Many of our clients have recently noticed a significant uptick in malicious spam (also called phishing), and some users have been tricked. This is a very serious issue, please take a moment to read this message to better protect your company.
Organized crime and government sponsored groups have farms of cyber-perpetrators who create new malicious threats every day. Billions of emails are sent every week, with the hopes that a small percentage will get through and open up doors for the criminals. Brand new threats, often called zero-day threats, have often not yet been flagged by spam filters or Anti-virus programs to proactively protect you.
Often the emails you receive will look credible, and even appear to have come from a known or trusted person (which is usually a spoof). Here is an example:
In this case, if you click on the “Download” link, a credible-looking landing page asks you to input your Microsoft Office 365 credentials. Once you have done this, malware will access your Office 365 account or computer and go to work. In many cases, the software will remain silent in your machine for weeks or even months as the perpetrators collect behavioral information about your habits.
The final endgame is typically to defraud your company (a whole topic unto itself) or further proliferate the software by using your email account to pass the threat along to your contacts (hence the name “virus”).
Upward Technology is currently in the process of developing a new division to proactively combat this evolving threat. Doing so effectively requires:
- A good understanding of each client’s risk profile
- A robust suite of technological controls
- Strong policies and user training
At Upward, we believe that You, the human element, are perhaps the most important defense for your business. Here are some basic best practices every employee should keep in the forefront of their mind to keep their company (and their jobs) safe.
Be Conservative and Trust Your Gut
Upon reflection, most users who have fallen for a phishing attempt readily admit that they missed something obviously incongruent or suspicious about the message. We are all busy, and most of us get way too many emails, but part of the behavioral shift needed to combat this threat is a higher degree of caution.
If you knew that 5% of the physical letters you received in the mail had poison inside of them, you would inspect all the envelopes you pull from your mailbox with a higher degree of scrutiny, right? Your inbox should be treated as such.
Trust your gut. Your good instincts and judgment are your companies strongest defense.
Ask Whenever in Doubt
As you begin to approach your incoming mail with a higher degree of skepticism, use your technical support team and co-workers as a sounding board to verify that your suspicion is warranted. Here are the steps to follow:
- Don’t click on the message if it’s suspicious ie: you didn’t go looking for it or ask for it.
- Right-click on it, copy and send it as an attachment to email@example.com
- Ask your neighbor at work to look at it over your shoulder if you want the validation that it seems fishy.
Report it Immediately if you make a Mistake
The worst thing that can happen in these cases is a known mistake going unreported. If you just have one of those days, and accidentally respond or compromise information in a moment of weakness, please raise your hand. This is a call to leadership at your company as well to create and foster a culture where employees aren’t afraid of punishment if they make a mistake.
As mentioned, these threats can sometimes sit in the background for months, so identifying and isolating the compromised systems early is critical. These mistakes are extremely common and made by employees from the warehouse to the C-suite, so be brave and report it right away!
If you have any questions or are interested in learning more about protecting your company, please reach out to firstname.lastname@example.org
*We have recently been informed that some federal and state government accounts have been compromised and malicious emails have been coming from official government accounts, furthering the case that cyber-security effects everyone and precautions should be taken to protect you and your company. Please be extra cautious about any messages like this!