Hackers continue to target teleworking employees, trying to capitalize on cyber weaknesses that may arise from companies having a large and relatively untested remote workforce.  According to the Federal Bureau of Investigation (FBI) and U.S. Cybersecurity and Infrastructure Security Agency (CISA), the latest COVID-19-related cyber threat comes from voice phishing or “vishing” attacks. 

How Vishing Attacks Work

According to the FBI/CISA Alert, hackers, who have been perpetrating the schemes since July, have registered domains and created phishing pages duplicating a company's internal VPN login page, also capturing two-factor authentication (2FA) or one-time passwords (OTP). They have also obtained certificates for the domains they registered and used a variety of domain naming schemes, including Secure Sockets Layer (SSL).

To help carry out the attacks, cybercriminals have then compiled dossiers on the employees at the specific companies using mass scraping of public profiles on social media platforms, recruiter and marketing tools, publicly available background check services, and open-source research.  The information collected about the employees includes: name, home address, personal cell/phone number, position at company, and duration at company.

According to the FBI, the first iteration of the cyber scheme involved using Voice Over Internet Protocol (VoIP) numbers to call employees on their personal cellphones. Cybercriminal then started incorporating spoofed numbers of other offices and employees in the victim company. The actors used social engineering techniques and, in some cases, posed as members of the victim company’s IT help desk, using their knowledge of the employee's personally identifiable information—including name, position, duration at company, and home address—to gain the trust of the targeted employee. The targeted employee is then told that a new VPN link would be sent and required their login, including any 2FA or OTP. The cybercriminals then logged the information provided by the employee and used it in real-time to gain access to corporate tools using the employee’s account.

How to Protect Your Company from Vishing Attacks

The FBI identifies several steps that businesses can take to avoid falling victim to a vishing attack. They include:

  • Restricting VPN connections to managed devices only, using mechanisms like hardware checks or installed certificates, so user input alone is not enough to access the corporate VPN.
  • Limiting VPN access hours to mitigate access outside of allowed times.
  • Employing domain monitoring to track the creation of, or changes to, corporate, brand-name domains.
  • Actively scanning and monitoring web applications for unauthorized access, modification, and anomalous activities.
  • Using the principle of least privilege and implementing software restriction policies or other controls; monitoring authorized user accesses and usage.
  • Considering using a formalized authentication process for employee-to-employee communications made over the public telephone network where a second factor is used to authenticate the phone call before sensitive information can be discussed.

Employees can also play a significant role in thwarting vishing attacks. The FBI recommends that employees:

  • Verify web links do not have misspellings or contain the wrong domain.
  • Bookmark the correct corporate VPN URL and do not visit alternative URLs on the sole basis of an inbound phone call.
  • Be suspicious of unsolicited phone calls, visits, or email messages from unknown individuals claiming to be from a legitimate organization. Do not provide personal information or information about your organization, including its structure or networks, unless you are certain of a person's authority to have the information. If possible, try to verify the caller’s identity directly with the company.
  • If you receive a vishing call, document the phone number of the caller as well as the domain that the actor tried to send you to and relay this information to law enforcement.
  • Limit the amount of personal information you post on social networking sites. “The internet is a public resource; only post information you are comfortable with anyone seeing,” the FBI warns.
  • Regularly evaluate your settings, as sites may change their options periodically.

As we have discussed in prior articles, employees are often a company’s largest cyber risk. With an increasing number of employees now working from home, the threat is even greater. We encourage businesses to thoroughly review their policies and procedures to determine what changes may be needed to strengthen your defenses in light of the influx of cyberattacks targeting remote workers.

If you have questions, please contact us

If you have any questions or if you would like to discuss the matter further, please contact me, Maryam Meseha, or the Scarinci Hollenbeck attorney with whom you work, at 201-896-4100.