Barracuda Spam Filtering

Microsoft the No. 1 Most-Spoofed Brand in Phishing Attacks (O365)

1) Microsoft the No. 1 Most-Spoofed Brand in Phishing Attacks
Nearly 60% of all phishing attacks impersonate Microsoft and about half a million Microsoft 365 accounts were compromised in 2021, new data shows.

Barracuda Networks’ telemetry — from from millions of emails it analyzed — shows that in 2021, a little over half of all social engineering attacks came via phishing, and Microsoft was the most-impersonated brand in those attack attempts. Overall, attackers sent 3 million emails from 12,000 compromised accounts, and one in five organizations suffered an account compromise last year.

As a Security Software Distributor of Barracuda there security mail which is by far the best in the industry. Built from scratch using open source. For a very inexpensive dollar amount you could be protected> Call your MSP/Tech firm for pricing and then have them call MspPortal Partners to assist in implementing a secure solution at no additional cost.

1) Google Emergency Update Fixes Chrome Zero-Day
Google patches a critical flaw in its Chrome browser, bringing its count of zero-day vulnerabilities fixed in 2022 to four already. Do you really want to use Chrome or Google period let alone Google Mail
2) Microsoft Releases Advisory to Address Critical Remote Code Execution Vulnerability (CVE-2022-26809)
3)Microsoft Releases April 2022 Security Updates (112)
4) Apple Releases Security Updates (its getting worse)

Roy Miehe | MspPortal Partners Inc. | Ceo/President

Security Software Distributor: Bitdefender , Barracuda, RackSpace, Axcient

“Where Service and Technical Skills Count”

More Orgs Suffered Successful Phishing Attacks in 2021 Than in 2020

Enterprise organizations appear to be falling even further behind in their battle against phishing threats despite heightened awareness of the problem and efforts to curb it.

A new study shows that in 2021 more organizations experienced at least one successful email-based phishing attack than the year before. There were also more opportunistic and targeted phishing attacks last year compared with 2020, as well as phishing attacks involving ransomware and business email compromise (BEC).

Researchers recently analyzed data from a survey of 600 IT and security professionals and another survey of 3,500 employees from seven countries, including the US, UK, France, Germany, and Australia. The researchers also analyzed data gathered from some 100 million simulated phishing attacks and more than 15 million emails that end users reported as being suspicious.

Seventy-eight percent of organizations experienced a ransomware attack in which a phishing email was the initial infection vector. Seventy-seven percent reported a phishing-related BEC incident — an 18-point increase from 2020. Overall, 12% more organizations reported being victims of an indiscriminate or opportunistic phishing attack, while organizations reporting more targeted spear-phishing and BEC attacks went up 20%.

Roy Miehe | MspPortal Partners Inc. | Ceo/President
Bitdefender and Barracuda Distributor for Msp’s
“Where Service and Technical Skills Count”

Hackers slip into Microsoft Teams chats to distribute malware

Security researchers warn that some attackers are compromising Microsoft Teams accounts to slip into chats and spread malicious executables to participants in the conversation.

More than 270 million users are relying on Microsoft Teams every month, many of them trusting the platform implicitly, despite the absence of protections against malicious files.
Simple but efficient method

Researchers at Avanan, a Check Point company that secures cloud email and collaboration platforms, found that hackers started to drop malicious executable files in conversations on Microsoft Teams communication platform.

The attacks started in January, the company says in a report today, and the threat actor inserts in a chat an executable file called “User Centric” to trick the user into running it.

Once executed, the malware writes data into the system registry installs DLLs and establishes persistence on the Windows machine.
“In this Teams attack, hackers have attached a malicious Trojan document to a chat thread. When clicked on, the file will eventually take over the user’s computer” – Avanan

Manage Microsoft Teams settings for your organization
Here you can turn on or turn off file sharing and cloud file storage options. read Article and turn off file sharing

Users can upload and share files from cloud storage services in Teams channels and chats. Cloud storage options in Teams currently include Dropbox, Box, Citrix files, Google Drive, and Egnyte. Turn on the switch for the cloud storage providers that your organization wants to use.

Using either the above solution and fixing the issues or

Use Bitdefender/MspPortal Partners malware protection in combination of Barracuda/MspPortal Partners Spam, Phishing malware protection

Roy Miehe | MspPortal Partners Inc. | Ceo/President Bitdefender /MSP Aggregator – Distributor “Where Service and Technical Skills Count”

The two agencies also shared a list of measures that can help admins mitigate BlackByte attacks: 2-14-2022

Thanks to Bleeping Computer

Implement regular backups of all data to be stored as air gapped, password protected copies offline.
Ensure these copies are not accessible for modification or deletion from any system where the original data resides.
Implement network segmentation, such that all machines on your network are not accessible from every other machine.
Install and regularly update MspPortal Partners/Bitdefender antivirus software on all hosts, and enable real time detection.
Install updates/patch operating systems, software, and firmware as soon as updates/patches are released be careful of this look at KB’s first.
Review domain controllers, servers, workstations, and active directories for new or unrecognized user accounts.
Audit user accounts with administrative privileges and configure access controls with least privilege in mind. Do not give all users administrative privileges.
Disable unused remote access/Remote Desktop Protocol (RDP) ports and monitor remote access/RDP logs for any unusual activity.
Consider adding an email banner to emails received from outside your organization.
Disable hyperlinks in received emails MspPortal Partners/Barracuda
Use double authentication when logging into accounts or services.
Ensure routine auditing is conducted for all accounts
Ensure all the identified IOCs are input into the network SIEM for continuous monitoring and alerts.
Do you want Security Updates Emailed to you Subscribe to blog (bottom of News page)

Roy Miehe | MspPortal Partners Inc. | Ceo/President

Bitdefender /MSP Aggregator – Distributor

“Where Service and Technical Skills Count”

New Phishing Attack on Microsoft O365

August 26, 2021
New Phishing Attack on Microsoft O365 Users Leverages Open Redirects to Avoid Detection
Widespread credential phishing campaign abuses open redirector links
Microsoft 365 Defender Threat Intelligence Team Link Article

MspPortal Partners along with Barracuda does have a solution
Read what Essentials complete will provide for you Includes ESS, Message Archiver and O365 Backup
One Drive, Exchange, Sharepoint,Teams (PDF)

With Barracuda Advanced Threat Protection

With Barracuda Advanced Threat Protection
MspPortal Partners blocked 767 Infected attachments in the last 24 hours protecting our partners clients from becoming/getting infected. Thousand of dollars were saved in mitigation costs

Scan Description the file was scanned by the Barracuda Advanced Threat Protection (ATP) service. ATP scans for malware, zero-day exploits, and targeted attacks not detected by other virus scanning features or the intrusion prevention system. ATP analyzes files in a secure cloud environment and makes an overall determination once scanning is complete.

Most of the blocked emails were Microsoft: docx, xlsm , xlsx, pdf, exe and rar

MspPortal Partners is a leader in providing security software to the Tech Community at better then wholesale pricing , service and support

MspPortal now provides Encrypt Mail at no extra charge using Barracuda Spam filtering

If you are using with MspPortal Partners Barracuda Spam Filtering you can now do encrypt mail also at no additional cost.

Rackspace, Office 365, Google Apps, Exchange, Lotus Domino, GroupWise, Zimbra, Gmail, postfix, Send Mail, and more can be used as long as you can add a smart host entry.

I will assist in the original setup at no extra charge ( training) Use a word such as I do “secure” in the subject line plus you have the best spam filtering soluion in the industry.

13 email threat types to know about right now

Brought to by Barracuda and MspPortal Partners/MSP Aggregator – Distributor
How inbox defense protects against increasingly sophisticated attacks or compliment your current mail filtering solution considering O365 and Mimecast are now compromised very inexpensive to protect yourself from bad actors.
Have your tech team contact MspPortal Partners for pricing

MspPortal provides aggressive/displacement pricing but assisting in the integration and 1 & 2 line tech support

PDF Table of Contents
1) Introduction: Radically reduce susceptibility to targeted email attacks page 1
2) Fighting increasingly complex email attacks page 3
3) Spam page 5
4) Malware 8
5) Data Exfiltration page 12
6) URL Phishing page 15
7) Scamming page 18
8) Spear Phishing page 22
9) Domain Impersonation page 26
10)Brand Impersonation page 30
11)Blackmail page 34
12)Business Email Compromise page 38
13)Conversation Hijacking page 42
14)Lateral Phishing page 46
15)Account Takeover page 49
16)Strengthening your email security posture with API-based inbox defense page 53
17)Conclusion: Effectively protecting against evolving email threats page 56

PDF download Barracuda 13 email threats

Now is the Time to think about Protecting Mail and Endpoints

Most firms bought in to the idea of purchasing Microsoft Office 365 for financial reasons and convenience. Microsoft promised easy access to Word, Excel and Outlook know matter where you are. Unfortunately, now might be the day of reckoning with the breach of Microsoft cloud products. Hackers, phishing emails and bad actor malware are regularly using O365 to find more victims, and truth is, you’re actually more likely to already be infected via Microsoft’s patching processes. (This is not your fault. Microsoft’s MO is to always do patching on your operating system to keep you secure.)

You need to take a proactive position to:
1) Protect your email (Barracuda Spam Filtering best in breed)
2) Protect your Windows Operating systems (Bitdefender Gravity Zone fully EDR protection The only cybersecurity vendor to prevent all advanced threats AV comparatives.

With both of these layers of security in place, you can limit your exposure to the SolarWinds malware threat, which is bigger than even the media understand. Everyday more and more firms are coming forward with security breaches. Unfortunately for SolarWinds’ customers, the malware used int he attack is a mutating virus and responds to web commands.

If you are the Public, ask your Internet provider or support tech if they use SolarWinds RMM. If they do, ask to have it removed and replaced. Most tech firms will try justify why they should keep SolarWinds. Fight for your protection.

If you are tech company, contact MspPortal Partners, and we will set you up with the proper security to protect you endpoints and clients.

The cost for both lines through us is less than $6.00 a month per endpoint/mailbox. MspPortal Partners is a Value-Add Distributor for both products. MspPortal Partners does not sell direct to the public. MspPortal Partners have over 400 plus tech firms fully trained to implement a security solution to protect you.

Note: More than likely, your tech firm will charge for any modifications to your account because the virus is not their fault.

Side/foot note:
1) We asked and received a confirmation from the legal team at Barracuda that there is was/no integration of SolarWinds Orion software in the ESS spam filtering or RMM solutions.
2) Bitdefender also confirmed it does not use the Orion solution.
3) Sign up for our RSS feed to keep you informed on today’s Security Landscape

SolarWinds Hackers’ Attack on Email Security Company Raises New Red Flags

Customers of Mimecast were targeted in cyberattack, showing the multiple layers of potential victims at risk in massive hack

Earlier this week, Mimecast confirmed an attacker had compromised a certificate provided to certain customers to authenticate Mimecast products to Microsoft 365 Exchange Web Services. The tools and techniques used in this attack link these operators to those who recently targeted SolarWinds, The Wall Street Journal reports.

The SolarWinds attack affected some 18,000 public and private organizations that downloaded infected versions of legitimate updates to its Orion network management software. However, the attack on Mimecast shows not all victims had to be SolarWinds customers to be targeted.

Mimecast was a SolarWinds customer in the past but no longer uses the Orion software, a person familiar with the matter told WSJ. The company has not determined how attackers got in or whether its earlier use of SolarWinds could have left it vulnerable.

Microsoft recently informed us that a Mimecast-issued certificate provided to certain customers to authenticate Mimecast Sync and Recover, Continuity Monitor, and IEP products to Microsoft 365 Exchange Web Services has been compromised by a sophisticated threat actor. Mimecast Comments

Look at this: on there comment section
Forward-Looking Statements-my interpretation is it is not our fault and no payment relief was made
Do you really want to do business with a firm like this? Or trust your confidential emails to you customers.

Dark Reading Comments and Article

SolarWinds Attackers May Have Hit Mimecast, Driving New Concerns
Mimecast no longer uses the SolarWinds Orion network management software that served as an attack vector for thousands of organizations.

The discovery of a data breach at email service provider Mimecast could indicate attackers behind the massive SolarWinds incident may have pursued multiple paths to infiltrate target organizations, a new report states.

Left undisclosed by SolarWinds: Put out of list of the 18,000 companies affected even CISA has not confirmed, maybe folks should contact the FTC they are a publicly traded firm