It has been reported that a prolific phishing campaign is attempting to trick people into believing they’ve subscribed to a movie-streaming service to coerce them into calling a phone number to cancel – where someone will guide them through a procedure that infects their computer with BazaLoader malware. BazaLoader creates a backdoor onto Windows machines that can be used as an initial access vector for delivering additional malware attacks – including ransomware. The notorious Ryuk ransomware is commonly delivered via BazaLoader, meaning a successful compromise by cybercriminals could have extremely damaging consequences.
<p>Enterprises shouldn’t ignore the alarming developments around a recent phishing campaign involving BazaLoader malware. It showcases the wickedly ingenious ways in which threat actors manipulate unwitting users into actually helping them open a more sophisticated access vector. The end result of leveraging human factors among the unwary is the ability to carry out more detrimental attacks, such as ransomware.</p> <p> </p> <p>Organizations can fight back, though. First of all, they need to promote a very open culture of privacy and data security awareness to help thwart malicious activities that depend on human factors, as in the BazaLoader attack in which users are actually guided through the process of assisting threat actors. Secondly, companies can also completely rethink how they protect the sensitive and highly valuable data that these attacks are really after. Guarding and monitoring the borders around this data, as well as ingress and egress points, isn’t fool-proof, as this type of attack demonstrates. Protect the data itself through data-centric methods such as tokenization and format-preserving encryption. These methods travel with the data no matter where it goes, so even if an attack vector is opened and threat actors get their hands on sensitive data, all that information ultimately will be worthless to them. By doing this, enterprises have a much better chance at mitigating the vulnerabilities that human behavior itself presents.</p>