Chinese Hacking Secrets Revealed

September 25, 2015

The secret behind Chinese hacking has been revealed by ThreatConnect. CNN Money reports:

The hackers’ techniques don’t sound very sophisticated: They send innocent-looking emails to unsuspecting recipients, whose computers then get infected with malware that trawls for sensitive information.

This graphic from ThreatConnect shows the key role played by spearphishing.


Source: ThreatConnect

This simple technique is devastatingly effective because it is easy to create an email that deceives users into taking the actions desired by the attackers. In its September 24, 2015 first page story, “Sleuths Link Hacker to China’s Military,” the Wall Street Journal describes how a spearphishing email works. The Wall Street Journalwrites,

The email attachment would tempt anyone following the diplomatic standoff between China and other countries in the South China Sea.

How can you help your users fight being deceived? Use SP Guard from Iconix. SP Guard lets IT quickly and easily tell users which senders are trusted.

Iconix Issued Seventh U.S. Patent For Email

September 24, 2015

ICONIX, Inc., the industry leader in visual email solutions, announced on September 15, 2015, that the United States Patent and Trademark Office has issued Iconix’s seventh patent titled “User interface for email inbox to call attention differently to different classes of email.” The abstract for U.S. Patent 9,137,048, dated September 15, 2015, states: “Sender emails have their Truemarks (icons) displayed in the sender column of a list view” and “fraudulent emails have a fraud icon displayed with a warning in the sender column.”


Learn more at our new blog.

NSA Director Warns — Don’t Underestimate Impact of Users on Security

September 11, 2015

On September 8, 2015, Admiral Mike Rogers, NSA Director and Commanding Office of US Cybercommand, conducted a briefing at the Wilson Center. During that briefing he was asked about the recent breach of the Joint Staff by a spearphishing attack.


Admiral Mike Rogers

He said, “[Y]you can have the greatest technology and greatest defensive structure in the world, but in the end, you can never underestimate the impact of user behavior.”

Learn more at our new blog.

Sun Tzu Explains Cyberwar 2,500 Years Ago

September 8, 2015

The US Government does a very good job of technically securing its systems.  There is rarely a report of attackers compromising US Government computers through technical exploits.  So, how do they do it?

A recent report in The Hill describes how Chinese and Russian cyberwarriors are using the same tactics to cyberattack the United States Government. What are these common tactics?  Spearphishing emails.  Why would two adversaries adopt identical tactics?


About 2,500 years ago Sun Tzu, the Chinese general, strategist and tactician, wrote what is considered by many to be the definitive work on military strategy and tactics — the Art of War.

Learn more at our new blog.

Phishers Steal $100 Million

August 12, 2015

Federal authorities have shut down a ring of hackers who used techniques such as phishing to infiltrate newswire services to gain access to corporate press releases.

Sec Johnson

Homeland Security Secretary Jeh Johnson briefs the press, flanked by U.S. Attorney Paul Fishman and SEC Chair Mary Jo White.

The indictment alleges how the hackers users used phishing to infiltrate the newswire services and how they used anti-forensics to evade detection for five years. Using these press releases, the criminals were able to make money by quickly placing trades before the public had access to the information.  Learn more at our new blog.

Pentagon Spearphished

August 7, 2015

The Pentagon has been infiltrated by a spearphishing attack that targeted the Joint Chiefs.


CNN is reporting that the unclassified email system used by 4,000 users on the Defense Department network has been down for more than 10 days following a sophisticated cyber attack that used spearphishing to compromise the system.

Learn more at our new blog.

Spearphishing? Deciding Isn’t Easy

July 29, 2015

Part of the fallout from the Office of Personnel Management (OPM) data breach is the need to provide identify protection services to the millions of compromised government employees. In its efforts to provide these services to compromised federal workers, the OPM contracted with a private company.  That contractor, CSID, sent an email with a link to enroll in identity protection services.

ArmyTimes reports that acting upon warnings from the Army Threat Integration Center, Fort Meade’s Cyber Security Network Defense Team identified a message from CSID as a spearphishing attempt. The Fort Meade Cyber Security Network Defense Team warned Army personnel to “close the message immediately and report it as spam to the Cyber Security Network Defense Team,” according to a warning posted on the Fort Meade Facebook page.

fort meade

The message has lots of spearphishing red flags to trigger a warning, but it was real.

Learn more at our new blog.


Get every new post delivered to your Inbox.