Blog - Page 5 of 116

LinkedIn Used to Spread DarkGate Malware

authenticator app, Corsair, DarkGate, Linkedin, malware, malware-as-a-service, Ophtekauthenticator app, Corsair, DarkGate, Linkedin, malware, malware-as-a-service, OphtekOphtek, LLC

Dec 2023

The threat of malware strikes the business world again, and this time it’s using LinkedIn to trick users into downloading the DarkGate malware.

LinkedIn is designed to help professionals connect with each other and build professional relationships. It’s proven to be wildly popular, with 950 million members currently registered on the platform.

But where there are huge numbers of users, there will also be large amounts of data. And this data is like catnip to threat actors. This is why fake LinkedIn posts have started appearing on the platform. These posts, as well as a campaign of direct messages, are far from informative for the users of LinkedIn. Instead, they are being used to trick LinkedIn users, primarily those who hold positions within the social media niche, to download malware.

Unveiling the Essentials of DarkGate on LinkedIn

Security experts have been aware of DarkGate since 2017, but it was considered a low-level threat due to its limited activity in the digital wild. However, this changed in June 2023, when its creator began selling it as Malware-as-a-Service package. Since then, a campaign using DarkGate has been launched by threat actors, believed to be working in Vietnam, which targets LinkedIn users.

Mostly, these users have consisted of social media managers operating in the US, the UK, and India. Using LinkedIn posts, or sending direct messages to targets, the threat actors propose that a job offer at Corsair is on the table. LinkedIn is a highly popular recruitment tool, so there’s nothing out of the ordinary with these initial contacts. However, the targets are encouraged into downloading malicious documents, such as a Word document containing a job description and a text file discussing salary details.

Within these documents are malicious links. Once clicked, these links lead to a series of scripts being launched which are used to build DarkGate. The malware’s first move is to start uninstalling security tools located on the infected system. DarkGate’s next step is to begin harvesting data from the compromised system. In particular, DarkGate appears to be targeting login credentials for Facebook business accounts, hence the focus on social media managers.

Protecting Your Credentials from DarkGate

If you’re a social media manager and regularly log on to LinkedIn, the advice is simple: stay away from any links relating to job offers for Corsair. Unfortunately, the threat actors are likely to change the details of their attack now that it’s started generating headlines. Nonetheless, you can still do the following to protect your credentials:

Never click unsolicited links: it’s important to be vigilant against unsolicited links, especially when they’re found in unsolicited direct messages. If you do receive direct messages, or even emails, containing unsolicited links, it’s best to delete them and block the sender.
Install all updates: clicking a malicious link can help threat actors exploit vulnerabilities within your PC, so you need to minimize the number of vulnerabilities which are present. The best way to achieve this is by always installing updates when prompted or making sure that automatic updates are activated.

Use an authenticator app: both LinkedIn and Facebook allow you to use an authenticator app to provide a further layer of security to your credentials. Most commonly, the sites in question will require you, after entering your login credentials, to enter a unique code generated by the app. This means that, if your login credentials are compromised, they will be next to useless to threat actors.

For more ways to secure and optimize your business technology, contact your local IT professionals.

Safeguarding Your Business Against Social Engineering

complex passwords, malware, multi factor authentication, Ophtek, Phishing Email, Ransomware, social engineering, vulnerabilitycomplex passwords, malware, multi factor authentication, Ophtek, phishing, ransomware, social engineering, vulnerabilityOphtek, LLC

Dec 2023

One of the biggest threats to your organization’s IT comes in the form of social engineering attacks. Therefore, you need to keep your business protected.

In the digital age, there are many threats to your IT infrastructure. These can include ransomware, software vulnerabilities and malware. However, perhaps the most dangerous, and easiest to launch, attack involves social engineering. This attack relies on exploiting human psychology to gain a foothold within a targeted network. In many ways, it’s an age-old deception strategy from the physical world, but simply transferred over to the digital world. This article looks deep into the world of social engineering and should provide you with a better understanding of how to safeguard your business.

What is Social Engineering?

The main objective of social engineering, for a threat actor, is to convince individuals that divulging sensitive information or performing network actions is the right thing to do. Often, this strategy relies on phishing emails. These are emails which are sent to targets and claim to have been sent from someone they know e.g. a work colleague or a supplier. However, what the threat actor is trying to do here is either extract confidential information – such as login credentials – or encourage the target to click a malicious link.

Get Your Team to Recognize Social Engineering

Social engineering attacks will always be targeted at your employees, so this means that you need to invest in educating your employees. While an IT induction represents a good opportunity to warn them of the telltale signs of social engineering, the sheer range of social engineering strategies requires something more intensive. Accordingly, regular training courses which are followed up with refresher courses are highly recommended. Even better, sending randomised ‘spoof’ phishing emails internally can indicate which employees require tailored training.

Strengthen Your Authentication Processes

If you want to add an extra layer of defense to your IT infrastructure, strengthening your authentication processes is an excellent way of achieving this. Not only will this thwart social engineering campaigns, but it will also protect you against almost all other security threats. Therefore, make sure you focus on the following:

Integrate password rules which require your employees to create complex passwords e.g. using a mixture of case types, numbers and symbols.

Bring in multi-factor authentication to help protect your employees’ existing login credentials and place a further obstacle in the way of unauthorized access.
Put a time limit on passwords and ensure that they have to be updated within a set time e.g. every two months.

Secure Your Communication Channels

Applications such as Microsoft Outlook and Teams have revolutionized the way that businesses communicate, but they also represent a rich source of data. With this in mind, you need to secure these communication channels against the threat of social engineering. Encrypting data flowing in and out of these applications is paramount to protect the type of data that social engineering is hungry for. So, use VPN’s where possible and make sure your employees avoid using their devices on public Wi-Fi.

For more ways to secure and optimize your business technology, contact your local IT professionals.

5 Ways to Optimize Your Business IT Infrastructure

cybersecurity, energy efficient, IT Network, Ophtek, scalability, workflow_automationCybersecurity, energy efficient, IT Network, Ophtek, scalability, workflow_automationOphtek, LLC

Nov 2023

Businesses should always be trying to optimize their IT infrastructure. A fter all, not only will this improve efficiency, but it will also cut costs.

In the dynamic and competitive landscape of business, a highly tuned IT infrastructure can be the difference between success and mediocrity. T herefore, if you truly want an infrastructure which fosters both smooth daily operations and capacity for growth, you need to start optimizing your operations. This may sound like a monumental task, but luckily Ophtek are here to help make this job easier with 5 ways to optimize your business IT infrastructure.

1. Strengthen Your Cybersecurity

In a world of ever evolving cyber thre ats, it’s crucial that your IT infrastructure is secure. Therefore, you need to start by strengthening your existing cybersecurity protocols. Begin by conducting regular security audits to ensure that you can monitor your defenses in real time. This means that, for example, if your firewall is no longer adequate against contemporary threats, you will know that it needs replacing with a more suitable solution. Additionally, never underestimate the impact of employee training programs to teach them the best security practices.

2. Calibrate Your Network Configuration

M aintaining a smooth flow of data acros s an organ ization’s network is essential. Accordingly, you should be mindful of fine tuning your network settings to achieve this. Optimizing your bandwidth usage and reducing latency are two of the most important steps you can take to improve performance. Sometimes, this will be as simple as simply adjusting network settings to cope with demand, but if a prolonged and heavy demand is forecast, investing in more sophisticated hardware may be required.

3. Be Energy Efficient

IT infrastructures use a lot of energy, and this can lead to significant outgoings in energy costs. Therefore, researching and investing in energy efficient hardware is one of the best practices you can implement. So, for example, i f you invest in more energy efficient data centers, not only will you benefit from lower running costs, you will also be spending less on cooling the data centers. And, best of all, as well as helping your finances, it also enhances your green credentials and benefits the environment.

4. Automate Routine Tasks

One of the best ways to optimize your IT operations is by automating repetitive and routine tasks. This approach can be applied to numerous tasks such as software updates, network monitoring and security tasks. As well as saving time, automation eliminates the risk of human error. This means that your IT demands are completed more efficiently and your human resources can be allocated to more complex activities which cannot be automated.

5. Never Forget Scalability

F inally, it’s vital that you design your IT infrastructure with scalability in mind. Business requirements can change rapidly, and your IT operations need to keep pace with them. This can cover increased demand for user numbers, application changes, or data volume. Whatever the requirements, your IT architecture needs to be able to adapt to these changes if you want your business to grow. So, make sure you thoroughly assess your existing and future needs, embrace cloud computing, and monitor your infrastructure’s performance.

For more ways to secure and optimize your business technology, c ontact your local IT professionals

Latin America Banks Targeted by BBTok Malware Variant

anti malware, antivirus software, banking malware, banking trojan, BBTok Malware, firewall, Ophtek, Phishing Emailanti-malware, antivirus, banking malware, BBTok, firewall, malware, Ophtek, phishingOphtek, LLC

Nov 2023

Back in 2020, a new banking trojan by the name of BBTok emerged into the digital landscape and was responsible for numerous attacks. And now it’s back.

Banks in Brazil and Mexico appear to be the main targets of BBTok’s new campaign, and it’s a variant which is far more powerful than any of its previous incarnations. Its main deceptive threat is that it is able to spoof the interfaces of 40 different banks in Brazil and Mexico. This means that it’s perfectly placed to harvest sensitive data. In particular, this new strain of BBTok is deceiving victims into disclosing their credit card details and authentication codes. This gives the campaign a financial angle and highlights the serious threat it poses.

How Does BBTok Launch Its Attacks?

BBTok’s latest strategy begins with a phishing email, one that contains a malicious link which kickstarts the attack by launching the malware alongside a dummy document. BBTok is particularly successful as it has been coded to deal with multiple versions of Windows, and it also tailors the content of the attack to both the victim’s country and operating system. BBTok also allows the threat actors behind it to execute remote commands and steal data without the victim being aware.

Most notably, however, is the way in which BBTok replicates the interface of numerous banking websites – such as Citibank and HSBC – to truly deceive the victim. Appearing to be genuine at first glance, these interfaces are used to trick victims into entering security codes and passwords associated with their accounts. This gives the threat actors full access to their financial data and, more disturbingly, full control over their finances. This means that unauthorized payments and bank transfers can quickly land the victim in severe financial trouble.

How to Stay Safe from Banking Malware

In an increasingly digital world, where we all make numerous financial transactions online every week, it’s important to remain guarded against banking malware. As well as the financial damage that malware such as BBTok can cause, it can also create a foothold for threat actors to delve deep into your networks. And this represents a major threat to the security of both your data and your customer’s data. Accordingly, you need to stay safe, and here are some crucial tips to help you:

Beware of phishing emails: your employees should always be cautious when opening emails or clicking on links from unknown sources. As with BBTok, many banking trojans spread through phishing emails which trick you in to visiting fake banking websites. This provides threat actors with the perfect opportunity to harvest your credentials. Therefore, make sure that your employees know how to quickly identify a phishing email and what to do with them.
Install a firewall: putting a firewall in front of your network is a vital step in strengthening your digital defenses. Firewalls act as keen-eyed gatekeepers who scrutinize incoming and outgoing traffic, this allows them to determine whether traffic is trusted and whether any alarms need to be raised. Banking trojans, of course, often transmit stolen data out of your network, so a firewall is the perfect way to identify and prevent this activity.
Strong endpoint security: to protect your network against malware, it’s essential that you employ robust cybersecurity measures throughout your business. In particular, employee workstations and mobile devices are most at risk, so installing advanced antivirus and anti-malware software here should be a priority.

For more ways to secure and optimize your business technology, contact your local IT professionals.

Major US Casinos Hit by Ransomware

BlackCat, educate team, MGM, Ophtek, Phishing, protection, Ransomware-as-a-Service, social engineeringBlackCat, educate team, MGM, Ophtek, phishing, protection, ransomware as a service, social engineeringOphtek, LLC

Nov 2023

A major ransomware attack on the MGM brand of casinos has led to the firm’s IT systems having to be shut down.

The ransomware-as-a-service hacking group BlackCat has taken responsibility for the attack, and it’s an attack which has caused major issues for MGM. IT systems responsible for processing electronic payments, digital key cards, parking systems and ATMs have all been impacted by this attack. While the attack is considered major, it was executed by the simplest of means. As ever, this attack on MGM contains some important lessons for organizations to learn and enforce.

How Were the MGM Casinos Hacked?

The MGM attack was made possible by the use of social engineering techniques. In particular, BlackCat identified an MGM employee by scouring related profiles on LinkedIn. With this information at their disposal, the threat actors contacted the MGM help desk and used this employee’s details as their way into the system. The exact nature of the breach, for security reasons, has not been disclosed, but it’s believed that it only took 10 minutes for BlackCat’s strategy to be successful.

BlackCat, with full access to MGM’s IT infrastructure, set about issuing demands to MGM through a secure communication channel they had put in place. However, MGM refused to pay any of the ransom fees demanded by BlackCat. Instead, on the recommendations of their security team, MGM began shutting their Okta servers – used for authorization processes – down.

However, BlackCat were able to remain active on the network due to the administrator privileges that they had gained during the attack. And, in response, BlackCat set about compromising over 100 hypervisors – applications which are used to manage virtual machines located on a PC – and encrypting the data contained on them.

BlackCat, again, brought their ransom demand to the table and also threatened to launch further attacks if this was not met.

How Could MGM Have Protected Their IT Systems?

As a thriving, world-famous organization, MGM could have done without the headlines relating to the attack by BlackCat. And, as with all social engineering attacks, this could have easily been avoided if MGM had practiced the following:

Be skeptical: unsolicited requests for information should always be treated with caution. If personal information is being requested, then always question the person, even if they appear to be legitimate, asking for the information. More importantly, take steps to verify their identity through official channels to confirm their authenticity.
Educate your team: it’s important that you familiarize your team with the most common social engineering tactics such as phishing emails and baiting. Awareness of these techniques will allow your staff to recognize these manipulative techniques before they can execute their malicious payloads.
Protect personal information: it’s crucial that you always protect sensitive data such as passwords, financial details, and personal identification. Avoid sharing such information with strangers or unverified individuals, such as on social media sites – as social engineers often harvest these channels to discover vulnerabilities.

For more ways to secure and optimize your business technology, contact your local IT professionals.

« Previous 1 … 3 4 5 6 7 … 116 Next »