Dark READING reports that a Hungarian man has pleaded guilty in a phishing scheme to blackmail  Marriott.  The plea was entered on Nov. 23, 2011. The man, Attila Nemeth, 26, used data he stole from Marriott in an effort to force them to hire him into the IT department.  Dark READING summarized the scam: The case puts a whole new spin on the targeted attack; rather than trying to cash in on the intelligence or use it for competitive purposes, the perpetrator used it as leverage. Nemeth's methods were similar to those of advanced persistent threat (APT) attackers: He got a [...]

On October 31, 2011, Symantec released a whitepaper entitled  The Nitro Attacks: Stealing Secrets from the Chemical Industry.  In the whitepaper, Symantec reports on a hacking attack on 29 chemical companies.  The attack appeared to be aimed at stealing intellectual property related to the research, development and manufacture of chemicals.  These attacks started in July 2011 and continued until mid-September.  The attacks also targeted 19 non-chemical companies, primarily in the defense industry. Symantec tells us how the systems were compromised: The attackers first researched desired targets and then sent an email specifically to the target. Each organization typically only saw a handful of employees at the receiving end [...]

Trend Micro, a leading security company and distributor of the Iconix products, has uncovered a massive and ongoing series of cyber attacks dubbed Lurid.  Trend Micro provided this overview of Lurid: Trend Micro has discovered an ongoing series of targeted attacks known as “LURID,” which has successfully compromised 1,465 computers in 61 different countries. We have been able to identify 47 victims, including diplomatic missions, government ministries, space-related government agencies, as well as other companies and research institutions. The countries most impacted by this attack include Russia, Kazakhstan, and Vietnam, along with numerous other countries mainly Commonwealth independent states (in [...]

The September 26, 2011 edition of the Wall Street Journal contained a special section dedicated to information security.  In an article entitled What's a Company's Biggest Security Risk? You., reporter Geoffrey A. Fowler details the security gaps that are created by people.  Fowler writes: We are the weakest link. Hacking attacks against companies are growing bigger and bolder—witness a string of high-profile breaches this year at Sony Corp., Citigroup Inc. and others. But gone are the days when hackers would simply find holes in corporate networks to steal valuable data. Large companies have grown wise to the threat of hacking, and [...]

ICONIX, Inc., the industry leader in visual email solutions, announced today that it has added fraud filtering capability to SP GuardTM, its spear-phishing defense product. Now, in addition to highlighting legitimate messages with an icon in the inbox, enterprises will be able to block fraudulent messages pretending to be from their organization or their trusted partners.   Recent security breaches at many major enterprises have been widely reported in the press. Cisco's June 2011 study, "Email Attacks: This Time It's Personal", reported that suspicious emails with suspicious links are being replaced by highly targeted emails that do not rely on [...]

In two companion articles appearing in tomorrow's edition (9/24/11) of The Sydney Morning Herald, reporter Dylan Welch describes international cyber spying.  The first article, Code red: the cyber spy threat, discusses the wide-ranging problem of cyber espionage.  The article describes a large number of cyber attacks against many governments and international organizations.  Of course, spearphishing plays a prominent role in the story.   These are just two of the incidents reported: On June 1, 2009, messages with the heading ''China and Climate Change'' dropped into the email inboxes of five US State Department officers. The five officers, working in the [...]

PC World is reporting that the malware which was used in the spearphishing attack that compromised the RSA security token  may have been used to attack US defense organizations. PC World quotes Bernardo Quintero, the founder of malware analysis site VirusTotal.  "According to our data, RSA was just one of the targets. [Attackers] used the same malware to try to penetrate other networks."  The report continues: VirusTotal is a popular site with security professionals who use it to get a quick industry consensus take on suspicious files. It runs any file through a battery of antivirus scanning engines and spits out [...]