Blog - Ophtek

The 5 Best IT Security Practices to Adopt for 2025

AI, cybercrime, Employee Training, Ophtek, secure IoT, security practices, supply chain security, zero trust architectureAI, cybercrime, IoT, Ophtek, security, Training, ZTAOphtek, LLC

Jan 2025

2025 promises to be an exciting year for businesses, but cybercrime will remain a major threat. That’s why strengthening your cybersecurity is essential.

With the costs of cybercrime expected to hit $10.5 trillion in 2025, it’s evident that tackling cybercrime is a major priority for all businesses. However, it’s easy to become complacent with the quality of your defenses. You may feel that 2024 was a quiet year for you in terms of malware, so why change anything? Well, it’s this complacency that threat actors prey upon. Therefore, you need to constantly evolve your defenses to remain safe.

Start Enhancing Your Cybersecurity Today:

You may be wondering where to start, but this is where Ophtek has your back. We’ve pooled our resources and knowledge to bring you the 5 best IT security practices to adopt in 2025:

Train Your Employees to Stay Safe: Your first line of defense against threat actors remains your employees. If your employees understand the threat of malware then you increase your chances of staying safe. However, if they don’t understand the telltale signs of ransomware and trojans, this manifests itself as a major chink in your armor. You can remedy this by conducting regular training sessions to educate and update your team on all the latest threats. This makes your staff less likely to fall victim to scams and protect your systems.
Use Zero Trust Architecture: Trust is crucial in business, but it can be dangerous when it comes to IT systems. Therefore, adopting a zero trust architecture (ZTA) model can enhance your security practices. ZTA involves enforcing strict identity verification – such as Microsoft Authenticator – and segmenting your networks to restrict access to only those who need it. These practices will minimize the risk of both external and internal threats, optimizing the security of your IT infrastructure.
Secure Your IoT Devices: The number of connected IoT devices is set to grow significantly in the next five years, up to 32.1 billion devices by 2030. Start securing them by checking if any of them are still using default passwords – if they are, change these to strong passwords immediately. It’s also a good idea to segment IoT devices onto separate networks, this limits how far malware can spread through your IT infrastructure in the case of an infection. Finally, make sure that software patches and firmware updates are installed promptly.
Implement AI Cybersecurity: Artificial Intelligence (AI) is increasingly being used to detect and neutralize threats in real time. Capable of analyzing huge amounts of data and identifying unusual activity, AI excels at spotting sophisticated threats before they create a foothold in your networks. This automation allows you to stay ahead of the threat actors and safeguard your systems more effectively than ever. Consequently, exploring options such as IBM’s range of AI tools could make a vast difference to your defenses in 2025.
Maximize Your Supply Chain Security: Threat actors are as innovative as they are dangerous, this is best evidenced by their attempts to target your vendors to gain access to your systems. To keep your business safe, audit the vendors you work with to verify their cybersecurity protocols and compliance. Working closely with your vendors will enable you to limit threat actors exploiting any gaps in security.

For more ways to secure and optimize your business technology, c ontact your local IT professionals.

Default Passwords Cause Havoc for Juniper Routers

business router, default passwords, educate staff, Jupiter, Mirai botnet, monitor network, multi factor authentication, routerbusiness router, default passwords, educate staff, Jupiter, Mirai botnet, monitor network, multi-factor authentification, routersOphtek, LLC

Jan 2025

Strong passwords are vital to cybersecurity. A recent botnet attack highlights the serious risks of relying on default passwords instead of secure alternatives.

The Mirai malware, first detected in 2016, has been behind numerous botnet attacks in the past and has been very busy recently. A botnet attack gives a threat actor control over a large number of compromised PCs, allowing the threat actor to combine these infected PCs into a formidable strike force. These attacks often involve data theft, cryptojacking, brute force attacks, and phishing campaigns.

This latest attack was enabled by the presence of default passwords on routers manufactured by Juniper Networks. Default passwords are used on many devices, so it’s important to understand the mechanics behind this attack.

Mirai Starts Infecting Routers

The exploitation of Juniper routers began in mid-December. Customers accessing the internet with Juniper Session Smart routers began to notice unusual behavior with them. The Mirai malware was seen to be scanning specifically for these routers. Once this model of router was found, Mirai proceeded to compromise the router before utilizing it in a distributed-denial-of-service (DDoS) attack.

But what was unique about the Session Smart router? Why was Mirai singling this router out? Well, the answer proved to be simple: it was a router known to ship with a default password. Therefore, a threat actor could easily take control of the router if its password hadn’t been changed. Scan enough Session Smart routers and, eventually, one will be found with the default password still in place.

The main impact of a DDoS attack is a slowdown in PC performance, as all the PC’s resources are being directed into the attack. For a business, this is troubling as the majority of their PCs are likely to be dependent on similar routers. This means that this slowdown in productivity could have a major impact on a business’ performance.

Don’t Fall Victim to Default Passwords

Users of Session Smart routers have been advised to change their password from the default version to a unique and strong one. This is the best advice you can give when it comes to default passwords. Leaving them in place is simply inviting threat actors into your networks. However, there are further measures you can take to secure your devices:

Educate Users About Risks: Train your employees to understand the dangers of default passwords. Make sure they understand what is and isn’t a secure password, helping to build a culture of cybersecurity awareness.
Use Multifactor Authentication: The beauty of multifactor authentication is that it adds an extra layer of security to your defenses. Therefore, even if one of your passwords is compromised, additional authentication is required to access your devices and networks.
Monitor for Default Password Usage: It’s difficult to monitor every device and verify the status of its password, but you can get help with this. Many security tools – such as Kaspersky Industrial CyberSecurity for Networks – can scan devices connected to a network and determine if a default password is being used.

For more ways to secure and optimize your business technology, contact your local IT professionals.

Remcos RAT Malware Attacks Increase in Q3 2024

malicious downloads, Ophtek, phishing_email, PowerShell script, RAT, Remcos RAT, Remote Access Trojanmalicious downloads, Ophtek, phishing email, PowerShell Script, RAT, Remcos RAT, remote access trojanOphtek, LLC

Jan 2025

Malware has a habit of going through periods of intense activity, and this is exactly what the Remcos RAT malware has been up to in Q3 2024.

First detected in 2016, Remcos is somewhat of a veteran of the malware scene, but its activity has ramped up significantly throughout 2024. Reaching a peak during Q3 2024, Remcos has the potential to take control of infected machines remotely, hence the Remote Access Trojan (RAT) attachment to its name. This remote access allows the threat actors behind this latest campaign to both harvest data and monitor PC activities in real time. RATs are nothing new in the world of cybersecurity, but any notable surges in activity are always cause for concern.

To help protect your PCs from falling into the clutches of Remcos, we’re going to dive into the story behind it – and RATs in general – to uncover how they work.

Understanding RATs

The concept of a RAT is simple: they give a threat actor unauthorized remote access to a PC. First detected way back in the 1970s, a RAT is a strain of malware which threat actors use to take control, silently and discreetly, of your PCs.

With a RAT installed, the attackers can quickly gain access to all of your data and applications e.g. passwords, webcams, and microphones. This puts your organization at risk of falling victim to espionage and having your secure data compromised. Typically, RATs are spread via phishing emails or malicious downloads.

Behind the Scenes of Remcos’ Latest Attacks

The current Remcos campaign is interesting as, following investigation by McAfee researchers, it’s been discovered that two Remcos variants are currently active. The first Remcos variant uses a PowerShell script to download malicious files from a remote server and then inject it into a genuine Microsoft tool (RegASM.exe) to help conceal it. The second variant of Remcos is transmitted through phishing emails and exploits a known vulnerability (CVE-2017-11882) to give threat actors remote access.

Both variants are particularly virulent and persistent, with a number of innovative design features ensuring that they remain evasive and can operate under the radar. Remcos encodes its data in Base64 to avoid suspicion and also makes a point of not leaving any additional files on infected hard drives. Furthermore, Remcos edits the registry and startup folders in a way which enables it to load back up on every reboot.

Outsmarting Remote Access Trojans

Luckily, you don’t have to fall victim to Remcos or any other RAT attacks as Ophtek has your back. To help you get your defenses optimized, we’re going to share the three best ways to RAT-proof your IT infrastructure:

Use Antivirus and Keep Software Updated: Make sure all your PCs are protected by strong antivirus software – such as Kaspersky or AVG – which checks for malicious files in real-time. Alongside this measure, regularly update all your PC software to prevent hackers from exploiting vulnerabilities.

Be Cautious of Suspicious Emails: It’s critical that all your staff are mindful of the most identifiable signs of phishing emails. Dedicate part of your IT inductions to highlighting the danger of clicking on unexpected email links or attachments, and carry out refreshers on a regular basis. Ultimately, if an employee receives an email which looks slightly strange, they should always check this with an IT professional before taking action.

Practice Strong Password Security: One of the simplest ways to protect your IT systems is by using unique and strong passwords for your PCs and servers. Also, use multifactor authentication where possible, this means that even if an attacker obtains your passwords, there’s a further layer of security standing in their way.

For more ways to secure and optimize your business technology, c ontact your local IT professionals.

Microsoft Teams and the Black Basta Malware Threat

Black Basta, DarkGate, junk emails, Microsoft Teams, Ophtek, TeamViewer, ZbotBlack Basta, DarkGate, junk emails, Ophtek, Teams, teamviewer, ZbotOphtek, LLC

Dec 2024

Microsoft Teams has become an integral part of business life, but it also represents a sure-fire malware opportunity for threat actors.

Teams can be used for videoconferencing, voice calls, file sharing, and numerous collaborative processes, so it’s no surprise that it’s become extremely popular. This growth has accelerated significantly since the pandemic, and with over 320 million daily active users of Teams, it’s clear to see why threat actors view it as such an attractive target. The latest attack of note to strike Teams has been carried out by the Black Basta malware, last seen on these pages targeting US businesses in 2022.

As many of our readers are regular users of Teams, we decided it would be beneficial to shed light on this attack to help you reinforce your defenses.

Black Basta Strikes Again

The attack starts when a threat actor launches an onslaught of junk emails into a victim’s inbox. Naturally, this is an irritating situation, so when an offer of help is received via a Microsoft Teams message, it sounds like a lifesaver. This ‘help’ involves downloading a remote management tool – such as TeamViewer or Quick Assist – in order for the mysterious helper to connect to the PC in question and investigate the problem.

However, granting access is a huge mistake as it gives them full control over the PC in question. Therefore, the threat actor is able to begin downloading malware onto the target PC which harvests data. Of particular interest to the malware are login credentials, VPN configuration files, and multi-factor authentication tokens. These powerful slices of data then allow remote access to the PC without a single security question being raised.

Researchers have found that malware such as DarkGate and Zbot is being utilized by the threat actors during the attack, and that they’re posing as members of the targeted organization’s IT team. It’s also been reported that the threat actors have, at least once, attempted to use a QR code to trick a user into giving up their login credentials.

Shield Yourself from Black Basta Attacks

Handing over even a single set of login credentials can have catastrophic consequences for your IT infrastructure. With a foothold in your defenses, a threat actor can quickly establish themselves within your system, stealing data, encrypting files, and damaging hardware. Therefore, you should be mindful of attacks such as Black Basta.

The best safety essentials to employ are:

Standardize Your Remote Management Tools: make sure that you take a consistent approach with remote management tools. For example, stick to using one particular tool – such as TeamViewer – and ensure this is the only one installed on your PCs. Additionally, make sure that staff are aware that your chosen tool is the only one to be trusted, but even this should be scrutinized.
Restrict External Communication in Teams: It’s possible to block external Teams users from interacting with your employees, so it may be beneficial to put this in place. This ensures that all communication taking place within your Teams system involves only authorized employees, minimizing the risk of rogue communications being spread.
Educate Your Employees: human error remains the leading cause of cyber attacks, so this is an area you need to pay close attention to. Training your employees to identify a social engineering campaign is crucial, and could help prevent your IT infrastructure being taken over by threat actors. Make this part of your onboarding processes and conduct regular refreshers with existing staff.

For more ways to secure and optimize your business technology, c ontact your local IT professionals.

One of the recent developments in hacking has been the Bring Your Own Vulnerable Driver (BYOVD) attack, but what is it and how do you defend against one?

By now, the Ophtek blog should have informed you about ransomware, trojans, and cryptojacking, but we’ve rarely mentioned the dangers of a BYOVD attack. In the past, BYOVD attacks were mostly carried out by only the most sophisticated threat actors, but they’re now becoming increasingly popular with even basic bedroom hackers. Therefore, today is the day we remedy this and provide you with a fully comprehensive look at BYOVD attacks and how you can stay safe.

The Role of Drivers within Your PC

Before we dig deep down into the mechanics of a BYOVD attack, it’s important that you understand what’s at the heart of their malicious activities: drivers. You’ve no doubt heard of drivers in passing, but it’s only the most die-hard PC user who would fully understand what they do. Their main role is as a file used to support software applications. They work by acting as a bridge between an operating system and a device e.g. between Windows and a graphics card.

Without drivers, your PC simply wouldn’t work. From your display through to your speakers and printer, there would be no way for your operating system to communicate with these devices. This makes drivers a crucial part of any PC, but it also means they’re ripe for cyberattacks.

Breaking Down a BYOVD Attack

We’re all aware of software vulnerabilities, and a BYOVD is a unique take on this method of hacking. In a BYOVD attack, threat actors will trick their victims into downloading outdated, vulnerable drivers onto their PC. This could be through phishing emails or pop-up adverts, with the main objective of getting these unsafe drivers downloaded onto a PC along with a nasty dose of malware. With these vulnerable drivers in place, threat actors can take control of the infected PC.

BYOVD attacks are dangerous for the following reasons:

Data Theft: With BYOVD attacks capable of bypassing your security software, they not only have easy access to all your data but can effortlessly transmit it to remote servers.
Install Further Malware: IT systems with vulnerabilities exploited are at risk of having further malware installed on them. So, for example, a threat actor could first gain access to your system before downloading further malware to facilitate DDoS attacks or support cryptojacking.
Damage Your Productivity: A BYOVD attack can quickly render your IT systems unusable due to the capabilities of drivers. By exploiting the deep access and reach drivers have, threat actors have the opportunity to disable network components, corrupt system files, and damage hardware.

You can find out more specifics of the impact of a BYOVD attack by checking out our article on the EDRKillShifter malware.

Protecting Your IT Systems from BYOVD Attacks

You may have been unfamiliar with BYOVD attacks, but you should now have a basic understanding of how they operate. The next step is to protect yourself by implementing these security practices:

Driver Whitelisting: this is a method whereby only authorized system users have the privileges to install drivers on your IT infrastructure. Even then, the use of Windows Defender Application Control should also be utilized to ensure that only pre-approved, digitally signed drivers can be installed.
Regular Updates: one of the simplest ways to protect against BYOVD attacks is by installing all updates and patches as soon as possible. Automating these updates allows you to guarantee that you have the freshest, most secure drivers on your system at all times.
Employee Education: BYOVD attacks are often distributed by phishing attacks, so it’s useful to educate, and regularly refresh, your employees on the telltale signs of a phishing attack. This could prove invaluable as your employees are your most important defense against cyberattacks.

For more ways to secure and optimize your business technology, contact your local IT professionals.

1 2 3 … 123 Next »