2025:

  1. Train Your Employees to Stay Safe: Your first line of defense against threat actors remains your employees. If your employees understand the threat of malware then you increase your chances of staying safe. However, if they don’t understand the telltale signs of ransomware and trojans, this manifests itself as a major chink in your armor. You can remedy this by conducting regular training sessions to educate and update your team on all the latest threats. This makes your staff less likely to fall victim to scams and protect your systems. 
  2. Use Zero Trust Architecture: Trust is crucial in business, but it can be dangerous when it comes to IT systems. Therefore, adopting a zero trust architecture (ZTA) model can enhance your security practices. ZTA involves enforcing strict identity verification – such as Microsoft Authenticator – and segmenting your networks to restrict access to only those who need it. These practices will minimize the risk of both external and internal threats, optimizing the security of your IT infrastructure.
  3. Secure Your IoT Devices: The number of connected IoT devices is set to grow significantly in the next five years, up to 32.1 billion devices by 2030. Start securing them by checking if any of them are still using default passwords – if they are, change these to strong passwords immediately. It’s also a good idea to segment IoT devices onto separate networks, this limits how far malware can spread through your IT infrastructure in the case of an infection. Finally, make sure that software patches and firmware updates are installed promptly.
  4. Implement AI Cybersecurity: Artificial Intelligence (AI) is increasingly being used to detect and neutralize threats in real time. Capable of analyzing huge amounts of data and identifying unusual activity, AI excels at spotting sophisticated threats before they create a foothold in your networks. This automation allows you to stay ahead of the threat actors and safeguard your systems more effectively than ever. Consequently, exploring options such as IBM’s range of AI tools could make a vast difference to your defenses in 2025.
  5. Maximize Your Supply Chain Security: Threat actors are as innovative as they are dangerous, this is best evidenced by their attempts to target your vendors to gain access to your systems. To keep your business safe, audit the vendors you work with to verify their cybersecurity protocols and compliance. Working closely with your vendors will enable you to limit threat actors exploiting any gaps in security.

For more ways to secure and optimize your business technology, contact your local IT professionals.

Read More

Default Passwords Cause Havoc for Juniper Routers

business router, default passwords, educate staff, Jupiter, Mirai botnet, monitor network, multi factor authentication, router, , , , , , ,
14
Jan 2025

Strong passwords are vital to cybersecurity. A recent botnet attack highlights the serious risks of relying on default passwords instead of secure alternatives.

The Mirai malware, first detected in 2016, has been behind numerous botnet attacks in the past and has been very busy recently. A botnet attack gives a threat actor control over a large number of compromised PCs, allowing the threat actor to combine these infected PCs into a formidable strike force. These attacks often involve data theft, cryptojacking, brute force attacks, and phishing campaigns.

This latest attack was enabled by the presence of default passwords on routers manufactured by Juniper Networks. Default passwords are used on many devices, so it’s important to understand the mechanics behind this attack.

Mirai Starts Infecting Routers

The exploitation of Juniper routers began in mid-December. Customers accessing the internet with Juniper Session Smart routers began to notice unusual behavior with them. The Mirai malware was seen to be scanning specifically for these routers. Once this model of router was found, Mirai proceeded to compromise the router before utilizing it in a distributed-denial-of-service (DDoS) attack.

But what was unique about the Session Smart router? Why was Mirai singling this router out? Well, the answer proved to be simple: it was a router known to ship with a default password. Therefore, a threat actor could easily take control of the router if its password hadn’t been changed. Scan enough Session Smart routers and, eventually, one will be found with the default password still in place.

The main impact of a DDoS attack is a slowdown in PC performance, as all the PC’s resources are being directed into the attack. For a business, this is troubling as the majority of their PCs are likely to be dependent on similar routers. This means that this slowdown in productivity could have a major impact on a business’ performance.

Don’t Fall Victim to Default Passwords

Users of Session Smart routers have been advised to change their password from the default version to a unique and strong one. This is the best advice you can give when it comes to default passwords. Leaving them in place is simply inviting threat actors into your networks. However, there are further measures you can take to secure your devices:

  • Educate Users About Risks: Train your employees to understand the dangers of default passwords. Make sure they understand what is and isn’t a secure password, helping to build a culture of cybersecurity awareness.
  • Use Multifactor Authentication: The beauty of multifactor authentication is that it adds an extra layer of security to your defenses. Therefore, even if one of your passwords is compromised, additional authentication is required to access your devices and networks.
  • Monitor for Default Password Usage: It’s difficult to monitor every device and verify the status of its password, but you can get help with this. Many security tools – such as Kaspersky Industrial CyberSecurity for Networks – can scan devices connected to a network and determine if a default password is being used.

For more ways to secure and optimize your business technology, contact your local IT professionals.

Read More

Remcos RAT Malware Attacks Increase in Q3 2024

malicious downloads, Ophtek, phishing_email, PowerShell script, RAT, Remcos RAT, Remote Access Trojan, , , , , ,
07
Jan 2025

Malware has a habit of going through periods of intense activity, and this is exactly what the Remcos RAT malware has been up to in Q3 2024.

First detected in 2016, Remcos is somewhat of a veteran of the malware scene, but its activity has ramped up significantly throughout 2024. Reaching a peak during Q3 2024, Remcos has the potential to take control of infected machines remotely, hence the Remote Access Trojan (RAT) attachment to its name. This remote access allows the threat actors behind this latest campaign to both harvest data and monitor PC activities in real time. RATs are nothing new in the world of cybersecurity, but any notable surges in activity are always cause for concern.

To help protect your PCs from falling into the clutches of Remcos, we’re going to dive into the story behind it – and RATs in general – to uncover how they work.

Understanding RATs

The concept of a RAT is simple: they give a threat actor unauthorized remote access to a PC. First detected way back in the 1970s, a RAT is a strain of malware which threat actors use to take control, silently and discreetly, of your PCs.

With a RAT installed, the attackers can quickly gain access to all of your data and applications e.g. passwords, webcams, and microphones. This puts your organization at risk of falling victim to espionage and having your secure data compromised. Typically, RATs are spread via phishing emails or malicious downloads.

Behind the Scenes of Remcos’ Latest Attacks

The current Remcos campaign is interesting as, following investigation by McAfee researchers, it’s been discovered that two Remcos variants are currently active. The first Remcos variant uses a PowerShell script to download malicious files from a remote server and then inject it into a genuine Microsoft tool (RegASM.exe) to help conceal it. The second variant of Remcos is transmitted through phishing emails and exploits a known vulnerability (CVE-2017-11882) to give threat actors remote access.

Both variants are particularly virulent and persistent, with a number of innovative design features ensuring that they remain evasive and can operate under the radar. Remcos encodes its data in Base64 to avoid suspicion and also makes a point of not leaving any additional files on infected hard drives. Furthermore, Remcos edits the registry and startup folders in a way which enables it to load back up on every reboot.

Outsmarting Remote Access Trojans

Luckily, you don’t have to fall victim to Remcos or any other RAT attacks as Ophtek has your back. To help you get your defenses optimized, we’re going to share the three best ways to RAT-proof your IT infrastructure:

  • Use Antivirus and Keep Software Updated: Make sure all your PCs are protected by strong antivirus software – such as Kaspersky or AVG – which checks for malicious files in real-time. Alongside this measure, regularly update all your PC software to prevent hackers from exploiting vulnerabilities.
  • Be Cautious of Suspicious Emails: It’s critical that all your staff are mindful of the most identifiable signs of phishing emails. Dedicate part of your IT inductions to highlighting the danger of clicking on unexpected email links or attachments, and carry out refreshers on a regular basis. Ultimately, if an employee receives an email which looks slightly strange, they should always check this with an IT professional before taking action.
  • Practice Strong Password Security: One of the simplest ways to protect your IT systems is by using unique and strong passwords for your PCs and servers. Also, use multifactor authentication where possible, this means that even if an attacker obtains your passwords, there’s a further layer of security standing in their way.

For more ways to secure and optimize your business technology, contact your local IT professionals.

Read More