KnowBe4’s Tweets

We heard it's holiday szn (whatever that means), which results in an increase in cybercrime. However, we’re excited to announce that our holiday resource kit is now available! Get your free kit now to prepare for the festivities: bit.ly/3EeWLPs

23h

Looking for binge-worthy content before the long holiday weekend? 'The Inside Man' is an award-winning KnowBe4 Original Series that delivers security awareness principles. Watch a preview of Season 4 now! bit.ly/3Wk96sU

A technique attackers are using to bypass multi-factor authentication (MFA) that researchers describe as MFA fatigue attacks uses social engineering to take advantage of human error:

Attackers repeatedly attempt to login to an account protected by MFA, which spams the user with MFA requests until the user finally approves the login.

MFA Fatigue Attacks

A new phishing campaign uses website contact forms, legitimate software depositories and Google Ads to distribute their links that lead to the installation of ransomware and information-stealing malware:

A Recent, Complex, Ransomware Campaign

New phishing campaign leads to the installation of ransomware. The threat actor uses website forms, software depositories, and Google Ads to distribute...

A new Instagram support impersonation scam notifies victims of an “Unusual Logon” complete with change of password phishing landing pages:

New Instagram Support Phishing Attack Fakes “Unusual Logon” Experience Well Enough to Fool Victims

Long gone are the days of tacky landing pages that barely impersonate a brand; threat actors are improving their social engineering game well enough...

We're giving you KnowBe4 security awareness training tip Tuesday! The United States Computer Emergency Readiness Team website provides information on where to send a copy of phishing attempts so it can be examined by experts. #SecurityTipTuesday

A recent phishing attack impersonates Geek Squad and uses optical character recognition embedded in images that display the scammer's phone number:

Image-Based Phishing and Phone Scams Continue to Get Past Security Scanners

Using the tactic of not including a single piece of content that can be considered malicious, these scams are making their way to inboxes every single time

With so many third party support services and regulatory requirements, you have to ensure your organization remains breach-free. Join

@James_McQuiggan

for a new webinar as he discusses the five major threats to your digital supply chain. Register now! bit.ly/3hSZOEy

Phishing email attacks targeting users in the Middle East have doubled ahead of the World Cup. Researchers at Trellix found emails impersonating FIFA, team managers, and more:

World Cup Phishing Attacks Doubled And Will Increase

Researchers at Trellix revealed that phishing email attacks targeting users in the Middle East doubled in October 2022 ahead of the World Cup in Qatar. These attacks will increase dramatically...

24 hours after Australian insurer Medibank refused to pay ransom, about 10 million health records were published. Cybercriminals behind the attack warned that this was only part of the data set they have:

10 Million Health Records from Australian Insurer Medibank are Leaked After Refusing to Pay the...

24 hours after a ransom warning was made that threatened the leaking of the exfiltrated data, portions of Medibank’s stolen data was published.

Hornet Security’s Cyber Security Report 2023 confirms phishing emails remain the top attack vector, with nearly 40% of all attacks start with a phishing email:

4 out of 10 Emails are Unwanted as nearly 40% of all Attacks Start with Phishing

Hornet Security analyzed more than 25 billion emails - 40.5% of them are unwanted, with 5% of those emails being marked as malicious.

The latest data shows that historically massive rate increases seen over the last few years are beginning to come down. But why? We answer this question and more on the blog:

Cyber Insurance Rates Begin to Stabilize as Insurers Gain Better Insight into Cyberattacks

The latest data shows that historically massive rate increases seen over the last few years are beginning to come down, primarily due to insurers...

A new report from U.K. cyber insurer Hiscox reveals that 36% of ransomware victims that have paid the ransom experienced a second attack:

Over One-Third of Companies Who Pay the Ransom are Targeted for a Second Time

Despite the somewhat logical notion that once you’ve paid the ransom, the attack is over, new data shows that paying the ransom doesn’t help you...

Our evangelists are giving you the gift of tips to stay safe each week during this holiday season. To prepare for Black Friday and Cyber Monday scams,

@JakkiJayne

, Security Awareness Advocate for KnowBe4, details how to avoid becoming a victim:

2022 Black Friday and Cyber Monday Scams

Retailers have their cards on the table and headlines of ‘The Best Deals for Black Friday and Cyber Monday 2022’ are coming fast and so are the scams.

The 2022 Holiday Season Threat Trends Summary report from the Retail & Hospitality Information Sharing and Analysis Center is out, learn what the primary threat focuses are this holiday season:

Retailers: Credential Harvesting Attacks Are the “Big Thing” This Year for the Holiday Season

New data polled from retail industry about their security focus this holiday season reveals the kinds of attacks every organization should be preparing for

A new phishing kit targeting US consumers with holiday offers uses anchor tags to stay under the radar of cybersecurity solutions like antivirus software:

This New Phishing Kit Flies Under the Radar of Antivirus Software

Akamai researchers have discovered a new phishing campaign that targets United States consumers with fake holiday offers. Fake landing pages...

A new report from the UK’s National Cyber Security Center highlights the current state of threats in the UK, with particular focus on ransomware attacks and their impact. Further details of the report can be found on the blog:

Ransomware Attacks on UK Organizations are Not Being Reported Enough, Clouding Impact

A new report from the UK’s National Cyber Security Center highlights the current state of threats in the UK, with particular focus on ransomware attacks...

Black Friday, Cyber Monday, and Giving Tuesday scams.. Oh My! Prepare your users for these types of scams while they're trending with the holiday resource kit. Get yours now! bit.ly/3fNXvBP

As ransomware, business email compromise, and phishing attacks continue to escalate, new data sheds light on where organizations need to focus to help put a stop to attack success.

Valid Accounts Rank as the Top Initial Access Infection Vector, Putting a Spotlight on Credentials

As ransomware, business email compromise, and phishing attacks continue to escalate, new data sheds light on where organizations...

Phishing emails are now misusing Microsoft's 365 voice functionality to hide malicious links:

Phishing Attacks Misuse Microsoft Dynamics 365 Customer Voice Functionality to Hide Malicious Links

Leveraging a legitimate feature of Dynamics 365, threat actors are able to obfuscate the malicious nature of the email within content...

Want to know how to defend against MFA hacks?

@rogeragrimes

will show you 12 ways hackers can and do get around your favorite MFA solution. He'll share a hacking demo by Kevin Mitnick and successful examples of every attack type. Watch it on-demand now! bit.ly/3gZiUbm

We're gearing you and your users up for the holidays by sharing different types of seasonal scams to look out for each week. It's a weekly holiday gift from us to you!

@J4vv4D

warns of package delivery scams that could appear right on your doorstep: bit.ly/3gkhhoJ

1:20

185 views

Researchers describe a type of phishing attack dubbed “clone phishing,” in which attackers follow up a legitimate email from a trusted sender with a replica. More details about this attack are on the blog:

Watch Out For This Tricky New Tactic Called Clone Phishing

Researchers at Vade Secure describe a type of phishing attack dubbed “clone phishing,” in which attackers follow up a legitimate email from a trusted...

The recent cryptocurrency company FTX has filed for bankruptcy - which has resulted in phishing attacks. Read more details about the attack on the blog:

[SCAM OF THE WEEK] Phishing Campaign Targets Crypto Users

Major cryptocurrency company FTX recently filed for bankruptcy, and there's a big phishing campaign on the loose targeting FTX users.

How Hackers Hack and the Tools They Use |

One of the biggest questions security professionals in SMB companies get asked is why would hackers want to hack them.

@StuAllard

explains why hackers are motivated and how your organization can stay safe from these attacks. Read more via Spiceworks:

spiceworks.com

Stu Sjouwerman, founder and CEO of KnowBe4, dives deep into the mind of hackers in this exploration of the way they think, plan, the tools they use, and how to tackle them.

The threat actor “Fangxiao” has been active since at least 2017, and has used more than 42,000 domains in its phishing operations. More details on this cybercriminal's past on the blog:

Fangxiao Domain-Spoofing for Revenue

Researchers at Cyjax describe a large phishing campaign being run by a China-based financially motivated threat actor called “Fangxiao.”

Thank you to all the customers that came to our Atlanta User Group! We've had a great year, visiting customers in cities across the U.S. Can't wait to meet even more of you next year!

How many of your users’ passwords are P@ssw0rd? If you said more than zero: 1. Why and 2. You may have more weak passwords in your network than you may think. Find out how many weak passwords are in your network with the free Weak Password Test! bit.ly/3NkvgqT

KnowBe4 has been named by G2 as a Leader for SOAR based on user reviews, customer satisfaction, popularity and market presence. Download the full report now! bit.ly/3C77I3B

Researchers have observed the production of a large number of bogus domains that misrepresent themselves as belonging to a well-known employment agency in the Kingdom of Saudi Arabia. More detail of this campaign are on the blog:

“Hired Hand” in the Kingdom of Saudi Arabia Uses Domain Spoofing

Researchers have observed the production of a large number of bogus domains that misrepresent themselves as belonging to a well-known employment agency...

Did we just hear carol bells? Nope, that's just the sweet sound of the brand new holiday resource kit arriving! Check out more details of oh-what-fun activities your kit includes on the blog:

[FREE Resource Kit] Stay Safe This Holiday Season with KnowBe4

Are your users aware of the holiday phishing scams cybercriminals will be sending them? We have brand new holiday resources to help your users...

KnowBe4 Retweeted

National Cybersecurity Alliance

@StaySafeOnline

Nov 9

Inside Look👀: KnowBe4 Perry Carpenter will present at #CONVENE 2023 his insights during his “Hearts, Minds, and Actions” session! Get excited and buy your #conference tickets here: hubs.la/Q01rWmmv0 #staysafeonline #cybersecurity #cyberevents

It's not too late to register for a live PhishER demonstration! Join us on November 16th @ 2:00 PM ET and get an in-depth look at features such as PhishFlip. Register now! bit.ly/3SSVJNo

If you're attending the NYC Cyber Security Summit, join Erich Kron, Security Awareness Advocate at KnowBe4. Erich will participate in the panel discussion ‘Ransomware and Resiliency – To Trust or Not Trust?'. Don't miss out! #OfficialCyberSummit bit.ly/3WxlPIG

Nov 14

How many business emails do the recipients actually want? Or, conversely, how many of them are unwanted? A recent study answers this question on the blog:

The Rise in Unwanted Emails, Now Found to be Nearly 41%

How many business emails do the recipients actually want? Or, conversely, how many of them are unwanted?

Nov 11

In the latest FBI warning, cybercriminals are now impersonating financial institutions' refund payment portals. More details on this scam are on the blog:

[HEADS UP] FBI Warns of Tech Support Scams That Impersonate Payment Portals for Fake Refunds

In the latest FBI warning, cybercriminals are now impersonating financial institutions' refund payment portals.

Nov 11

Did you know that the likelihood of an employee clicking on a phishing link changes depending on the industry they work in? Find out what risks your industry is facing and more in KnowBe4’s 2022 Phishing by Industry Benchmarking Report. bit.ly/3DrAzQC

Nov 11

Researchers warn that a phishing campaign is using Microsoft’s Dynamic 365 Customer Voice feature to send malicious links.

Phishing Campaign Abuses Microsoft Customer Voice

Researchers at Avanan warn that a phishing campaign is using Microsoft’s Dynamic 365 Customer Voice feature to send malicious links.

Nov 10

Cybercriminals are always coming up with new, devious phishing techniques to trick your users. Join us November 17th @ 2:00 PM AEST for a live demonstration of PhishER! bit.ly/3WkHFPu

Nov 10

Even with employees seeing cyberattacks first-hand and understanding the seriousness of such attacks, organizations have a culture problem where users just don’t care.