Don't Be The Next Victim Of Cyber Crime

Phishing emails still remain one of the top methods of choice for hackers to attempt to steal your business critical information, infiltrate your networks and gain access to your data. And they’re at it again…

This time the hackers used very sophisticated techniques – including the exact recipient details, use of company logos and believable ‘from’ names –  to make it look like a genuine email from Microsoft Office 365. This technique to gain the trust of the email recipient was an attempt to acquire login details for their Office 365 accounts.

The result

In this particular case anyone who supplied their Office 365 login details and passwords has seen their accounts compromised, with the hackers gaining complete access to their Office 365 account and in turn, access to emails, documents, contacts and data.

Once the hackers have gained access to the account, they have taken copies of entire mailboxes and forward to another email accounts for their own malicious intent. From here they take the data and use it to spam – on a massive scale – all the contact details they managed to acquire. In one case someone received 600 spam emails in just 2 hours! All the emails look to be coming from the compromised users account details, so spam filters are less able to detect them as spam.

Preventative steps to implement

Due to the level of sophistication of this threat it is very easy to believe this is a real email. If you or your employees fall victim to such a threat, here’s how you can mitigate the damage in the first instance:

1. Reset all passwords in the organisation
2. Check which accounts have been compromised and remove any forwards
3. If you are still getting spam emails, blacklist the domains or email addresses
4. If it is possible, remove any email alias associated with that mailbox and give the user a new email address

How to spot a phishing email

Today hackers use lots of sophisticated tactics to make a malicious email appear genuine, so it can be extremely difficult for users to identify a scam email.

If the email above landed in your inbox would you be able to identify that it was a scam? Are you confident your employees would know the difference?

5 tips on what to look out for to reduce your risk of becoming the next victim:

1. If an email is asking you to update or re-enter your personal or login details out of the blue, be extra vigilant as it is likely to be a scam. Most companies will never email asking you to supply personal information. Delete the email, a genuine request will be sent again.
2. Look at the ‘From’ name and email address. The ‘From’ name may look genuine but often doesn’t appear as the official company name. The email address it has come from generally has an unusual address and doesn’t look to be coming from an official company
3. If the email is asking you to follow a link hover over it, but don’t click on the link – this will show you the address of where the link goes. A genuine email will link to an official company site.
4. Increasingly scammers are getting better at presenting phishing emails that are more or less free of poor spelling and grammar. But, you should still watch out for these tell-tale signs. It is common to see a real lack of consistency with the presentation of the email, which may include several different font styles, font sizes and a mismatch of logos.
5. Scam emails may also contain information such as account numbers and IDs designed to trick you into thinking the email is genuine. Check any of these against your records to see if they match.

Keeping your business secure

Data is the lifeblood of any business, keeping it secure from threats such as phishing emails is vital. If your business doesn’t have the right levels of security infrastructure in place it could have serious consequences for your business if you were to fall victim to a phishing attempt such as this one.

To reduce your risks of becoming the next victim of a scam like this, here are a couple of preventative measures you may want to consider:

Set up 2 Factor Authentication
When logging into accounts, 2 Factor Authentication requires you to enter not only your password but another piece of information only you know or have immediately to hand – usually a one-off code generated from your authentication software. This adds an extra layer of security to your accounts as using a password and piece of information only known to you will make it extremely difficult for hackers to gain access to your data and networks.

User Security Training
Even the best cyber security tools are only as effective as the people who use them. Your employees are usually your last line of defence from hackers gaining access to your systems, however, human error is the most common cause of a security breach. Training your employees on the various threats, how to prevent a breach and what to do should they be the victim of an attack will bring significant benefits in helping to maintain your business security.

Contact Us

We place the upmost importance on helping you protect your business from security threats. Contact our experts today to discuss how we can help you.

We will work in partnership with you to put the right solutions in place for your business and train your employees. If you would like to learn more, feel free to contact us here.