Researchers from Fortinet are warning of a new threat to be on the lookout for.

Right now, NFTs are all the rage. Everyone is talking about them, and many are excited about them. Hackers have been quick to take advantage of that fact, and the Fortinet researchers have stumbled across a poisoned spreadsheet that purports to contain information about NFTs.

The spreadsheet actually quietly deploys a malware strain called BitRAT when opened.

BitRAT is a particularly nasty strain of malware that first appeared for sale on the Dark Web back in late 2020. It is notable because it can bypass User Account Control (UAC), which is a Windows feature designed to prevent unauthorized access to the OS.

Once installed on a target system BitRAT can steal login credentials from browsers and other applications. It can log keystrokes and upload or download files which makes it more than capable of installing other forms of malware once the beachhead has been established.

It’s too early to say yet whether NFTs are here to stay or if they’re just a flash in the blockchain pan. Either way, if they are generating buzz and excitement around the world, hackers will continue to exploit that excitement.

As the Fortinet researchers put it:

“Be mindful that attackers often use attractive and trendy subjects as lures. As NFTs become increasingly popular, they will be used to entice victims into opening malicious files or clicking on malicious links.”

The best thing you can do is to educate your employees and inform them of the threat. Remind everyone you know that no matter how exciting the topic might be, it’s never a good idea to open files from untrusted sources or click on links embedded in emails. If you need to go to a website open a new browser tab and manually type in the URL. Better safe than sorry.

Researchers at Avanan are a Check Point subsidiary. They have recently issued a warning that anyone who uses Microsoft Teams should be aware of. According to the latest statistics, more than 270 million people use Teams every single month.

According to Avanan, hackers are breaking into Team chats and attaching malicious files to ongoing conversations. By all outward appearances the attached files appear to be relevant to the conversations, but anyone unfortunate enough to click on the file will be infected.

At this point, it’s not clear how the hackers are gaining access to Teams in the first place. The most likely possibilities include compromising a third-party vendor that a company does business with, phishing attacks, or stealing Microsoft 365 or email credentials.

The disturbing thing about this recent spate of attacks is the fact that it requires absolutely no sophistication. It’s about the simplest form of attack one could imagine and made possible in no small part by virtue of the fact that Microsoft Teams is almost universally trusted by those who use it.

Very few people think anything of security once they’re entrenched in the Teams framework.

The researchers at Avanan recommend the following to limit your risk and exposure:

Encourage end-users to reach out to IT when seeing an unfamiliar file
Implement protection that downloads all files in a sandbox and inspects them for malicious content
Deploy robust, full-suite security that secures all lines of business communication, including Teams
Make sure you recognize anyone leaving files in Teams chat
Even if your employees follow all of those recommendations, it won’t provide bullet-proof protection, but it will make an infection from this vector much less likely.

Although Teams already has robust file protection protocols in place, you can bet that Microsoft will be taking another closer look at this in the weeks and months ahead.

For most of the history of the internet Linux has been able to stay below the radar of hackers around the world.

While there have been some attacks that specifically targeted Linux users, they’ve managed to keep a low enough profile that it hasn’t been a major issue.

According to a group of researchers from VMware, that appears to be changing.

They warn that hackers are increasingly setting their sights on Linux-based systems. That’s a problem because to date, there has been no corresponding increase in efforts to detect and manage those threats.

Even worse is that with a growing number of hybrid systems in use today, Linux is becoming much more commonly seen in the Enterprise environment. Given the disconnect between the growing threat level and the level of preparations being made to meet that threat, Linux-based systems may well be the new weakest link in your company’s network.

If there’s a silver lining in the dire warning from the folk at VMware it lies in the fact that most of the attacks targeting Linux-based systems aren’t very sophisticated at this point. That will change over time but in the here and now it shouldn’t take much to fend off the current generation of attacks.

As the VMware team put it:

“Focus on the basics. The fact is that most adversaries are not super advanced. They’re not looking for unique exploits, they’re looking for the general open vulnerabilities and misconfigurations. Focus on those before you start focusing on zero-day attacks and new vulnerabilities – make sure you’ve got the basics covered first.”

It’s sound advice and easy to follow. The worst thing you can do in this case is nothing. The threat level is rising. That’s an indisputable fact. Those who take no action do so at their cost.

Researchers have spotted a new phishing campaign you should be aware of.

What sets this one apart is that the hackers are using a lowly but specially crafted CSV file to infect machines. They are installing the BazarBackdoor malware. If you’re not familiar with the term CSV stands for “Comma Separated Values” and it’s a text file format that can be loaded into Excel.

If you open the file in a text editor, you’ll simply see alphanumeric values separated by commas with the first line generally being the headers for the spreadsheet. Open the same file in Excel and it will separate the data into neat rows and columns.

CSV files are popular because they make it relatively easy to export data from one application and import it into another. Since the files are text only most people consider them to be relatively harmless and are generally not all that cautious when opening them.

Microsoft Excel supports a feature called Dynamic Data Exchange (DDE) which can be used to execute commands whose output is inputted into the open spreadsheet including CSV files.

Hackers are always on the lookout for new angles to play and have naturally begun to abuse this feature. They execute commands that download malware on the devices of unsuspecting victims.

BazarBackdoor is a stealthy malware strain created by the TrickBot group. It’s main purpose as the name suggests is to provide ongoing remote access to an internal device that can be used as a springboard for further lateral movement within a network.

The current campaign is centered around emails that pretend to be “Payment Remittance Advice” emails with links to remote sites that download a CSV file with innocuous names like “document-2196t6.csv.”

If this file is opened in notepad or word pad and examined, at first glance it will appear to be nothing more than a run of the mill CSV file. Unfortunately, embedded inside of it is a WMIC call in one of the columns of data that launches a PowerShell command and that’s enough. That’s all the hackers need to install the malware.

As always vigilance is your best defense against this sort of thing. Remind your employees not to open any emails from unknown or untrusted sources and not to download or open any attachments from those emails.

Individual users often don’t have a good sense of the scope and scale of hacking attacks around the world. The numbers may shock you.

According to Microsoft, in 2021 the company blocked more than 25.6 billion brute force authentication attacks against Azure AD users. They also and intercepted a staggering 35.7 billion phishing emails with Microsoft Defender for Office 365.

Vasu Jakkal is Microsoft’s Corporate Vice President for Security, Compliance, and Identity. Jakkal is both passionate and concerned about this subject. The increase in the total number of attempts since the pandemic began has been breathtaking.

Unfortunately, Jakkal says that so far only a minority of Azure AD and Microsoft 365 users seem interested in taking steps to bolster their own security. Based on statistics gathered by Microsoft, only 22 percent of Azure AD users have activated MFA (multi-factor authentication) protocols. MFA would keep their accounts safer and make it significantly more difficult for hackers to force their way in.

Here is how much more difficult it can be:

Google combined forces with researchers at New York University and the University of California to study that very topic. They discovered that MFA implementation can block up to 100 percent of automated bot attacks, 99 percent of bulk phishing attacks, and up to 66 percent of targeted attacks. That is an impressive level of protection for something that’s so simple to implement and make use of!

The two big takeaways here are:

The total number of hacking attacks is increasing dramatically.
Although automated tools are getting progressively better at preventing many of them, end users have an important role to play too. Unfortunately, as of right now they’re not.
Depressingly few users are taking even the most basic steps to better secure their accounts. If you set one major IT security goal for the year, a very good one would be to do all you can to increase the percent of users at your firm who are taking advantage of MFA everywhere they can.

An increasing number of scammers are using social media to target victims and relying on social engineering tricks to convince people to part with their personal information or money. The problem has grown serious enough that the FTC (Federal Trade Commission) has issued a formal warning to consumers.

According to a recently released FTC report:

“More than 95,000 people reported about $770 million in losses to fraud initiated on social media platforms in 2021.

Those losses account for about 25 percent of all reported losses to fraud in 2021 and represent a stunning eighteen-fold increase over 2017 reported losses. Reports are up for every age group, but people 18 to 39 were more than twice as likely as older adults to report losing money to these scams in 2021.

More than half of people who reported losses to investment scams in 2021 said the scam started on social media. Reports to the FTC show scammers use social media platforms to promote bogus investment opportunities and even to connect with people directly as supposed friends to encourage them to invest.

People send money, often cryptocurrency, on promises of huge returns, but end up empty-handed.”

Overall cryptocurrency scams are regarded as the number one threat for investors in 2022, according to a new report from the North American Securities Administrators Association (NASAA). However, the FTC is cautioning all users to exercise caution and develop better habits when scrolling through their favorite social media platform.

They recommend setting limits on who can see your posts, taking advantage of increasingly robust privacy controls, opting out of targeted advertising, and doing more due diligence on any company you plan on doing business with before buying anything from them.

It’s good advice in general but it is especially important now given how prevalent social media-based attacks are becoming.

Microsoft recently announced an important upgrade to Microsoft Defender.

It now supports vulnerability management for both Android and iOS.

The company’s announcement reads in part as follows:

“With this new cross-platform coverage, threat and vulnerability management capabilities now support all major device platforms across the organization – spanning workstations, servers, and mobile devices.

Threat and vulnerability management in Microsoft Defender for Endpoint continuously monitors and identifies impacted devices, assesses associated risks in the environment, and provides intelligent prioritization and integrated workflows to seamlessly remediate vulnerabilities.”

Although the new feature was introduced with very little fanfare, this is a significant change. This will make the lives of network admins much easier by significantly decreasing the surface attack area of mobile endpoints.

This is part of Microsoft’s broader strategy to expand the security platform’s capabilities across all platforms to provide endpoint users with a unified security solution. Previous upgrades to Microsoft Defender’s capabilities included adding support for Linux users back in 2020.

Just one month later, the company added a “Microsoft Secure Score for Devices” feature. This is a feature that that allows network security professionals to evaluate the state of security of all devices connected to the enterprise network. It also includes a “recommended actions” section to further bolster security.

Then in October 2020 the company added another new feature that automatically generated reports to assist with the tracking of vulnerable Windows and macOS devices on the network. These included vulnerability severity levels, exploit availability, vulnerability age, and vulnerable devices sorted by OS.

All these changes are superb when evaluated individually but taken together they demonstrate just how serious Microsoft is taking matters of security. They also display the company’s clear commitment to provide cross-platform protection. This is all with the understanding that networks are no longer homogenous entities and are often made up of a wide range of different device types running a variety of operating systems.

Kudos to Microsoft for their ongoing efforts to make Microsoft Defender even more valuable than it already is.

In late 2020 a new strain of malware called UpdateAgent appeared and began infecting Mac users.

Initially the strain wasn’t all that worrisome. It stole system information but it was by no means the worst threat on a Mac user’s radar.

Since that time, the hackers behind the malicious code have been busy. UpdateAgent has received a few developments, with each one adding a new element of danger to the equation. As things stand now UpdateAgent should be considered a serious threat to Mac users.

As of its latest iteration UpdateAgent installs an annoyingly persistent adware strain called Adload. It has gained capabilities that make it easy for UpdateAgent to install other even more threatening and damaging payloads in the future.

Microsoft has been investigating and following the development of UpdateAgent. The company has discovered that the hackers who created the strain are hosting a wide range of other payloads on Amazon Web Services’ S3 and CloudFront services. While these have not yet been tied to UpdateAgent, it’s a clear sign of the shape of things to come.

In addition to that, the code is now capable of fetching compressed zip files instead of .dmg files. It has been modified to prevent Gatekeeper from displaying pop-up warnings to users. It can also inject persistent code inside background processes that are invisible to the user.

Microsoft had this to say about their study of the malware strain:

“UpdateAgent is uniquely characterized by its gradual upgrading of persistence techniques, a key feature that indicates this trojan will likely continue to use more sophisticated techniques in future campaigns.

Like many information-stealers found on other platforms, the malware attempts to infiltrate macOS machines to steal data and it is associated with other types of malicious payloads, increasing the chances of multiple infections on a device.”

If UpdateAgent wasn’t on your radar before it certainly belongs there now. It’s one to watch out for in the year ahead.

Back in September of 2020 Microsoft announced that it was experimenting with the addition of SMTP MTA Strict Transport Security (MTA-STS) support to Exchange Online. This was done in a bid to ensure the email communication and security of their Office 365 customers.

In a recent statement by the company the Exchange Online Transport Team said:

“We have been validating our implementation and are now pleased to announce support for MTA-STS for all outgoing messages from Exchange Online.”

While it may not sound like a terribly exciting change, it truly is a big step forward. Now that the feature is in place in Office 365, any emails sent by users via Exchange Online will be delivered using connections with both authentication and encryption protocols. This is for protecting them from interception and attack attempts and includes both man-in-the-middle and downgrade attacks.

Again, per the Exchange Online Transport Team:

“Downgrade attacks are possible where the STARTTLS response can be deleted, thus rendering the message in cleartext. Man-in-the-middle (MITM) attacks are also possible, whereby the message can be rerouted to an attacker’s server.

MTA-STS (RFC8461) helps thwart such attacks by providing a mechanism for setting domain policies that specify whether the receiving domain supports TLS and what to do when TLS can’t be negotiated, for example stop the transmission.”

In addition to the feature addition Microsoft has also provided guidance on how to adopt MTA-STS. This includes where to host the policy file on your domain’s web infrastructure.

Additionally, the Exchange Team announced that they’re in the process of rolling out SANE for SMPT (with DNSSEC support). That provides better protection for SMTP connections than MTA-STS does.

The company’s plan is to proceed slowly and in two phases. Phase I is to be completed by March 2022 and phase II is to be completed by year end 2022. The team stressed that admins would be able to use both standards on the same domain at the same time, allowing them to account for senders who may exclusively use one or the other.

Great news indeed. Kudos to Microsoft for their continuing efforts.