Scarinci Hollenbeck, LLC
The Firm
201-896-4100 info@sh-law.comFirm Insights
Author: Scarinci Hollenbeck, LLC
Date: September 10, 2020
The Firm
201-896-4100 info@sh-law.comHackers continue to target teleworking employees, trying to capitalize on cyber weaknesses that may arise from companies having a large and relatively untested remote workforce. According to the Federal Bureau of Investigation (FBI) and U.S. Cybersecurity and Infrastructure Security Agency (CISA), the latest COVID-19-related cyber threat comes from voice phishing or “vishing” attacks.
According to the FBI/CISA Alert, hackers, who have been perpetrating the schemes since July, have registered domains and created phishing pages duplicating a company’s internal VPN login page, also capturing two-factor authentication (2FA) or one-time passwords (OTP). They have also obtained certificates for the domains they registered and used a variety of domain naming schemes, including Secure Sockets Layer (SSL).
To help carry out the attacks, cybercriminals have then compiled dossiers on the employees at the specific companies using mass scraping of public profiles on social media platforms, recruiter and marketing tools, publicly available background check services, and open-source research. The information collected about the employees includes: name, home address, personal cell/phone number, position at company, and duration at company.
According to the FBI, the first iteration of the cyber scheme involved using Voice Over Internet Protocol (VoIP) numbers to call employees on their personal cellphones. Cybercriminal then started incorporating spoofed numbers of other offices and employees in the victim company. The actors used social engineering techniques and, in some cases, posed as members of the victim company’s IT help desk, using their knowledge of the employee’s personally identifiable information—including name, position, duration at company, and home address—to gain the trust of the targeted employee. The targeted employee is then told that a new VPN link would be sent and required their login, including any 2FA or OTP. The cybercriminals then logged the information provided by the employee and used it in real-time to gain access to corporate tools using the employee’s account.
The FBI identifies several steps that businesses can take to avoid falling victim to a vishing attack. They include:
Employees can also play a significant role in thwarting vishing attacks. The FBI recommends that employees:
As we have discussed in prior articles, employees are often a company’s largest cyber risk. With an increasing number of employees now working from home, the threat is even greater. We encourage businesses to thoroughly review their policies and procedures to determine what changes may be needed to strengthen your defenses in light of the influx of cyberattacks targeting remote workers.
If you have any questions or if you would like to discuss the matter further, please contact me, Maryam Meseha, or the Scarinci Hollenbeck attorney with whom you work, at 201-896-4100.
No Aspect of the advertisement has been approved by the Supreme Court. Results may vary depending on your particular facts and legal circumstances.
Cryptocurrency intimidates most people. The reason is straightforward. People fear what they do not understand. When confusion sets in, the common reaction is either to ignore the subject entirely or to mistrust it. For years, that is exactly how most of the public and even many in law enforcement treated cryptocurrency. However, such apprehension changed […]
Author: Bryce S. Robins
Using chattel paper to obtain a security interest in personal property is a powerful tool. It can ensure lenders have a legal claim on collateral ranging from inventory to intellectual property. To reduce risk and protect your legal rights, businesses and lenders should understand the legal framework. This framework governs the creation, sale, and enforcement […]
Author: Dan Brecher
For years, digital assets operated in a legal gray area, a frontier where innovation outpaced the reach of regulators and law enforcement. In this early “Wild West” phase of finance, crypto startups thrived under minimal oversight. That era, however, is coming to an end. The importance of crypto compliance has become paramount as cryptocurrency has […]
Author: Bryce S. Robins
Earlier this month, the U.S. Supreme Court issued a decision in Ames v. Ohio Department of Youth Services vitiating the so-called “background circumstances” test required by half of federal circuit courts.1 The background circumstances test required majority group plaintiffs pleading discrimination under Title VII of the Civil Rights Act to meet a heightened pleading standard […]
Author: Matthew F. Mimnaugh
Special purpose acquisition companies (better known as SPACs) appear to be making a comeback. SPAC offerings for 2025 have already nearly surpassed last year’s totals, with additional transactions in the pipeline. SPACs last experienced a boom between 2020–2021, with approximately 600 U.S. companies raising a record $163 billion in 2021. Notable companies that went public […]
Author: Dan Brecher
Merging two companies is a complex legal and business transaction. A short form merger, in which an acquiring company merges with a subsidiary corporation, offers a more streamlined process that involves important corporate governance considerations. A short form merger, in which an acquiring company merges with a subsidiary corporation, offers a more streamlined process. However, […]
Author: Dan Brecher
No Aspect of the advertisement has been approved by the Supreme Court. Results may vary depending on your particular facts and legal circumstances.
Consider subscribing to our Firm Insights mailing list by clicking the button below so you can keep up to date with the firm`s latest articles covering various legal topics.
Stay informed and inspired with the latest updates, insights, and events from Scarinci Hollenbeck. Our resource library provides valuable content across a range of categories to keep you connected and ahead of the curve.
Let`s get in touch!
Sign up to get the latest from the Scarinci Hollenbeck, LLC attorneys!