ConcealBrowse Analysis: Thwarting Advanced Cyber Threats in the Chemical Industry

/in /by

Facing an ever-increasing cyber threat landscape, an integrated chemical and equipment company recognized the need for enhanced cybersecurity measures and strategically invested in ConcealBrowse. This decision proved crucial when ConcealBrowse identified a sophisticated threat that other security systems failed to detect.

ConcealBrowse in Action: Detecting and Analyzing a Complex Threat

ConcealBrowse’s advanced capabilities came to the forefront when it detected a locally-hosted HTML file named “Salary-Review copy[.]htm.” This file, designed to mimic a legitimate Microsoft login page for credential harvesting, was unique in its approach, bypassing typical email-based phishing methods.

Indicators of Compromise (IOCs) Identified: 

DOMAIN: ziralanded[.]xyz

IPV4: 45.93.139[.]225

SHA256 Hash: 2ae1cdc5d32960d2a985a0e3a9437428d760c680d5a6a3c1ce23f1b5470c5f1a

Deep Dive: Analysis

Our analysis revealed the file’s deceptive nature, utilizing local and internet-based resources. Crucially, it accessed ziralanded[.]xyz, likely controlled by attackers and hosted on infrastructure not immediately recognizable as malicious. This sophistication in avoiding detection underscores the evolving threat landscape.

Isolation at Work

Upon detecting the file, ConcealBrowse’s isolation mechanism was activated. This feature opens potential threats in a remote, isolated session, ensuring any harmful actions are contained and the user’s actual device remains secure.

The Valuable Outcomes

This incident highlighted ConcealBrowse’s critical role in the company’s cybersecurity framework. By detecting and analyzing a sophisticated threat, ConcealBrowse not only protected the company’s network but also provided valuable insights into the tactics used by modern cyber attackers.

Conclusion

This case study underscores the importance of advanced cybersecurity solutions like ConcealBrowse in the modern digital landscape. Its ability to adapt and respond to new types of threats, including those that bypass traditional security measures, is invaluable. As the threat landscape evolves, ConcealBrowse continues to be an essential tool for organizations seeking to protect their digital assets and maintain robust cybersecurity defenses.

 

ConcealBrowse Analysis: The Hidden Risks of Shared Hosting

/in /by

Introduction

In the intricate cybersecurity landscape, where threats evolve daily, tools like ConcealBrowse provide a much-needed safety net. A recent threat analysis for a hedge fund highlighted how ConcealBrowse’s smart decision engine leverages its “proximity” metric to identify potential threats, even when not directly implicated as malicious.

Decoding the Proximity Alert

In this instance, the URL in question was malaproject[.]com. At first glance, there seemed to be no direct evidence pointing to it being harmful. However, ConcealBrowse’s decision engine isolated the URL based on its proximity principle.

The Shared Hosting Concern

Further analysis revealed that malaproject[.]com was mapped to the IP address 192.232.223[.]30, registered with UnifiedLayer—a shared hosting service. Over the past two years, 22 URLs associated with the same IP address were flagged as malicious on various cyber threat intelligence feeds.

This discovery underscores a prevalent concern: websites hosted on shared services face increased risks. Shared hosting platforms might be cost-effective and resourceful for many, but they also become a hotbed for threats, as one compromised site can cast a shadow on others sharing the same IP.

ConcealBrowse: A Shield against Hidden Dangers

With shared hosting being a common choice for many online ventures, the risks associated with “bad neighbors” become more palpable. If a site on shared hosting is compromised, its neighboring sites become risky by association, given their proximity to the malicious infrastructure.

That’s where ConcealBrowse comes in. By detecting the elevated risk due to such associations, it ensures the site is isolated, preventing potential threats from causing harm. The “more work, less risk” mantra of ConcealBrowse captures its essence—it continually identifies and mitigates hidden dangers, allowing businesses to operate without disruption.

Conclusion

Shared hosting may be a double-edged sword, offering benefits but with hidden cybersecurity challenges. Tools like ConcealBrowse emphasize the importance of staying one step ahead, protecting organizations from not just direct threats but also from risks arising from their online environment. In an age of complex cyber threats, it’s no longer just about direct attacks but also about understanding the landscape and associations that might indirectly expose one to vulnerabilities. ConcealBrowse’s technology stands as a testament to the evolving nature of digital protection in today’s world.

 

 

Browser-Based Threat Report: Nov. 13

/in /by

Browser-Based Threat Report

Week of November 13th, 2023

ConcealBrowse is leveraged by teams across the world to combat weaponized URLs and Browser-Based Threats. The technology is constantly analyzing suspicious web artifacts to identify risks in the form of drive-by attacks, phishing portals, and other threats that materialize while browsing.

At Conceal, your digital safety is our utmost priority. Our weekly threat report for the week of November 13th, 2023, unveils critical insights into the ever-evolving landscape of online threats.

The following report highlights recently detected sites that were deemed suspicious:

_____________

SHA-256: 02f7c0e429b7388692f75d54bfde7e6bc2f1f68160efa434e306bd7d352f41c0

This URL was detected by ConcealBrowse on November 8th, 2023. It was first identified by various CTI feeds on October 5th, 2023, and resubmitted on November 9th, 2023, highlighting the continued nefarious activity of the domain. To date, 16 security vendors have annotated the URL as malicious.

This page takes advantage of typosquatting, in which end users accidentally type in the wrong web address, which then leads them to a page that mimics their intended destination. This specific instance mimics a popular shopping page and seems harmless. The intent of the majority of these spoofed sites is to obtain sensitive information from the end user, such as credit card information and address, during the checkout process.

_____________

SHA-256: f84a8fa0bc3dd592124b7a14a1bb64cb4fe8b40626c58d5c0341a3d590975500

This URL was detected by ConcealBrowse on November 6th, 2023. The URL was first detected by 2 security vendors on November 4th and by 18 security vendors to date. The URL has been classified as malicious and subsequently as a delivery vector for malware and spam.

The top-level domain used by the page is notorious for hosting malicious and risky web pages. Further, research indicates that nearly half of the registered domains using “.top” are used for nefarious activity such as spam and malware distribution. This specific URL directed users to a page that hosted various malware from Arkei, Privateloader, and Vidar. Their purpose is to steal information from the endpoints they infect, including saved passwords, credit card information, and the latest being 2-factor authentication tokens.

_____________

SHA-256: 82cf0044f474bbef6e896f0e741f0795fe6c2abcc7facec854e5967a17b89ea5

This web page was detected by ConcealBrowse on November 9th, 2023, and was first identified as malicious on September 28th, 2022. As of November 14th, the URL has been annotated as malicious, malware, and suspicious by 6 security vendors in total. This shows the dynamic reputation of webpages, thus emphasizing the importance of real-time URL analysis, which is enabled with Conceal Browse.

The web page is hosted by a web server that has historically hosted other malicious sites. In addition, the URL has recently been seen downloading two files of unknown content and has several embedded JavaScript files. After further static and dynamic analysis, the embedded JS files appear to modify the DOM of the parent URL. Due to this behavior, the URL has been identified by security vendors and has even been sinkholed by various DNS providers.

_____________

Valuable Outcomes

ConcealBrowse offers comprehensive protection against many sophisticated cyber threats, as recent threat reports exemplify. Our advanced threat detection capabilities have successfully flagged and quarantined malicious web pages, preventing users from falling victim to various cyber-attacks. Conceal remains dedicated to upholding the integrity of online interactions, constantly refining our detection algorithms and threat identification protocols to ensure proactive protection against emerging cyber threats. By integrating cutting-edge technology and a robust security infrastructure, we empower users to navigate the digital landscape with confidence, knowing that their online activities are shielded from potential harm.

Join the Conceal Community and claim your FREE ConcealBrowse licenses!

Join the Conceal Community today and fortify your online security for free! Don’t miss the chance to benefit from our advanced threat protection and stay one step ahead of cybercriminals. Experience peace of mind while browsing the internet, knowing that ConcealBrowse is your shield against the ever-evolving threat landscape. Take the proactive step towards a safer online experience – get your free ConcealBrowse license now and join a community committed to safeguarding your digital world.

Sign up for the Conceal Community and claim your free licenses by completing the form below.


Browser-Based Threat Report: Nov. 6

/in /by

Browser-Based Threat Report

Week of November 6th, 2023

ConcealBrowse is leveraged by teams across the world to combat weaponized URLs and Browser-Based Threats. The technology is constantly analyzing suspicious web artifacts to identify risks in the form of drive-by attacks, phishing portals, and other threats that materialize while browsing.

At Conceal, your digital safety is our utmost priority. Our weekly threat report for the week of November 6th, 2023, unveils critical insights into the ever-evolving landscape of online threats.

The following report highlights recently detected sites that were deemed suspicious:

_____________

SHA-256: e487be0271aa1047e6dd76c59aa6b04094c99113188f9fa139c39497097228c7

This URL was detected by ConcealBrowse on November 3rd, 2023, with it first being submitted to a various CTI feeds November 4th, showcasing how Conceal Browse protects users from the unknown.

When visiting the page, users encounter various pop-ups that state the workstation is infected with malware. This common tech support scam then prompts the end user to call the number listed in the pop-up to remedy the infection. Often, the scammers attempt to elicit payment from users, or entice them to download some sort of remote access software from the page, thus granting access to the endpoint. The Remote Access Trojan, if downloaded, grants persistent access with registry keys, gains elevated privileges and even bypasses file scanning and monitoring tools using various masquerading tactics.

_____________

SHA-256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

This web page was detected by ConcealBrowse on November 3rd, 2023 with it first being identified by CTI feeds the same day. To date, only 4 security vendors have identified this

threat. This highlights the ability of Conceal Browse to identify current adversary techniques and delivery methods.

The original URL in question has various redirects that lead the end user to a spoofed McAfee home page. The final page, seen below, is very interactive, meaning the spoofed page has been well crafted to increase its legitimacy. The spoofed page, which is hosted across numerous Russian based web servers, was dynamically creating help and feedback buttons, hoping users would engage. It was discovered that the domain was seen delivering backdoors via this technique in previous campaigns.

_____________

SHA-256: cba292db6c58d7028353ca98ee27dc334640987670b15cb83f2b419686596996

This currently active URL was detected by ConcealBrowse on November 2nd, 2023, with variations of the malicious pathname (intentionally removed above) identified throughout the first week of November 2023. The URL prevented by Conceal Browse has since been identified by 10 security vendors, who have classified the delivered webpage as malicious, suspicious, phishing, and even malware. The domain has been identified as a known infection source from reputable CTI feeds, indicating that nefarious content is continuously delivered.

The webpage is a blog that has various referrer headers that request resources from legitimate domains such as Google and Youtube. The page, however, does request resources from a known malicious domain that has was seen downloading suspicious HTML files just a week ago. Since the page is requesting resources from a known malicious domain, the page should be avoided.

_____________

Valuable Outcomes

ConcealBrowse offers comprehensive protection against many sophisticated cyber threats, as recent threat reports exemplify. Our advanced threat detection capabilities have successfully flagged and quarantined malicious web pages, preventing users from falling victim to various cyber-attacks. Conceal remains dedicated to upholding the integrity of online interactions, constantly refining our detection algorithms and threat identification protocols to ensure proactive protection against emerging cyber threats. By integrating cutting-edge technology and a robust security infrastructure, we empower users to navigate the digital landscape with confidence, knowing that their online activities are shielded from potential harm.

Join the Conceal Community and claim your FREE ConcealBrowse licenses!

Join the Conceal Community today and fortify your online security for free! Don’t miss the chance to benefit from our advanced threat protection and stay one step ahead of cybercriminals. Experience peace of mind while browsing the internet, knowing that ConcealBrowse is your shield against the ever-evolving threat landscape. Take the proactive step towards a safer online experience – get your free ConcealBrowse license now and join a community that’s committed to safeguarding your digital world.

Sign up for the Conceal Community and claim your free licenses by completing the form below.


Browser-Based Threat Report: Oct. 30

/in /by

Browser-Based Threat Report

Week of October 30th, 2023

ConcealBrowse is leveraged by teams across the world to combat weaponized URLs and Browser-Based Threats. The technology is constantly analyzing suspicious web artifacts to identify risks in the form of drive-by attacks, phishing portals, and other threats that materialize while browsing.

At Conceal, your digital safety is our utmost priority. Our weekly threat report for the week of October 30th, 2023, unveils critical insights into the ever-evolving landscape of online threats.

The following report highlights recently detected sites that were deemed suspicious:

_____________

SHA-256: 95bd5672de917dd113b5a48f4347931661dced296f6b83d2e76c002f3847e926

Browser-Based Threat Report

This URL was detected by ConcealBrowse on October 27th, 2023, with it first being submitted to a various CTI feeds October 13th and most recently October 25th, 2023.

The page was last seen delivering an innocent seeming HTML file that has encoded Javascript. The file dynamically reconstructs new HTML code as it opens in the browser and presents to the end user, a spoofed Microsoft login page, as seen above. Fortunately, Conceal Browse identified anomalies associated with the page and prevented the HTML smuggling

attack occurring in the first place, subsequently stopping the credential theft attempt.

This attack type is becoming increasingly popular due to it’s stealthiness. The drive by downloaded HTML file is not only being delivered by a reputable source (in this case, CloudFlare’s development platform) but is also encoded, then decoded and reconstructed locally to bypass web proxies and email gateways.

_____________

SHA-256: fc93937220e51c05c4c2273fe7ae0d8f50b0faafb1c1f02659bb3c0652f5b421

This web page was detected by ConcealBrowse on October 30th, 2023 with it first being submitted to CTI feeds on October 31st, 2023. This showcases Conceal’s ability to identify risky webpages in real time, even before CTI feeds report on them. This type of attack has been seen in several of Conceal’s customer environments.

The delivered page mimics the Yahoo home page by pulling legitimate assets such as images, an iFrame and even a script from Yahoo.com, which is not common practice. Any assets pulled from legitimate sites are mainly through their content delivery network. The adversaries spent a decent amount of time on crafting the page, which included 168 legitimate links leading to Yahoo. However, the page did have a high amount of empty and void links, which is indicative of phishing sites. Threat actors often do not have the time or ability to fully mimic web page functionality. With that, the site has been subsequently identified by 5 security vendors as a phishing site.

Browser-Based Threat Report

_____________

SHA-256:da9bb3966753582f1ad63eb91315ce3207b33bec9b166adc7048ddcc70258a40

This currently active URL was detected by ConcealBrowse on October 25th, 2023. Although the webpage was first submitted to various CTI feeds October 31st, 2021, it was resubmitted the morning of October 31st, 2023, meaning the page continues to deliver suspicious content.

The webpage is a login page to a commoditized Phishing-as-a-Service (PhaaS) provider based out of Russia that has been operating since June 2021. As a purchasable nefarious phishing service, the page should not be trusted.

Browser-Based Threat Report

_____________

Valuable Outcomes

ConcealBrowse offers comprehensive protection against many sophisticated cyber threats, as recent threat reports exemplify. Our advanced threat detection capabilities have successfully flagged and quarantined malicious web pages, preventing users from falling victim to various cyber-attacks. Conceal remains dedicated to upholding the integrity of online interactions, constantly refining our detection algorithms and threat identification protocols to ensure proactive protection against emerging cyber threats. By integrating cutting-edge technology and a robust security infrastructure, we empower users to navigate the digital landscape with confidence, knowing that their online activities are shielded from potential harm.

Join the Conceal Community and claim your FREE ConcealBrowse licenses!

Join the Conceal Community today and fortify your online security for free! Don’t miss the chance to benefit from our advanced threat protection and stay one step ahead of cybercriminals. Experience peace of mind while browsing the internet, knowing that ConcealBrowse is your shield against the ever-evolving threat landscape. Take the proactive step towards a safer online experience – get your free ConcealBrowse license now and join a community that’s committed to safeguarding your digital world.

Sign up for the Conceal Community and claim your free licenses by completing the form below.

 


The “Non-Subscribe” Attack: How ConcealBrowse Shields the Human Layer

/in /by

The Deceptive Face of “Unsubscribe” 

It’s no longer a surprise that the cyber threat landscape is continuously evolving, and cybercriminals are relentlessly innovating ways to infiltrate and exploit unsuspecting users. The most recent deceptive method brought to our attention is the “Non-Subscribe” attack by our partner mSOC. This ploy deceives users by providing an “Unsubscribe” button in spam emails, drawing them into a trap under the facade of halting unwanted communications. 

Understanding the “Non-Subscribe” Attack

The Deceptive Email: Users receive a spam email, often with a subject line that’s attention-grabbing or concerning. While the topic of the email might seem irrelevant, the purpose isn’t the content itself, but the “Unsubscribe” button embedded within.

The Trap: Clicking on “Unsubscribe” redirects users to a web page. This page may be eerily identical or closely resemble a legitimate-looking platform, as seen in the shared screenshot. Unsuspecting users, believing they are on a genuine page, enter their email address to unsubscribe.

 

Figure 1: The Suspicious Unsubscribe Redirect

 

The Motive: Contrary to what one might think, these users never subscribed to the emails in the first place. By entering their email address, they inadvertently validate their email address for cybercriminals. Moreover, the “Unsubscribe” button isn’t just for email harvesting – it has been leveraged for other mischievous activities as well.

 

In the case of this attack, an examination from mSOC of the Proofpoint log entry marked “SPAM” affirms the malicious nature of such emails. The payload URL embedded within these emails further underscores the need for caution.

 

 Figure 2: Conceal’s Analysis of the Site in Question

ConcealBrowse: Your Protection Against Deceptive Tactics

Now, while technical solutions to detect and prevent such threats are paramount, it’s equally crucial to shield the human layer – the end-users. This is where ConcealBrowse steps in.

Real-time Alerts: If a user accidentally clicks on a deceptive link, ConcealBrowse offers real-time alerts, warning them about the potential threat while proactively isolating it in an environment clear of the organization’s network.

Layered Security: By integrating machine learning algorithms into the AI-powered detection and prevention engine, ConcealBrowse identifies and blocks malicious sites and payloads, protecting users even if they mistakenly land on risky sites.

Human-Centric Design: Recognizing that humans are the most vulnerable link in the security chain, ConcealBrowse has been designed keeping the user in mind. Its intuitive interface, combined with its potent backend security, ensures that users feel protected without feeling overwhelmed.

Final Thoughts

In the ongoing battle against cyber threats, it’s not enough to have just technical solutions in place. Protecting the human layer, the most targeted and vulnerable layer, is of utmost importance. The “Non-Subscribe” attack is just a glimpse into the deceptive methods employed by cybercriminals. With ConcealBrowse, you’re not just relying on technology to keep threats at bay; you’re empowering every individual to be a formidable line of defense against these ever-evolving threats.

press release hero

Conceal Named Winner of the Prestigious Black Unicorn Awards for 2023

/in /by

Conceal Won the Coveted Title of Black Unicorn in the Most Prestigious Awards for Cybersecurity Companies Who Have the Potential of Being Valued at $1B during CyberDefenseCon 2023

October 26, 2023, 9:43 AM Eastern Daylight Time

AUGUSTA, GA –(BUSINESS WIRE)–Conceal is proud to announce it has been named winner of the Black Unicorn Awards for 2023 by Cyber Defense Magazine (CDM), the industry’s leading electronic information security magazine. This accolade was bestowed during CyberDefenseCon 2023, the most exclusive and esteemed conference for CISOs and cybersecurity innovators globally.

Conceal contended with numerous leading providers of cybersecurity products and services to secure this distinguished award. The term “Black Unicorn” is indicative of a cybersecurity company poised to attain a $1 billion market value through private or public investment (Source). The Black Unicorn Awards spotlight companies with such remarkable potential in the cybersecurity arena.

“We’re pleased to name Conceal as a winner among a small, elite group of cybersecurity industry leaders in our annual Black Unicorn awards,” said Judges Dr. Lindsey Polley de Lopez of www.VentureScope.com, Dino Boukouris of www.momentumcyber.com and Gary Miliefsky of www.cyberdefensemediagroup.com.

Gordon Lawson, CEO of Conceal, expressed his enthusiasm, “We’re thrilled to join this exclusive group of Black Unicorn winners in the 11th year of the Cyber Defense Awards at CyberDefenseCon 2023. Being recognized at a platform where the Top Global CISOs gather by invitation only is truly an honor. Given the stiff competition and a judging panel comprising esteemed infosec experts from around the globe, this recognition is indeed gratifying and humbling.”

As Conceal continues to innovate and lead in the realm of browser security, particularly with its flagship solution, ConcealBrowse, this award underscores its commitment to providing robust, proactive protection for users at the edge. ConcealBrowse, powered by the intelligent ConcealSherpaAI engine, offers unparalleled browser protection, making it an invaluable asset for individuals and businesses seeking resilient defense against sophisticated online threats.

About Conceal

Conceal is a cutting-edge cybersecurity company dedicated to pioneering a solution for secure online navigation. Renowned for its flagship product, ConcealBrowse, the company seamlessly blends advanced technology with user-friendly design to deliver unparalleled browser protection. Powered by the intelligent ConcealSherpaAI engine, ConcealBrowse proactively identifies and neutralizes threats from malicious links, ensuring a safe and swift browsing experience for users. With a commitment to innovation and excellence, Conceal continues to break new ground in protecting users from the ever-evolving landscape of online threats. For more information, visit www.Conceal.io.

About Cyber Defense Awards

This is Cyber Defense Magazine’s 11th year of honoring cybersecurity innovators, in this case the Black Unicorn Awards for 2023 on our Cyber Defense Awards platform. In this competition, judges for these prestigious awards includes cybersecurity industry veterans, trailblazers and market makers Gary Miliefsky of CDMG, Dr. Lindsey Polley de Lopez of VentureScope, Robert R. Ackerman Jr. of Allegis Cyber, Dino Boukouris of MomentumCyber and with much appreciation to emeritus judges Robert Herjavec of Cyderes, Dr. Peter Stephenson of CDMG and David DeWalt of NightDragon.  To see the complete list of winners for the Black Unicorn Awards for 2023 please visit https://cyberdefenseawards.com/black-unicorn-winners-for-2023/ and download The Black Unicorn Report for 2023: https://cyberdefenseawards.com/the-black-unicorn-report-for-2023/.

About Cyber Defense Magazine

Cyber Defense Magazine is the premier source of cyber security news and information for InfoSec professions in business and government. Our mission is to share cutting-edge knowledge, real-world stories and awards on the best ideas, products, and services in the information technology industry.  We deliver electronic magazines every month online for free, and special editions exclusively for the RSA Conferences and Cyber Defense Conferences.  CDM is a proud member of the Cyber Defense Media Group. Learn more about us at https://www.cyberdefensemagazine.com and visit https://www.cyberdefensetv.com and https://www.cyberdefenseradio.com to see and hear some of the most informative interviews of many of these award winning company executives.  Search for a Cybersecurity job at https://www.cyberdefenseprofessionals.com or post an infosec job for free, anytime.  Join a webinar at https://www.cyberdefensewebinars.com and realize that infosec knowledge is power.

Source: https://www.businesswire.com/news/home/20231026399768/en/Conceal-Named-Winner-of-the-Prestigious-Black-Unicorn-Awards-for-2023

Browser-Based Threat Report: Oct. 23

/in /by

Browser-Based Threat Report

Week of October 23rd, 2023

ConcealBrowse is leveraged by teams across the world to combat weaponized URLs and Browser-Based Threats. The technology is constantly analyzing suspicious web artifacts to identify risks in the form of drive-by attacks, phishing portals, and other threats that materialize while browsing.

At Conceal, your digital safety is our utmost priority. Our weekly threat report for the week of October 23rd, 2023, unveils critical insights into the ever-evolving landscape of online threats.

The following report highlights recently detected sites that were deemed suspicious:

One of which, ConcealBrowse was able to identify one of these threats seven days before the other threat feeds.

_____________

SHA-256: 0b52c5338af355699530a47683420e48c7344e779d3e815ff9943cbfdc153cf2​

This URL was detected by ConcealBrowse on October 17th, 2023, with it first being submitted to a handful of CTI feeds on October 15th, 2023. The webpage has since been taken down. This 17-day lapse between domain registration and page deletion is a long time given today’s threat environment. This highlights the importance of real-time analysis, which Conceal Browse enables. In this gap, only 8 security vendors, including Conceal Browse, flagged the page as suspicious.

The webpage the URL led its victims to was seen downloading an HTML file that has a historically bad reputation for various actions such as C2 node callouts.

The serving IP address continues to host malicious domains and has been flagged as malicious by two security vendors. Other webpages hosted on the server have been featured in Conceal’s weekly threat report previously.

_____________

SHA-256: d772f4ce3ff3a63d73da19acb3864fa4b3cf01807ac6c9322db27d60e2f4e7fa

This web page was detected by ConcealBrowse on October 12th, 2023, with it first being submitted to CTI feeds on October 19th, 2023. This showcases Conceal’s ability to identify risky webpages in real-time, even before CTI feeds report on them.

The delivered webpage included a captcha, prompting the end user to click on the “allow” button in the fake notification displayed in the top left (see below). This is a common tactic in which attackers present iFrames or transparent overlays on top of seemingly innocuous and common user interactive dialogue boxes. The transparent iFrame is clicked by the user because it is common. However, the overlay executes script that often initiates a download or even displays a login screen for credentials to be captured. This specific webpage is no longer active; however, users should be cautious when they see this tactic in the wild.

_____________

SHA-256: 6f5d8c5bf77786b84d00504f8a8f790a2261f49aef0c11327b611b9e1e91ab6e

This currently active URL was detected by ConcealBrowse on October 23rd, 2023. Although the webpage was first submitted to various CTI feeds on July 17th, 2018, it was resubmitted the morning of October 24th, meaning the page continues to deliver suspicious content.

The webpage has recently been delivering an HTML file that has conducted HTTP requests to various .ru domains. The serving IP address has been annotated in the past as a malicious C2 node and, more recently, has been identified as a cryptomining server by other intelligence services.

_____________

Valuable Outcomes

ConcealBrowse offers comprehensive protection against many sophisticated cyber threats, as recent threat reports exemplify. Our advanced threat detection capabilities have successfully flagged and quarantined malicious web pages, preventing users from falling victim to various cyber-attacks. Conceal remains dedicated to upholding the integrity of online interactions, constantly refining our detection algorithms and threat identification protocols to ensure proactive protection against emerging cyber threats. By integrating cutting-edge technology and a robust security infrastructure, we empower users to navigate the digital landscape with confidence, knowing that their online activities are shielded from potential harm.

Join the Conceal Community and claim your FREE ConcealBrowse licenses!

Join the Conceal Community today and fortify your online security for free! Don’t miss the chance to benefit from our advanced threat protection and stay one step ahead of cybercriminals. Experience peace of mind while browsing the internet, knowing that ConcealBrowse is your shield against the ever-evolving threat landscape. Take the proactive step towards a safer online experience – get your free ConcealBrowse license now and join a community that’s committed to safeguarding your digital world.

Sign up for the Conceal Community and claim your free licenses by completing the form below.


Introducing ConcealBrowse for Firefox Users!

/in /by

As we continue to expand our solution here at Conceal to best fit our customer needs, we are pleased to announce that ConcealBrowse is now available for Firefox! In our pursuit to make the internet a safer place, we’ve extended our protective umbrella to one more browser – Firefox.

You might already be familiar with our powerful detection and prevention capabilities that function seamlessly with Chromium-based browsers like Chrome, Microsoft Edge, and Brave. Now, all these robust features, powered by the advanced SherpaAI engine, are at the disposal of Firefox users, too!

How to Get ConcealBrowse on Firefox

Installing ConcealBrowse on Firefox is a breeze.  We have a simple three step process that can get your browser running securely in no time at all.  The installation process of our browser extension is seamless and requires little user interaction. 

FAQs

Can I choose the browsers I want to support with ConcealBrowse?

Absolutely! You can tailor your installation to your needs. Instructions on how to do this are available here.

 

Can I deploy Firefox using an RMM or MDM solution?

Yes, our ConcealBrowse installation can be integrated into your RMM or MDM solution for a hassle-free deployment.

 

Is the extension available in the Firefox store?

No, the extension is signed by Firefox but we’ve opted to host it independently.

 

What about Mac users? Can they install Firefox?

Certainly!

 

Your Feedback Matters

We’re always striving to better our offerings. And who better to guide us than you? As we continue to work on extending our solution, let us know what else you would like to see!

Happy (and safe) browsing to all Firefox users!

Browser-Based Threat Report: Oct. 16

/in /by

Browser-Based Threat Report

Week of October 16th, 2023

ConcealBrowse is leveraged by teams across the world to combat weaponized URLs. The technology is constantly analyzing suspicious web artifacts to identify risks in the form of drive-by attacks, phishing portals, and other threats that materialize while browsing.

At Conceal, your digital safety is our utmost priority. Our weekly threat report for the week of October 16th, 2023, unveils critical insights into the ever-evolving landscape of online threats.

The following report highlights recently detected sites that were deemed suspicious:

SHA-256 42a439f1d2c94a9d456fc25fd9ae758fd1a55b1061d4a9ba5e90406424f3f39c​

This URL was detected by ConcealBrowse on October 16th, 2023, with it first being submitted to a handful of CTI feeds on September 21st, 2023.. The URL in question was recently submitted for new analysis on October 15th, 2023. To date, only 4 security vendors excluding ConcealBrowse have annotated this URL.

The link uses various http (insecure) redirects, which leads to gambling sites, spoofed shopping sites, and a suspicious download. More concerning, it also redirects to a QR code, which entices the end user to scan with their mobile device, which are often less secure than our PC’s and laptops. The QR code leads the user to another suspicious webpage that is being tracked by CTI feeds.

Additionally, the serving IP address annotated above has been seen delivering a W32 trojan variant as recently as October 8th, 2023.

_____________

SHA-256 18358a77382e2475a5dcc8445ef23a859d1d7cb698d6b31808f76104cf30fbfd​

This web page was detected by ConcealBrowse on October 16th, 2023 with it first being submitted to CTI feeds on August 3rd, 2019. This site shows a continued trend of seeing compromised websites of smaller businesses go at length without being addressed.

When analyzing this site. It was flagged as malicious by multiple different vendors. Further analysis shows that this site contains several signatures including creating files in the system directory.

Several MITRE ATT&CK techniques are also found on this site at the time of analysis to include: Masquerading, Process Injection, Ingress Tools Transfer, Encrypted Channel, Application Layer Protocol, and Non-Application Layer Protocol.

_____________

SHA-256 18358a77382e2475a5dcc8445ef23a859d1d7cb698d6b31808f76104cf30fbfd​

This currently active URL was detected by ConcealBrowse on October 16th, 2023. Although it was first submitted to various CTI feeds August 15th, 2023, it was resubmitted the morning of October 17th, meaning the delivered page has been compromised again.

The URL takes users to seemingly benign page offering a free PDF converter. When clicking “Download Now,” users download the converter and inadvertently, a malicious dropper file. The dropper file is a redline trojan variant.

_____________

Valuable Outcomes

ConcealBrowse offers comprehensive protection against a myriad of sophisticated cyber threats, as exemplified in recent threat reports. Our advanced threat detection capabilities have successfully flagged and quarantined malicious web pages, preventing users from falling victim to various cyber attacks. Conceal remains dedicated to upholding the integrity of online interactions, constantly refining our detection algorithms and threat identification protocols to ensure proactive protection against emerging cyber threats. By integrating cutting-edge technology and a robust security infrastructure, we empower users to navigate the digital landscape with confidence, knowing that their online activities are shielded from potential harm.

Join the Conceal Community and claim your FREE ConcealBrowse licenses!

Join the Conceal Community today and fortify your online security for free! Don’t miss the chance to benefit from our advanced threat protection and stay one step ahead of cybercriminals. Experience peace of mind while browsing the internet, knowing that ConcealBrowse is your shield against the ever-evolving threat landscape. Take the proactive step towards a safer online experience – get your free ConcealBrowse license now and join a community that’s committed to safeguarding your digital world.

Sign up for the Conceal Community and claim your free licenses by completing the form below.