Carl B. Johnson
Author

Carl B. Johnson

vCISO and compliance expert.

https://carlbjohnson.com

posts

Phishing Awareness

How to Spot Phishing Emails: 9 Red Flags That Matter

In March 2022, the FBI's Internet Crime Complaint Center reported that phishing schemes were the most common cybercrime in 2021, with over 323,000 victims — more than double the count from 2019. That number is climbing again in 2022. If you're searching for how to spot

Carl B. Johnson Sep 22, 2022 7 min read
Phishing Attacks

What Is a Phishing Attack? A Real-World Breakdown

A Single Email Cost Ubiquiti $46.7 Million In 2015, networking giant Ubiquiti Networks disclosed that employees had been tricked into wiring $46.7 million to overseas accounts controlled by attackers. The weapon wasn't malware or a zero-day exploit. It was email. If you've ever asked

Carl B. Johnson Sep 22, 2022 7 min read
Fake Emails

Fake Emails: How to Spot Them Before They Cost You

The $2.4 Billion Problem Sitting in Your Inbox In 2021, the FBI's Internet Crime Complaint Center reported that business email compromise — a category driven almost entirely by fake emails — accounted for nearly $2.4 billion in adjusted losses. That made it the single costliest cybercrime type reported.

Carl B. Johnson Sep 22, 2022 7 min read
FakeEmail

FakeEmail Attacks: How Spoofed Messages Breach Networks

The FakeEmail Problem Is Bigger Than You Think In March 2022, the FBI's Internet Crime Complaint Center reported that business email compromise — the category that covers most fakeemail schemes — accounted for $2.4 billion in adjusted losses in 2021 alone. That made it the single most financially damaging

Carl B. Johnson Sep 22, 2022 7 min read
Supply Chain Attacks

Removed Legitimate Apps? How Attackers Exploit Trust

When Trusted Software Becomes Your Biggest Threat In March 2022, researchers confirmed that threat actors had compromised the update mechanism for Asus software, ultimately pushing malware to nearly a million machines. The attackers hadn't built anything from scratch. They had removed legitimate code from a trusted update pipeline

Carl B. Johnson Sep 22, 2022 6 min read
Spoofing Caller

Spoofing Caller Attacks: How Hackers Steal Trust

In March 2022, the FBI warned that threat actors were spoofing caller IDs of financial institutions and government agencies to steal millions from unsuspecting victims. The Bureau's Internet Crime Complaint Center (IC3) received over 18,000 complaints related to spoofing in 2021 alone, with adjusted losses exceeding $82

Carl B. Johnson Sep 04, 2022 6 min read
Phishing Links

What Is a Phishing Link? Anatomy of a Click That Costs Millions

In March 2022, a single employee at Okta clicked a link in what appeared to be a routine IT notification. That one click gave the Lapsus$ threat actor group access to internal systems, ultimately affecting roughly 2.5% of Okta's customer base — hundreds of organizations. The attack didn&

Carl B. Johnson Sep 04, 2022 8 min read
Spoofing

What Is Spoofing? The Attack Behind 80% of Breaches

In March 2022, the FBI's Internet Crime Complaint Center reported that Business Email Compromise — a scheme built almost entirely on spoofing — cost victims over $2.4 billion in 2021 alone. That made it the single most financially devastating category of cybercrime they tracked. Not ransomware. Not cryptojacking. Spoofing-based

Carl B. Johnson Sep 04, 2022 6 min read
Group Online Svindel

Group Online Svindel: How Organized Fraud Rings Work

A Single Phishing Email Led to a $100 Million Heist Between 2013 and 2015, a Lithuanian man orchestrated one of the most audacious cases of group online svindel ever documented. Evaldas Rimasauskas and his associates impersonated a legitimate Asian hardware manufacturer and tricked both Google and Facebook into wiring over

Carl B. Johnson Sep 04, 2022 7 min read