What's new arround internet
| Src | Date (GMT) | Titre | Description | Tags | Stories | Notes |
 |
2024-05-06 05:52:32 | La sécurité des e-mails est désormais redéfinie avec des capacités de protection des menaces adaptatives dans toute la chaîne de livraison Email Security is Now Redefined with Adaptive Threat Protection Capabilities Across the Entire Delivery Chain (lien direct) |
Another RSA Conference has arrived, and with it comes the gold standard report for our industry, the Verizon DBIR. And for yet another year, it concludes the same thing: the human element is central to the vast majority of breaches (76% this year), especially the ones that matter, from ransomware to BEC to data loss. The very first word of the 2024 DBIR is also not new; it\'s “phishing”. Email security has always been central to human risk: it\'s the #1 way users encounter threats, the #1 way users make mistakes, and the #1 way attackers get what they want, from credentials to wire transfers to malware infections. Proofpoint has a long history of stopping more human-targeted threats than anyone else. Our long history of firsts includes the first ML models to stop unwanted messages, the first rewriting of URLs for click-time protection, and the first connection of a malware sandbox to email. But attackers have continued to innovate and so have we – starting now, we\'re setting a new standard for protection across the entire email delivery chain. Building an Unmatched Detection Ensemble What organizations need in email security is simple to describe but hard to do: a single solution to protect against every type of threat, every time, every way a user may encounter it, using every form of detection. Our detection ensemble was already the industry\'s most effective, including threat intelligence, static analysis, sandboxing, click-time protection, and our unique set of Nexus AI models. I\'m thrilled to announce that we have now added the industry\'s first ever pre-delivery protections to stop social engineering and malicious URLs, as well as our newly integrated post-delivery behavioral AI, Proofpoint Adaptive Email Security. * New capability According to our data across more than 500,000 organizations, including 87 of the Fortune 100, attackers rely on two techniques more frequently than any others: text-based social engineering and malicious URLs. While we already detect both these threat types at the highest rates in the industry, we wanted to push the envelope – not just detecting them, but detecting them as early as possible. To make this a reality, we optimized the performance of our Nexus AI LLM-based detection model by 10X, enabling us to use semantic analysis to interpret a malicious message\'s intent (such as invoicing fraud), regardless of the words they use or even the language they write in. In parallel, we built the capability for our gateway to hold messages with suspicious URLs until they are sandboxed. The result is the most formidable set of defense in-depth measures available for organizations to prevent attacks from reaching their targets. Continuous End-to-End Detection with Proofpoint Adaptive Email Security Joining our pre-delivery enhancements is Proofpoint Adaptive Email Security, our API-based offering that integrates with Microsoft 365 and applies our broad detection ensemble to stop advanced threats, including BEC, social engineering and lateral phishing messages. Once deployed, Adaptive Email Security enriches all detections with easy-to-understand explanations about behavioral anomalies observed. Additionally, it automatically quarantines high confidence threats, while delivering real-time coaching using contextual warning banners to alert users to the risks in social engineering and BEC-type emails that don\'t contain an obvious malicious payload. Insight into a malicious message generated by Adaptive Email Security The Next Level While we\'re thrilled for you all to experience our latest set of innovations, we know we can still do more to help you protect your people. That takes two main forms: continuing to lead with Nexus AI, and deepening and strengthening our ecosystem partnerships. Nexus AI: The value of our proprietary data is enhanced by contextual insights and in-depth classification from our leading team of threat researchers and data scientists, who track adversaries, analyze evolving attacker tradecraft, profile data exfiltration pa | Ransomware Malware Threat Conference | ★★★ | |
|
2024-04-16 06:00:54 | De l'ingénierie sociale aux abus DMARC: Ta427 \\'s Art of Information Gathering From Social Engineering to DMARC Abuse: TA427\\'s Art of Information Gathering (lien direct) |
Key takeaways TA427 regularly engages in benign conversation starter campaigns to establish contact with targets for long-term exchanges of information on topics of strategic importance to the North Korean regime. In addition to using specially crafted lure content, TA427 heavily leverages think tank and non-governmental organization-related personas to legitimize its emails and increase the chances that targets will engage with the threat actor. To craftily pose as its chosen personas, TA427 uses a few tactics including DMARC abuse in concert with free email addresses, typosquatting, and private email account spoofing. TA427 has also incorporated web beacons for initial reconnaissance of its targets, establishing basic information like that the email account is active. Overview Proofpoint researchers track numerous state-sponsored and state-aligned threat actors. TA427 (also known as Emerald Sleet, APT43, THALLIUM or Kimsuky), a Democratic People\'s Republic of Korea (DPRK or North Korea) aligned group working in support of the Reconnaissance General Bureau, is particularly prolific in email phishing campaigns targeting experts for insight into US and the Republic of Korea (ROK or South Korea) foreign policy. Since 2023, TA427 has directly solicited foreign policy experts for their opinions on nuclear disarmament, US-ROK policies, and sanction topics via benign conversation starting emails. In recent months, Proofpoint researchers have observed (Figure 1) a steady, and at times increasing, stream of this activity. While our researchers have consistently observed TA427 rely on social engineering tactics and regularly rotating its email infrastructure, in December 2023 the threat actor began to abuse lax Domain-based Message Authentication, Reporting and Conformance (DMARC) policies to spoof various personas and, in February 2024, began incorporating web beacons for target profiling. It is this initial engagement, and the tactics successfully leveraged by TA427, which this blog is focused on. Figure 1. Volume of TA427 phishing campaigns observed between January 2023 and March 2024. Social engineering TA427 is a savvy social engineering expert whose campaigns are likely in support of North Korea\'s strategic intelligence collection efforts on US and ROK foreign policy initiatives. Based on the targets identified and the information sought, it is believed that TA427\'s goal is to augment North Korean intelligence and inform its foreign policy negotiation tactics (example Figure 2). TA427 is known to engage its targets for extended periods of time through a series of benign conversations to build a rapport with targets that can occur over weeks to months. They do so by constantly rotating which aliases are used to engage with the targets on similar subject matter. Figure 2. Example of TA427 campaign focused on US policy during an election year. Using timely, relevant lure content (as seen in Figure 3) customized for each victim, and often spoofing individuals in the DPRK research space with whom the victim is familiar to encourage engagement, targets are often requested to share their thoughts on these topics via email or a formal research paper or article. Malware or credential harvesting are never directly sent to the targets without an exchange of multiple messages, and based on Proofpoint visibility, rarely utilized by the threat actor. It is possible that TA427 can fulfill its intelligence requirements by directly asking targets for their opinions or analysis rather than from an infection. Additionally, insight gained from the correspondence is likely used to improve targeting of the victim organization and establish rapport for later questions and engagement. Figure 3. Timeline of real-world events based on international press reporting, side-by-side with Proofpoint observed subject lures. Lure content often includes invitations to attend events about North Korean policies regarding international affairs, questions regarding topics such as how deterr | Malware Tool Threat Conference | APT 37 APT 43 | ★★ |
|
2023-12-18 06:00:21 | Une approche de risque intégrée pour briser la chaîne d'attaque juridique et de conformité: les informations de Proofpoint Protect 2023 An Integrated Risk Approach to Breaking the Legal and Compliance Attack Chain: Insights from Proofpoint Protect 2023 (lien direct) |
Last September, Proofpoint held our first in-person event since the pandemic in New York City, Protect 2023. In this blog post, our Chief Compliance Officer in Residence John Pepe shares some key insights from the leaders who participated in the Compliance Leader\'s Roundtable at that conference. A big part of that discussion was exploring how combining data points from multiple tools can help stop known risk patterns before problems escalate. “Break the Attack Chain” is a Proofpoint initiative that outlines our approach to prevent and disrupt cyberattacks that target people and their data. The attack chain can basically be broken down into eight steps and three main stages: Initial compromise Privilege escalation Data exfiltration Steps in the attack chain. We believe that breaking the attack chain is so important that we made it the theme of Protect 2023. When you break the attack chain, you reduce the risks and the impact of cyberattacks. And you avoid a lot of the financial, reputational and operational damage. Proofpoint argues that this starts by taking a people-centric approach to security that focuses on the human factors that enable and motivate attackers. But this theme isn\'t just relevant to cybersecurity. It\'s also an important concept that\'s relevant to compliance professionals and their current challenges. Recently at the Protect 2023 conference, we explored how the industry is using this idea to rethink the ways it approaches and mitigates risk. What\'s top of mind for compliance professionals right now? Part of my job at Proofpoint is to provide our customers-some of whom are highly regulated-with executive briefings on compliance and regulatory best practices. I also have a lot of critical discussions with the legal and regulatory communities. So I understand why the concept of breaking the attack chain transcends cybersecurity and really resonates with these groups. That\'s why I chose to explore it at Protect 2023 at the Compliance Leader\'s Roundtable. This panel was comprised of a chief compliance officer from a leading financial services provider, the head of surveillance for an asset manager, and a chief information security officer. And our topic was “What\'s Top of Mind for Compliance Professionals Post COVID-19." The discussion was informal and focused on work-from-home (WFH) initiatives during and after the pandemic. Two interconnected areas were of particular interest: Risks and programs related to WFH, with a special focus on collaboration platforms How behavioral indicators may help to predict potential legal or compliance issues When talking about insider risks and threats, the panelists explored: Best practices for controlling messaging apps and mitigating risks in mobile texts and chat How behavioral modeling and analytics can be used to enhance risk monitoring for user conduct How combining multiple compliance approaches can help form a holistic risk management program, which can mean integrating: Threat detection People analytics Conduct compliance applications As part of the conversation, I brought up the topic of employee behaviors and patterns that can lead to legal or compliance issues. The example scenario I offered was of a disgruntled employee who had received an underwhelming bonus or was passed up for a promotion. To get back at the company, this person stole sensitive company data and intellectual property (IP) before they left their job. The panel discussed behaviors or telemetry that might be present in such a scenario. And they talked about whether any data about user conduct might help detect and prevent potential losses. An integrated approach to breaking the attack chain What follows are some of the ways that our panelists use tools to mitigate risks. And how Proofpoint can help. Combining internal and external data One of the most crucial aspects of a surveillance analyst\'s job, especially in financial services, is monitoring employee risk. The roundtable emp | Tool Threat Mobile Prediction Conference | ★★★ |
1
We have: 3 articles.
We have: 3 articles.
To see everything:
Our RSS (filtrered)
