Scarinci Hollenbeck, LLC, LLCScarinci Hollenbeck, LLC, LLC

Firm Insights

Could Your Remote Workers Fall Victim to a Voice Phishing Attack?

Author: Scarinci Hollenbeck, LLC

Date: September 10, 2020

Key Contacts

Back

Hackers continue to target teleworking employees, trying to capitalize on cyber weaknesses that may arise from companies having a large and relatively untested remote workforce...

Hackers continue to target teleworking employees, trying to capitalize on cyber weaknesses that may arise from companies having a large and relatively untested remote workforce.  According to the Federal Bureau of Investigation (FBI) and U.S. Cybersecurity and Infrastructure Security Agency (CISA), the latest COVID-19-related cyber threat comes from voice phishing or “vishing” attacks. 

How Vishing Attacks Work

According to the FBI/CISA Alert, hackers, who have been perpetrating the schemes since July, have registered domains and created phishing pages duplicating a company’s internal VPN login page, also capturing two-factor authentication (2FA) or one-time passwords (OTP). They have also obtained certificates for the domains they registered and used a variety of domain naming schemes, including Secure Sockets Layer (SSL).

To help carry out the attacks, cybercriminals have then compiled dossiers on the employees at the specific companies using mass scraping of public profiles on social media platforms, recruiter and marketing tools, publicly available background check services, and open-source research.  The information collected about the employees includes: name, home address, personal cell/phone number, position at company, and duration at company.

According to the FBI, the first iteration of the cyber scheme involved using Voice Over Internet Protocol (VoIP) numbers to call employees on their personal cellphones. Cybercriminal then started incorporating spoofed numbers of other offices and employees in the victim company. The actors used social engineering techniques and, in some cases, posed as members of the victim company’s IT help desk, using their knowledge of the employee’s personally identifiable information—including name, position, duration at company, and home address—to gain the trust of the targeted employee. The targeted employee is then told that a new VPN link would be sent and required their login, including any 2FA or OTP. The cybercriminals then logged the information provided by the employee and used it in real-time to gain access to corporate tools using the employee’s account.

How to Protect Your Company from Vishing Attacks

The FBI identifies several steps that businesses can take to avoid falling victim to a vishing attack. They include:

  • Restricting VPN connections to managed devices only, using mechanisms like hardware checks or installed certificates, so user input alone is not enough to access the corporate VPN.
  • Limiting VPN access hours to mitigate access outside of allowed times.
  • Employing domain monitoring to track the creation of, or changes to, corporate, brand-name domains.
  • Actively scanning and monitoring web applications for unauthorized access, modification, and anomalous activities.
  • Using the principle of least privilege and implementing software restriction policies or other controls; monitoring authorized user accesses and usage.
  • Considering using a formalized authentication process for employee-to-employee communications made over the public telephone network where a second factor is used to authenticate the phone call before sensitive information can be discussed.

Employees can also play a significant role in thwarting vishing attacks. The FBI recommends that employees:

  • Verify web links do not have misspellings or contain the wrong domain.
  • Bookmark the correct corporate VPN URL and do not visit alternative URLs on the sole basis of an inbound phone call.
  • Be suspicious of unsolicited phone calls, visits, or email messages from unknown individuals claiming to be from a legitimate organization. Do not provide personal information or information about your organization, including its structure or networks, unless you are certain of a person’s authority to have the information. If possible, try to verify the caller’s identity directly with the company.
  • If you receive a vishing call, document the phone number of the caller as well as the domain that the actor tried to send you to and relay this information to law enforcement.
  • Limit the amount of personal information you post on social networking sites. “The internet is a public resource; only post information you are comfortable with anyone seeing,” the FBI warns.
  • Regularly evaluate your settings, as sites may change their options periodically.

As we have discussed in prior articles, employees are often a company’s largest cyber risk. With an increasing number of employees now working from home, the threat is even greater. We encourage businesses to thoroughly review their policies and procedures to determine what changes may be needed to strengthen your defenses in light of the influx of cyberattacks targeting remote workers.

If you have questions, please contact us

If you have any questions or if you would like to discuss the matter further, please contact me, Maryam Meseha, or the Scarinci Hollenbeck attorney with whom you work, at 201-896-4100.

No Aspect of the advertisement has been approved by the Supreme Court. Results may vary depending on your particular facts and legal circumstances.

Scarinci Hollenbeck, LLC, LLC

Related Posts

See all
Corporate Transactions: Best Practices for Successful Deals post image

Corporate Transactions: Best Practices for Successful Deals

Corporate transactions can have significant implications for a corporation and its stakeholders. For deals to be successful, companies must act strategically to maximize value and minimize risk. It is also important to fully understand the legal and financial ramifications of corporate transactions, both in the near and long term. Understanding Corporate Transactions The term “corporate […]

Author: Dan Brecher

Link to post with title - "Corporate Transactions: Best Practices for Successful Deals"
How to Conduct a Fair and Legal Employee Termination in 2025 post image

How to Conduct a Fair and Legal Employee Termination in 2025

Ongoing economic uncertainty is forcing many companies to make tough decisions, which includes lowering staff levels. The legal landscape on both the state and federal level also continues to evolve, especially with significant changes to the priorities of the Equal Employment Opportunity Commission (“EEOC”) under the Trump Administration. Terminating an employee is one of the […]

Author: Angela A. Turiano

Link to post with title - "How to Conduct a Fair and Legal Employee Termination in 2025"
Admin Dissolution for Annual Report: What You Need to Know post image

Admin Dissolution for Annual Report: What You Need to Know

While filing annual reports may seem like a nuisance, failing to do so can have significant ramifications. These include fines, reputational harm, and interruption of your business operations. In basic terms, “admin dissolution for annual report” means that a company is dissolved by the government. This happens because it failed to submit its annual report […]

Author: Dan Brecher

Link to post with title - "Admin Dissolution for Annual Report: What You Need to Know"
What Is Antitrust Litigation Law? post image

What Is Antitrust Litigation Law?

Antitrust laws are designed to ensure that businesses compete fairly. There are three federal antitrust laws that businesses must navigate. These include the Sherman Act, the Federal Trade Commission Act, and the Clayton Act. States also have their own antitrust regimes. These may vary from federal regulations. Understanding antitrust litigation helps businesses navigate these complex […]

Author: Robert E. Levy

Link to post with title - "What Is Antitrust Litigation Law?"
Dissolving Your Business: Essential Legal Steps to Protect Your Interests post image

Dissolving Your Business: Essential Legal Steps to Protect Your Interests

If you’re considering closing your business, it’s crucial to understand that simply shutting your doors does not end your legal obligations. Unless you formally dissolve your business, it continues to exist in the eyes of the law—leaving you exposed to ongoing liabilities such as taxes, compliance violations, and potential lawsuits. Dissolving a business can seem […]

Author: Christopher D. Warren

Link to post with title - "Dissolving Your Business: Essential Legal Steps to Protect Your Interests"
The Role of Corporate Restructuring in Mergers & Acquisitions post image

The Role of Corporate Restructuring in Mergers & Acquisitions

Contrary to what many people think, corporate restructuring isn’t all doom and gloom. Revamping a company’s organizational structure, corporate hierarchy, or operations procedures can help keep your business competitive. This is particularly true during challenging times. Corporate restructuring plays a critical role in modern business strategy. It helps companies adapt quickly to market changes. Following […]

Author: Dan Brecher

Link to post with title - "The Role of Corporate Restructuring in Mergers & Acquisitions"

No Aspect of the advertisement has been approved by the Supreme Court. Results may vary depending on your particular facts and legal circumstances.

Sign up to get the latest from our attorneys!

Explore What Matters Most to You.

Consider subscribing to our Firm Insights mailing list by clicking the button below so you can keep up to date with the firm`s latest articles covering various legal topics.

Stay informed and inspired with the latest updates, insights, and events from Scarinci Hollenbeck. Our resource library provides valuable content across a range of categories to keep you connected and ahead of the curve.

Let`s get in touch!

* The use of the Internet or this form for communication with the firm or any individual member of the firm does not establish an attorney-client relationship. Confidential or time-sensitive information should not be sent through this form.

Sign up to get the latest from the Scarinci Hollenbeck, LLC attorneys!