#MXDR #XDR #FightAgainstCybercrime

Imagine that you are the head of the information security team and you want to build a multi-layered defense system against cyberattacks at all levels. You are starting to set up your arsenal, including antivirus software, antispam system, NGFW, IDS/IPS, sandbox… when suddenly you are faced with three belated observations:

📌 Solutions from different vendors conflict with each other, but they must somehow be made to work together cohesively.

📌 You install a SIEM system, which collects reports on the solutions across the entire corporate infrastructure in one place, but it does not help detect modern attacks, no matter what correlation rules are written for this purpose.

📌 You decide to install an EDR solution, which collects telemetry data from hosts and provide greater correlation and threat hunting capabilities. Yet, many cyber threats continue to fly under the radar.

What can you do? Deploy Group-IB Managed XDR!

#MXDR #XDR #FightAgainstCybercrime

The "elite niche" in the cybersecurity market is now occupied by XDR (Extended Detection and Response) systems. This is a new category of solutions designed for the advanced detection, response and prevention of threats. Managed XDR helps analyze adversary activity, learn how to hunt for threats, and combat cybercrime — a mission worthy of a superhero.

Managed XDR will help you to:

▪️ Collect, correlate, and analyze data across various sources, giving security experts a powerful tool that continuously monitors all events that occur within the network and on each device, as well as external events that can pose a threat;

▪️ Make incident response much faster, which minimizes damages and quickly stops adversaries;

▪️ Detect the widest possible range of threats, from phishing to sophisticated targeted attacks, in a fully automated manner;

▪️ Provide 360-degree ​​visibility and manageability across all security solutions in order to get the most out of each of them;

▪️ Conduct in-depth investigations into incidents from patient zero (the first infected device on the network) to any further attack propagation, which helps control all potential infection vectors in the infrastructure.

#MXDR #XDR #FightAgainstCybercrime

Want to learn more?

We have prepared this blog post to share with you — on behalf of Group-IB developers — what lies "under the hood" of Group-IB Managed XDR system, what technology it uses, and what approach our cutting-edge solution applies. Let's go!

Want to see Managed XDR in action?

Simply request a demo by completing this form👈

What if I still don’t understand, but want to?

If you struggle to understand cybersecurity terms and Group-IB’s solutions but you really want to, we are always happy to help. Check out our educational courses: click on the link!

#phishing #CERT

📦 Group-IB has identified a widescale phishing campaign targeting users in the Middle East by impersonating well-known postal services.

Since as early as 2020, the Group-IB Computer Emergency Response Team (CERT-GIB) analysts have detected over 270 domains making use of the regional delivery and postal service brands. All the domains were part of a single massive phishing infrastructure. Scammers have impersonated over 13 different delivery brands, postal operators, and public companies from at least eight different countries, including Bahrain, Egypt, Israel, Jordan, Kuwait, Qatar, Saudi Arabia, and the United Arab Emirates.

In line with its mission of fighting cybercrime, upon discovery, CERT-GIB has sent notifications to relevant regional Computer Emergency Response Teams so they could take actions when new resources appear.

#FightAgainstCybercrime

The aim of this research is to raise awareness about the fake investment scheme and ultimately reduce the number of victims. We encourage cybersecurity researchers and the general public to join the fight against cybercrime and share fraudulent domains with us via "Report an Incident" form at https://www.group-ib.com for further evaluation and takedown.

If you are at the beginning of your journey in cybersecurity and want to become a specialist, check out our educational programs. All our courses and workshops are practice-oriented and include real cases and lab sessions. More details👈

#Classiscam

Group-IB has uncovered that Classiscam — a sophisticated scam-as-a-service operation — has expanded to Singapore in March 2022. Classiscam fraudsters target users of one of the leading classified platforms in Singapore. Scammers posing as legitimate buyers approach sellers with the request to purchase goods from their listings and the ultimate aim of stealing payment data.

Using its extensive scam intelligence on the Classiscam operation and its patented Graph Network Analysis tool, the Group-IB Digital Risk Protection team revealed that the scammers designed a phishing tool that generates fake websites that mimic the official platform of a local classified website used for selling and buying goods. These fake links are generated using web panels or Telegram bots.

In line with its mission of fighting against cybercrime, Group-IB immediately shared its findings about Classiscam with the members of the Singapore Police Force’s Alliance of Public-Private Cybercrime Stakeholders (APPACT) and the local classified website in question.

Learn more about the scheme 👈

#Classiscam

Using its patented Graph Network Analysis tool, Group-IB experts were able to reveal the group of interconnected websites operated by this group of Classiscammers. The whole group’s network included more than 200 domains, 18 of which were created to deceive the users of a Singaporean classified website, including 2 active as of July 19th, 2022.

Other websites in the network impersonate Singaporean moving companies, European, Asian, and Middle Eastern classified websites, banks, marketplaces, food and crypto brands, and delivery companies, which proves Classiscam’s global operations.

❗️Users should always check the domain of the URL to verify if it’s the official website before sharing any personal and payment details. Another recommendation is when communicating with the other party for sale of goods or services, to engage with online chat designed by official websites. Finally, like with conventional scams, do not trust too-good-to-be-true offers.

More details👈

A sophisticated scam-as-a-service scheme known as "Classiscam" is now targeting Singapore.

Read details: https://t.co/OIhdnnMgTh

#MaliBot #trojan

👑 Flubot is dead, and the new evil is detected and crowned, the first of his name – MaliBot. MaliBot malware, usually disguised as a cryptocurrency mining application, targets Android devices and uses overlay attacks to outfox MFA/2FA, capture messages and SMS, and steal banking and crypto credentials.

MaliBot operators harness a variety of distribution campaigns: they promote cryptocurrency applications in the form of APKs that victims are supposed to download and install manually; they clone real projects like TheCryptoApp (1M+ downloads on Google Play Store); operators also use smishing (SMS phishing) and other methods to multiply their chances to succeed.

There are at least two major countermeasures to leverage against such fraud attacks. Check out our new blog post to learn more👈

And also take a look at this live demonstration of how Group-IB Fraud Protection stops MaliBot or other similar threats.