BOOK AN APPOINTMENT WITH AN IT SPECIALIST TODAY

Hackers Increasingly Targeting Business Conversations

‘Conversation hijacking’ Seeks Sensitive Business Intelligence

Your employees probably know not to open unexpected file attachments or click on random links, but what if an attachment arrives as part of an email conversation with trusted colleagues?

Sophisticated hackers are using a technique known as “conversation hijacking” to insert themselves into business operations, gain insight into sensitive details, and exploit the information for financial gain. What should you know about this insidious form of cyberattack on businesses?

Conversation Jacking

Conversation Hijacking: Infiltrating Business Communications

New research indicates that the incidence of conversation hijacking increased by more than 400 percent in the second half of 2019 alone.

In a conversation hijacking attack, a hacker uses various methods for gaining access to business credentials — for instance, an email login. By using the phished information, the hacker then may join an existing email conversation by posing as someone already involved in the conversation.

Conversation hijacking attacks are mounted by hackers willing to invest significant time to gain access to sensitive information. The hacker may read through numerous emails and conduct research online to learn about business deals in progress or other potentially valuable information.

By gaining the trust of other people in the email thread, the hacker then can use a variety of techniques for gaining access to banking information and financial assets.

Forms of Conversation Hijacking

Conversation hijacking can take a number of different forms, with information coming from a range of different sources. Hackers may compromise email accounts through phishing or data breaches and use the stolen account information to stage account-takeover attacks.

A hacker then may spend time monitoring an email account — including ongoing message threads — to gain information about sensitive business details or financial arrangements. An attack may involve a hacker creating a fake domain similar to the real domains used by a company. In the case of domain impersonation, the goal is to create a domain similar enough to the real domain that unsuspecting employees click or download files without realizing the error.

Hackers also may impersonate the domain of a client, vendor or business partner to gain the trust of employees for the ultimate purpose of accessing financial accounts and information.

Protecting Your Business

Conversation hijacking can be more difficult to detect than other types of hacking, but you can take steps to protect your business, your employees and your clients and partners.

The most important step you can take is ensuring that your team members understand how conversation hijacking attacks work. They should always use caution when downloading files or clicking on links and take time to ensure that all information — including domain names — matches their expectations.

In addition, any requests for financial information or immediate payment should raise red flags and should be reported to your company’s accounting department. If an employee doubts the authenticity of an email, they can contact the sender by phone or by starting a new email thread with an email address known to be accurate. Employees also should report to your IT team any email conversations or other incidents that seem suspicious.

Additional security measures — including robust email filtering and inbox rules — also can help, and restricting macros within documents can limit the means for hackers to gain access to account information. Multi-factor authentication also can provide extra protection against sophisticated conversation hijacking attacks.

More Like This

Apple Notes Tips

Apple Notes Tips With the dawn of the new year, January is the perfect time to get your to-do list in order. But these days, most people’s lists are complicated agendas full of work and personal items, multiple schedules, and seemingly endless tasks. To keep things straight, one thing that can help is a savvy …

Apple Notes Tips Read More »

Read More

AA22-011A: Understanding and Mitigating Russian State-Sponsored Cyber Threats to U.S. Critical Infrastructure

Original release date: January 11, 2022 Summary Actions Critical Infrastructure Organizations Should Implement to Immediately Strengthen Their Cyber Posture. • Patch all systems. Prioritize patching known exploited vulnerabilities. • Implement multi-factor authentication. • Use antivirus software. • Develop internal contact lists and surge support. Note: this advisory uses the MITRE Adversarial Tactics, Techniques, and Common Knowledge …

AA22-011A: Understanding and Mitigating Russian State-Sponsored Cyber Threats to U.S. Critical Infrastructure Read More »

Read More

11 Unexpected Ways to Manage Chromebook Files

11 Unexpected Ways to Manage Chromebook Files Chromebooks have been around for over a decade now, but at the beginning, they weren’t intended for file management, with the original Chromebooks not even having a Files app. Copying or moving data, finding files or wirelessly transferring and syncing files with other systems was virtually impossible. But …

11 Unexpected Ways to Manage Chromebook Files Read More »

Read More

AA21-356A: Mitigating Log4Shell and Other Log4j-Related Vulnerabilities

Original release date: December 22, 2021 Summary The Cybersecurity and Infrastructure Security Agency (CISA), the Federal Bureau of Investigation (FBI), National Security Agency (NSA), Australian Cyber Security Centre (ACSC), Canadian Centre for Cyber Security (CCCS), the Computer Emergency Response Team New Zealand (CERT NZ), the New Zealand National Cyber Security Centre (NZ NCSC), and the …

AA21-356A: Mitigating Log4Shell and Other Log4j-Related Vulnerabilities Read More »

Read More

What Are Workers’ Rights in the Face of Employee Monitoring?

What Are Workers’ Rights in the Face of Employee Monitoring? As the use of technology in our everyday lives continues to increase, it’s no surprise that any legislation surrounding that technology is constantly lagging behind. After all, it’s usually impossible to know the potential dangers of technology until damage has been done. Fortunately, legislation usually …

What Are Workers’ Rights in the Face of Employee Monitoring? Read More »

Read More

Can Technology Reverse the Workforce – Depleting ‘Great Resignation’ of 2021?

Can Technology Reverse the Workforce – Depleting ‘Great Resignation’ of 2021? Although remote and other technology appears to be an underlying cause of the 2021 “Great Resignation,” it may also hold the key to a“Great Return.” Many believed the mass exodus from the workforce had peaked in April when a total of 24 million had …

Can Technology Reverse the Workforce – Depleting ‘Great Resignation’ of 2021? Read More »

Read More