Sunday, December 3, 2023

Cybercriminals Target Employees of Companies Worldwide to Exploit Network Access and Privilege Escalation

The FBI has published a Private Industry Notification (PIN) observing Cybercriminals are focusing to target employees of companies worldwide who maintain network access and an ability to escalate network privilege.

Throughout COVID-19, many companies had to quickly adapt to changing environments and technology. With these restrictions, network access and privilege escalation may not be fully monitored.

Several tools to automate services are implemented on companies’ networks, the ability to keep track of who has access to different points on the network, and what type of access they have, will become more difficult to regulate.

Threat

Presently, cybercriminals are attempting to gain all employees’ credentials, not just individuals who would likely have more access based on their corporate position.

According to FBI case information, as of December 2019, cybercriminals work together to target both US-based and international-based employees’ at large companies using social engineering techniques. The cybercriminals vished these employees through the use of VoIP platforms.

Vishing attacks are voice phishing, which occurs during a phone call to users of VoIP platforms. During the phone calls, employees were tricked into logging into a phishing webpage to capture the employee’s username and password.

Subsequently gaining access to the network, many cybercriminals found they had more network access, including the ability to escalate privileges of the compromised employees’ accounts.

In one instance, the cybercriminals found an employee via the company’s chatroom and influenced the individual to log into the fake VPN page operated by cybercriminals.

The actors used these credentials to log into the company’s VPN and performed an investigation to locate someone with higher privileges.

The cybercriminals were scanning for employees who could perform username and e-mail changes and found an employee through a cloud-based payroll service. The cybercriminals used a chatroom messaging service to contact and phish this employee’s login credentials.

Mitigations

  • Apply multi-factor authentication (MFA) for accessing employees’ accounts in order to minimize the chances of an initial compromise.
  • When new employees are hired, network access should be granted on a least privilege scale. Periodic review of this network access for all employees can significantly reduce the risk of compromise of vulnerable and/or weak spots within the network.
  • Scanning and monitoring for unauthorized access or modifications can help detect and minimize the loss of data.
  • Network segmentation should be implemented to break up one large network into multiple smaller networks which allow administrators to control the flow of network traffic.
  • Administrators should be issued two accounts: one account with admin privileges to make system changes and the other account used for email, deploying updates, and generating reports.

Final Word

Thus the report issued by FBI provides potential usage to recipients to protect against cyber threats.

“This data is provided to help cybersecurity professionals and system administrators guard against the persistent malicious actions of cyber actors”, says the FBI.

The FBI also encourages the recipients to report information concerning suspicious or criminal activity to their local FBI field office.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity, and hacking news updates.

Website

Latest articles

Active Attacks Targeting Google Chrome & ownCloud Flaws: CISA Warns

The CISA announced two known exploited vulnerabilities active attacks targeting Google Chrome & own...

Cactus Ransomware Exploiting Qlik Sense code execution Vulnerability

A new Cactus Ransomware was exploited in the code execution vulnerability to Qlik Sense...

Hackers Bypass Antivirus with ScrubCrypt Tool to Install RedLine Malware

The ScrubCrypt obfuscation tool has been discovered to be utilized in attacks to disseminate the RedLine Stealer...

Hotel’s Booking.com Hacked Logins Let Attacker Steal Guest Credit Cards

According to a recent report by Secureworks, a well-planned and advanced phishing attack was...

Critical Zoom Vulnerability Let Attackers Take Over Meetings

Zoom, the most widely used video conferencing platform has been discovered with a critical...

Hackers Using Weaponized Invoice to Deliver LUMMA Malware

Hackers use weaponized invoices to exploit trust in financial transactions, embedding malware or malicious...

US-Seized Crypto Currency Mixer Used by North Korean Lazarus Hackers

The U.S. Treasury Department sanctioned the famous cryptocurrency mixer Sinbad after it was claimed...

API Attack Simulation Webinar

Live API Attack Simulation

In the upcoming webinar, Karthik Krishnamoorthy, CTO and Vivek Gopalan, VP of Products at Indusface demonstrate how APIs could be hacked.The session will cover:an exploit of OWASP API Top 10 vulnerability, a brute force account take-over (ATO) attack on API, a DDoS attack on an API, how a WAAP could bolster security over an API gateway

Related Articles