Blog
by titanadmin | Dec 24, 2022 | Internet Security |
A new variant of the Android banking Trojan, Godfather, has been detected with the latest version of the malware being used to target more than 400 financial institutions worldwide, including 215 international banks, 110 cryptocurrency exchanges, and 94 cryptocurrency wallets in at least 16 countries including the United States, Canada, United Kingdom, Spain, France, and Germany.
Godfather malware is thought to have evolved from the Anubis banking Trojan, and while it was first detected 18 months ago, it has been rarely used until recently. The malware was only distributed in low volume during its first year, then it disappeared entirely in June 2022, suggesting the developers were working on a new version. That new version was released in September 2022.
While banking Trojans can have quite extensive functionality, their primary purpose is to steal the login credentials for financial institutions, which they usually obtain by generating fake login pages for the institutions that they target. What makes Godfather malware stand out is the number of financial institutions that are targeted. When installed on a device, Godfather malware will generate a fake login page when a user attempts to use the app of a targeted bank or cryptocurrency exchange. These fake login pages are overlays, that are displayed on top of the legitimate targeted app. The fake login page created by the malware will capture the user’s credentials when they are entered.
Most financial institutions have additional authentication requirements and no longer rely on a username and password for granting access. Banking Trojans therefore need to have the capability to bypass these additional authentication measures if they are to be successful. Godfather malware achieves this by masquerading as Google Play Protect and attempts to get the user to grant it accessibility rights, which allows the app to log keystrokes and also read SMS messages and perform screen captures. Those rights will allow the malware to capture the necessary information to bypass multi-factor authentication and other security features. Once credentials and other login information are harvested, accounts are accessed and emptied.
The new version of the malware was detected and analyzed by security researchers at Group-IB, who believe the malware was developed by Russian speakers, as the malware has a kill switch that will deactivate it if it detects any of the languages in former Soviet states, apart from Ukraine. The researchers believe that Godfather malware has been created for use under the malware-as-a-service model, where the developers offer the malware to a range of threat actors for a fee, allowing them to steal login credentials for financial accounts without having to develop their own malware.
Since multiple threat actors will likely be using the malware, the vectors used to distribute the banking Trojan will likely be diverse. As was the case with Anubis, one of the distribution methods is via decoy applications in the Google Play store. Godfather malware is more advanced than its predecessor and it is thought that it will grow into a major threat and will likely be modified further to target even more financial institutions.
by titanadmin | Dec 22, 2022 | Phishing & Email Spam, Security Awareness |
Phishing is one of the most common ways that cybercriminals attack businesses. Phishing is used to install malware and steal credentials, both of which will provide them with initial access to the network. Since phishing targets individuals, one of the most important steps to take to prevent phishing attacks is to provide security awareness training to the workforce.
Employees should be warned about the risk of phishing attacks and taught what to look for to help them identify, avoid, and report phishing threats. Training alone is not the answer though, as employees need practice at identifying phishing. Phishing simulations should therefore be conducted. These are realistic but fake phishing emails that are sent to all members of the workforce, the responses to which are tracked. When a user fails a phishing simulation, they can be provided with relevant training to help them identify similar threats in the future and to correct any risky behaviors. The combination of security awareness training and phishing simulations – both of which are provided through SafeTitan – can reduce susceptibility to phishing attacks by up to 80%.
Security awareness training should teach employees the red flags that indicate a phishing attempt. Employees should also be encouraged to report phishing attempts to their security team, as there is a good chance that the phishing email will not be the only such threat in the email system. When these threats are reported, security teams can remove all other copies of that message from the email system, thus preventing other users from being exposed to the threat. It is also important to encourage users to report phishing threats that they have responded to, as the faster the security team is made aware of a clicked link or file download, the faster mitigations can be implemented to reduce the harm that can be caused.
One problem for businesses is employees are often fearful of reporting responses to phishing emails due to the potential for negative repercussions, such as disciplinary action. If reporting is delayed, then mitigations are also delayed, which can potentially have serious consequences. The UK’s National Cyber Security Centre (NCSC) has recently suggested that in order to address this issue, businesses need to change their mindset. At many businesses, employees are made to feel that it is their responsibility to identify and avoid phishing attempts when the reality is it is the responsibility of the employer to block threats by implementing a range of technical controls. Employees should be trained on how to identify phishing attempts of course, but in order to develop a strong reporting culture, employees must not be made to think that a failure to avoid a phishing threat is their fault. The NCSC also takes issue with the commonly provided advice that employees should not click hyperlinks in unsolicited emails as, in many cases, that is actually a requirement of their job.
Technical Recommendations for Protecting Against Phishing Attacks
So how should businesses combat phishing? What technical measures should be implemented to improve defenses and make it much harder for phishing attacks to succeed? TitanHQ has long recommended what the NCSC suggests, and that is phishing prevention requires a defense-in-depth approach, where multiple overlapping layers of protection are implemented. This is vital, as no single anti-phishing measure will be 100% effective, 100% of the time.
The NCSC recommends multiple technical measures, the most important of which are a spam filtering solution that scans all inbound emails for phishing signatures and the setting of DMARC and SPF policies, as these are effective at blocking the majority of phishing threats. TitanHQ’s SpamTitan solution incorporates DMARC, DKIM, and SPF for blocking phishing threats, machine learning for identifying zero-day threats, as has constantly updated blacklists of malicious IP addresses and domains. SpamTitan also has a sandbox for deep behavioral inspection of attachments, in addition to dual anti-virus engines.
The NCSC also recommends implementing web proxies or web filters to prevent employees from accessing malicious websites linked in phishing emails. SpamTitan Plus rewrites URLs in phishing emails and follows them, providing protection against these malicious links. The WebTitan DNS filter will block access to known malicious websites and will also prevent downloads of malicious or risky files from the Internet, such as executable files – another recommendation of NCSC.
While not often considered by businesses as a phishing prevention measure, a password manager does provide a degree of protection against phishing attacks that harvest credentials, so businesses should provide one for their employees to use and they should encourage employees to use it. Password managers suggest strong passwords and then autofill them when they are required. Since the password is tied to a specific URL or domain, if a user lands on a phishing site that spoofs a brand, the password manager will not auto-fill the password, since the URL/domain is not associated with that password. It is also important to ensure that multi-factor authentication is enabled. Ideally, businesses should opt for passwordless authentication with a FIDO token.
Additional safeguards that should be considered include allow-listing to prevent executable files from running from any directories that users can write them and configuring the Registry to ensure that dangerous scripting or file types are opened in Notepad and are not executed. NCSC also recommends using PowerShell in constrained mode, script signing, disabling the mounting of .iso files on endpoints, locking down the macro settings, and only allowing users to enable macros if they need to do so for their job. Businesses should also stay up to date on the latest threats and ensure that mitigations are implemented against those threats and that they are incorporated into security awareness training programs, as TitanHQ does with SafeTitan.
By implementing all of these mitigations and adopting a defense-in-depth approach it becomes less important that employees can recognize and avoid threats, although training is still important because one or more of the above measures may fail. Businesses should also avoid punishing employees for failing to identify phishing attempts, as that is likely to create a culture of fear rather than a culture of reporting threats.
TitanHQ can help businesses significantly improve their defenses and implement many of the NCSC recommendations for combatting phishing. For more information on TitanHQ solutions, give the team a call today, or take advantage of the free trials on all TitanHQ products.
by titanadmin | Dec 15, 2022 | Internet Security, Phishing & Email Spam, Spam Advice, Website Filtering |
Phishing is one of the most effective ways of gaining initial access to business networks, either by stealing credentials or installing malware. Phishing exploits human weaknesses and involves tricking individuals using social engineering into taking a certain action, such as visiting a website where they are asked for sensitive information or opening a file that contains malicious code.
One of the best defenses against phishing attacks is an anti spam service. A spam filter will scan all incoming (and often outbound) emails looking for the signatures of spam and phishing. Suspect messages are quarantined pending a manual review and rules can be set for confirmed phishing emails, which is often to delete the messages or quarantine them for further investigation. Spam filters will prevent the majority of malicious emails from reaching inboxes, but crucially, not all. Some malicious messages will bypass the spam filter and will land in inboxes, no matter what spam filtering solution you use.
Advanced spam filters such as SpamTitan provide several layers of protection against spam, phishing, and malware but even advanced spam filters are not sufficient on their own to combat phishing. Cybercriminals are now conducting highly sophisticated attacks, so further layers need to be added to your defenses. A web filter is recommended for blocking access to the URLs linked in phishing emails. Spam filters may check links in emails, but these may be made malicious after emails are delivered. A web filter provides time-of-click protection against malicious links. Web filters can also be configured to block certain file downloads from the Internet.
To protect against credential theft, businesses should consider providing a password manager to their employees. Phishing attacks that seek credentials usually direct users to a spoofed website, such as a site with a fake Microsoft login prompt for stealing Microsoft 365 credentials. Employees are often fooled by these scams as the phishing sites look exactly the same as the brands they spoof. Password managers provide some protection. When a password is added to the password vault, it is associated with a specific URL or domain. If the user lands on that URL or domain, the password manager will autofill the password. If the user lands on an unrelated domain, the password will not be filled as the URL or domain is not associated with that password. That serves as a warning that the URL has not been visited before.
Sometimes, employees will be fooled and will disclose their login credentials. This is where multi-factor authentication helps. With multi-factor authentication enabled, compromised passwords will not grant access to accounts unless an additional factor is provided. Since phishing kits are in use that are capable of intercepting MFA codes, the choice of MFA is important. For the best protection use phishing-resistant MFA, which is based on FIDO authentication.
By implementing all of the above technical measures, businesses will be well protected against phishing attacks, but that does not mean it is not necessary to provide security awareness training to the workforce. Security awareness training forms the final layer of protection and prepares employees for the threats they are likely to encounter. Security awareness training teaches employees about phishing, malware, business email compromise, and other cyber threats, and explains best practices and why they are essential for security. The goal of security awareness training is to create a security culture where all employees are aware that they play a role in the security of their organization and to develop a reporting culture where the IT department is made aware of any threats that bypass defenses. That allows the IT department to tweak security solutions to make sure similar threats are blocked in the future.
Security awareness training should be accompanied by phishing simulations. These simulated phishing attacks identify weaknesses that can be addressed. That may be a gap in the training content or an individual who has not understood the training. Simulations allow gaps to be proactively addressed before they are exploited in real cyberattacks. Simulations also help to keep training fresh in the mind and give employees practice at identifying cyber threats.
TitanHQ can help your business to improve defenses against phishing and cyberattacks through layered defenses provided by SpamTitan email security, WebTitan web filtering, and SafeTitan security awareness training. For more information on improving your phishing defenses, give the TitanHQ team a call.
by titanadmin | Nov 30, 2022 | Security Awareness |
Today is International Computer Security Day – A day when the focus is on improving cybersecurity and ensuring all computers and electronic devices are appropriately secured against the increasing number of cyber threats. It has only been 30 days since the end of Cybersecurity Awareness Month, but International Computer Security Day serves as a reminder of the importance of cybersecurity.
International Computer Security Day was the brainchild of the Association for Computer Machinery (ACM), which created this national day of recognition to raise public awareness of the importance of computer security. The first International Computer Security Day was in 1988 when computers were first starting to become widely used by businesses and governments, although were yet to become popular in homes, and a year before the world wide web came into existence. Fast forward 45 years, and not only are computers used extensively in homes, but devices are also now carried in pockets that are around 1,000 times faster than the Cray-2 supercomputer of the mid-80s!
The purpose of International Computer Security Day is to raise awareness of the need to secure all computers, whether they are PCs, laptops, smartphones, or IoT devices, and to empower users of these devices to secure their digital presence. International Computer Security Day is also an ideal time for businesses to take stock of their cybersecurity defenses and assess areas where improvements can be made, and to take the day to improve the awareness of employees and reemphasize the importance of cybersecurity in the workplace.
International Computer Security Day and Cybersecurity Awareness Month are concerned with raising awareness of cybersecurity and its importance for all individuals whenever they use their computer or access the Internet, not just during these national days and months of recognition, but throughout the year. Businesses can raise awareness at these times, but cybersecurity needs to be an ongoing conversation. Security awareness training programs should be running continuously throughout the year if they are to be truly effective.
Running a once-a-year training session for the workforce on computer security is useful, but these classroom-based training sessions have their limitations. A more effective strategy for security awareness training is to run computer-based training courses continuously, with training modules completed regularly throughout the year. If you choose a training platform that delivers training in short modules lasting no more than 10 minutes, these can easily be completed by employees without disrupting workflows. 2-3 three modules completed by each employee every month will only take up 20-30 minutes of their time, but this is likely to be far more effective than a 2-hour training session once a year at helping you to develop a security culture in the workplace, where employees stop and think about security before taking any action on a computer.
An even more effective way of training is to use a training platform that provides intervention training. The most effective training is provided instantly when a mistake is made, such as when an employee responds to a phishing email, saves sensitive data in an insecure location, or engages in any other risky cyber behavior. With the right training platform in place, when employees engage in these behaviors, the platform instantly sends them the relevant snippet of the company policy, along with a short training module relevant to that behavior or threat. This is important for correcting that behavior, as in many cases, the employee in question will not be aware that they have made a mistake. Don’t provide intervention training and that risky behavior is likely to be repeated.
SafeTitan from TitanHQ is a comprehensive security awareness training platform for businesses that has been proven to improve the security awareness of employees and reduce risky cyber behaviors and susceptibility to all common cyber threats. The platform is the only behavior-driven training platform to provide intervention training to employees in real time in response to risky behaviors and security mistakes. The platform automates the provision of that training to reduce admin time and ensures consistent and repeatable training is delivered.
The SafeTitan platform also includes a phishing simulator, for sending realistic dummy phishing emails to the workforce. These are proven to reinforce training by giving employees experience at recognizing and responding correctly to phishing threats. Through SafeTitan security awareness training, intervention training, and phishing simulations, staff susceptibility to phishing threats, ransomware, malware, BEC attacks, CEO spoofing is reduced by up to 92%.
If you want to make a real difference and greatly improve your human defenses, this International Computer Security Day take advantage of the free trial of SafeTitan and sample the training content and see for yourself how easy the platform is to use. Start using SafeTitan and Next International Computer Security Day your company will have a much stronger security posture and will be significantly more resilient to cyber threats.
by titanadmin | Nov 29, 2022 | Industry News |
Growth at TitanHQ has been tremendous over the past two years thanks to a sizable investment from the UK private equity firm, Livingbridge, in 2020, and the release of new cybersecurity solutions to better meet the needs of SMBs, enterprises, and the MSPs that serve them. TitanHQ has released SpamTitan Plus, which builds on the strong performance of SpamTitan Cloud and delivers industry-leading protection from phishing along with the security awareness training and phishing simulation platform SafeTitan – The only behavior-driven security awareness training platform that delivers security awareness training in real-time in response to security mistakes by employees.
For many years, TitanHQ has been enjoying strong organic year-on-year growth, and over the past couple of years has significantly expanded its footprint in the United States, helped by several strategic new hires and a new office in Shelton, Connecticut, staffed by a highly experienced team. That growth has recently been recognized by Deloitte, which has ranked TitanHQ as the 45th fastest-growing company in Ireland at the 2022 Deloitte Technology Fast 50 Awards. This is the second year in a row that TitanHQ has made the Top 50. The 2022 Deloitte Technology Fast 50 Awards is one of the most prestigious award programs for technology companies in Ireland and has been running for 23 years. The positions calculated by Deloitte are based on the previous four years of revenue growth.
“As the business environment becomes more complex, the Irish technology sector has shown great resilience and tenacity. This year’s ranking shows growth across a broad range of sectors with companies coming up with innovative solutions to address changing consumer and business demands while faced with adversity,” said David Shanahan, Partner, Deloitte. “It’s also encouraging to see so many new entrants, including seven in the top ten. Despite the challenges of late, the Irish indigenous tech sector continues to succeed.”
Combined, the top 50 companies in the list have generated more than €500 million in revenue, averaging €10 million per company, and in 2021 employed more than 5,500 people. The average growth rate for all companies was 594%. This year there were 17 companies that made it into the top 50 for the first time, with 7 of those companies ranking in the top 10. 8 Irish counties and all four provinces are represented in the list, and this year has seen an increase in the number of companies with female CEOs. 7 of the 50 companies are led by women.
“Organic year-on-year growth and recent significant investment have turbocharged TitanHQs growth. This has allowed TitanHQ to accelerate ambitious growth plans through increased investment in product development – and in people,” TitanHQ’s CEO, Ronan Kavanagh.
