Received a Random Link? DO NOT CLICK ON IT!

a person is typing on a laptop computer

If you ever receive random texts or emails from PayPal (or any other business, for that matter) telling you they suspended your account and now require you to authenticate your identity with an unknown link, then you should definitely think twice before clicking on that link. This is a common method that hackers use to break into accounts, especially those account holders that fall for this phishing scam. There is a better alternative to investigate this issue to see where it leads. It is important to access your account the way you normally would instead of clicking on that link.

If you were in this position, what would you do?

It is pretty safe to say that no one wants to fall for a phishing scam; but, at the same time, it can be very tempting to trust the message to make sure there is nothing wrong with your account.

The best approach is simple, but definitely not one that we would intuitively think to do.

Instead of clicking on the link provided in the text or email, open up a new web browser tab and login to the website, the same way you normally would in order to access your account. It does not matter the type of account you are trying to log into, whether it be your bank, your favorite online retailer, or any website that you have an account with. The practice of logging into the site directly, rather than using the link given, is simple and easy to do. It will also help keep you from being a victim of a phishing attack.

Let Us Help Your Team and Keep Them Safe

4 Corner IT can help you and your company choose the best tools and resources to keep everyone safe from security and phishing attacks. Our professionals can help build your business’ defenses and offer training to all members of your team, including how to identify potential threats and the best practices to keep safe from these attacks. For more information or to get started today, contact us at 954.474.2204.

Contact Us Today and Check Out Our Blog!

The Raspberry Robin Worm

raspberry robin

Utilizing storage devices, such as USB drives, has been known to spread malware from one device to another. Recent analyses found an imminent threat, known as the Raspberry Robin worm, is currently developing. What is it and how can you keep yourself and your company safe from attacks?

What is Raspberry Robin?

Raspberry Robin is a worm that was initially discovered in Europe in September 2021 by cybersecurity intelligence analysts at Red Canary. It was found to primarily affect users of Windows-operating systems.

What exactly does Raspberry Robin do?

When an infected USB drive is inserted into a computer, the device will display an infected .LNK file. A msiexec process is then started through the command prompt. A .BAT file has two commands that can be executed. One command can manage various Windows features and the other command can configure Open Database Connectivity. The combination of the two will make the threat difficult to locate on the network as it remains hidden.

The Raspberry Robin infection process was found to escalate further where compromised QNAP NAS (Network-Attached Storage) devices are also affected. During this stage, the hacker is able to retrieve the victim’s user and device names, using HTTP requests, once the .LNK file is downloaded. From the infected QNAP device, the malware then utilizes a malicious DLL (Dynamic-Link Library) in order to gain access and take control over the entire system.

How does Raspberry Robin spread?

Although it is understood that Raspberry Robin spreads via compromised USB drives, it’s unclear how it spreads from device to device.

What are hackers looking for?

Unfortunately, like most malware that are in its initial stages of development, there is not much known about Raspberry Robin. More research is required to determine its spreadability and the intention hackers may have when creating this worm. Although it is currently unknown, it is suspected that hackers developed this attack with the intent to steal data and/or install additional viruses on infected devices.

The Final Takeaway

To keep yourself and your business safe from Raspberry Robin is to treat all USB devices with intense scrutiny. This includes eliminating inserting USB drives that do not belong to you or USB devices that might have been found lying around on the ground. It is important to remember that USB drives may not look suspicious from the outside but inside, it can be compromised. Always think twice before plugging in any unknown devices on your computers. 

AE Technology Group can help your organization keep itself protected from the various and growing threats out there, including this Raspberry Robin worm. Although we’re unable to physically stop your team from inserting potentially infected USB devices, we can provide further education, including the dangers of doing so, as well as training for employees. In addition, we will continuously track your network environment for possible threats. To learn more about how we can keep your business safe, please contact us at (516) 536-5006.

Advanced Technology Cybersecurity Risks and What to Do About It

cyber security

Cybersecurity for modern businesses is always attempting to stay ahead of the increasingly more complex security threats from hackers and cybercriminals. Companies will continue to invest in technology to enhance their business. As technology evolves, so do the cyber security threats that can infiltrate a business’s network. No company is immune, where smaller enterprises or large government agencies, even with today’s securities.

The Risks of Modern Technology

Technology such as the Internet of Things (IoT), artificial intelligence, cloud services, and more allow businesses to streamline their processes and accomplish more efficiently and accurately in a shorter timeline. With more technology comes greater risk as cyber criminals consistently innovate and find new ways to steal data from businesses of any size. 

Advancements such as automation remove human error and provide a more efficient way of doing business, but it doesn’t come without increased risks. Cybercriminals have highly sophisticated tools and capabilities using the very technology that businesses use to streamline their processes. 

When your business invests in technology, it’s important to invest in robust and aggressive cyber security that protects data and your business’s networks. A comprehensive review of your cybersecurity practices should be reviewed regularly. You want to consider the following: 

  • Do your employees have enough training to be an asset rather than a vulnerability?
  • Are the security measures currently in place enough to protect your business against threats and risks? 
  • Is your business prepared and looking ahead at the developing and evolving cyber threats and risks that are likely to emerge with new technologies?

The Current Evolving Threat Landscape

If your business is going to be prepared for advanced threats, it’s important to stay up to date with the current threats that can impact your business. Here are a few ideas on how to protect your business from developing threats.

Malware – Malware is becoming increasingly harder to find. Malware is getting better at mimicking user behavior as it is better at hiding their actions. To fight this threat, you need to ensure your team is trained to be able to spot malware or use automated security solutions to help you catch malware before it becomes a major problem.

More Technology Means More Vulnerability – More technology may be beneficial for businesses, but more technology means you have more to protect from attacks. Increased risk management and streamlining technologies to make IT less complex can help protect your business. 

Increase Upper Management Awareness – Often in companies, the upper levels of the corporate hierarchy remain blissfully unaware of the security issues and threats as they believe these risks are to be handled by the IT team. Cyber attacks can impact any level of a business, and it’s important to ensure everyone, including high-level executives, have a base awareness of the threats and what to look for. 

Need Help Securing Your Business

Working with us as your managed IT service can help ensure your data is protected against any cybersecurity threat your business may encounter. You can get back to focusing on running your business while we focus on protecting your business from cyber threats. To learn more, give us a call at (516) 536-5006.

BlackRock Trojan: Aggressive Viral Menace For Android Device Users

blackrock trojan aggressive viral menace for android device users

A new attack on android applications known as the BlackRock trojan has already targeted over 300 applications on the android operating system, including banking, social media, and dating applications. Any application with payment features, which is most nowadays, has been targeted and users credit card information has been compromised. How does this all work though, and what implications will it have for the future of the android operating system?

The Mechanics of BlackRock

The essential approach that BlackRock takes to get access to your information is it sends out a false Google Update and requests accessibility privileges. After it is granted these privileges it develops its own autonomy and no longer needs further interaction from the user to operate, it does this through granting itself further permissions afterwards. 

Some abilities BlackRock has, are traditional of trojan attacks, and some are quite problematic. It can collect device information, it can perform overlay attacks, but even more concerning, it can prevent antivirus software and even prevent uninstalling, leading to a longer lifespan than most hacks and more damage being done to your device and more of your information being compromised.

The Network and History of BlackRock Malware

Information from the site ThreatFabric has concluded that BlackRock is based on banking malware known as Xerxes, which itself is a version of Lokibot malware, discovered in 2019. Lokibot is part of an underground network of rented malware which circulated in 2016 and 2017. What really caused it to be a ubiquitous problem is when the source code got leaked. 

Android tried to get out in front of the older malware by pushing their newer devices which, with their new hardware, had a natural adaptation curve for implementing the attacks on the new systems. This, unfortunately, didn’t last long. In 2018, MysteryBot dropped, which was an update on the Xerxes system to work with new Android systems. 

The ancestral history of BlackRock is inundated with Lokibot variants. Parasite was a brief problem, although after disappearing from the malware space, Xeres was the direct parent of BlackRock, with the former appearing in 2019 and now, here in 2020, we have BlackRock.

Top Apps That Have Been Threatened

Numerous applications have suffered the injection and compromise of BlackRock, but the most notable are:

  • Gmail
  • Google Play
  • Netflix
  • Wells Fargo
  • Twitter
  • Instagram
  • Facebook

Many others have been targeted as well, leading to an entire suite of applications being at risk. Millions of users could have been affected and had their financial and contact information now in the hands of hackers, which could be numerous themselves seeing as the above mentioned malware network is vast and diverse.

Implications for Android

Android, being a more open operating system, runs the risk of more of these said attacks if they don’t take a new approach to how they monitor their application base. Two futures exist for android after this latest breach.

One, they stay with the same approach they have now and hope that they can rely on a numbers game, praying that the majority of their apps stay solid with their own individual protection protocols, and hoping the majority of their users stay safe.

The other is they radically change how they monitor their operating system, implementing much more rigorous analysis of their potential apps and making the approval process contain much more scrutiny in their security requirements. 

Either way the future for android will remain risky if they simply ignore the growing underground network of malware. They desperately need to engage in research of this growing corner of the hacking world if they have any hope of maintaining a safe and secure user base.

Get more news, tips and tricks at our blog here.