Trends come and go and keeping up with them when it comes to pop culture or fashion might be challenging, but when it comes to cybercrime, you’ll likely never be ahead of the hackers. Their ability to adapt their tactics and tailor them to be more effective is constantly changing – and nearly impossible to keep up with.
Recently, Barracuda released a report that reviewed data spanning from May 2020 through June 2021 which analyzed over 12 million email attacks at approximately 17,000 organizations. What they found was that these phishing attacks are increasing in complexity and the old tactic of fighting them off with rules, blocked lists, or outdated policies are no longer working. The spam tactic of one hacker hitting many users at once are being refined to sophisticated criminal organizations which target with sometimes a single email.
How are they doing it? While you’re likely familiar with all thirteen different types of attack strategies that were defined, in this week’s breakdown, we’ll look at a few in detail. This can help you to tailor your message to your clients, as well as build up a multi-layered approach in building a proactive solution for their organizations.
Brand Impersonation
Brand identification is the goal of nearly every business. You see a logo and know what it is before you even read a word. The element of trust is built into these brands. Scammers know how to take that trust and manipulate with that by impersonating these brands so that users act without hesitation because they trust them. Microsoft is one of the top three brands that are used in these phishing emails, along with WeTransfer and DHL. This has stayed consistent since 2019. Since nearly 80% of businesses use a Microsoft product, it doesn’t seem likely that their brand will be safe from impersonators anytime soon. Currently, 43% of the phishing impersonation attacks are impersonating Microsoft, as most of those products are tied to logins, gaining access to a user’s account is a doorway into other files and folders within a business. Once they are in, ransomware and other malicious activity is just a click away. WeTransfer allows users to share larger files, and DHL serves in the transportation industry, so combined they hit across the board on a variety of verticals.
Spear Phishing
Anyone in IT should be aware of phishing emails, but spear-phishing is a more targeted attack method. Research on the audience or intended victim(s), their workplace, and even their social sites creates a curated email inquiry or request that is harder to decipher from a more common spam message or attack. Ensure that you are creating awareness about this specific type of attack in addition to the general awareness of phishing. Combined, this builds up that multi-layered approach that we recommend.
Business Email Compromise
A business email compromise scam, or BEC scam, essentially combines the trust built from within a business or organization with a fraudulent request and puts it into an email to the targeted recipient. This usually will include a request to send or transfer funds, to purchase gift cards, or to send donation money to a bogus charity. These are often sent as an impersonation of an executive or high-level individual at the company so that they would be less likely to question the request. BEC’s make up about 10% of the social engineering attacks that were found in the report and of that 10%, one in five were targeted to people in sales roles.
Next week we’ll look at the other strategies and then dive into more ways that you can counterattack their methodologies with solutions that target all of them in a combined effort. Above all, training and strengthening the human workforce is the best way to mitigate the risk of cybercrime.
The post Trends in Cybercrime appeared first on Breach Secure Now!.
