Popular phishing attacks today

A recent report from Barracuda only goes to show how important it is to implement phish training for employees in the workplace. Cybercriminals are constantly changing their tactics to better evade automatic detection filters as well as better trick an unknowing victim. Due to this, the complexity of email threats is increasing. As said in the report from Barracuda, there are 13 threat types faced by organizations today. These range from high-volume, less-complex attacks like spam or malware to more complex and targeted attacks like business email compromise attacks and impersonation attacks.

Phishing Impersonation

Phishing Impersonation attacks will usually pose as emails from a well-known company like Microsoft or WeTransfer. The goal of these attacks is to trick the victim into believing the email is legitimately from the well-known company and get them to click on a phishing link. According to the report, 49% of all socially engineered threats are phishing impersonation attacks.

While hackers are able to impersonate any brand/company they want, there are definitely certain brands that get impersonated more than others. There is a tendency to expect communication from our favorite or most-used brands, and that makes people more likely to trust any communication that comes from them. Because of this natural human tendency, it is more common for hackers to impersonate popular brands/companies. According to the report from Barracuda, Microsoft, WeTransfer, and DHL have remained the top three brands used in phishing impersonation attacks since 2019.

Business Email Compromise

Business Email Compromise, or BEC attacks usually involve impersonating an individual. The threat actor will impersonate either someone inside or outside of an organization, usually an executive employee, and request wire transfers, gift cards, or donations to bogus charities. This past year, BEC attacks made up 10% of all socially engineered attacks. This type of attack will target basically any industry: education, healthcare, commercial, travel-organizations, and more.

Members of finance are usually popular targets for BEC attacks. It was reported that in the past year CFOs received around 4% of all BEC attacks. Finance departments as a whole received 13% of all BEC attacks. Another popular target of BEC attacks are people who’s roles are sales-related. There are often a large number of sales people in an organizations, so the percentage of total BEC emails that go to sales departments, may appear a little skewed. It was reported that 19% of BEC attack emails went to people who have sales roles. However the number of attacks was less than that of people who have finance roles. On average, there were four attacks per inbox for people in sales roles, and six attacks per inbox for people in finance roles.

Extortion

According to the report, extortion attacks only make up 2% of the total amount of phishing attacks from the past year. Most of these attacks were sextortion email threats, where hackers demand a ransom with the threat that they will expose sensitive or embarrassing content if not paid. In extortion, ransom payments are usually demanded in bitcoin so the payment is difficult to trace.

Scamming

Last year, scamming attacks represented 39% of all social engineering attacks. Scamming attacks are generally a less-targeted attack where threat actors cast a wide net with many different types of scams. Because of this, these threats cost victims hundreds of millions of dollars. Their techniques usually rely on piggybacking on current events. For example, this past year, scams that claimed they were looking for investments in fraudulent coronavirus treatments/vaccines were popular.

Spear-Phishing Attacks

Spear-phishing attacks are targeted phishing attacks. Instead of a wide net being cast like in scamming attacks, spear-phishing attackers will spend time researching their victims to build an attack that they are more likely to fall for. Oftentimes, the type and amount of information the target(s) has on social media sites will help attackers create an accurate picture of the individual(s) and discover their weak spots.

How can you protect your business and users against an attack?