Email Hacks in South Africa:

Email Hacks in South Africa.

Email Hacks to look out for: Spear Phishing, Word Doc. Malware, Microsoft Invoice Phish, Password Hash Capture, Touchscreen Clickjacking, SMS Recovery Hack.
President Ramaphosa’s personal phone was hacked with Pegasus.
Transnet faces major systems cyber-attack. South Africa 3rd highest in the world for ransomware attacks.

Spear Phishing Campaign.

Problem: Spear Phishing Campaign using spoofed email addresses that look like intercompany correspondence. Once trust is gained (Social Engineering), an email attachment with IMG, ISO, or CAB files is sent and once clicked the files drops the payload, and the data-stealing begins. Trust is gained through correspondence and then social media engineering using credible names and stories.
Solution: Users to be trained in security best practices and simulations like not to open attachments before verifying.

Word Doc. Malware.

Problem: Word Doc. Malware. Malware is not in the word document therefore macros bypass security filters. Once the word doc. is opened and editing enabled and Excel file downloads the Zloader payload. The Zloader payload is executed using rundll32.exe.
Solution: Macros are disabled by default in Microsoft Office applications for good reason and should only be opened when delivered by a trusted source. If in doubt contact your IT support ASAP.  Users to be trained in security best practices and simulations like not to open attachments before verifying.

Microsoft Invoice Phish.

Problem: Phishing/vishing/social engineering hybrid exploit delivers a Microsoft Store Invoice of a large enough amount to create panic. The intent is to try lure you into trying to reverse the payments and giving away your credit card details.
Solution: Users to be trained in security best practices and simulations. Cross-check your bank statements with unauthorised payments. Look out for generic Dear Customer exploit as invoices should be personalised, no credit card information or no redacted number of the 4 last digits. Other giveaways are VAT totals, headers and email addresses. When in doubt don’t panic phone your bank.

Password Hash Capture.

Problem: Password Hash Capture uses a UNC link in an email (or just opening the email) to trigger a remote malicious webserver forcing an object download which in turn triggers the webserver authentication login. Your password hash is retrieved in the attempted authentication.
Solution: Passwords of 16 characters or more. Block outbound auth logins. Convert incoming mail to plant text. Patch windows registry download from Microsoft. Users to be trained in security best practices and simulations.

Touchscreen Clickjacking.

Problem: ClickJacking of touch screens by using an element that appears on the screen as an object like a crack or hair. The malicious URL is activated when the user attempts to wipe or touch the element.
Solution: Users to be trained in security best practices and simulations.

SMS Recovery Hack.

Problem: SMS recovery hack is a password reset hack where the hacker spoofs a password recovery email/SMS with malicious intent. The hacker attempts to login into your account triggering either password recovery options and/or a verification code. You will then reply in the email/SMS with that code they triggered.
Solution:  Use application verification methods and not SMS verification. 2FA and Google Authenticator application.