In the space of hours, Ukraine’s government, top energy companies, private and state banks, main airport, and Kyiv’s metro system all reported hits on their systems. The attacker was not immediately clear—Wired, in a recent story, described Russia as using its neighbor as a “test lab for cyber war,” but Moscow denies any part in past attacks. Its own state oil giant Rosneft also reported being hit by a cyberattack today; Rosneft’s website was unresponsive at time of writing. It’s unclear if the attacks are linked. Another Russian oil firm, Bashneft, has been hit too.

More at QZ.com

Please leave us a comment at the bottom if you might of fallen for one of these phishing e-mails!

Colorful Language!

This first one is from somebody claiming to be “Cadwalader, Wickersham and Taft LLP” using colorful language and trying to trick you into clicking on a fake link to what is likely a phishing website or virus/malware.

Apple Phishing

This 2nd one is claiming to be from Apple & is trying to trick you to click a link and login to your apple account.

Were you to actually click the link and login to your apple account they likely would capture your real apple password through the fake website!

Upgrade your Account!

This is a phishing e-mail trying to trick you into clicking on a link to “Upgrade” your account to see your “missing e-mails”

Here’s another one trying to trick you into clicking a link to upgrade your account.

Print This

This one is trying to trick the user into clicking a link so they can help somebody out by “printing” a document for them. Quite a weird phishing e-mail if u ask me!

You’ve been selected!

Phishing scam from “Amazon” trying to get you to complete some survey. It’s not really from amazon and u won’t actually get anything but maybe some malware or a virus if you do anything this says!

Would you of fallen for any of these phishing e-mails?! Leave us a comment below!

Palo Alto Networks threat intelligence analyst Brad Duncan reported that “Spora”, a powerful new ransomware strain that is able to encrypt files without communicating to a command-and-control server, is using a social engineering attack vector using fake “Chrome Font Pack” pop-ups.

Most ransomware spreads either through spam and email attachments or “malvertising”—fake ads that contain malware or malware links. Spora exploits unpatched vulnerabilities in both browsers and operating systems.

Spora’s evil geniuses have compromised multiple websites and turned the website pages into an unreadable font.  They tell visitors that the “HoeflerText” font is missing from the user’s browser and that they can fix this by downloading the “Chrome Font Pack.”

People then download and install the malicious code by double-clicking the “update.exe” file which kicks off the malicious code. The bad guys even provide help by showing where the victims can find the install file.

The moral of the story is this:  Be vigilant, be aware, and be prepared.   Keep your computer’s browsers updated to the latest versions, and make sure your operating systems are updated with the latest security patches.

And as always, “Think Before You Click”!

A new ransomware attack was spotted in Europe that uses a highly-targeted spear phishing attack using Dropbox as a delivery mechanism. It only takes one click to infect a workstation and a victim has just 24 hours to pay the ransom in Bitcoin, which is very aggressive. It’s called the “Pacman” ransomware, suggesting pictures of something eating up all files.

The ransomware strain is highly malicious. Besides containing a ransomware payload, the code includes a keylogger and has “kill process” capabilities that shut down Windows operating system functions like taskmgr, cmd, regedit and more which makes it very hard to remove this malware.

Europe is often used as a beta-testing ground for attacks on the U.S., so you can just wait for this to happen here. The problem is that this spear phishing attack is focused on a small vertical, but fully automated. In this case it’s chiropractors in Denmark. But remember that with the tens of millions of data-breach records out there, it’s very easy to do this. Next time it can be your employees getting one of these in their inbox, specifically targeted for your company.

Here is how the attack looks, reported by CSIS. It’s an email in perfect Danish from a “possible new patient”, who explains they are moving into the area, have bad neck and back problems, and is looking for a new therapist. The new patient conveniently has links to his MRI and CT scan, because his back is a case of its own.

This attack has been rated high-risk because of its highly targeted nature and the degree of social engineering used.

Technical Background 

The malicious code has been developed in .NET, so it needs to have the .NET package installed, which most Windows machines have installed by default these days.

From there, “pacman.exe” is extracted and dropped on to the system while initializing the encryption of files on the local hard disk. The code searches the disk for data files which are subsequently encrypted. After a system has been compromised it will call home to the central C&C server.

A new file extension “.ENCRYPTED” is added to all files. The process continues by replacing the desktop of the infected machine with instructions on how to regain access to the data.

It is only a matter of time before functionality is added to encrypt both mapped and unmapped network drives.

What To Do About It

1) If you have not done so already, on your “edge” device whether this is a web-filter, proxy server or firewall, include Dropbox as a blocked domain. This may not be popular but it’s a corporate survival point. It’s also a way to get back some control over “shadow-IT”.

2) Urgently step your users through effective security awareness training, so that they will spot the Red Flags related to ransomware spear phishing attacks.

Source: Knowbe4

The Critical threat is from computers with adware from a company called Superfish which installs a self-signed root HTTPS certificate that can intercept encrypted traffice for every website a user visits. Basically this threat undermines the very reason HTTPS protections exist in the first place.

More details HERE.