Beware of Fake Cybersecurity Audits: Cybercriminals Use Scams to Breach Corporate Systems

Companies are being warned that malicious hackers are using a novel technique to break into businesses – by pretending to offer audits of the company’s cybersecurity.

With ransomware and other cybersecurity threats high in the mind of many business owners, it is all too easy to imagine how many companies might react positively to an invitation to have the security of their networks tested.

But computer crime fighters in Belgium and Ukraine have warned that your business could be falling for a scam if it is duped into granting access to someone with malicious intent.

Safeonweb, an initiative from the Centre for Cybersecurity Belgium (CCB), has warned local companies to be wary of malicious hackers offering fake cybersecurity audits.

The attackers, according to Safeonweb, have posed as officers from the “FOD Cyberbeveiliging” or “Federal Cybercrime Service”. However, no such authority actually exists. The real authority coordinating Belgium’s cybersecurity is the CCB.

According to the CCB, the criminals pretend to be an officer of the “Federal Cybercrime Service,” and make contact with companies as part of a campaign to raise awareness of internet safety. A free audit is offered by the imposter to assess the victim company’s security, who brings their own computer equipment to connect to the company’s network.

Ukraine’s Computer Emergency Response Team (CERT-UA) issued a similar alert last month, where they said there had been “numerous cases” where unidentified parties had posed as CERT-UA officials, and encouraged companies to allow them to conduct a cybersecurity audit.

In the case of the incidents reported in Ukraine, the attackers had sent requests for potential victims to connect their systems to the AnyDesk remote access software under the pretext of conducting a “security audit.”

The genuine CERT-UA explained in its warning that, in some cases, it does use remote access software (such as AnyDesk) to assist in the defence of organisations, only after prior agreement through pre-agreed communications channels.

Companies are advised that if in any doubt, not to make an appointment and report any contact with a potential scammer to the authorities.

Furthermore, it is advisable to check the identity of the person who has contacted you, by contacting the institution they claim to be connected with via their official website or telephone (don’t – obviously – use any contact details provided by the potential scammer!)

Editor’s Note: The opinions expressed in this and other guest author articles are solely those of the contributor and do not necessarily reflect those of Tripwire.