Blog

Nobody will want to target us, we have nothing to steal. We are not important enough. We are not big enough. All our email is in the cloud, so we are ok. These are some of the excuses we hear from Small and Medium business owners when we speak to them about the cyber risk associated with their email systems. Yet they all know how to protect physical company assets, like a motor vehicle.

Is The Second Half of 2023 Your Time to Shine?

The last three years have proven that most of what we understand to be correct can be changed in days. Those restful days of small and incremental changes to the environment in which we operate are gone. We live in the time of hyper connected, rapidly changing events that we have no control over and even less chance of predicting. Whether it is global events such as war, pandemics or local events like flooding or massive inflation; the perfect storm of uncertainty has pushed us into the world of heightened risk and increasing attack surfaces.

Uncertainty drives many things including the ability of cyber criminals to use our fear to spread their attacks and tempting our trusted people to lean towards the dark side. We have seen a large number of insider driven attacks, many of which are accidental or negligent but a growing number of these start with the compromise of a trusted user. When seen as a victimless crime, many take the bait and provide access intentionally. The time of the super malicious insider is with us.

Without visibility and the capability to understand intent, you will only know something has been going on when your name is shining in the lights of breach notifications. Not the kind of shine most people are working towards.

I am constantly seeing and hearing more talk about the risk posed by insiders when it comes to business risk. The talk of insider risk and the threat to the business, threats to compliance and security has been amplified in recent weeks, yet very few businesses have any form of Insider Risk Management program in place. 

Why is this?

Do we not know where to start, or are we scared of what we might find?

Large and small business all show different levels of support or acceptance of the importance of insider threats. Sadly, the importance they place on these are totally worthless if only in words.

In the last couple of weeks we have seen reports of top secret government information being leaked/lost/copied on different sides of the Atlantic.

Microsoft 365 servers contain extremely sensitive information and most organisations simply cannot do without it for an extended period of time. Zero-day attacks – those attacks that take advantage of a vulnerability in software or firmware, and found by cybercriminals before a vendor can issue a fix – are one of the cybercriminal’s greatest advantages.

Often providing privileged access, zero-day attacks become the means for a single cybercriminal group to potentially gain access to literally tens or hundreds of thousands of organisations in every geography, industry vertical, size and country. There are even posts on the dark web by cybercriminal gangs offering as much as $3 million for a zero-day remote code execution exploit.

According to a recent analysis, there were 80 zero-day vulnerabilities exploited in 2021, a 166% increase from 2020, with Microsoft, Apple and Google products most frequently targeted.

Over the last month the J2 Software team have noticed an increase in an evolved method in change of bank details or payment fraud. While this might sound like old news, this now more directly involves the CEO.

Traditional payment fraud has been rife for some time where the cyber criminal impersonates the CEO, or other senior members of staff, to convince the finance department to make an urgent payment to either a new supplier or update their bank details. The change of bank detail fraud uses fake banking confirmation letters and the trust of finance people to update an existing supplier’s details. The growing number of successful attacks have proven to be very costly to businesses of all sizes. Owing to this, many businesses have now implemented stronger verification processes to verify supplier bank details changes, which means that the criminals have had to change their approach and tactics.

This trend involves an internal change of bank details, mostly for the CEO. The cyber criminal impersonates the CEO by using an external email address, claiming that it is their private email address, and requests that their bank details for payroll is updated. All of these use similar wording and it is usually done a week before payroll, to stress the urgency. To make sure that they pay their CEO, many of these changes have been successful. The finance or HR team update the details and the cyber criminal is paid, after which they rapidly get the money out before anybody notices.

Cyber criminals constantly adapt their approach to deceive their targets and increase their success rate. The J2 cyber security team have seen a new trend developing that speaks directly to this phenomenon.

Our team have been involved in several investigations in the last few weeks and uncovered an adapted approach to completing a successful change of bank details fraud. The attack method is not new, the execution has simply evolved.

Many people have seen and encountered the standard approach to change of bank details fraud, also known as Invoice fraud, where an attacker pretends to be one of your suppliers, creates fake change of bank details letters and emails the accounts department to get bank details updated and then makes off with your heard earned cash…