So you've got a prospect meeting. This is every MSP’s dream; it’s your time to shine. You’ve got a prospective client interested in switching providers. While this is a great opportunity for you, there are plenty of ways things can go sideways. In this blog post, we’ll explore how to prepare, how to handle the meeting, and what you can do to turn the “prospect” into a client. Continue reading
What's new this week in the news for MSPs?
App2Container tool by Amazon makes its debut; many US websites hit in WastedLocker ransomware attacks; Maze ransomware allegedly strikes Xerox; and, new Thiefquest data wiper using ransomware in its attacks. Let's see what it's all about.
If you’re onboarding clients, it means you’re adding new business and generating more revenue, but the more clients you onboard, the more likely it is you’re going to make a mistake. That’s why developing an onboarding process to ensure everything is in order is essential for growing MSPs. Continue reading
If everything’s going according to plan, you’re landing more clients, generating additional MRR and scaling your organization, but as your business transforms into a powerhouse, structural changes occur, and if you’re not careful with the framework, you can find yourself in a bit of a dilemma. Continue reading
So you've got a prospect meeting. This is every MSP’s dream; it’s your time to shine. You’ve got a prospective client interested in switching providers. While this is a great opportunity for you, there are plenty of ways things can go sideways. In this blog post, we’ll explore how to prepare, how to handle the meeting, and what you can do to turn the “prospect” into a client. Continue reading
What's new this week in the news for MSPs?
Nutanix introduces new services to help pandemic-affected companies; AWS launches Amazon Honeycode; Maze ransomware allegedly strikes LG Electronics; newcomer WastedLocker ransomware leveraging fake program updates; and CLOP Ransomware hits Indiabulls group. Let's see what it's all about.
A Quarterly Business Review (QBR), also known as a business review or executive business review, is a face-to-face meeting between MSPs and clients that takes place once per quarter. Its purpose is to review their partnership and discuss how the MSP can better support the client’s business goals. Continue reading
Before we talk about Azure PowerShell vs Azure CLI, first of all, we need a bit of background. Both are available in the Azure cloud or you can use them remotely from your workstation. On your workstation, you will have to install a module, which we will explain later, but both are available in Azure Cloud Shell. Azure CLI is short for the Azure command-line interface. Continue reading
Many MSPs rely on selling hardware as a way to generate additional revenue. While this source of revenue can help MSPs to boost their top lines, it can also create unwanted friction between them and their clients if they’re not initially straightforward about marking up hardware products. Continue reading
Networking isn't always effective, but when it is, MSPs benefit in the long run. They typically end up generating more business, finding new opportunities and educating themselves on emerging industry trends, which benefits not only them but their customers. Continue reading
What's new this week in the news for MSPs?
Google launches a new cloud file storage tier; AWS adds a new data migration device; AWS solves a 2.3 Tbps DDOS attack; fake data breach notification malware caught by Google; and Black Kingdom ransomware hack manipulating Pulse VPN flaws.
Let's see what it's all about.
Google has announced the launch of its new product Filestore High Scale, a cloud-based file storage tier for businesses operating high-performance computing workloads. It is said to be the next step in the development of Google's Cloud Filestore service.
With Filestore High Scale, Google has integrated the capabilities of data storage startup Elastifile Ltd., which it acquired in July 2019. The new tier lets users send shared file systems that can expand to a capacity that permits hundreds of thousands of input/output operations per second, with tens of gigabytes per second throughput and hundreds of terabytes.
Google said that other workloads that may benefit from Filestore High Scale's scale-out storage are electronic design automation, financial modeling, genomics, and video processing.
AWS Snowcone is a new device added by Amazon to its family of data migration devices. This device is small and very portable, weighing only 4.5 pounds and measuring just nine by six by three inches. It provides up to 8 terabytes of storage for businesses using edge computing workloads, where space, power, and cooling features are limited.
AWS Snowcone operates on two central processing units. It has 4 gigabytes of memory for computing operations, a USB-C connection, and an optional battery unit.
In a blog post, Amazon Chief Evangelist Jeff Barr shared that Snowcone's primary objective is data migration, “Internet of Things,” transportation, content distribution and tactical edge computing, logistics, and autonomous vehicles use cases. What's more, the device is tamper-proof, dust-tight, water-resistant, and can transfer data using the AWS DataSync service.
AWS Snowcone will be available first in the AWS East (Northern Virginia) and AWS West (Oregon) regions, and additional regions will be added soon.
Amazon Web Service reported that it was able to diminish a distributed denial-of-service attack of 2.3 terabits per second in February. It is the most massive DDoS attack on record to date. According to the details given in the AWS Shield Threat Landscape Report- Q1 2020, this attack continued for three days. Those behind the attack failed to knock Amazon cloud services offline.
The method used is the so-called Connection-less Lightweight Directory Access Protocol reflection-based attack. In this type of attack, the attacker sends a CLDAP request to an LDAP server with a spoofed sender IP address — the target's IP address. The server then mounts a bulked-up response to the target's IP address, causing the reflection attack, hence the name.
The server is unaware of the attack when it receives multiple, apparently legitimate requests to establish communication, according to Imperva. From each open port, it answers each attempt with an SYN-ACK packet. This will eventually cause the server's connection overflow tables to flood and genuine clients will be denied access.
To distribute malware and scams, bad actors have begun pushing fake notices about data breaches at big company names. These direct people to risky websites. The groups behind them are mixing Google Sites, black SEO, and spam pages.
Google Alerts, which uses predefined terms set by users to monitor search results, has helped in the spread of these false notifications. Some companies found in the notifications include Dropbox, Hulu, Ceridian, Shein, PayPal, Target, Chegg, EA, Canva, HauteLook, Mojang, InterContinental Hotels Group, and Houzz. These companies have suffered a data breach at some point in the past.
If a user follows any of these links picked up by Google Alerts, they find themselves on landing on pages with download offers for undesired extensions and malware, and fake giveaways.
Aside from using compromised websites, these groups also make their own pages. In many instances, they have used Google Sites to host their content.
A fake giveaway of iPhone 11 devices was one of the malicious links used as a redirect, claiming to have been set up by Google for its “Membership Rewards” program.
Using spam pages to redirect users to pages that pose a risk is not new; this is just the latest example by a malware group.
Businesses with unpatched Pulse Secure VPN software or initial access on the network are the target of the operators of the Black Kingdom ransomware. The malware was captured in a honeypot computer system that let security researchers examine and document its methods of operation.
A Pulse Secure VPN (CVE-2019-11510) critical vulnerability affecting earlier versions of its software was leveraged by the malware operators.
Researchers noted that the ransomware built endurance by mimicking a legitimate scheduled task for Google Chrome. According to REDTEAM.PL's analysis, it's likely that a scheduled task runs base64-encoded string code in a hidden PowerShell window to get a script named “reverse.ps1”, and then opens a reverse shell on the infected host.
Security researcher GrujaRS first spotted Black Kingdom ransomware in February, when it appeared to have appended a .DEMON extension to encrypted files.
The sample examined communicated with the same IP address seen in REDTEAM.PL's report. The ransom note sought $10,000, to be deposited to a bitcoin wallet, and threatened that failure to do so would lead to the data being destroyed or sold.
Learn about common ransomware attack scenarios and what to do if one of these attacks affects your clients:
Further reading Ransomware Attack Scenarios
I hope this update has been helpful. MSP360 is your resource for MSP news. Stay home, stay safe and healthy, and remember to check back next week for more highlights.
