The IT Nerd

Armorblox has a deep dive into their latest analysis on an attack targeting end users across a large, national institution within the Education Industry with an email almost identical to an invoice reminder notification from a trusted vendor. 

Upon opening the attachment, unsuspecting victims were met with a message that seemed to be from Microsoft informing the recipient that he or she was being taken to the organization’s sign-in page. No matter if the end user immediately closed the attachment or waited to be navigated through, just opening the attachment initiated the installation of malware onto the user’s machine. 

Further details of this attack can be found in the blog, including:

• What techniques were used to get past traditional email security filters and pass the eye tests of unsuspecting users?
• How this attack  bypassed Microsoft Office 365 email security, potentially compromising more than 100,000 mailboxes.
• Guidance and recommendations that can be used to prevent similar attacks.

You can read the deep dive here.

Pentera has releaseda new research report on how Uriel Gabay, Security Researcher at Pentera was able to bypass an air-gapped network to execute an attack. In order to protect an organization’s critical assets from Internet access, IT teams often create isolated or ‘air-gapped’ networks. 

These networks are largely considered inherently untouchable, but Pentera Labs Research was able to bridge the air-gap and access them with only a few lines of code. Air-gapped networks may not have direct access to the Internet, but they still often require DNS services in order to resolve a company’s internal DNS records. 

Uriel was able to exploit this reality to execute an attack over the DNS and showcase how hackers could relatively easily access offline information that organizations assumed was safe.

You can read the research here.