It has been reported that a Dubai-based exhibitions firm has lost $53,000 (Dh194,700) in an elaborate phishing attack. Binu Manaf, CEO and managing director of Cheers Exhibition, said a cybercriminal hacked his firm’s email and then used a spoofed email to trick its client to wire the funds into an overseas bank.The CEO said he didn’t realise the company’s email account had been hacked until one of his clients enquired if he had sent out emails seeking payments into an overseas account instead of a local bank in Dubai.
Experts Comments
September 25, 2019
In this attack the bad actor had the time to trawl through previous company emails to gain an understanding of the targets business. The more time hackers are allowed unhindered access to email systems the more creative they can become with their targeted emails.
There are a number of simple protections such as either frequent password changes or even deploying MFA for authentication into critical systems (email being one of those), ensuring a modern Antivirus system is used and kept up-to .....Read More
Like(
September 25, 2019
In addition to user awareness training via regular phishing simulations and education, organisations can create detection and response mechanisms to identify and thwart these attempts before they make it to a user’s inbox. Setting up automation to identify emails that seem 'phishy' and blocking them for review by the security team can take a little extra work but should be able to help reduce risk. Beyond implementing tools, consistent behaviours can help thwart phishing and, in this case,.....Read More
September 25, 2019
We continue to see such attacks against businesses whereby emails are sent to trick recipients into sending money or other details. This is a prevalent form of Business Email Compromise and these threats are highly targeted and rely on social engineering rather than malware, meaning that such “Imposter Emails” often evade security solutions that look only for malicious content or behavior.
Technology alone cannot offer effective protection. One of the key measures is raising security.....Read More
September 25, 2019
Although email infrastructure is critical to any organization and security controls should be implemented to protect it, more important the company should also security assess their business processes to reduce the risk affecting confidentiality, Integrity, and Availability of the information processed by these processes. In addition to vulnerable email infrastructure in this incident, we also have seen that how easy is it to trick the employee to send the money to overseas account by sending a .....Read More
Submit Your Expert Comments
What do you think of the topic? Do you agree with expert(s) or share your expert opinion below.Be part of our growing Information Security Expert Community (1000+), please register here.
Linkedin Message
@Gavin Millard, VP of intelligence , provides expert commentary at @Information Security Buzz.
"Email is a critical business tool that needs to be protected as such, continuously identifying flaws...."
#infosec #cybersecurity #isdots
https://informationsecuritybuzz.com/expert-comments/dubai-company-loses-53000-in-targeted-cyber-attack
Facebook Message
@Gavin Millard, VP of intelligence , provides expert commentary at @Information Security Buzz.
"Email is a critical business tool that needs to be protected as such, continuously identifying flaws...."
#infosec #cybersecurity #isdots
https://informationsecuritybuzz.com/expert-comments/dubai-company-loses-53000-in-targeted-cyber-attack