Wednesday, April 24, 2024

Cybercriminals Target Employees of Companies Worldwide to Exploit Network Access and Privilege Escalation

The FBI has published a Private Industry Notification (PIN) observing Cybercriminals are focusing to target employees of companies worldwide who maintain network access and an ability to escalate network privilege.

Throughout COVID-19, many companies had to quickly adapt to changing environments and technology. With these restrictions, network access and privilege escalation may not be fully monitored.

Several tools to automate services are implemented on companies’ networks, the ability to keep track of who has access to different points on the network, and what type of access they have, will become more difficult to regulate.

Threat

Presently, cybercriminals are attempting to gain all employees’ credentials, not just individuals who would likely have more access based on their corporate position.

According to FBI case information, as of December 2019, cybercriminals work together to target both US-based and international-based employees’ at large companies using social engineering techniques. The cybercriminals vished these employees through the use of VoIP platforms.

Vishing attacks are voice phishing, which occurs during a phone call to users of VoIP platforms. During the phone calls, employees were tricked into logging into a phishing webpage to capture the employee’s username and password.

Subsequently gaining access to the network, many cybercriminals found they had more network access, including the ability to escalate privileges of the compromised employees’ accounts.

In one instance, the cybercriminals found an employee via the company’s chatroom and influenced the individual to log into the fake VPN page operated by cybercriminals.

The actors used these credentials to log into the company’s VPN and performed an investigation to locate someone with higher privileges.

The cybercriminals were scanning for employees who could perform username and e-mail changes and found an employee through a cloud-based payroll service. The cybercriminals used a chatroom messaging service to contact and phish this employee’s login credentials.

Mitigations

  • Apply multi-factor authentication (MFA) for accessing employees’ accounts in order to minimize the chances of an initial compromise.
  • When new employees are hired, network access should be granted on a least privilege scale. Periodic review of this network access for all employees can significantly reduce the risk of compromise of vulnerable and/or weak spots within the network.
  • Scanning and monitoring for unauthorized access or modifications can help detect and minimize the loss of data.
  • Network segmentation should be implemented to break up one large network into multiple smaller networks which allow administrators to control the flow of network traffic.
  • Administrators should be issued two accounts: one account with admin privileges to make system changes and the other account used for email, deploying updates, and generating reports.

Final Word

Thus the report issued by FBI provides potential usage to recipients to protect against cyber threats.

“This data is provided to help cybersecurity professionals and system administrators guard against the persistent malicious actions of cyber actors”, says the FBI.

The FBI also encourages the recipients to report information concerning suspicious or criminal activity to their local FBI field office.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity, and hacking news updates.

Website

Latest articles

Phishing Attacks Rise By 58% As The Attackers Leverage AI Tools

AI-powered generative tools have supercharged phishing threats, so even newbie attackers can effortlessly create...

Multiple MySQL2 Flaw Let Attackers Arbitrary Code Remotely

The widely used MySQL2 has been discovered to have three critical vulnerabilities: remote Code...

CoralRaider Hacker Evade Antivirus Detections Using Malicious LNK File

This campaign is observed to be targeting multiple countries, including the U.S., Nigeria, Germany,...

Spyroid RAT Attacking Android Users to Steal Confidential Data

A new type of Remote Access Trojan (RAT) named Spyroid has been identified.This...

Researchers Uncover that UK.GOV Websites Sending Data to Chinese Ad Vendor Analysts

Analysts from Silent Push, a data analytics firm, have uncovered several UK government websites...

Ransomware Victims Who Opt To Pay Ransom Hits Record Low

Law enforcement operations disrupted BlackCat and LockBit RaaS operations, including sanctions on LockBit members...

IBM Nearing Talks to Acquire Cloud-software Provider HashiCorp

IBM is reportedly close to finalizing negotiations to acquire HashiCorp, a prominent cloud infrastructure...
Guru baran
Guru baranhttps://gbhackers.com
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

WAAP/WAF ROI Analysis

Mastering WAAP/WAF ROI Analysis

As the importance of compliance and safeguarding critical websites and APIs grows, Web Application and API Protection (WAAP) solutions play an integral role.
Key takeaways include:

  • Pricing models
  • Cost Estimation
  • ROI Calculation

Related Articles