Skip to content

QR-Phishing (Quishing): A New Threat on the Rise

With the rapid advancement of technology, cybercriminals are constantly exploring new methods to deceive unsuspecting individuals. One such emerging threat is QR-phishing, also known as “quishing” or “QR code phishing”. This technique involves the use of phishing emails or messages containing QR codes that, when scanned, lead to malicious websites or scams. In this article, we will delve into what QR-phishing is, the dangers it poses, and how you can protect yourself against this growing threat.

Understanding QR-Phishing or QR Code Scams

QR-phishing leverages fraudulent QR codes as a medium to deceive victims. A QR code is a matrix barcode that can be scanned using a smartphone or mobile device or other scanning devices. It can contain various types of information, such as URLs, text, or contact details. In the context of phishing, cybercriminals embed QR codes within their fraudulent messages or emails, for example by disguising them as harmless links or promotions. 

The Dangers of QR-Phishing

QR-phishing or QR code spoofing presents several dangers to individuals who unknowingly fall victim to the scam:

One of the significant hazards of QR-phishing is the potential for malware infections. Always treat QR codes as links. When you scan QR codes from a phishing email, it can trigger the download of malicious software onto your device. This malware can compromise your sensitive information, grant unauthorized access to your device, or even allow cybercriminals to control it remotely. The consequences can include data breaches, privacy violations, and financial losses.

Another danger is credential theft. QR-phishing attacks often employ deceptive techniques, such as creating fake login pages or forms that closely mimic legitimate websites. Unwitting victims may unwittingly enter their usernames, passwords, or other confidential details into these malicious portals. Cybercriminals can then capture this information and gain unauthorized access to their accounts. This can lead to identity theft, unauthorized transactions, and potential financial ruin.

Financial loss is a significant risk associated with QR-phishing. Scammers frequently redirect victims to a fake website or counterfeit banking or payment portals designed to look like genuine platforms. Unsuspecting individuals may unknowingly input their financial information, which can result in fraudulent transactions, unauthorized access to their accounts, and the exposure of sensitive data like credit card details. This can lead to substantial monetary losses and leave victims vulnerable to further financial exploitation.

Protecting Yourself Against QR-Phishing and QR Codes

Protecting yourself against QR-phishing can be challenging since traditional email protection systems may struggle to identify QR codes as malicious links. However, there are still proactive measures you can take to safeguard your online security:

1. Stay Informed: Educate yourself about QR-phishing and its potential risks. Understand that scanning a QR code can be as dangerous as clicking on a suspicious link. Exercise caution and avoid scanning QR codes from untrusted sources or unfamiliar emails.

2. Verify the Source: Be vigilant when receiving emails or messages containing QR codes. Verify the legitimacy of the sender and the content before taking any action. If you have doubts about the authenticity of the message, contact the organization or individual through verified channels to confirm the request.

3. Use Web Filtering: Employ a robust web filtering solution like SafeDNS to add an extra layer of protection. Web filters can help detect and block access to malicious websites associated with QR-phishing attacks, reducing the risk of unsuspecting users falling victim to such QR code scams.

4. QR Code Scanning Apps: Consider using reputable QR code scanning applications that offer security features. These apps can detect potentially malicious QR codes and provide warnings or block the user from accessing harmful websites.

What to Do If You Scan a Phishing QR Code

Despite your best efforts to stay vigilant, it’s still possible to fall prey to a phishing QR code. If you realize that you have scanned a QR code that leads to a malicious phishing website or suspect that you may have been a victim of QR-phishing, here are the steps you should take:

1. Disconnect from the Network: Immediately disconnect your device from the internet to prevent any further communication with the malicious website or potential malware. Disable Wi-Fi and cellular data connections to ensure that your device is offline.

2. Perform a Security Scan: Run a comprehensive security scan on your device using reputable antivirus or security software. This will help identify and remove any malware or suspicious files that may have been downloaded as a result of scanning the phishing QR code.

3. Change Your Passwords: Change the passwords for any accounts that you accessed or entered information into after scanning the QR code. Start with your email account, social media profiles, and online banking or financial accounts. Ensure that your new passwords are strong, unique, and not used for multiple accounts.

4. Enable Two-Factor Authentication: If you haven’t already done so, enable two-factor authentication (2FA) on your online accounts. 2FA adds an extra layer of security by requiring a verification code in addition to your password when logging in. This can help protect your accounts even if your login credentials have been compromised.

5. Monitor Your Accounts: Keep a close eye on your financial accounts, credit card statements, and any other accounts that may have been compromised. Look for any unauthorized transactions or suspicious activity. If you notice anything unusual, contact your financial institution or service provider immediately to report the incident.

Remember, it’s crucial to act swiftly if you realize that you have scanned a phishing QR code. Taking immediate steps to disconnect from the network, perform a security scan, change passwords, and report the incident can help minimize the potential damage and protect your online accounts and personal information.

Conclusion

As QR-phishing continues to evolve as a sophisticated cyber threat, it is crucial to remain vigilant and cautious when encountering QR codes, especially in emails or messages from unknown sources. By increasing your awareness of this technique and implementing proactive measures such as verifying sources and leveraging web filtering solutions, you can protect yourself from falling victim to QR code phishing attacks. Remember, your knowledge and carefulness are your best defenses against emerging threats in the digital landscape.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About SafeDNS
SafeDNS breathes to make the internet safer for people all over the world with solutions ranging from AI & ML-powered web filtering, cybersecurity to threat intelligence. Moreover, we strive to create the next generation of safer and more affordable web filtering products. Endlessly working to improve our users’ online protection, SafeDNS has also launched an innovative system powered by continuous machine learning and user behavior analytics to detect botnets and malicious websites.

How to find Citrix NetScaler

Earlier this week, Citrix alerted customers to three vulnerabilities in its NetScaler ADC and NetScaler Gateway products. Surfaced by researchers at Resillion, these vulnerabilities include a critical flaw currently being exploited in the wild to give attackers unauthenticated remote code execution on vulnerable NetScaler targets (CVE-2023-3519). Compromised organizations include a critical infrastructure entity in the U.S., where attackers gained access last month and successfully exfiltrated Active Directory data. And at the time of publication, there appear to be over 5,000 public-facing vulnerable NetScaler targets. 

What are Citrix NetScaler ADCs and Gateways? #

NetScaler Application Delivery Controller (ADC), formerly known as Citrix ADC, acts in a number of capacities to ensure reliable application delivery to users. This can include load balancing across application servers, off-loading of certain operations, security protections, and policy enforcement.

NetScaler Gateway, formerly known as Citrix Gateway, provides single sign-on (SSO) from any device to multiple applications through a single URL.

What is the impact? #

The three reported vulnerabilities affecting NetScaler ADC and Gateway products are of various types, and each include different preconditions required for exploitation:

  • Unauthenticated remote code execution (CVE-2023-3519; CVSS score 9.8 – “critical”)
    • Successful exploitation requires the NetScaler target be configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, or RDP Proxy) or “authentication, authorization, and auditing” (AAA) virtual server.
  • Reflected cross-site scripting (XSS) (CVE-2023-3466; CVSS score 8.3 – “high”)
    • Successful exploitation requires the victim to be on the same network as the vulnerable NetScaler target when the victim loads a malicious link (planted by the attacker) in their web browser.
  • Privilege escalation to root administrator (nsroot) (CVE-2023-3467; CVSS score 8.0 – “high”)
    • Successful exploitation requires an attacker having achieved command-line access on a vulnerable NetScaler target.

U.S.-based CISA has reported attackers exploiting CVE-2023-3519 to install webshells used in further network exploration and data exfiltration, causing CVE-2023-3519 to be added to CISA’s Known Exploited Vulnerabilities Catalog. Other common attacker goals, like establishing persistence, lateral movement, and malware deployment, are potential outcomes following successful exploitation.

Are updates available? #

Citrix has made patched firmware updates available. Admins should update older firmware on vulnerable NetScaler devices as soon as possible.

CISA has also made additional information available around indicators of compromise and mitigations.

How do I find potentially vulnerable NetScaler instances with runZero? #

From the Asset inventory, use the following prebuilt query to locate NetScaler instances in your network:

hw:netscaler or os:netscaler

Results from the above query should be triaged to verify they are affected ADC or Gateway products and if they are running updated firmware versions.

You can also use the following query in your Software and Services inventory pages to locate NetScaler software:

product:netscaler

Results from the above query should be triaged to verify they are affected ADC or Gateway products and if they are updated versions.

As always, any prebuilt queries are available from your runZero console. Check out the documentation for other useful inventory queries.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About runZero
runZero, a network discovery and asset inventory solution, was founded in 2018 by HD Moore, the creator of Metasploit. HD envisioned a modern active discovery solution that could find and identify everything on a network–without credentials. As a security researcher and penetration tester, he often employed benign ways to get information leaks and piece them together to build device profiles. Eventually, this work led him to leverage applied research and the discovery techniques developed for security and penetration testing to create runZero.

What is a lateral movement attack and how does it occur?

A lateral movement attack occurs when the cybercriminal gains access to an initial target to move between devices within the network without their presence being noticed.

In this article, we explain in detail what side threats are and how to avoid them. Want to know more about it? Read our text to the end.

A lateral movement attack can present itself in a variety of ways and for a variety of purposes.

In practice, this type of action is related to accessing an entry point, which corresponds to the initial target, so that the attacker can later gain access to other locations on the network, being able to steal data or infect devices and demand a ransom payment, for example.

However, it is possible to avoid lateral threats with the support of an IT team prepared to identify them in a timely manner and with the support of powerful cybersecurity solutions, such as PAM.
In this article, we share key information about a lateral movement attack. To make it easier to read, we have divided our text by topics. They are:

1. What is a lateral movement attack?

2. How does a lateral movement attack occur?

3. Examples of lateral movement attack

4. How to detect a lateral movement attack?

5. How to prevent a lateral movement attack?

6. PAM senhasegura: the ideal solution for preventing lateral movement attacks

7. About senhasegura

8. Conclusion

Enjoy your reading!

1. What is a lateral movement attack?

Lateral movement attacks occur when cybercriminals use current access to move around the rest of the network, infecting computers and internal servers until they reach their target, unidentified.

After intrusion, the malicious attacker uses various resources to increase their privilege and gain access to sensitive data and other high-value assets.

As it avoids the detection of cybercriminals, this type of attack makes it possible for them to stay in the IT environment for a long time, and it may take weeks or even months for them to be discovered.

2. How does a lateral movement attack occur?

The lateral movement attack starts from an entry point, which could be a stolen credential, a malware-infected machine, or other intrusion strategies.

This point is usually connected to the attacker’s command and control (C&C) server, which allows it to store information stolen from remotely accessed devices contaminated by malware.

At that point, the attacker explores the network, observing its users and devices. Therefore, they understand host nomenclatures and network hierarchies, identify operating systems, and put together a plan to make targeted moves.

Malicious agents still use resources that make it possible to discover where they are located on the network, what they can access and what type of protection is in effect.

3. Examples of lateral movement attack

Several types of cyberattacks can be associated with lateral movement. Among them, we can highlight: spying, data exfiltration, botnet and ransomware infection.

In the case of espionage, hackers associated with rival nations and groups or competing companies can carry out a lateral movement attack in order to monitor the actions of a government or organization.

In practice, when the motivation for the crime is not related to financial gain, the tendency is for malicious attackers to try to remain hidden for a long period.

In data exfiltration, the attacker moves or copies information belonging to a company without authorization. The motivations for this type of attack can be several, among them, stealing intellectual property, requesting ransom of stolen data, or carrying out identity theft.

Botnet infection usually occurs in distributed denial-of-service attacks. In this sense, the hackers use lateral movement to add many devices to their botnet, enhancing its performance1.

Lastly, the lateral movement attack could also be related to ransomware, causing cybercriminals to infect as many devices as possible in order to demand ransom payment.

4. How to detect a lateral movement attack?

Actions taken by malicious actors can become suspicious for an IT team prepared to deal with a lateral movement attack.

This is because these professionals must remain alert to any unusual occurrence, investigating all movements in the IT environment rather than running the risk of overlooking anomalies that represent a threat of lateral movement.

To assist IT teams in this task, it is advisable for organizations to have automated solutions that monitor interactions between devices and/or computers and provide information on vulnerabilities found.

By gathering the necessary data, the application starts to control software, providing network security to prevent access by malicious attackers, who are prevented from performing lateral movements or obtaining privileges.

The main steps of a lateral movement attack are exploiting an initial target, establishing communication between the cybercriminal and the target, persisting with the initial target, and identifying and exploiting other targets on the network.

5. How to prevent a lateral movement attack?

Most organizations have faced or will inevitably face attacks from malicious actors. Therefore, the ideal is that they are prepared to contain these threats as soon as possible, avoiding financial losses.

One of the ways to stop the lateral movement of ransomware and other types of attacks is micro-segmentation, which makes it possible to isolate assets and applications and prevent malicious attackers and ransomware from spreading across the network.

It is also possible to close vulnerable parts of the network by hiring an ethical hacker to perform a penetration test, which will show how far a cybercriminal could penetrate the network without being detected.

With the findings obtained by the hacker, the company will be able to fix flaws that generate insecurity.

If your goal is to prevent a lateral movement attack on your company, it’s also critical to adopt the Zero Trust network security philosophy, whereby no user, connection, or device should be trusted by default.

Endpoint security shouldn’t be overlooked either. Therefore, it is highly recommended to apply security technologies to devices such as smartphones, notebooks, and desktop computers.

The use of Multiple Authentication Factor is also recommended, which makes it more difficult for a malicious attacker to act, since in order to act, they would need, in addition to credentials, other authentication factors, such as a token or even the fingerprint of the user.

Finally, it is essential to limit user privileges through PAM, the most suitable solution for companies that want to prevent lateral movement attacks.

In practice, the role of PAM is to remove high privileges from regular user accounts and use administrative accounts with limited access to certain activities. This can reduce the chances of a successful lateral movement attack if the malicious attacker compromises an unprivileged user’s account.

Generally, companies maintain numerous privileged accounts, which allow administrative tasks in the IT environment, which poses a risk to their digital security. Therefore, PAM should be adopted to reduce the attack surface and protect systems and data against lateral movement attacks, among other threats.

6. PAM senhasegura: the ideal solution for preventing lateral movement attacks

As we mentioned in the previous topic, PAM is an indispensable solution to prevent successful lateral movement attacks.

Since 2001, we at senhasegura have offered the global market a PAM solution with features that ensure the digital security of organizations around the world. Among its benefits, the following stand out:

  • Fast deployment and simple maintenance

  • Full life cycle management of privileged accesses

  • No extra costs

  • Personalized offer of high-performance hardware appliances

  • Management of DevOps secrets

  • Integrated Digital Certificate Management

  • Solutions for cloud infrastructure, etc.

7. About senhasegura

We at senhasegura are recognized as leaders in cybersecurity by our customers and IT consulting companies worldwide.

Our mission is to guarantee the sovereignty of organizations over their privileged information through PAM, preventing data theft and leakage, as well as periods of inactivity that impact business performance.

To do this, we follow the privileged access management lifecycle using machine automation, before, during and after the access.

In addition to automatically auditing privilege usage, we investigate privileged actions to prevent abuse, reduce cyber risks, and bring organizations into compliance with audit criteria and standards such as HIPAA, PCI DSS, ISO 27001 and Sarbanes-Oxley.

8. Conclusion

In this article, you saw that:

  • A lateral movement attack can present itself in many ways

  • It occurs when hackers access an entry point and use that entry to move through the rest of the network, infecting computers and internal servers until they reach their target

  • Malicious agents can take weeks or even months to be discovered

  • Examples of lateral movement attacks include espionage, data exfiltration, botnet infection, and ransomware

  • To detect a lateral movement attack, it is important to have qualified professionals and effective solutions

  • To prevent this type of attack, the following are recommended: micro-segmentation, penetration tests, adoption of the Zero Trust security philosophy1 and endpoint security, and investment in a PAM solution, which provides each user with only the access necessary to perform their tasks. functions.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About Segura®
Segura® strive to ensure the sovereignty of companies over actions and privileged information. To this end, we work against data theft through traceability of administrator actions on networks, servers, databases and a multitude of devices. In addition, we pursue compliance with auditing requirements and the most demanding standards, including PCI DSS, Sarbanes-Oxley, ISO 27001 and HIPAA.

ESET helps MSPs support their clients with new ESET Vulnerability and Patch Management functionality

The timely patching of applications and operating systems remains a critical activity to help prevent potentially crippling security breaches. Yet with the increasing prevalence of hybrid work and the growing adoption of cloud services, overloaded IT teams are often struggling to keep up.

Because of this, businesses are increasingly turning to MSPs for help for a good reason. MSPs can help them reduce risk whilst building a stronger security posture through implementing best practices such as automation, triaging critical alerts, scheduling auto-deployments, testing patches, and mitigating user delays. So, what are some other solutions that MSPs can offer?

Gain full visibility

MSPs simply cannot protect what they cannot see. Therefore, they must gain full visibility of the security and health of their clients. With the ESET PROTECT Cloud console, MSPs can enjoy a complete overview of all their clients from a single pane of glass. This means no more portal fatigue. Through a unified view, MSPs get full 360-degree visibility of endpoints, licenses, vulnerability, and patching statuses across the businesses they are responsible for. The ESET PROTECT Cloud console also provides multiple language support and only has light resource demands.

The information provided within the console is always up to date and is available 24/7. This provides real-time status of a client’s security posture. MSPs can connect anytime, anywhere from their favorite web browser, allowing them to respond instantly to client queries, day or night. They can also use the console to create client reports highlighting the effectiveness and progress of the vulnerability and patch management policies employed.

Vulnerability management

With the new ESET Vulnerability and Patch Management functionality now available in ESET PROTECT Cloud, MSPs can centralize and automate multiple IT security and management tasks. Through it, they can maintain an up-to-date inventory of their clients and close any infrastructure blind spots that might have existed previously.

ESET Vulnerability and Patch Management scans thousands of popular applications, such as Adobe Acrobat, Mozilla Firefox, and Zoom Client, for over 35,000 common vulnerabilities and exposures (CVEs). Vulnerabilities can then be filtered and prioritized based on exposure score and severity. In addition, MSPs can run vulnerability reports highlighting the most vulnerable software and devices, the number of affected devices, and which users show the highest behavioral risk.

Time is of the essence

Of course, it is not just a case of what, but also of when. Time is often of the essence when keeping out the bad guys. Therefore, the timely patching of any holes in your clients’ systems is imperative. ESET Vulnerability and Patch Management enables immediate, automatic updates and patching through its customized settings. It also enables MSPs to patch manually if they prefer. It simplifies the patching process by prioritizing critical assets and scheduling the remainder to off-peak times to avoid interruption.

As the threat landscape evolves, we evolve too. The ESET Vulnerability and Patch Management inventory is constantly updated with the patch name, version of the app, CVE, patch severity, and affected applications. This means that business-critical software updates can be activated without delay, empowering MSPs to better safeguard their clients against the constantly evolving threat landscape and assist in their compliance with the likes of GDPR, HIPAA, and PCI DSS.

Earn the trust of your clients

ESET’s dependable, market-leading solutions are already offered by more than 10,000 MSPs worldwide. They not only give MSPs the flexibility they need and provide multiple revenue streams, but they also help boost an MSP’s reputation, allowing them to keep their customers satisfied and loyal.

The brand-new ESET Vulnerability and Patch Management capability within ESET PROTECT Cloud helps MSPs support organizations that lack the budget and staff to do patch management effectively by themselves. Through the ESET PROTECT Platform, MSPs can decrease the complexity of cybersecurity and mitigate their clients’ exposure to new and emerging threats, whilst benefitting from full prevention, detection, and response.

To discover more about how our solutions can better safeguard your clients from a constantly evolving threat landscape and help you earn their trust, please click here.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About ESET
For 30 years, ESET® has been developing industry-leading IT security software and services for businesses and consumers worldwide. With solutions ranging from endpoint security to encryption and two-factor authentication, ESET’s high-performing, easy-to-use products give individuals and businesses the peace of mind to enjoy the full potential of their technology. ESET unobtrusively protects and monitors 24/7, updating defenses in real time to keep users safe and businesses running without interruption. Evolving threats require an evolving IT security company. Backed by R&D facilities worldwide, ESET became the first IT security company to earn 100 Virus Bulletin VB100 awards, identifying every single “in-the-wild” malware without interruption since 2003.

23.6.6 ‘Voyager’ released

Changes compared to 23.6.5

Bug Fixes

  • Fixed an issue preventing Windows 7 and Windows Server 2008 R2 Clients from starting

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About Comet
We are a team of dedicated professionals committed to developing reliable and secure backup solutions for MSP’s, Businesses and IT professionals. With over 10 years of experience in the industry, we understand the importance of having a reliable backup solution in place to protect your valuable data. That’s why we’ve developed a comprehensive suite of backup solutions that are easy to use, scalable and highly secure.

×

Hello!

Click one of our contacts below to chat on WhatsApp

Social Chat is free, download and try it now here!

×