ActiSoft Technology - Blog #CEO FraudActiSoft Technology - Blog #CEO Fraudhttps://www.actisofttechnology.com/blogs/tag/ceo-fraudThu, 23 Apr 2026 13:20:03 +0200http://zoho.com/sites/<![CDATA[Top Cyber Threats to SMEs]]>https://www.actisofttechnology.com/blogs/post/top-cyber-threats-to-smes-in-2022....and-more-than-likely-beyondIf you’re running a small to medium sized business, it’s easy to think that you might not be a big enough fish to attract the interest of cyber crimin ]]>
If you’re running a small to medium sized business, it’s easy to think that you might not be a big enough fish to attract the interest of cyber criminals. But the truth is, small organisations are just as much at risk of hacks and other security threats as huge corporations – in fact, being smaller may make you more of a target. 

Attackers are targeting thousands of businesses every day, and those with less robust defences in place make much easier prey than bigger organisations who can invest more time and money into cyber security. 

Hackers also love targeting small businesses because they often deal with large sums of money and have great contacts – which means there’s lots of lovely data to steal.

It's often said that knowledge is power, and that’s certainly true when it comes to cyber-crime. The owners and managers of SMEs need to be aware of the risks, which is why we’ve put together this short article outlining the most common cyber-attacks right now and what we have seen.
1) Phishing 

By far the most prevalent – and damaging – threat facing small and medium sized businesses in 2022 is phishing. These attacks account for 90% of all breaches; a figure that’s grown by 65% since 2021. Phishing attacks are when a hacker sends an email pretending to be from trusted contact, tricking the recipient to click on a malicious link, download a code or share sensitive information. There are several types of phishing attacks you need to know about:

  • The spray and pray approach, which is where hackers send out thousands of emails all at once, in the hope that one or two will bite
  • Spear phishing: a campaign that targets a particular person or organisation and includes information which is known to be of interest to the specific target
  • Whaling: an even more targeted and carefully executed attack, where the hacker goes after a specific C level executive in the organisation 

Phishing attacks are becoming increasingly sophisticated, which means that even if you think you’ve seen it all before, you could still be caught out.
2) Ransomware 

Ransomware is a type of malicious software which prevents or restricts users from accessing their computer systems and data, commonly by locking their screens and/or files until they pay a ransom. Like other cyber-attacks, ransomware technology has become more sophisticated over recent years. A popular attack at the moment is a breed of ransomware known as “cryptoransomware” where files are encrypted and users are forced to send an online payment in return for a decryption code.

Hackers will push for payments in all sorts of ways, though. The costs vary according to the type of ransomware being used and different exchange rates. Users are often asked to pay their ransoms in bitcoin, because it offers a greater level of anonymity, but hackers also list alternative options such as Amazon gift cards or iTunes vouchers. Sometimes it seems like an easy option to just pay up, but it should be noted that paying the ransom is no guarantee your files will be returned.
3) Social Engineering 

Social engineering plays a huge role in cyber-crime. Even though advances in technology have been behind more sophisticated attacks, those attacks can only be properly deployed by a human. So, hackers work hard to understand how people think and manipulate them into making security mistakes or sharing valuable data. Social engineering happens in several phases. First, the hacker investigates their victim and identifies any weaknesses in their security systems. Next they start to gain their trust, either by sharing information the victim might be interested in or by pretending to be a trusted contact. Then, when the target lets their guard down and begins to trust the hacker, they’ll go in for the kill. 
4) Insider Threat 

Insider threats are posed by individuals from inside an organisation. This can include current or previous staff members, partners and contractors with access to passwords and company data. These individuals may act maliciously, intentionally stealing data or infiltrating systems for personal gain, but often they’re completely unwitting. Lack of awareness about cyber security issues can turn the most diligent worker into an insider threat, so it’s important to have robust policies and training measures in place. 
5) Shadow IT

Shadow IT is a term covering the use of different IT systems, apps, services and devices that haven’t been approved by an IT department. Since Cloud services have become more popular, and also since the first lockdown, the use of Shadow IT has grown exponentially. New technology drives innovation and can deliver huge cost and time savings, but without the right security measures in place it also poses a huge risk.


6) Software Exploits

A software exploit is a code that’s been written to take advantage of a particular vulnerability or flaw in a piece of software. Although security professionals sometimes develop these exploits as evidence of vulnerabilities, they’re also widely used by hackers with malicious intent. 


The purpose of this article is to provide you with an overview of the most common threats to your organisation. We’ll go into more detail about each type (and a few others!) in our next articles. In the meantime, if you want to know more about how to protect your SME from cyber threats, get in touch!

Are your users putting a big target on your organisation’s back?

Cybercriminals are constantly coming out with new ways to hack into your network and steal your organisation’s confidential information.

Find out if your users are putting a big target on your organisation’s back.

KnowBe4’s new Password Exposure Test (PET) is a complimentary IT security tool that allows you to run an in-depth analysis of your organisation’s hidden exposure risk associated with your users.

PET makes it easy for you to identify users with exposed emails publicly available on the web, and checks your Active Directory to see if they are using weak or compromised passwords that are part of a known data breach. PET then reports on any user accounts affected so you can take action immediately!

Here's how it works:

  • Checks to see if any of your organisations email addresses have been part of a data breach
  • Tests against 10 types of weak password related threats associated with user accounts
  • Checks against breached or weak passwords currently in use in your Active Directory
  • Reports on the accounts affected and does not show/report on actual passwords
  • Just download the install, run it, get results in minutes!
    Identify how many users take the bait and reply before the bad guys do! 
    Try It Now!
    ]]>    Fri, 10 Jun 2022 11:13:34 +0000    <![CDATA[Phishing Remains the Most Common Form of Attack]]>https://www.actisofttechnology.com/blogs/post/phishing-remains-the-most-common-form-of-attackBlog courtesy of KnowBe4 Written by Stu Sjouwerman Phishing attacks are “by far” the most common vector for data breaches, according to a new survey by ]]>
    Blog courtesy of KnowBe4
    Written by Stu Sjouwerman
    Phishing attacks are “by far” the most common vector for data breaches, according to a new survey by the UK’s Department for Digital, Culture, Media, and Sport (DCMS).


    “Among those that have identified breaches or attacks, around a quarter (27% of these businesses and 23% of these charities) experience them at least once a week,” the report states. “The most common by far are phishing attacks (for 83% and 79% respectively), followed by impersonation (for 27% and 23%). Broadly, these patterns around frequency and threat vectors are in line with the 2020 and 2019 results.”

    The DCMS says most of the respondents observed a noticeable increase in phishing attacks since the beginning of the pandemic.

    “Among the organisations saying cyber security had become a higher priority under the pandemic, there were those that said that, in their case, the frequency of attacks had increased since March 2020 – especially phishing attacks,” the report says. “Others giving this response felt their organisations were more exposed to cyber risks now that their staff were working from home, because there were more endpoints to deal with and because they had less oversight of staff outside the office. In some cases where organisations had moved online to a greater extent following the lockdown, management boards had started paying more attention to cyber security as a business risk.”
    The report found that only 20% of businesses said they conducted simulated phishing exercises for their employees, although respondents had a favourable view of risk assessments.

    “In addition to their core purpose of identifying key risks, risk assessments were often viewed as a good way to produce evidence for management boards, which could be used to justify proposed cyber security actions or investment, or to show trends over time and whether things had improved,” the report says. “For example, one medium business carried out a mock phishing exercise as part of their risk assessment – they found that 15 per cent of staff responded to the mock phishing email, and presented these findings to the management board. This led to new user training on phishing emails, as well as other technical rule changes.”

    New-school security awareness training with simulated phishing tests can help your employees thwart social engineering attacks.

    The DCMS has the story.

    Free Phishing Security Test

    Would your users fall for convincing phishing attacks? Take the first step now and find out before the bad guys do. Plus, see how you stack up against your peers with phishing Industry Benchmarks. The Phish-prone percentage is usually higher than you expect and is great ammo to get budget.

    Here's how it works:

      • Immediately start your test for up to 100 users (no need to talk to anyone)
      • Select from 20+ languages and customise the phishing test template based on your environment
      • Choose the landing page your users see after they click
      • Show users which red flags they missed, or a 404 page
      • Get a PDF emailed to you in 24 hours with your Phish-prone % and charts to share with management
      • See how your organisation compares to others in your industry
    Go Phishing Now!
    ]]>    Mon, 29 Mar 2021 13:33:05 +0000    <![CDATA[KPMG: Cyber Security Risk Is Now No. 1 Threat To Growth]]>https://www.actisofttechnology.com/blogs/post/kpmg-cyber-security-risk-is-now-no.-1-threat-to-growthBlog courtesy of KnowBe4 Written by Stu Sjouwerman KPMG in the UK just released their CEO 2021 Outlook Pulse Survey where glo ]]>
    Blog courtesy of KnowBe4
    Written by Stu Sjouwerman
    KPMG in the UK just released their CEO 2021 Outlook Pulse Survey where global leaders were asked about their 3-year outlook.  CEOs of the world’s most influential companies are planning what a return to ‘normal’ will look like. Nearly half (45 percent) expect normality to resume in 2022, with only one-third (31 percent) anticipating a return to normal in 2021. Significantly, 24 percent of leaders say that their business has changed forever.


    When asked:  Which of the following risks poses the greatest threat to your organisation's growth over the next 3 years? the following graph was published. Note the change from position 5 in 2020 to position 1 in 2021:             
    The full article is highly recommended. Here is a link to the KPMG site with the complete  survey results:


    Get Your CEO Fraud Prevention Manual

    CEO fraud has ruined the careers of many executives and loyal employees, causing over $26 billion in losses. Don’t be the next victim. This manual provides a thorough overview of how executives are compromised, how to prevent such an attack and what to do if you become a victim.

    Get Your Manual
    ]]>    Thu, 25 Mar 2021 15:36:45 +0000    <![CDATA[The Most Commonly Spoofed Business-Related Applications in a Phishing Campaign]]>https://www.actisofttechnology.com/blogs/post/the-most-commonly-spoofed-business-related-applications-in-a-phishing-campaignBlog courtesy of KnowBe4 Written by Stu Sjouwerman Business-related applications like Zoom, Microsoft, and DocuSign are the most commonly spoofed servic ]]>
    Blog courtesy of KnowBe4
    Written by Stu Sjouwerman

    Business-related applications like Zoom, Microsoft, and DocuSign are the most commonly spoofed services in phishing attacks, according to a new report from GreatHorn. Business apps made up 45% of all impersonation phishing attacks. Social media-related phishing attacks accounted for 34% of attacks, while consumer services like Amazon and PayPal made up 20%.


    The researchers also found that while the total volume of daily phishing attempts has decreased compared to last year, the number of successful phishing attacks has increased. The researchers attribute this to attackers getting better at the social engineering aspect, as well as getting their emails past security filters.

    “Though daily occurrences of phishing attacks have decreased from 36% to 25% between 2020 and 2021, weekly and monthly phishing attacks have increased from 28% to 42% and 11% to 17%, respectively,” GreatHorn says. “These attacks are increasingly difficult to detect as cybercriminals become more sophisticated and targeted in their attacks – advancing beyond the ‘batch and blast’ methodology to social engineering phishing campaigns. As a result of this, the quantity of phishing attempts being experienced by organisations may have decreased daily, but the impact of those campaigns that bypass traditional email security is increasing. As a result of increasing attacks, email security has risen to one of the top 3 IT security projects for 2021 among the organisations surveyed.
    The researchers note that a primary concern of most respondents regarding email security products was that the product would miss phishing attacks.

    “Missing phishing attacks remains the top issue in current email security solutions with 39% of respondents noting this as a top concern in both 2020 and 2021,” the researchers write. They add, “Fewer organisations report being ‘satisfied’ with their current email security solution, decreasing from 76% in 2020 to 53% in 2021. On the other hand, organisations reporting their email security solution was ‘good enough’ increased from 19% in 2020 to 36% in 2021.”

    New-school security awareness training can provide your organisation with an essential layer of defence by teaching your employees how to recognise phishing attacks.

    GreatHorn has the full story. 

    Free Phishing Security Test

    Would your users fall for convincing phishing attacks? Take the first step now and find out before the bad guys do. Plus, see how you stack up against your peers with phishing Industry Benchmarks. The Phish-prone percentage is usually higher than you expect and is great ammo to get budget.

    Here's how it works:

      • Immediately start your test for up to 100 users (no need to talk to anyone)
      • Select from 20+ languages and customise the phishing test template based on your environment
      • Choose the landing page your users see after they click
      • Show users which red flags they missed, or a 404 page
      • Get a PDF emailed to you in 24 hours with your Phish-prone % and charts to share with management
      • See how your organisation compares to others in your industry
    Go Phishing Now!
    ]]>    Tue, 16 Mar 2021 18:20:43 +0000    <![CDATA[A Hacker Is Selling Access To The Email Accounts Of Hundreds Of C-Level Executives]]>https://www.actisofttechnology.com/blogs/post/a-hacker-is-selling-access-to-the-email-accounts-of-hundreds-of-c-level-executivesBlog courtesy of KnowBe4 Written by Stu Sjouwerman ZDNet's Zero Day column just reported one of the best reasons why you sh ]]>
    Blog courtesy of KnowBe4

    Written by Stu Sjouwerman

    Great for Marketing Purposes and for Phishing!

    ZDNet's Zero Day column just reported one of the best reasons why you should step your users through new-school security awareness training yet:


    "A threat actor is currently selling passwords for the email accounts of hundreds of C-level executives at companies across the world. The data is being sold on a closed-access underground forum for Russian-speaking hackers named Exploit.in, ZDNet has learned this week.  The threat actor is selling email and password combinations for Office 365 and Microsoft accounts, which he claims are owned by high-level executives occupying functions such as:

      • CEO - chief executive officer
      • COO - chief operating officer
      • CFO - chief financial officer or chief financial controller
      • CMO - chief marketing officer
      • CTOs - chief technology officer
      • President
      • Vice president
      • Executive Assistant
      • Finance Manager
      • Accountant
      • Director
      • Finance Director
      • Financial Controller
      • Accounts Payable
    Access to any of these accounts is sold for prices ranging from $100 to $1,500, depending on the company size and user's role. A source in the cyber-security community who agreed to contact the seller to obtain samples has confirmed the validity of the data and obtained valid credentials for two accounts, the CEO of a US medium-sized software company and the CFO of an EU-based retail store chain.

    The source, which requested that ZDNet not use its name, is in the process of notifying the two companies, but also two other companies for which the seller published account passwords as public proof that they had valid data to sell. These were login details for an executive at a UK business management consulting agency and for the president of a US apparel and accessories maker.

    I don't have to tell you the risks that this brings related to CEO Fraud, also known as Business Email Compromise. ZDNet has the full story.

    Get Your CEO Fraud Prevention Manual

    CEO fraud has ruined the careers of many executives and loyal employees, causing over $26 billion in losses. Don’t be the next victim. This manual provides a thorough overview of how executives are compromised, how to prevent such an attack and what to do if you become a victim.

    Get Your Manual

    Want to know and monitor the Dark Web for your organisations credentials? Check out our DomainWatch service

    ]]>    Tue, 01 Dec 2020 11:15:21 +0000    <![CDATA[The Geography of Business Emails Compromise]]>https://www.actisofttechnology.com/blogs/post/the-geography-of-business-emails-compromiseBlog courtesy of KnowBe4 Written by Stu Sjouwerman Researchers at Agari have released a report on the global distribution of business email compromise ( ]]>

    Blog courtesy of KnowBe4

    Written by Stu Sjouwerman

    Researchers at Agari have released a report on the global distribution of business email compromise (BEC) actors, and determined that 25% of these criminals are operating from within the United States. This makes the US the second-largest hub for BEC actors in the world. Criminals in Nigeria still account for the vast majority of BEC attacks, at 50% of the global total. South Africa was third, with criminals there responsible for 9% of these attacks. Agari’s researchers based their findings on incidents in which the attackers failed to anonymise their real-world locations.

    “A quarter of the BEC actors we identified globally were located in the US, operating in 45 states and the District of Columbia,” Agari says. “Nearly half these scammers were located in five states: California, Georgia, Florida, Texas, and New York Many of the BEC actors in our dataset were clustered around a handful of US cities. The largest of these were based in and around Atlanta, GA, with 7% of all US-based BEC actors operating in this metropolitan area.”


    The US government isn’t letting these actors operate unperturbed—the Justice Department has arrested dozens of people allegedly involved in these schemes. Still, the number of BEC attacks originating in the US is notable, considering that Europe only accounts for 6%, the Middle East for 4%, and the Asia-Pacific for 2%.


    “It’s well-known that organizations within the United States are preferred targets for BEC actors. Some groups our team has researched, such as Exaggerated Lion, have exclusively targeted US-based businesses, for instance. But it may be surprising to some that a quarter of all BEC actors operate from within the US.”


    Agari adds that BEC activity is on the rise in other countries as well.


    “Because of the impact of BEC attacks globally, law enforcement in Nigeria has become more aggressive in recent years, which has caused BEC actors to migrate to other countries,” the researchers write. “Additionally, the significant return on investment from BEC scams has led far more sophisticated Eastern European cybercrime groups, like Cosmic Lynx, to get into the game. This only increases the geographic distribution of BEC attack sources.”

    BEC attacks are extremely profitable, so criminals put a great deal of effort into refining their tactics. New-school security awareness training can help your employees thwart targeted social engineering attacks.

    Agari has the story.

    Get Your CEO Fraud Prevention Manual

    CEO fraud has ruined the careers of many executives and loyal employees, causing over $26 billion in losses. Don’t be the next victim. This manual provides a thorough overview of how executives are compromised, how to prevent such an attack and what to do if you become a victim.

    Get Your Manual
    ]]>    Tue, 03 Nov 2020 13:32:08 +0000