How to Deal with Modern Phishing Techniques and Leverage Secure Cloud Transitions?
The global pandemic of COVID-19 has forced many enterprises and small businesses to shift to new ways of doing business, including switching to cloud-based applications (SaaS) for seamless work from home experience. For others, the fast and unplanned transition was bumpy. This transition period was a boon for cybercriminals as they used a range of linked devices on several fronts. They went on to exploit those making heavy use of digital systems in all aspects of life. Such change will demand greater cybersecurity solutions as more people need unfamiliar and complex technology.
There is also a need for creating a cyber investigation. The response team has recently understood phishing techniques to be modified by operators of a widely practiced campaign to gain credentials in what appears to be a perceived effort to exploit the easy use of cloud-based SaaS. Their new techniques have been developed both to avoid detection and to increase the chance of successful fishing.
How is the recent of a new phishing campaign?
The threat actor picked up a contact list and then sent the email to the list following a successful Phish or password assault on a user and taking over the account in a Microsoft Office 365 TM tenant environment. As the email came from an Office 365 platform account, it has inherited normal and awaited user signature trappings. Further, the receiver and the recipient email system would have found the incoming mail to be from the Office 365 tenant room based on the extended mail headers. These headers will add credibility to the mail such that the filtering and inspection of the human being can be circumvented.
This initiative’s deliberately constructed emails further questioned users’ ability to distinguish the phishing email and a genuine one. Usually, it will be a secure encrypted email addressing the threat perpetrators, which beefs up the demand for managed security operations.
Cybercriminals usually achieve this typical phishing scenario by building the message on the legal, stable ZIX email provider, allowing the user to click on an email address.
A free-theme page with another connection was hosted on OneDrive that forwarded the user to a regular “phishing” domain on a dynamic hosting service. In this case, Unified Layer provided the IP registers the false domain. However, unwary users could not have recognized the domain because the dangerous actors provided them with a familiar-looking login prompt.
Although the phish username appears to be a legal login for Microsoft, a few variations remain. In the legitimate login, users see:
- The use of the “Sign in” Oxford comma.
- Appropriate capitalization of the right Skype substantive.
- “Can’t your account access? “Sign in by a security key” gets replaced by a generic line.
- The ‘Sign-in options’ are substituted for ‘sign-in options,’ without constant capitalization and the sign-in hyphen.
It is difficult for any layman to get hold of such nuances. Also, Microsoft connections have been set up to access the real phishing messages. It’s no wonder that users unintentionally insert their login credentials and resume the loop.
As a managed IT service provider in Florida, we have come across many who has detected multiple variations of this campaign over the past several months, basically following the same script. Email server managers and compliance departments should ensure that users become aware of phishing campaign signs such as those mentioned above and recognize them. The players behind them illustrate a consistent, continuous, and systematic process bound to succeed when cloud platforms confuse consumers and security devices.
The role of Microsoft Partnered managed security operations.
The Microsoft 365 Defender provides cross-domain information and actionable information in a centralized view of incidents to allow security operations teams to respond to attacks in a systematic manner. A dedicated team of cybersecurity experts works closely with the Microsoft researchers to leverage the findings of threat analysis reports for critical threats such as BISMUTH campaigns containing technical requirements, identification information, and mitigation status.
Tools such as advanced hunting allow security teams to carry out additional environmental inspections for related or similar threats. Threat and vulnerability management data suggest mitigation recommendations that companies should take to reduce risks, including allowing applicable attack surface reduction laws.
Microsoft 365 Defender’s leading capabilities are assisted by a network of Microsoft analysts and security experts at Computer Solutions East who control the threat environment and track threats. Via Microsoft 365 Defender, we turn threat intelligence into security and comprehensive analysis tools organizations can use to develop corporate resilience.
CSE is a leading global supplier of advanced cybersecurity solutions based out of the USA. Explore the range of comprehensive cybersecurity solutions coupled with dedicated security experts driving applied cybersecurity systems and controlled security operations.
Our network of advanced technologies and intelligent operation centers brings security with creativity combined with global scope and global distribution capacities. We are supported to ensure that our clients are secure to innovate, build cyber resilience, and grow confident by our highly qualified team.
