“The email campaign uses a spoofed email address to appear like a National Cyber Awareness System (NCAS) alert and lure targeted recipients into downloading malware through a malicious attachment,” the CISA statement says. CISA, whose parent agency is DHS, also notes that it never sends NCAS notifications containing email attachments.
To protect against this and other social engineering attacks, CISA is advising users and administrators to beware of unsolicited emails, even when the sender appears to be known, and exercise caution with links and attachments. Email recipients are also advised to verify the sender’s web address and search the internet for the main website of the organization referenced in the email.
“We live in an interconnected digital economy, one where businesses are increasingly vulnerable to online attacks that target users, the traditional ‘weak link’ in cybersecurity. The rise of convincing phishing campaigns like those purporting to be from the DHS brings the problem into sharp focus,” said Sherban Naum, SVP of corporate strategy and technology for Bromium, in emailed comments.
Naum recommends that organizations defend themselves by adopting a defense in depth security strategy, because “We can’t continue to put the onus of security on users and expect them to spot these threats…” One of the critical parts of defense-in-depth is new-school security awareness training.
SCMagazine has the story:
** Optrics Inc. is an Authorized KnowBe4 partner
Find out how affordable new-school security awareness training is for your organization. Get a quote now.
The original article can be found here: