The WorkTango platform creates space for employees to have a voice and helps companies easily gather frequent feedback for any engagement, transformation, or feedback initiative

WorkTango

worktango

Cyber-crime is a complex landscape, but when it comes to actually launching cyber-attacks, there are three main techniques that criminals have relied on for decades to help them get around organizations’ defenses and into their networks:  phishing, credentials theft and business email compromise.  According to Verizon’s Data Breach Investigation Report, these ‘big three’ are the cause . over two-thirds (67%) of all successful data breaches globally Check Point Research recently joined forces with to analyze and take a deep dive into a large scale phishing campaign that targeted thousands of global organizations, revealing the campaign’s overall infection chain, infrastructure and how the emails were distributed. Otorio In August, attackers initiated a phishing campaign with emails that masqueraded as Xerox scan notifications, prompting users to open a malicious HTML attachment. While this infection chain may sound simple, it successfully bypassed Microsoft Office 365 Advanced Threat Protection (ATP) filtering and stole over a thousand corporate employees’ credentials. Interestingly, due to a simple mistake in their attack chain, the attackers behind the phishing campaign exposed the credentials they had stolen to the public Internet, across dozens of drop-zone servers used by the attackers. With a simple Google search, anyone could have found the password to one of the compromised, stolen email addresses:  a gift to every opportunistic attacker. Infection Chain The initial attack started with one of several phishing email templates. The attacker would send an email imitating a Xerox (or Xeros) scan notification with the target’s first name or company title in the subject line. Once the victim double-clicked the attached HTML file, the default system browser displayed a blurred image with a preconfigured email within the document (see figure 1 above). Throughout the campaign several other phishing page variants were used, but the blurred background image remained the same. After the HTML file was launched, a JavaScript code would then run in the background of the document. The code was responsible for simple password checks, sending the data to the attackers’ drop-zone server, and redirecting the user to a legitimate Office 365 login page. Throughout the campaign, the code was continuously polished and refined, with the attackers creating a more realistic experience so the victims were less likely to have their suspicions aroused, and more likely to provide their login credentials. By using simple techniques, the attackers were also successful in evading detection by most Anti-Virus vendors, as can be seen from the following detection rates from the latest iteration of the campaign: Infrastructure This campaign utilized both unique infrastructure, and compromised WordPress websites that were used as drop-zone servers by the attackers. While using a specialized infrastructure, the server would run for roughly two months with dozens of XYZ domains. These registered domains were used in the Phishing attacks. We discovered dozens of compromised WordPress servers that hosted the malicious PHP page (named “go.php”, “post.php”, “gate.php”, “rent.php” or “rest.php”) and processed all incoming credentials from victims of the phishing attacks. Attackers usually prefer to use compromised servers instead of their own infrastructure because of the existing websites’ well-known reputations. The more widely recognized a reputation is, the chances are higher that the email will not be blocked by security vendors. Email Distribution Analyzing the different email headers used in this campaign allowed us to draw several conclusions regarding the Tactics Techniques & Procedures (TTPs) used by the attackers: The emails are sent from a Linux server hosted on Microsoft’s Azure The emails are often sent by using PHP Mailer 6.1.5 (latest version from Mar 19 to May 27) The emails are delivered using 1&1 email servers Attackers used compromised email accounts to distribute spam through high-reputation phishing campaigns because the emails are harder to block. In one specific campaign, we found a phishing page impersonating IONOS by 1&1, a German web hosting company. It is highly likely that the compromised IONOS account credentials were used by the attackers to send the rest of the Office 365 themed spam. Targeted Organizations We found that once the users’ information was sent to the drop-zone servers, the data was saved in a publicly visible file that was indexable by Google. This allowed anyone access to the stolen email address credentials with a simple Google search. The public availability of this data allowed us to create a breakdown of the victims according to their industry (based on a subset of ~500 stolen credentials). Although there was a wide distribution of targeted industries, there appears to be a special interest in Energy and Construction companies. Previous Campaigns We found several correlations to previous phishing activity by comparing the campaign’s TTPs. Due to the similarities, these activities were likely executed by the same attacker or group of attackers. We discovered a phishing email from May 2020 that perfectly matched the TTP’s described above. It also used the same JavaScript encoding that was used by this campaign in August. In this older scenario, the script redirected the user to another variant of an Office 365 phishing page that was not entirely encoded within the initial HTML file. Google search engine algorithm naturally indexes the internet, and that is what makes it the most popular search engine ever invented. Thanks to its powerful algorithm, it also capable of indexing the hackers pages where they temporarily store the stolen credentials. We informed Google for them indexing the hackers’ failures and victims now can use Google search capabilities to look for their stolen credentials and change their passwords accordingly. The suspended the associated .xyz domains immediately upon receiving this information from Check Point and confirming the abuse. XYZ Registry’s Anti-Abuse Team Conclusion Our analysis of this campaign highlights the efforts that attackers will make to conceal their malicious intentions, bypass security filtering and trick users. To protect yourself against this type of attack, be suspicious of any email or communication from a familiar brand or organization that asks you to click on a link or open an attached document. Here are some practical tips to help keep your data safe: Beware of lookalike domains, spelling errors in emails or websites, and unfamiliar email senders. Be cautious with files received via email from unknown senders, especially if they prompt for a certain action you would not usually do. Ensure you are ordering goods from an authentic source. One way to do this is to NOT click on promotional links in emails, and instead, Google your desired retailer and click the link from the Google results page. Beware of “special” offers that don’t appear to be reliable or trustworthy purchase opportunities. Make sure you do not reuse passwords between different applications and accounts. Organizations should prevent zero-day attacks with an end-to-end cyber architecture, to block deceptive phishing sites and provide alerts on password reuse in real time. Check Point Infinity is effective because it combines two key ingredients: full convergence across all attack surfaces and all attack vectors, and advanced prevention that can tackle the most sophisticated zero-day phishing and account takeover attacks. Indicators of Compromise C&C domains registered by the attacker aauths[.]xyz asklogzswq[.]xyz bdqopt[.]xyz drakovexlogz[.]xyz hrekre[.]xyz ionlineforyou[.]xyz itsthebestasajob[.]xyz khetwexw[.]xyz livestrde28[.]xyz loggsofice[.]xyz manonwork[.]xyz officeautonow[.]xyz officednslogsonline[.]xyz quantityscape[.]xyz redirectitto[.]xyz rhbreeef[.]xyz sendlivofse[.]xyz shlivemicrosft[.]xyz synchoilas[.]xyz urentr[.]xyz vintageredwe[.]xyz wegoforyou[.]xyz weworkhard[.]xyz workingoni[.]xyz zixzanwe[.]xyz mtietw[.]xyz justgoturwork[.]xyz froffisse[.]xyz Recent C&C pages on compromised servers http://corp.uber24[.]ru/php/go.php https://aparthotelgeres[.]pt/wp-content/plugins/1/post.php https://expendiatus[.]xyz/post.php https://ifultech[.]com/1/post.php https://www.aascarrierinc[.]com/wp-includes/SimplePie/Decode/HTML/rest.php https://silverstream-london[.]com/1/post.php https://actorsstudio.com[.]np/wp-admin/includes/1/post.php http://365itsos.com[.]au/wp-admin/includes/rent.php https://www.skyblue-network[.]com/wp-includes/images/go.php https://www.kayakingfloridakeys[.]com/wp-admin/rent.php https://easimedic[.]com/1/post.php https://www.aascarrierinc[.]com/wp-includes/SimplePie/Decode/HTML/rest.php HTML Phishing pages SHA-1: e76eb571068c195444d0e23cbdc35fba19a95e0c 9fc656e03703994d5f144457d020db5b06469abc 79d4464c7325feb38a02726b049d6cce3d747627 44c05f4b2bb0787a9c2fcf7c36e1dab457fbe370 c1ec15c712c29dcac08660fddb0da71e94b3d04a 4933bd2fa4c9a3ea30ac479a738ebcdfb488044f d098f6473f2f6bfd8e3f2f14dd56adc969e76725 a8e817fa63fe2c5bf0273f63f2267b61ce89de72 37713a64ffd1b126f8a4809e94faf9cd72538974 53c4ccab781d93eb04ff5bcfc01321c11958816c 4f309c3a8d754a3fcdfed611e4f101e6b690ddd5 cccf673f3c9c02f5f9a21346cdc91f78d94c92b3 2ac423a86d94d82cc0ecc3c508aa7a90c27a4b9c

How a Team of Hackers left Stolen Phishing Credentials up for Grabs

Having a lot of traffic on your website is great. But your main goal should be to ensure that traffic is leading to conversion, which means conversion rate optimization should be a priority. What’s a good conversion rate? Well, a conducted by concluded that a good conversion rate should typically be between 2% to 5%. study WordStream In other words, that’s the conversion rate you should aim for. So, without further ado, let’s take a look at some tips to help you with CRO. 1. Improve Your Page Loading Speed The loading speed of your website plays a major role in how well it will convert. Most people expect websites to load as quickly as possible. When there are issues with page , visitors are likely to leave the page and simply look for another one. As a matter of fact, will abandon a page if it hasn’t loaded within three seconds. loading speed of users 53% If your page is not fast enough, there are a lot of potential conversions you’re missing out on. So, keep in mind, the faster your website, the better your conversion rate will be. Make sure to check your website’s loading speed by using tools such as . Google’s Page Speed Insights 2. Optimize for Mobile Your website needs to look natural and be intuitive across all sorts of devices, including mobile. That’s why you should opt for workting with a . responsive web design company is generated by mobile devices, which means a mobile-friendly site is a must. So, you could potentially miss out on a lot of conversions if you don’t properly optimize your page for mobile. of worldwide traffic 50.81% 3. Use Catchy Headlines Now, moving away from the technical side of things, headlines are another important factor that can have an impact on your conversion rate. After all, they are the first thing a user is going to see upon entering a website. Headlines should be constructed in a way that grabs the users’ attention and sparks their curiosity. Try to immediately highlight the benefits the users will get if they use your products/services. For instance, let’s say that you offer a free trial for your subscription-based service. Instead of writing “Start an Account” in your headline and mentioning the free trial somewhere else, highlight the fact that the users will benefit from a free trial right in the headline. “Start Your 30-day Free Trial,” for example. That way, you’ll let users know right off the bat that they’re going to get one month free off of your subscription services and they’ll most likely not hesitate to sign-up for it. So, in order to get the most out of your headlines, make sure to them and find out which ones are the most effective. constantly A/B test 4. Remove Distractions Having a website with pages upon pages of content, loaded with all sorts of links and buttons will diverge the users’ attention, ultimately driving them away from achieving the goal you want to accomplish. And that means fewer conversions. So, be sure to remove unnecessary distractions. Your page needs to be clear, concise and easy to navigate. In other words, keep it as simple as possible. Including headlines, subheadings, adding testimonials, highlighting benefits and having visuals that show that you offer should be enough. 5. Remove Unnecessary Form Fields Speaking of getting rid of things, if your goal is to get users to sign up, having too many form fields can really drive down your conversion rate. Why? Well, asking for the user’s information can scare them away. too many form fields Not only that, but too many fields might give the user the feeling that it takes too much effort to complete the form, giving them a reason to abandon it. With that being said, only keep the form fields that are essential to achieving your goal. 6. Establish Trust With Your Users Now, building trust with your customers can be one of the most effective ways to improve conversion rates, especially if you are a digital marketing agency. After all, when you’re trying to sell something, the customer needs to know that he can trust you first. Find ways to establish some sense of trust. One of the simplest methods to do this is by adding verification tags and images of the systems you’re using or logos of other companies you are collaborating with. payment It might not seem like much, but it can work wonders. Consider adding a for the user to browse through, right after you have presented the benefits and features of your product. testimonial or review section This type of reassurance can help build trust with your brand and push your potential customer to conversion. Letting them know that other customers are happy with your products is a great way to influence the purchasing decision. 7. Instill a Sense of Urgency Another great way in which you can improve your conversion rates is by instilling a sense of urgency in your users. As we’ve previously mentioned, the users might first hesitate when taking a look at your products. Besides adding a review section, you can also mention a limited time offer or let your potential customers know you have a limited quantity of products. This will induce the fear of missing out, forcing the user to act quickly in order to get the most out of the deal. Therefore, increasing the chances of getting more conversions. Final Words Keep in mind that traffic isn’t everything. Therefore generating as much traffic as possible shouldn’t be your priority, but improving your conversion rates should. Hopefully, with the help of these tips, you’ll be able to notice an increase in sales or leads. Remember that both establishing trust with your customers and creating a sense of urgency can be great ways to boost your conversion rates, as any would agree. ecommerce development company However, don’t forget to focus on the more technical things as well. After all, the loading speed of your page and mobile optimization is responsible for getting users on your page. And without users, there wouldn’t be anything to convert. And finally, make sure to constantly A/B test different variations of your website and see which one is the most effective at driving conversions.

Stories, News & Mentions about WORKTANGO

Worktango’s Stories on HackerNoon