Windows WordPad Flaw Exploited to Infect PCs 

cybersecurity, DLL_hijacking, email_links, email_sender, Ophtek, Phishing, Updates, WordPad, , , , , , ,
25
Jul 2023

WordPad, a basic yet popular word processor, is the latest Windows app to fall victim to a vulnerability exploited by threat actors. 
 
Bundled free with almost every version of Windows since Windows 95, WordPad has remained popular thanks to its simplicity. Less complex than Microsoft Word and more advanced than the basic Notepad app, WordPad gives users an effective word processing tool. However, it’s now an app which carries a real threat to your IT security. Due to a flaw in WordPad’s design, threat actors have started to abuse this vulnerability by launching a DLL hijacking attack. 

Everything You Need to Know about the WordPad Hack 

You may not be familiar with DLL hijacking, so we’ll start by looking at this form of attack. DLL files are library files which can be used by multiple programs all at the same time. This makes it a highly flexible and efficient file, one which can reduce disk space and maximize memory usage. When Windows launches an app, it searches through default folders for DLLs and, if they are required, automatically loads them. What’s important to note, however, is that Windows will always give priority to loading DLLs located in the same folder as the app being launched. 

DLL hijacking abuses this process by inserting malicious DLLs in the app’s parent folder. Therefore, Windows will automatically load this malicious file instead of the genuine one. This allows threat actors to guarantee their malware can be launched long after they have left the system. And this is exactly what has happened with WordPad. The hackers begin their attack by using a phishing email to trick users into downloading a file, one which contains the WordPad executable and a malicious DLL with the name of edputil.dll. Launching the WordPad file will automatically trigger the loading of the malicious DLL file. 

This infected version of edputil.dll runs in the background and uses QBot, a notorious piece of malware, to not only steal data, but also download further malware. The infected PC is then used to spread the attack throughout its entire network.  

Writing QBot into History  

While this form of attack is far from new, it has proved successful. Accordingly, it’s important that we hammer home the basics of good cybersecurity, with a particular emphasis on phishing attacks: 

For more ways to secure and optimize your business technology, contact your local IT professionals.

Read More

Streamlining Productivity: Essential Tools for Business PCs 

communication, Ophtek, Productivity_tools, suites, time_task_mgmt, Uncategorized, workflow_automation, , , , ,
18
Jul 2023

In today’s business environment, optimizing PC productivity is essential for organizations to stay competitive. And, to do this, you need the right tools. 

PCs have transformed the way we do business, but it’s important that we constantly move forward and avoid becoming complacent. There are always better ways to do things, more effective procedures and, often, easier solutions to our problems. And implementing these into your organization’s day-to-day operations will always pay dividends in terms of productivity and competitiveness. The best way to achieve this is by adopting the most essential tools for business PCs. 

The Most Essential Tools You Need for Business PCs 

Take a look at any software catalogue and you’re going to struggle to know where to start. The sheer range of available apps and tools is endless. But we’re going to give you a helping hand. So, if you want to raise your business game and get the most out of your PCs, make sure you work with the following tools: 

  • Communication: strong communication and collaboration tools have become crucial in the last decade, most noticeably during and after the Covid-19 pandemic. Thankfully, modern software development allows seamless teamwork to be a reality no matter how scattered your team are. Tools like Slack, Microsoft Teams, or Google Workspace provide real-time messaging, video conferencing and file sharing capabilities. This means your teams can communicate and work together effectively. 
     
  • Productivity suites: every business needs to arm themselves with a fully functioning productivity suite. The most common examples of these tools are Microsoft Office 365 and Google Workspace. With these suites integrated into your PCs, your employees will be able to access a wide range of applications such as word processing, spreadsheets, presentations, and email. Best of all, these platforms can be accessed remotely, making them incredibly flexible and perfect for remote employees. 
     
  • Time and task management: keeping on top of your workload is the number one problem that every employee faces daily. But it doesn’t need to be a struggle. You can quickly minimize this burden by adopting time management tools which will boost your productivity. Todoist, Toggl and Microsoft Outlook all allow you to organize tasks, set priorities, manage schedules, and track time spent on different activities. Your employees, therefore, can break their workload down into manageable tasks and track their progress. 
     
  • Workflow automation: tools such as Microsoft Power Automate and Zapier can accelerate your organization’s productivity by automating repetitive tasks. Therefore, you could set up email processes which automatically save attachments to the cloud. Or, you could program updates to be emailed to your warehouse once new orders are received. Ultimately, these tools will save your employees time, minimize errors and allow your team to focus on their core duties. 

Final Thoughts 

Due to the current economic crisis, making competitive gains – no matter how small – has never been more important. Accordingly, adopting the software tools covered above, could make a significant difference to your organization’s productivity. 
 
For more ways to secure and optimize your business technology, contact your local IT professionals. 

Read More

Interest in ChatGPT Related to New Malware Attacks 

ChatGPT, cyber attacks, malware, Ophtek, Phishing, two-factor authentication, , , , ,
04
Jul 2023

The launch of ChatGPT and its accompanying headlines have been heard around the world. And threat actors are leveraging this interest to launch new attacks. 

You don’t have to look hard to find a headline relating to ChatGPT, the latest and most intriguing AI service to be released to the public. Everyone has been talking about it and, of course, this also includes hackers. After all, anything which proves popular – such as social media and cryptocurrency – quickly becomes an attractive method of delivering malware. Now, while you and your business may not use ChatGPT daily, this latest campaign utilizes a few attack strategies you need to be aware of. 

How Has ChatGPT Got Caught Up in Malware? 

The massive interest generated by ChatGPT means that AI related apps are at the forefront of most internet users’ thoughts. As a result, threat actors have decided to turn this interest to their benefit with their most favored technique: deception. The attacks, which were discovered by Meta, the owners of Facebook, have involved 10 different malware families and, on Meta’s platforms alone, 1,000 malicious links relating to ChatGPT. 
 
Two of the most notable strains detected, which appear to have originated from Vietnam hacking groups, are NodeStealer and DuckTail. NodeStealer is a JavaScript-based piece of malware which is used to steal cookies and login credentials. DuckTail, meanwhile, not only steals cookies, but also focuses on hijacking Facebook business accounts to access lucrative ad accounts. Both of these malware strains are typically spread and activated via infected files or links to malicious websites. 

How Do You Stay Ahead of AI Malware? 

The official and genuine ChatGPT site has already been used by threat actors to develop new malware, so there is already concern about how it can be compromised. And this latest attack, while not directly involving the app, certainly adds fuel to the fire. Deception, of course, is nothing new in the world of hacking. But the number of people who fall for the duplicitous schemes of hackers is astronomical. Therefore, you need to remain on your guard by following these best practices: 

  • Use two-factor authentication: many of the malware strains identified in the latest round of ChatGPT-related attacks involve stealing credentials. Therefore, there’s never been a better time to implement a further layer of security in the form of two-factor authentication. While it won’t necessarily protect against session hijacks, two-factor authentication will significantly reduce the risk of unauthorized access to your accounts. 

For more ways to secure and optimize your business technology, contact your local IT professionals. 

Read More

Bumblebee Malware Gives a Nasty Sting Through Google Ads 

Ad-Blocker, Bumblebee, malvertising, malware, Ophtek, , , ,
27
Jun 2023

It’s difficult to avoid online ads these days. This makes them the perfect target for hackers. And this is what they have done with the Bumblebee malware. 

It’s estimated that the average American is exposed to between 4,000 to 10,000 online ads a day. And each one of these ads has the potential to carry malware. Therefore, it’s not surprising that threat actors have started exploiting them. This recent attack, however, has also employed SEO poisoning in its campaign – this is a method by which hackers create malicious websites and tempt visitors there with high-demand keywords. 

Bumblebee, then, is a credible threat to your organization and its IT systems. Consequently, it’s important that you know how it operates and, most importantly, how to avoid it. 

What Do You Need to Know about Bumblebee? 

First discovered in April 2022, the Bumblebee malware is classed as a ‘malware loader’ variant. This means that it is used to connect a remote attacker directly with the infected system. It’s believed that Bumblebee comes from the same hacking group behind BazarLoader. Bumblebee, however, is more powerful and is backed by enhanced stealth capabilities. So, not only is it capable of causing greater damage, it’s also harder to detect. This, as I’m sure you’ll agree, is the last thing any PC owner wants to hear. 
 
The most common approach for Bumblebee is to use Google Ads to lay bait for unsuspecting PC owners. For example, a Google Ad promising a free SQL to NoSQL guide was used to redirect those who clicked it to a fake download page. We say “a fake download page” but it did, in fact, take people to a page where a download occurred. Instead of a free guide, though, it instead downloaded Bumblebee. This malware was then opened and, to reduce detection, loaded Bumblebee into the infected system’s memory. 

Typically, Bumblebee has been targeting businesses rather than consumers. Ransomware, therefore, has been at the front of the threat actors’ operations. But this is achieved through highly detailed planning. Upon the initial infection, Bumblebee quickly downloads a series of malicious tools such as remote access services, network scanning apps and keystroke loggers. This strategy allows the attackers to identify weak spots and deploy ransomware where it will be most effective. 

How Do You Beat Bumblebee? 

All business owners can agree that ransomware is a headache they can do without. So, how do you keep your systems safe from the Bumblebee attack? Well, you may be surprised that the following tips make it very easy: 

  • Keep your software up to date: malicious ads often take advantage of vulnerabilities in outdated software. By keeping your web browser, operating system, and other software up to date, you can reduce your risk of falling victim to malvertising attacks. 

For more ways to secure and optimize your business technology, contact your local IT professionals. 

Read More
1 … 15 16 17 18 19 … 60