# data[].attributes.attachment_link.readable_text
A recent compromise of a system at DocuSign, the electronic document signing vendor, led to a phishing campaign that's hitting some of the company's customers right now.

Officials at DocuSign said they had noticed an increase in phishing emails to some customers and users in recent days and began investigating whether the company's eSignature service had been compromised. The investigation turned up no evidence of a breach of that service, but the company did find that a separate system had been compromised and that attackers had accessed a list of customer email addresses, leading to the current phishing campaigns.

The attackers hit a "non-core system that allows us to communicate service-related announcements to users via email", the company said in a blog post on the incident.

"A complete forensic analysis has confirmed that only email addresses were accessed; no names, physical addresses, passwords, social security numbers, credit card data or other information was accessed. No content or any customer documents sent through DocuSign's eSignature system was accessed; and DocuSign's core eSignature service, envelopes and customer documents and data remain secure," the post says.

The phishing campaign uses emails that mimic the format of legitimate DocuSign eSignature messages. Some of the subject lines of the phishing emails include: "Completed: [domain name] - Wire transfer for recipient-name Document Ready for Signature" and "Completed [domain name/email address] - Accounting Invoice [Number] Document Ready for Signature".

The phishing emails include a malicious Word attachment that will install malware on a victim's machine when it's opened. The attackers are specifically targeting DocuSign customers, who may be used to getting the confirmation emails or other messages from the company. But the phishing messages will look slightly different and likely come from a sender that's not familiar to the victim.

"They may appear suspicious because you don't recognize the sender, weren't expecting a document to sign, contain misspellings (like "docusgn.com" without an 'i' or @docus.com), contain an attachment, or direct you to a link that starts with anything other than https://www.docusign.com or https://www.docusign.net," the company said in its post.

Customers use DocuSign's service to electronically sign a variety of documents, including sensitive ones such as HR-related documents that contain personally identifiable information, and financial documents.

# data[].attributes.attachment_link.title
DocuSign Says Breach Led to Phishing Campaign | Pindrop

# data[].attributes.attachment_link.description
A recent compromise of a system at DocuSign, the electronic document signing vendor, led to a phishing campaign that's hitting some of the company's customers right now. Officials at DocuSign said they had noticed an increase in phishing emails to some customers and users in recent days and began investigating whether the company's eSignature service...

# data[].attributes.attachment_link.title
Associated Press' Twitter account hacked

# data[].attributes.attachment_link.title
Twitter: High-profile hacks were part of a 'coordinated social engineering attack'

# data[].attributes.attachment_link.readable_text
An Excel spreadsheet attached to the e-mail contained a zero-day exploit that led to the installation of a backdoor virus, exploiting an Adobe Flash vulnerability, which Adobe has since patched, writes Uri Rivner, head of new technologies, identity protection and verification at RSA, in a blog posted Friday.

RSA unveiled on March 17 that an attacker targeted its SecurID two-factor authentication product in what it termed an advanced persistent threat breach (see RSA Says Hackers Take Aim At Its SecurID Products). An refers to sophisticated and clandestine means to gain continual, persistent intelligence on a group such as a nation or corporation. Rivner's blog is the first substantial public comment on the breach since Coviello's statement.

RSA on Monday also announced it is acquiring Netwitness, the network security company that provides real-time network forensics and automated threat analysis solutions. In a statement, Netwitness founder and CEO Amit Yoran alluded to the breach: "Recent events reinforce the passion and commitment we have shared for years - to help you combat zero-day attacks, targeted and advanced threats, and other sophisticated security problems."

Netwitness technology and personnel helped identify the APT attack as it progressed, enabling RSA to launch an aggressive defense, an individual close to RSA says. But the breach had nothing to do with the acquisition; negotiations between RSA and Netwitness began before March 17.

According to Rivner, the exploit injected malicious code into the employee's PC, allowing full access into the machine. The attacker installed a customized variant of a remote administration tool known as Poison Ivy, which has been used in APT attacks against other companies. Such tools set up a reverse-connect model, which Rivner explains pulls commands from the central command and control servers, then execute the commands, rather than getting commands remotely, making them harder to detect.

Rivner's analysis of the breach determined the attacker had sent two different phishing e-mails over a two-day period to two small groups of RSA employees. "You wouldn't consider these users particularly high profile or high value targets," he says. Once inside, the attacker sought out employees with great access to sensitive information. "When it comes to APTs, it is not about how good you are once inside, but that you use a totally new approach for entering the organization," Rivner says. "You don't bother to just simply hack the organization and its infrastructure; you focus much more of your attention on hacking the employees."

The RSA official says the attacker initially harvested access credentials from the compromised employee and performed privilege escalation on non-administrative users in the targeted systems, and then moved on to gain access to key high value targets, which included process experts and IT and non-IT specific server administrators.

"If the attacker thinks they can exist in the environment without being detected, they may continue in a stealth mode for a long while," Rivner says. "If they think they run the risk of being detected, however, they move much faster and complete the third, and most 'noisy' stage of the attack. Since RSA detected this attack in progress, it is likely the attacker had to move very quickly to accomplish anything in this phase."

Rivner says the goal of the attacker is to extract information. In this assault, he says, the attacker gained access to staging servers at key aggregation points to prepare for extraction. Next, the attacker accessed servers of interest, moving data to internal staging servers to be aggregated, compressed and encrypted for extraction. Then, the attacker used file transfer protocol to transfer many password protected RAR files from the RSA file server to an outside staging server at an external, compromised machine at a hosting provider. The files were subsequently pulled by the attacker and removed from the external compromised host to remove any traces of the attack.

"While RSA made it clear that certain information was extracted, it's interesting to note that the attack was detected by its Computer Incident Response Team in progress," Rivner says. "I've been talking to many CISOs in corporations that were hit by similar APTs and a lot of companies either detected the attacks after months, or didn't detect them at all and learned about it from the government. This is not a trivial point: by detecting what is happening early on, RSA was able to respond quickly and engage in immediate countermeasures."

Rivner characterized APT as a new attack doctrine built to evade existing perimeter and endpoint defenses, and analogized an APT attack to stealth jet fighters that circumvent radar.

"For decades, you've based your air defense on radar technology, but now you have those sneaky stealth fighters built with odd angles and strange composite materials," he says. "You can try building bigger and better radars or ... you can try staring more closely at your existing radars in hope of catching some faint signs of something flying by, but this isn't going to turn the tide on stealthy attackers. Instead you have to think of a new defense doctrine. Building a new defense doctrine takes time, but over the course of history many campaigns that required building a new defense doctrine were eventually won."

Rivner cites the financial industry's seven-year campaign to battle phishing attacks, and alludes to a British payment council announcement that online banking fraud declined 27 percent despite a 21 percent increase in phishing attacks last year. "We've learned a thing or two that can help us build a new defense doctrine against APTs much faster," he says. "Already we're learning fast, and every organization hit by an APT is much more prepared against the next one; I'm confident it will take us far less than seven years to say we've turned the tide on APTs.

* * *

# data[].attributes.attachment_link.title
'Tricked' RSA Worker Opened Backdoor to APT Attack

# data[].attributes.attachment_link.description
An Excel spreadsheet attached to the e-mail contained a zero-day exploit that led to the installation of a backdoor virus, exploiting an Adobe Flash vulnerability, which Adobe has since patched, writes Uri Rivner, head of new technologies, identity protection and verification at RSA, in a blog posted Friday.

# data[].attributes.attachment_link.readable_text
Here are some tips on how to detect and avoid COVID-19 relief scams according to the Charlotte Center for Legal Advocacy.

CHARLOTTE, N.C. - Thanks to the COVID-19 relief package that passed in December 2020, hundreds of millions of dollars will go to replenishing local programs designed to help Carolinians make ends meet.

There are dozens of programs in the Charlotte area that are offering financial assistance, but it's not always easy to distinguish what's legitimate from what's a scam.

"You have a lot of programs now that offer relief to people and scammers, know that," Karen Moskowitz, consumer attorney for Charlotte Center for Legal Advocacy, said.

She said they've tracked countless pandemic related scams, and there's been a surge since the latest COVID-19 relief package passed.

"People are desperate; people have lost their jobs," Moskowitz said. "They can't pay the rent, can't pay utilities. And so when they get a call, it seems like a lifeline. They are desperate, and they're ready to try to get help."

The latest federal COVID-19 relief package allocated $700 million to North Carolina, and that money is being dispersed to dozens of legitimate local programs.

"You can go on our website, the Center for Legal Advocacy, [and] we have a list of some of those programs," Moskowitz said.

There have also been reports of fake groups popping up, claiming they can help pay your bills.

"What the scammers are usually trying to get is access to some personal identifying information," Moskowitz explained. "They can apply for credit in your name, they can apply for loans in your name."

Moskowitz said they've also seen fraudulent financial assistance applications making the rounds online.

"People shouldn't sign anything," she said.

But she said most of the scams they're tracking started as a cold call.

"You're not going to get a cold call from any of these government agencies," Moskowitz said.

Most legitimate assistance programs won't make random calls, either.

"If you get a cold call, and you're not sure about it, just get their contact information, hang up, and then you can google who you really need to contact," she said.

If you do think you've fallen for a scam, Moskowitz suggested putting an alert on your credit and then reporting it to the state.

"Contact the NC Attorney General's Office," Moskowitz outlined. "There is a consumer protection division. They can contact the North Carolina Secretary of State for charitable organizations, or they can call us. We're happy to talk to people if they think something is scammy."

If you come across something you think may be a scam, you can also email us money@wcnc.com.
Have a relative or friend in another state and want to know when they can get vaccinated? Visit NBC News' Plan Your Vaccine site to find out about each state's vaccine rollout plan.

Here are some tips on avoiding scammers from the Charlotte Center for Legal Advocacy:

Be aware of COVID-19 vaccine scams. Everyone who wants a vaccine can have one and the vaccine will be free for most people. Learn more about COVID-19 vaccine scams here.

Don't answer or hang up on Robo-calls. Scammers are using robo-calls to pitch fake products, work-from-home schemes and insurance scams. Try to avoid answering the call at all - if it is someone you know they will leave you a voicemail.

Avoid false utility company representatives: Scammers are calling to dupe people out of their cash and personal information by convincing them their utilities will be shut off if they don't pay. If you get a call from someone claiming to be your utility company, firmly tell them you will contact the utility company directly using the number on your bill or on the company's website. Even if the caller insists you have a past due bill or your services will be shut off, never give banking information over the phone unless you place the call to a number you know is legitimate. Utility companies neither demand banking information by email or phone nor demand payment by gift cards (like iTunes or Amazon), cash reload cards (like MoneyPak, Vanilla, or Reloadit), or cryptocurrency (like Bitcoin), these are scams.

Avoid foreclosure rescue and "we buy homes" scams. Scammers search public records for homeowners in danger of property tax, mortgage, and HOA foreclosure. Never sign paperwork on the spot. Scammers often try to trick homeowners into signing away ownership by signing a deed or other legal documents without disclosing the true nature of the transaction.

Be on the alert for Debt-Relief Scams. Avoid companies or out-of-state lawyers that offer to help. Under North Carolina law, it is illegal to collect upfront fees for debt settlement services. Often these companies do nothing but put you further in debt and damage your credit.

Don't pay someone in advance to help you access benefits. The government will not ask you to pay anything up front to get the stimulus money. No fees. No charges. No nothing. See our April 19 post about stimulus payments.

Avoid Social Security scams. The government will not call to ask for your Social Security number, bank account, or credit card number. Anyone who does is a scammer. Don't "verify" your number or be scared into thinking your benefits are about to be suspended.

Watch out for phishing emails and texts about the coronavirus that appear to be from health officials, experts, or anyone else. Don't open messages, click on links, or download attachments from senders you don't recognize.

Be cautious of offers to help get groceries, do errands - there are a number of good Samaritans, but unfortunately there have also been reports of scams, money given, nothing delivered.

Beware of "person in need" and grandparent scams. Scammers pose as a grandchild, friend or relative stranded or otherwise in trouble and need money quickly and quietly. They may ask for money by mail or gift card. Don't be pressured, hang up and call another relative or friend if you are still concerned to help you investigate.

Be careful before you donate to a COVID-related charity. Check legitimacy through the North Carolina Secretary of State, Charity Watch, or Charity Navigator.

Be cautious of any unsolicited door-to-door sales pitch or offers. Don't sign or agree to anything on the spot - if an offer seems too good to be true it probably is.

# data[].attributes.attachment_link.title
'It seems like a lifeline, but it's not' | COVID-19 relief scams targeting Carolinians who are looking for help

# data[].attributes.attachment_link.description
Here are some tips on how to detect and avoid COVID-19 relief scams according to the Charlotte Center for Legal Advocacy. CHARLOTTE, N.C. - Thanks to the COVID-19 relief package that passed in December 2020, hundreds of millions of dollars will go to replenishing local programs designed to help Carolinians make ends meet.

# data[].attributes.headline
What can we do to help prevent attackers from leveraging social engineering for their own benefit?

# data[].attributes.subject
What can we do to help prevent attackers from leveraging social engineering for their own benefit?

# data[].attributes.headline
How do cyber attackers leverage social engineering to go after a target?

# data[].attributes.subject
How do cyber attackers leverage social engineering to go after a target?

# data[].attributes.headline
What are some of the most common ways social engineering affects cybersecurity?

# data[].attributes.subject
What are some of the most common ways social engineering affects cybersecurity?

# data[].attributes.headline
What is Social engineering and how does the social engineering piece intertwine with the technical aspect of cyber attacks?

# data[].attributes.subject
What is Social engineering and how does the social engineering piece intertwine with the technical aspect of cyber attacks?