The IT Nerd

Abnormal Security today announced that it is fueling its continued hypergrowth by expanding its sales leadership. The company has appointed two executives to lead its channel and alliances initiatives, with Jonathan Corini joining as Vice President of Worldwide Channel Sales and Stephanie Goodman as Head of Global Alliances. 

Corini will lead Abnormal’s global channel sales strategy and oversee all aspects of the company’s channel partner program, while Goodman will expand Abnormal’s strategic alliances ecosystem and accelerate growth among technology partners. These appointments cap a banner year for the company, which now serves 1,880+ customers and recently crossed $100M in ARR. This unprecedented success over the past year is due in large part to the company’s extensive partner system, ongoing dedication to the channel, and deep technology alliances across the industry—all of which will continue under new leadership. 

Corini has over 23 years of experience in cybersecurity and has held numerous sales and channel leadership positions. He most recently served as the VP of Global Channels at HYPR, where he designed and launched a new channel-focused GTM strategy that was responsible for over one-third of the company’s pipeline. Previously, Corini was SVP of Global Channels at Mimecast, where he grew channel sourced bookings to over 40% of the company’s revenue and expanded the global MSP business to 20,000+ customers. In addition, Corini has held channel leadership roles at ForeScout Technologies, Tanium, and Intel Security throughout his extensive career.

Goodman brings over 15 years of security experience and comes to Abnormal most recently from Google, where she served as the Global Lead of Strategic Alliances & OEMs. While there, she launched a global OEM program that grew over 200% in its first year and led her team to grow GSI revenue by 250% over the course of 2023. Previously, Goodman was the Director of Global Strategic Alliances at ForeScout Technologies, where the alliance team created an integration monetization plan that now represents 25% of overall company revenue, and held channel program management roles at McAfee. 

The two executives are joining an established channel-first organization with strong technology partnerships. Abnormal currently supports dozens of strategic partners, including value-added resellers, by providing its behavioral AI platform to protect customers against the growing threat of advanced, socially-engineered email attacks. The email security platform currently integrates with Microsoft, Google, and CrowdStrike, as well as dozens of other cybersecurity platforms. Moving forward, the focus will be on deepening relationships with enterprise partners throughout North America, expanding channel partnerships across Europe and the Asia-Pacific region, and launching strategic alliances with key organizations across the industry.

For more information about the partner program or to become a partner, visit the Solution Partners page.

Abnormal Security is reporting on real-world AI-generated malicious emails their customers have received in the last year, with the attack examples from 2023 pointing to threat actors who have embraced the malicious use of AI, including: 

• A malware attack in which the threat actor poses as an insurance representative and informs the recipient that attached to the email contains benefits information and an enrollment form that must be completed/returned. If the recipient fails to do so, they are told they may lose coverage.
• Netflix impersonator compromises a legitimate domain in a credential phishing attack, where the threat actor poses as a customer service representative from Netflix, claiming that the target’s subscription has expired. 
• A cosmetics brand impersonator attempts invoice fraud in a billing account update attempt, posing as a business development manager for cosmetics company LYCON, and informs the recipient of irregularities in their balance sheet noticed during a mid-year audit. 

Even though generative AI has only been used widely for a year, it is evident that the potential is there for widespread abuse. The attacks shown here are well-executed but are only the beginning of what is possible. 

You can view the report here.

Abnormal Security has revealed its discovery of a novel BazarCall phishing attack variant that incorporates using Google Forms to increase the appearance of legitimacy and elevate the perceived authenticity of the initial malicious emails. The new attack report demonstrates an email sent by threat actors as part of the phishing attack with a real-world example of a Google Form with details similar to those used in a traditional BazarCall attack. 

BazarCall/BazaCall, aka call-back phishing, is a remarkably sophisticated strategy attack type that gained notoriety in 2020 due to its abnormal method of distributing malware – manipulating victims to interact with the attackers through a simple phone call. BazarCall attacks typically start with a phishing email designed to appear as a payment notification or subscription confirmation from a known brand. 

The attacker creates a Google Form and adds details about the fake transaction, including an invoice number and date, method of payment, and information about the product or service that was purportedly purchased; enable the response receipt option on the Settings tab and send the invitation to complete the form to themselves. When the invitation arrives, the attacker clicks the Fill Out Form button, which opens the Google Form. 

You can read all the details here.

Abnormal Security has published a novel Disney+ scam email that uses brand impersonation and personalization to send a convincing fake subscription charge notice. Mike Britton, the CISO of Abnormal Security, will demonstrate why this multi-stage attack is unique, what makes it challenging to detect, and how to stop impersonation attacks with AI.

The attachment is personalized and contains details about an upcoming bill, including the customer’s name, an invoice number, and the total amount to be paid in US dollars – a charge far more than the basic and premium Disney+ subscriptions combined. 

The threat actor incorporated Disney+ branding and colors while personalizing each email’s subject line and greeting the individual recipient with the target’s name in the PDF filename and within the content of the fake invoice, an unusual tactic due to the manual effort required to do this for each email.

You can read the report here.

Threat actors are known to capitalize on geopolitical events to manipulate victims into sending money, and the recent events in Gaza and Israel are no exception. 

In relation to this, Abnormal Security has published a recent attack detected in which cybercriminals attempted to solicit fraudulent charitable donations for children. 

The attackers encourage recipients to donate funds to cryptocurrency wallet addresses, claiming the money will be used to provide basic needs: water, medical care, and Internet access. 

According to the research, the campaign targeted 212 individuals at 88 organizations. Abnormal Security breaks down the cryptocurrency donation attack, what makes it notable, and why it is difficult to detect.

You can read the details here.

Shortly after the SEC charged Bittrex, “the best crypto trading platform,” with operating an unregistered securities exchange, the crypto exchange chose to shut down its U.S. operations and return assets to customers in the wake of the complaint after filing for bankruptcy protection several months ago. 

Abnormal Security has unveiled the details behind a novel bankruptcy phishing campaign in which real customers of crypto exchange Bittrex received malicious emails unbeknownst to them, claiming they still had assets on the exchange that could be withdrawn.

The timing of the attack was deliberate. Bittrex received bankruptcy court approval on Monday, October 30, to officially shut down U.S. operations. The threat actors had access to this information and determined that 10/23 was the best day to launch the attack as the deadline was in the court docket. Hackers claimed if the funds were not taken out of the crypto trading platform before the withdrawal period ended on 10/25, all assets would be forfeited. 

You can read the Abnormal Security report here.

Abnormal Security, the leading AI-native cloud email security platform, today announced enhanced capabilities to detect QR codes in emails and parse their corresponding links. The signals extracted from parsing the QR codes, combined with Abnormal’s behavioral analysis across the broader email environment, strengthens the platform’s ability to detect and block malicious activity. 

Recent data from Abnormal shows that QR codes are the primary attack vector in 17% of all advanced attacks targeting customer environments. As QR codes have risen in popularity, offering a convenient format for sharing information, threat actors have also begun to exploit their familiarity, including through credential phishing, extortion, and invoice payment fraud attacks. Attackers are increasingly crafting emails that contain malicious QR codes, often linking these images to a seemingly legitimate website, like a Google or Microsoft login page, and prompting recipients to enter their login credentials, which are then stolen or used to launch additional attacks. 

In contrast, Abnormal takes a radically different approach to stopping advanced email attacks. The unique API architecture ingests thousands of diverse signals to build a baseline of the known-good behavior of every employee and vendor in an organization based on communication patterns, sign-in events, and thousands of other attributes. It then applies advanced AI models including natural language processing (NLP) to detect abnormalities in email behavior that indicate a potential attack. This is how Abnormal has historically detected attacks that use QR codes, including this quishing campaign detected in late 2021. 

With the updated capabilities announced today, Abnormal has introduced models specifically designed to determine when an email contains a QR code, whether that is in the body of the email or in image and PDF attachments. The platform now parses the embedded link associated with the QR code, and ingests that information alongside other signals to identify and remediate malicious activity.

For more information on a recent QR code attack and additional product details, read this blog post. 

Abnormal Security has announced the launch of a new report, “The State of Email Security in an AI-Powered World.” The report reveals security leaders’ greatest concerns about the growing threat of generative AI in the enterprise—particularly via the email vector—and how they are preparing to adapt their defenses in response.  

Based on a survey of 300 senior cybersecurity stakeholders from organizations of all sizes across multiple industries, the research found that nearly all security leaders (98%) are concerned about the cybersecurity risks posed by ChatGPT, Google Bard, WormGPT, and similar tools. 

Their leading worry is the increased sophistication of email attacks that generative AI will make possible—particularly, the fact that generative AI will help attackers craft highly specific and personalized email attacks based on publicly available information. Not only are security leaders feeling nervous about these threats, many are already experiencing them. Four-fifths (80.3%)  of respondents confirmed that their organizations have either already received AI-generated email attacks or strongly suspect that this is the case.

Despite widespread concern, the vast majority of security leaders are not adequately prepared to protect against AI-generated email attacks. The majority of respondents are still relying on their cloud email providers or legacy tools for email security, with over half (53%) of respondents still using secure email gateways to protect their email environments. Unfortunately, this approach does not seem to be working, as nearly half of respondents (46%) lack confidence in traditional solutions to detect and block AI-generated attacks.

The research highlights an opportunity for an alternative approach with AI-driven security as the next frontier of email protection, as 92% of survey participants see the value in using AI to  defend against AI-generated email threats. Additionally, more than 94% of survey participants say that AI will have a major impact on their cybersecurity strategy over the next two years.

You can download the full report, The State of Email Security in an AI-Powered World, here. 

Healthcare organizations are a prime target, especially socially engineered attacks like business email compromise (BEC), which data shows is steadily increasing across the healthcare industry and is seeing a relative rise in 2023. 

Abnormal Security has released healthcare industry BEC data, revealing a 167% increase in advanced email attacks in 2023, which includes BEC, credential phishing, malware, and extortion, and a 279% increase in social engineering attacks, a significant spike from January to August.

Abnormal also provides a real-world example of an email attack impersonating the President/CEO of a healthcare network with 200+ US locations requesting all past due statements for customers, including emails for account payables departments.

For an extensive health network seeing so many patients daily, if the recipient replies with legit info and enables realistic requests for payments to be diverted into the account owned by the attacker, a successful attack could result in millions of dollars lost before the network realizes an error in its customers’ payments. 

You can read the report here:  abnormalsecurity.com/blog/healthcare-organizations-email-attacks-2023

Abnormal Security has published its newest discovery showcasing the evolution of the Nigerian prince scam and how these attacks continue, despite increased awareness, targeting businesses and organizations – not just personal accounts – and using generative AI to see more success. 

As a CISO that’s been doing this for years, it was intriguing and exciting to Abnormal Security’s CISO Mike Britton that this attack is still occurring and they’re still targeting business emails, which shows that this is still an effective attack.

You can read more on this here.