What We Do
How we do it
Resources
SECURITY ADVISORIES
May 11, 2022
CVE-2022-26923 - Active Directory Domain Services Elevation of Privilege Vulnerability
THE THREAT Microsoft has disclosed a new vulnerability impacting Active Directory Certificate Services (ADCS) tracked as CVE-2022-26923 (Active Directory Domain Services Elevation of Privilege Vulnerability). If exploited successfully, an authenticated attacker can escalate privileges in environments where ADCS is running on the domain. eSentire is aware of technical details and tooling [2] for…
Read More
View all Advisories →
Company
ABOUT ESENTIRE
About Us
eSentire is The Authority in Managed Detection and Response Services, protecting the critical data and applications of 1200+ organizations in 75+ countries from known and unknown cyber threats. Founded in 2001, the company’s mission is to hunt, investigate and stop cyber threats before they become business disrupting events.
Read about how we got here
Leadership Work at eSentire
LATEST PRESS RELEASE
May 17, 2022
Cybersecurity Leader eSentire Continues Its Commitment to Rigorous Security Standards Earning PCI DSS Certification
Waterloo, ON, May 17, 2022 — eSentire, the Authority in Managed Detection and Response (MDR), maintains one of the most secure and robust IT environments of any MDR provider in the industry. To that end, eSentire today announced that it has received the Payment Card Industry Data Security Standard (PCI DSS) certification, considered one of the most stringent and comprehensive payment card…
Read More
Partners
PARTNER PROGRAM
e3 Ecosystem
We provide sophisticated cybersecurity solutions for Managed Security Service Providers (MSSPs), Managed Service Providers (MSPs), and Value-Added Resellers (VARs). Find out why you should partner with eSentire, the Authority in Managed Detection and Response, today.
Learn more
ECOSYSTEM PARTNER RESOURCES
Apply to become an e3 ecosystem partner with eSentire, the Authority in Managed Detection and Response.
Login to the Partner Portal for resources and content for current partners.
Search
Resources
Security advisories — Feb 26, 2019

Followup: Social Engineering Warning

Speak With A Security Expert Now

On June 15, 2015, we sent an advisory regarding targeted social engineering/phishing attacks of elevated sophistication attempting to engineer fraudulent wire transfers across our clients. Since then, media reports have created better visibility into these types of attacks. On August 27, 2015 Brian Krebs (of krebsonsecurity.com) posted a summary of an FBI news release: (http://krebsonsecurity.com/2015/08/fbi-1-2b-lost-to-business-email-scams/).

Despite additional visibility and media coverage, these attacks continue to find success.

Over the past two months, we have analyzed over a dozen of these recent attack attempts within our client base, and have additional details to share:

  1. The vast majority of these attacks are initiated on Thursdays and Fridays. It is our belief that the proximity to the weekend and employee’s focus therein may be factors in play here.
  2. Vistaprint/Tucows seem to be among the most favoured domain reseller and registrar pair for these false domains.
  3. Note that while the vast majority of inbound wire transfer attempts are direct requests for money, there have been examples of fraudulent wire transfers for goods easily fungible. These include SIP trunk (Voice Over IP) services to be resold.
  4. While false domains for email are always created and used, on occasion the attacker will duplicate the website as well.
  5. When false domains are created, while they often will use similar misspellings (e.g. “n” where “m” is usually used), they are also using correct spelling of rebranded names. For example, if your firm’s name is XYZ Capital Partners with a domain name of xyzcapitalpartners.com, false domains created might be registered as either XYZ Capital Management (xyzcapitalmgmt.com) or XYZ Capital Group (xyzcapitalgroup.com).

As these types of attack rely upon tricking people with email content and contains no technical exploits, there are very few technical remedies. However, we recommend the following additional options:

  1. Identify all staff with the capability to set up and/or confirm wire transfers and regularly train them to watch for these attacks.
  2. Heightened awareness is needed especially if the requests arrive on days immediately preceding a weekend or a holiday.

All should watch the three most common Neuro-Linguistic Programming (NLP) techniques attackers use to gain information:

For example, a false request might look as though the CEO of the company has sent an urgent request to have money transferred, however they are in a board meeting and request that they are not disturbed. Existence of any two of these three NLP characteristics may indicate a potential fraud situation and should require further critical analysis.

We also recommend the following out-of-band verification methods:

  1. Whenever an executive requests a wire transfer, a confirmation call initiated by the recipient must be made before the wire is initiated. An inbound phone call from the executive is not sufficient (as inbound phone numbers can be spoofed).
  2. For each of the most-targeted individuals in the firm (including all of the senior executive, finance and accounting teams) a unique and discreet confirmation phrase should be used when a legitimate (though uncommon) wire transfer is needed. This uncommon catchphrase can be used to provide a level of non-repudiation during the request. This could include something along the lines of “Go Yankees!” within the body of the request. This may be most effective if the targeted individuals infrequently effect wire transfers.
View Most Recent Blogs