The CERT-Bund, die Computer-Gefahrenstelle der Bundesverwaltung, is currently warning of an outbreak of the GandCrab encryption Trojan.

The sender of this e-mail is “Saskia Heyne” and the subject is “Bewerbung auf die angebotene Stelle”. Attached to this email is a Word document which, when opened, tries to persuade the user to activate macros.

Without this step, the Trojan cannot execute its malicious code.

Only open Word files containing macros if you have obtained them from a 100% trustworthy source.

The new wave of attacks is mainly directed against companies.

Managing directors/CEOs (names can be found in the imprint of a website), sales and marketing staff (usually also publicly visible) and employees from public administrations (e.g. financial administrations). They are the most frequent targets of this wave of attacks, but anyone else can be affected.

With WeTransfer, the attackers use a very well-known platform for sending e.g. presentations, catalogues or larger graphics and photos. WeTransfer is a cloud service that is mainly used by companies and freelancers. It is an ideal Trojan horse to penetrate a company network. The phishing email looks very authentic. The sender appears to be the cloud service “WeTransfer”, the link to the alleged download file also looks genuine. However, the link leads to another website where the victim’s email address is saved in the first step. With this, the attackers have already identified all the easy targets.

In the next step, the website transmits malicious code to the victim’s computer. A good web browser protection like Bitdefender or McAfee can help with this step. The security software blocks access to the website and warns of the possible dangers (see picture).

Beware of a new wave of attacks via phishing emails

We carried out a test with Windows 10’s own security protection “Windows Defender”. Unfortunately, Defender allowed the website to be accessed and thus we were at the mercy of spying.

How can users defend against such an attack?

1. The e-mail client should only receive e-mails in text format, not in HTML format. In addition, the automatic reloading of external content (e.g. graphics) should be prevented. When loading graphics, for example, the attacker can pass on malicious code and knows who has opened his e-mail (the e-mail address is thus identified as a potential target). The e-mails may not look as nice in text format, but an attacker can no longer tell whether an e-mail has been opened or even read.
2. A healthy distrust, even with known senders, is the best protection. Does the colleague from accounting really send a WeTransfer file? Probably not. Excel or PDF files do not need much storage space and would be sent directly. If the colleague from the marketing department sends a file via WeTransfer, there is a higher probability that the email will be opened. Before clicking on the link in the email, look at the link address in the bottom left-hand corner of the email client. If it does not say “https://wetransfer.com/download/….” it is probably a phishing e-mail.
3. If 1 and 2 didn’t help and the email was opened in an unfocused moment, a good security solution like Bitdefender can help ward off an attack.
4. If 1 – 3 did not help, it is still possible to restore the system to a restore point or make regular updates with EaseUS ToDo Back-up.

Conclusion:
It remains exciting and the attacks are becoming more and more sophisticated. In the past, we received phishing emails from unknown senders in poor German or English. Nowadays, they are from known senders with halfway comprehensible content in the subject line. Even if the e-mails are encrypted on the Internet, the header with the e-mail address is readable, because otherwise it would not be possible to forward them to the right recipient. This is where cyber criminals come in and grab the e-mail addresses of the sender and recipient. With a watchful eye, common sense and a good security solution, the user is protected against a known phishing attack.

Yes, because e-mails offer the same protection against “reading” as the good old postcard. If you want/need to send really confidential data, such as business data, by e-mail, you cannot avoid encryption. The following options are available to protect messages/documents.

Password-protected files:
You can of course put the data in a password-protected file and then attach it to the e-mail. The only thing is that it is not very convenient to use and confidential things written in the message can still be read. The password should at least be sent by another means (messenger, telephone, etc.) and not by e-mail.

PGP (Pretty Good Privacy)
PGP uses a so-called public key procedure in which there is a uniquely assigned key pair. PGP is based on the so-called Web of Trust, in which there is no central certification authority, but trust is managed by the users themselves. Setting this up is much more difficult and presents many users with major hurdles.

Not at all! That doesn’t sound good, but it corresponds to reality. There is software, e.g. from the NSO Group from Israel, which is specialised in penetrating foreign systems. If a targeted attack is made on a specific device, no antivirus programme can defend itself against it. Antivirus scanners work with signatures of known malware. In the case of a new, as yet unknown attack scenario, they cannot prevent the attack because there is no signature for it in their database

This is where endpoint security comes in. If attackers succeed in getting onto their target’s system, the infected malware must be executed. Modern operating systems such as Windows 10 try to prevent this by so-called whitelisting. With whitelisting, only programmes and components that have previously been classified as “clean” by the user are executed. Whitelisting only works as long as an attack uses components that are not known to be harmless to get to the performance.

An advanced protection mode is the “Guarded Desktop”, which builds a “secure protective shell” around critical applications and prevents critical activities. These include, among others:

• Keylogging: the recording of keystrokes.
• Record screen activity.
• Changes to messages e.g. emails and messengers.
• Injecting malicious code into whitelisted databases and applications.

With the App-Protect software from Reddfort, users can protect themselves from targeted attacks. The application consists of two components, a sophisticated whitelist system and the Guarded Desktop. App-Protect is effective even if the virus scanner has been overcome by a potential attacker. App Protect simply prevents the start of executable files (EXE, MSI, BAT, etc.) and v the execution of e.g. macros from Office documents (DOC, XLS, etc.). It is still possible to start files such as videos, music, photos and Office documents from external USB drives. However, the execution of active elements, which in turn load malware, is reliably prevented.

The best way to use App-Protect is on a newly installed system to prevent possible malware from already being installed in the system and subsequently being “protected” by App-Protect.

Bitdefender has recently released an update that improves your privacy protection.

Die neueste Version von Bitdefender now offers “Anti-Tracker”, a browser extension that lets you know what information websites collect about you.

Unfortunately, there is no such thing as anonymity on the web.

You leave a digital footprint every time you visit a website. With every click, data about you and your online habits is collected and stored’.
Examples: A search on the topic of ‘fitness’ is enough for you to be offered a membership for a fitness club at every corner of the internet. Have you ever wondered why the car ad you clicked on suddenly appears everywhere? Or why the airline tickets are suddenly more expensive after a quick glance at them?
Anti-Tracker helps you!

Once activated, Anti-Tracker displays a list of trackers embedded in the pages you visit. Even better: with its help, you can then switch off these trackers and continue surfing without leaving traces everywhere. The extension is initially available for Chrome, Internet Explorer and Firefox.

If you haven’t received the update yet, don’t worry: it won’t be long now. What’s more, it is completely free of charge for you.