The FBI issued a warning about Business Email Compromise (BEC) spearphishing attacks.  The FBI describes the attacks: The schemers go to great lengths to spoof company e-mail or use social engineering to assume the identity of the CEO, a company attorney, or trusted vendor. They research employees who manage money and use language specific to the company they are targeting, then they request a wire fraud transfer using dollar amounts that lend legitimacy. The FBI reports that between October 2013 and February 2016 this scam has netted over $2.3 billion. The scammers target victims with deceptive emails.  Unmask the deception [...]

Our last blog posting discussed the warning from the IRS about the threat of fake emails being used to steal employee payroll data.  The following high profile companies have fallen victim to this scam. Click on the logos to read their stories. Do you notice what is missing in each of these cyberattacks?  Malware.  There is no malware involved in these data breaches.  The bad guys used spearphishing to trick the authorized users into divulging the desired information.

On March 1, 2016, the IRS issued an alert to HR professionals warning that criminals are targeting HR professionals in order to steal employee data.  The fake email appears to come from a company executive requesting employee payroll data. The IRS reports that the scam  has several variations, all aimed at getting crucial personal information about employees. The scams include: Kindly send me the individual 2015 W-2 (PDF) and earnings summary of all W-2 of our company staff for a quick review. Can you send me the updated list of employees with full details (Name, Social Security Number, Date of Birth, [...]

Personal information about tens of thousands of FBI and Homeland Security employees appears to have been compromised. This report from The Telegraph relates some details: [The hacker] managed to download the details of about 30,000 US government employees from the FBI and Homeland Security, as well as 200GB of data. The data includes more sensitive information like credit card numbers and military emails, he said. How did he do it?  The Telegraph reports that the method was spearphishing.  Again.    

On February 2, 2016, the U.S. Justice Department announced that Charles Harvey Eccleston, a former employee of the the U.S. Nuclear Regulatory Commission (NRC), pleaded guilty to an attempted e-mail “spearphishing” attack that targeted dozens of Department of Energy (DOE) employee e-mail accounts. “Eccleston admitted that he attempted to compromise, exploit and damage U.S. government computer systems that contained sensitive nuclear weapon-related information with the intent of allowing foreign nations to gain access to that information or to damage essential systems,” said Assistant Attorney General Carlin. What technology was Eccleston using?  Spearphishing. Thinking he was dealing with foreign agents, Eccleston assembled lists of [...]

Yesterday  60 Minutes on CBS broadcast The Great Brain Robbery: Economic espionage sponsored by the Chinese government is costing U.S. corporations hundreds of billions of dollars and more than two million jobs. On the 60 Minutes website is posted extra content called "Correspondent Candid" which is embedded below. In this segment, we learn exactly how the Chinese steal our stuff.  At 47 seconds the big secret is revealed. No surprise -- spearphishing.  At Spearphishing – The Movie former FBI agent Eric Fiterman gives us a deeper dive into spearphishing technology. What we see is how bad guys use technology to access the key control element of [...]

ESET is reporting that on December 23, 2015, about half of the 1.4 million residents of Ukraine's Ivano-Frankivsk region were left without power as the result of a spearphishing attack being attributed to Russia. Ukraine Utility Prykarpattya Oblenergo The attack on Prykarpattya Oblenergo was the classic spearphishing attack. The targeted individual received an email masquerading as from a trusted sender. In this case, the purported sender was the Ukrainian parliament. The email had an attachment. The attachment was crafted to induce the victim to enable scripts.  The scripts then compromised the victim's system. It is important to focus on the user to understand how this attack [...]