Kyocera Cyber thwarts elaborate phishing campaign

A highly co-ordinated phishing campaign extracted user credentials and MFA bypass that were then used to access the customer’s environment. 

We got the down-low from James Elliot, KYOCERA’s Head of Service
& Cyber Operations:

“This customer was unknowingly the target of a cyber-attack.

“It was a late weekend evening, and I received a call from our Cyber  Incident Response team. Those on duty were alerted to a malicious process that was attempting to run within the customer’s estate, which they duly prevented and quarantined. Shortly after a file extraction program attempted installation along with access from a known blacklisted IP addresses. 

“At this point it was clear that the customer was under cyber-attack. The team set about enacting their major cyber incident process. The customer’s infrastructure was contained, and network access restricted; this enabled a full containment of the environment to prevent any further access being possible. 

“All of this was done within 8 minutes of the first alert being raised.”

Following are aligned NIST Cybersecurity response process we not only identified the risk, detected and prevented the malicious activities, we then set about responding to and remediating the threats, hardening the environment and recovering the estate under our Cyber Response Service.

Kyocera Cyber’s early action prevented data being extracted and avoided a potentially damaging ransomware attack.