Abnormal Blog
Crane Hassold
Former Director of Threat Intelligence
Crane Hassold is the former Director of Threat Intelligence at Abnormal Security, where he led an intelligence team responsible for researching enterprise-focused phishing threats. Prior to moving to the private sector in 2015, Crane served as an Analyst at the FBI for more than 11 years, spending most of his career in the Behavioral Analysis Units, providing support to intelligence community and law enforcement partners against national security adversaries and serial criminals. In 2012, Crane helped create the FBI’s Cyber Behavioral Analysis Center, which takes an asymmetric approach to examining cyber threats by combining the traditional behavioral concepts used for decades in the violent crime world with technical expertise to gain a holistic understanding of threat actor TTPs.
Discover how two BEC threat groups are using automated translation tools to execute payment fraud and payroll diversion attacks in several languages simultaneously.
Discover how Firebrick Ostrich uses open-source intelligence to run their BEC scams in these supply chain compromise examples.
Threat actors are capitalizing on the new year, posing as human resources officials to send credential phishing attacks.
Discover how ChatGPT can be used by threat actors to run business email compromise schemes and other email attacks.
Reduce your risk of a BEC or phishing attack this holiday season by watching out for these email threats.
Threat group Lilac Wolverine is fine-tuning the art of exploiting people’s willingness to help others in some of the largest gift card attacks we've seen.
This post explores the continuation of the sharp decline in ransomware attacks as well as a few other notable data points from Q3 2022.
Uncovering how threat group Crimson Kingsnake uses third-party impersonation tactics to swindle organizations across the world.
Threat group Cobalt Terrapin uses sophisticated impersonation techniques with multiple steps to commit invoice fraud.
Discover how threat group Chiffon Herring leverages impersonation and spoofed email addresses to divert paychecks to mule accounts.
The number of ransomware attacks continued its downward trend in Q2 2022. Learn why and discover more about ransomware threat actors and targets.
Understanding the ways cybercriminals execute financial supply chain compromise is key to preventing your organization from falling victim to an attack.
Financial supply chain compromise, a subset of business email compromise (BEC), is on the rise. Learn how threat actors launch these sophisticated attacks.
Executives are no longer the go-to impersonated party in business email compromise (BEC) attacks. Now, threat actors are opting to impersonate vendors instead.
Here’s an in-depth analysis of the 62 most prominent ransomware groups and their activities since January 2020.
Like all threats in the cyber threat landscape, ransomware will continue to evolve over time. This post builds on our prior research and looks at the changes we observed in the ransomware threat landscape in the first quarter of 2022.
It’s IC3 Report week! In what has become an annual holiday for anyone that’s heavily involved in researching business email compromise (BEC) attacks, the FBI released its 2021 Internet Crime Report that details trends in various types of cybercrime activity over the past year.
Looking at the overall volume trends, there have been two main spikes in ransomware activity over the last two years.
As part of our research, we dove into why ransomware has changed and how each variable influences the overall threat of ransomware in distinctly different ways.
New research from the Abnormal Threat Intelligence team shows that ransomware delivery methods have evolved, payouts are growing in frequency and total cost, and there are more malicious actors participating in ransomware than ever before.
On August 12, 2021, we identified and blocked a number of emails sent to Abnormal Security customers soliciting them to become accomplices in an insider threat scheme. The goal was for them to infect their companies’ networks with ransomware. These emails allege to come from someone with ties to the DemonWare ransomware group.