More Orgs Suffered Successful Phishing Attacks in 2021 Than in 2020

Enterprise organizations appear to be falling even further behind in their battle against phishing threats despite heightened awareness of the problem and efforts to curb it.

A new study shows that in 2021 more organizations experienced at least one successful email-based phishing attack than the year before. There were also more opportunistic and targeted phishing attacks last year compared with 2020, as well as phishing attacks involving ransomware and business email compromise (BEC).

Researchers recently analyzed data from a survey of 600 IT and security professionals and another survey of 3,500 employees from seven countries, including the US, UK, France, Germany, and Australia. The researchers also analyzed data gathered from some 100 million simulated phishing attacks and more than 15 million emails that end users reported as being suspicious.

Seventy-eight percent of organizations experienced a ransomware attack in which a phishing email was the initial infection vector. Seventy-seven percent reported a phishing-related BEC incident — an 18-point increase from 2020. Overall, 12% more organizations reported being victims of an indiscriminate or opportunistic phishing attack, while organizations reporting more targeted spear-phishing and BEC attacks went up 20%.

Roy Miehe | MspPortal Partners Inc. | Ceo/President
Bitdefender and Barracuda Distributor for Msp’s
“Where Service and Technical Skills Count”

Hackers slip into Microsoft Teams chats to distribute malware

Hackers slip into Microsoft Teams chats to distribute malware

Security researchers warn that some attackers are compromising Microsoft Teams accounts to slip into chats and spread malicious executables to participants in the conversation.

More than 270 million users are relying on Microsoft Teams every month, many of them trusting the platform implicitly, despite the absence of protections against malicious files.
Simple but efficient method

Researchers at Avanan, a Check Point company that secures cloud email and collaboration platforms, found that hackers started to drop malicious executable files in conversations on Microsoft Teams communication platform.

The attacks started in January, the company says in a report today, and the threat actor inserts in a chat an executable file called “User Centric” to trick the user into running it.

Once executed, the malware writes data into the system registry installs DLLs and establishes persistence on the Windows machine.
“In this Teams attack, hackers have attached a malicious Trojan document to a chat thread. When clicked on, the file will eventually take over the user’s computer” – Avanan

Manage Microsoft Teams settings for your organization
Here you can turn on or turn off file sharing and cloud file storage options. read Article and turn off file sharing

Users can upload and share files from cloud storage services in Teams channels and chats. Cloud storage options in Teams currently include Dropbox, Box, Citrix files, Google Drive, and Egnyte. Turn on the switch for the cloud storage providers that your organization wants to use.

Using either the above solution and fixing the issues or

Use Bitdefender/MspPortal Partners malware protection in combination of Barracuda/MspPortal Partners Spam, Phishing malware protection

Roy Miehe | MspPortal Partners Inc. | Ceo/President Bitdefender /MSP Aggregator – Distributor “Where Service and Technical Skills Count”

Google Releases Security Updates for Chrome (Must Apply)

Google Releases Security Updates for Chrome (Must Apply) (Review update)
02/15/2022 07:25 AM EST

Original release date: February 15, 2022

Google has released Chrome version 98.0.4758.102 for Windows, Mac, and Linux. This version addresses vulnerabilities that an attacker could exploit to take control of an affected system. One of these vulnerabilities has been detected in exploits in the wild.

CISA encourages users and administrators to review the Chrome Release Note and apply the necessary update as soon as possible.

I have always supported Firefox. As bad as I personally think Facebook is, I think Google products and browser are worse.

Roy Miehe | MspPortal Partners Inc. | Ceo/President Bitdefender /MSP Aggregator – Distributor “Where Service and Technical Skills Count”

CISA Adds Nine Known Exploited Vulnerabilities to Catalog

Original release date: February 15, 2022

CISA has added nine new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence that threat actors are actively exploiting the vulnerabilities listed in the table below. These types of vulnerabilities are a frequent attack vector for malicious cyber actors of all types and pose significant risk to the federal enterprise.
CVE Number CVE Title Remediation Due Date
CVE-2022-24086 Adobe Commerce and Magento Open Source Improper Input Validation Vulnerability 3/1/2022
CVE-2022-0609 Google Chrome Use-After-Free Vulnerability 3/1/2022
CVE-2019-0752 Microsoft Internet Explorer Type Confusion Vulnerability 8/15/2022 not good
CVE-2018-8174 Microsoft Windows VBScript Engine Out-of-Bounds Write Vulnerability 8/15/2022 not good
CVE-2018-20250 WinRAR Absolute Path Traversal Vulnerability 8/15/2022
CVE-2018-15982 Adobe Flash Player Use-After-Free Vulnerability 8/15/2022
CVE-2017-9841 PHPUnit Command Injection Vulnerability 8/15/2022
CVE-2014-1761 Microsoft Word Memory Corruption Vulnerability 8/15/2022 not good
CVE-2013-3906 Microsoft Graphics Component Memory Corruption Vulnerability 8/15/2022 not good

The two agencies also shared a list of measures that can help admins mitigate BlackByte attacks: 2-14-2022

The two agencies also shared a list of measures that can help admins mitigate BlackByte attacks: 2-14-2022

Thanks to Bleeping Computer

  1. Implement regular backups of all data to be stored as air gapped, password protected copies offline.
  2. Ensure these copies are not accessible for modification or deletion from any system where the original data resides.
  3. Implement network segmentation, such that all machines on your network are not accessible from every other machine.
  4. Install and regularly update MspPortal Partners/Bitdefender antivirus software on all hosts, and enable real time detection.
  5. Install updates/patch operating systems, software, and firmware as soon as updates/patches are released be careful of this look at KB’s first.
  6. Review domain controllers, servers, workstations, and active directories for new or unrecognized user accounts.
  7. Audit user accounts with administrative privileges and configure access controls with least privilege in mind. Do not give all users administrative privileges.
  8. Disable unused remote access/Remote Desktop Protocol (RDP) ports and monitor remote access/RDP logs for any unusual activity.
  9. Consider adding an email banner to emails received from outside your organization.
  10. Disable hyperlinks in received emails MspPortal Partners/Barracuda
  11. Use double authentication when logging into accounts or services.
  12. Ensure routine auditing is conducted for all accounts
  13. Ensure all the identified IOCs are input into the network SIEM for continuous monitoring and alerts.
  14. Do you want Security Updates Emailed to you Subscribe to blog (bottom  of News page)

     

    Roy Miehe | MspPortal Partners Inc. | Ceo/President

    Bitdefender /MSP Aggregator – Distributor

    “Where Service and Technical Skills Count”

The Texas attorney general’s office sued Meta’s Facebook on Monday

Mon, February 14, 2022, 10:10 AM
WASHINGTON (Reuters) -The Texas attorney general’s office sued Meta’s Facebook on Monday, alleging that the social media giant violated state privacy protections with facial-recognition technology that collected the biometric data of millions of Texans without their consent.

The lawsuit accuses Facebook of capturing biometric information from photos and videos that users uploaded without consent, disclosing the information to others and failing to destroy it within a reasonable time.

“This is yet another example of Big Tech’s deceitful business practices and it must stop. I will continue to fight for Texans’ privacy and security,” Attorney General Ken Paxton said in a statement.

The lawsuit was first reported by the Wall Street Journal, which cited a person familiar with the matter as saying that the state was seeking hundreds of billions of dollars in civil penalties

“The scope of Facebook’s misconduct is staggering,” the lawsuit said. “Facebook repeatedly captured Texans’ biometric identifiers without consent not hundreds, or thousands, or millions of times — but billions of times,” the lawsuit said.

Leading Barracuda RMM will release 12 SP5 MR1

We will be releasing Barracuda RMM 12 SP5 MR1 to our cloud instances starting on January 31, 2022. This release includes an enhancement to view automated task results and necessary security updates. To ensure our partners are protected, we have updated our third-party dependencies. It is required for all partners to update to this Maintenance Release as soon as possible.

NOTE: After you update the Maintenance Release, please ensure your Onsite Managers and Device Managers for Windows and Mac, as well as your Office 365 and VMWare Service Modules, are updated. These two Service Modules must be updated to the latest version to work with this Maintenance Release.

A maintenance window is required for this upgrade during which all services will be unavailable. Please plan accordingly using the schedule outlined below.

Barracuda Cloud Maintenance Window
US07 Friday, February 4 from 0000 – 0200 UTC-0500

This is a tech dashboard with more scripts to utilize for all your clients. Pricing is monthly no contracts and more aggressive then mainline products. Migration has no conflicts with other providers. Remote Support is a true point to point

Bitdefender and Microsoft O365 Information IMPORTANT

Bitdefender Policy Update- please apply

Network Protection ->General Settings Section- Check off Besides SSL Scan RDP.  Brute Force attacks are happening..it surprises me considering the whole world I thought shutdown RDP on the public side.

Microsoft Changes to O365 user and Resellers agreements

Dear Reseller,  

We’d like to take the opportunity to provide you with an overview of upcoming changes Microsoft is making to their CSP experience. 

Historically, Microsoft has not enforced their annual subscription terms which has allowed customers flexibility in modifying licenses throughout the annual term. Effective March 10, 2022, Microsoft will be enforcing annual terms, and offering monthly terms for customers who wish to maintain flexibility with license changes.  Monthly-term license subscriptions will be charged a 20% premium, however, to help support this new enforcement, Microsoft is offering a promotion for most of the monthly-term licenses.  This promotion is effective through June 2022 and is for designated SKUs where the customer has under 2,400 of the same licenses within the same tenant. Customers who do not want to pay a 20% premium for this flexibility will need to move their license to an annual term before Microsoft’s promotion ends in June. 

In addition to enforcement of term policies, Microsoft is only allowing a 72-hour time frame during which new subscriptions can change terms or quantities. After 72-hours from the initial purchase, subscriptions cannot be modified until the next renewal period (either monthly or annual).

Think about this the headache you will have trying to do co-terming with you clients. Remember this withing the same tenant, with no time to adjust. We are working to provide a solution and alternative to Micorsoft’s actions

Roy Miehe | MspPortal Partners Inc. | Ceo/President

Bitdefender /MSP Aggregator – Distributor

“Where Service and Technical Skills Count”

Bitdefender New Portfolio email

This will not effect MspPortal Partners pricing on all Gravity Zone pricing will remain the same. Per my Distribution Manager 1-6-2021

Yes a la carte refers only to annual enterprise solution – not MSP. You will continue to distribute Cloud Security for MSP + ATS + EDR, etc. with no change 😊

I will let you know details ASAP on the annual pricing changes to the enterprise only (no change to annual bundles).

The message sent was a little confusing and concerning to a lot of MSP and Resellers

The a-la-carte licensing model is being updated: advanced security capabilities (Cloud Sandbox, HyperDetect and Root Cause Analysis) will now be included in the base license to provide an even higher security level with the base tier. We are also consolidating SKUs and will support both on-premises and cloud console deployments from the same SKU/license.

– The current a-la-carte products and GravityZone Advanced Business Security will move to End-of-Sale for new customers starting April 1st, 2022. This is due to the introduction of the enhanced a-la-carte licensing mentioned above and to optimize the number of packages in our business solutions portfolio from four to three.

Something to think about as an opinion and comment if you bill your clients annually you might change to monthly as soon as feasible and financially acceptable to you.  Annual contracts both with your vendor and your clients could backfire or be detrimental to you .

Roy Miehe | MspPortal Partners Inc ” Where Service and Technical Skills Count”

 

Bitdefender BEST 7.4.2.142 (Windows) Release Notes – Fast Ring

BItdefender updates The release notes are available here.

Folks stay up to date on Product 7.4.2.142 and  engine 7.90782 last update 1-4-2022

Also Bitdefender alerts via email .. they are still struggling and still using Mailchimp hence you’re not receiving all alerts that you have requested. Very important to login daily..and review your endpoints if they have red on them more then likely it is a  engine update but could be a product update is needed. If you are with a RMM solution using Bitdefender my suggestion is to convert to the real Gravity Zone platform. Not all distributors are the same, pricing should be the same based upon Bitdefender guidelines but some will try to buy your business. Pricing is not always the best way to select your distributor, interview them and find out if you have a questions or issue do they pick up the phone and do they have tech support available to answer and fix your solution and or questions. Safe Safe folks malware is on the rise

Roy Miehe | MspPortal Partners Inc. | Ceo/President
Bitdefender /Distributor
“Where Service and Technical Skills Count”