Who We Are
SRG Security Resource Group Inc. is a Canadian company dedicated to providing world-class Protective Security Guard and Patrol and Cyber Security services. Founded in the spring of 1996, SRG provides solutions and services for people and organizations across Canada.
SRG Security Resource Group Inc. is a wholly owned subsidiary of Input Capital Corp.
Cyber Security Bulletin: Increased Threat from Emotet Malware Campaigns
Since July 2020 there has been an increase in malicious activity associated with Emotet malware campaigns. Emotet has been frequently observed working in tandem with Trickbot and Ryuk malware in a persistent attempt to compromise computer systems within Canada. These threats have been successfully used to attack many Canadian companies since 2019.
Emotet is an advanced botnet attached to email. Once a system is infected by Emotet, additional malware, including Trickbot and Ryuk may be implanted on the system resulting in data exfiltration or attempts to extort the victim.
Emotet malware can be spread through untargeted bulk spam emails (such as shipping notifications, or “past-due” invoices), as well as what appear to be targeted malicious emails (spear phishing). Targeted emails are particularly effective as they appear to come from a trusted source, often from someone with whom the email recipient has recently been in communication.
Furthermore, Emotet email campaigns have been observed to be leveraging both ‘thread hijacking’, a technique where malicious emails are inserted into existing email threads, and using password-protected zip files to avoid detection by network defenses. These techniques result in convincing messages that an unaware recipient may believe to be trustworthy and encouraged to download malware by opening an attachment (a macro-enabled Microsoft Word document or PDF) or clicking a malicious link.
SUGGESTED ACTIONS
Please reach out to us with your concerns or for more information on how to protect yourself or your business.
Cyber Security Bulletin: Due Diligence vs Bad Actors
While bad actors continue their denial-of-service for ransom activities, SRG would like to remind all clients and businesses to continue your due diligence as you work to protect your company assets:
Actors claiming to be various Advanced Persistent Threat (APT) groups have been threatening to carry out large-scale distributed denial-of-service attacks for ransom, commonly known as Ransom DoS (RDoS). Recent reported threats were against the financial sector, globally and in Canada, but other sectors are expected to be subject to the same activities. The threats are typically accompanied by short Distributed Denial of Service attacks (DDoS) that are intended to demonstrate the actor’s capability.
Details vary from case to case but the core elements are as follows:
There are reports across Canada of such activity where the subject line of the ransom email is: “DDoS Attack on <organization name>’s network”. The email specifies a date on which the organization’s network would be subjected to a DDoS attack and imply that a small-scale attack on a specific IP address range will be carried out immediately to prove the message was not a hoax. The mail demands a ransom amount, to be paid in Bitcoin, to avoid a larger and sustained attack. The ransom attack then escalates daily with non-payment.
The following denial-of-service techniques have been reported:
Recommended Protection Activities are as follows:
Reach out to us with your concerns or for more information on how to protect yourself or your business.
Cyber Security Bulletin: Working from home during the COVID-19 Pandemic
During the COVID-19 pandemic, there has been a significant increase in the adoption of additional network software by companies endeavoring to enable their employees to work from home.
This has turned the attention of the “bad actors” looking to exploit potential vulnerabilities in these work-from-home technologies. As always, their intent is to disrupt business or to compromise computer systems.
In addition to the vulnerabilities that may exist in the software being used, some companies are implementing these collaboration systems in a less secure manner for ease and convenience of the home worker, further exposing themselves to being exploited during online meetings and while file sharing from one home worker to another.
Here are some key mitigation strategies and guidance SRG recommends:
Keep these technologies as well as home user systems patched and updated for protection.
Coronavirus (COVID-19) Pandemic Update – SRG Remains Fully Operational
The health and safety of our employees, clients, and the general public remains SRG’s top priority during the COVID-19 pandemic.
While we continue to provide cyber and physical security services as required services during this period, we are taking all reasonable precautions to protect our employees, contractors, and the public. We are committed to ensuring security needs are met without sacrificing the health and safety standards recommended by national, provincial, and regional health authorities. Some of these standards include, but are not limited to:
SRG executives and senior management continue to monitor developments in respect to COVID-19 and are in frequent communication with our clients and our staff to ensure health and safety standards are being met during this period.
While this situation continues to evolve, we are confident in our ability to provide our clients and partners with the highest standard of security services for which we have become known.
Thank you for placing your trust in SRG Security Resource Group Inc.
I would also like to express my thanks to our extraordinary SRG team of security guards, cyber security analysts, and office workers, who have continued their responsibilities without fail during these trying times.
Blair Ross
President & COO
Cyber Security Bulletin: COVID-19
The industry is seeing heightened activity pertaining to COVID-19 themed malware that is proliferating on the internet. Counterfeit websites and email phishing campaigns are leveraging public fear of and interest in the COVID-19 pandemic to spread malware that can infect corporate and personal systems.
As staff use the internet to search out status and information on the COVID-19 world situation, they may be redirected to sites that can cause a malware infection. Further, phishing campaigns and email attachments that may look like a legitimate correspondence from executives regarding the COVID-19 situation should be scrutinized.
We encourage companies to make their people aware of this situation and be wary of any email attachments, suspicious website redirections and unauthorized email in general.