News Alert: Fortra researchers find email impersonation attacks climbing to an all-time high – Source: www.lastwatchdog.com

Eden Prairie, Minn., June 22, 2023 — Malicious emails have reached a crescendo in 2023 according to the latest report from cybersecurity software and services provider Fortra.

Email impersonation threats such as BEC currently make up nearly 99 percent of threats, and of those 99 percent of threats observed in corporate inboxes are response-based or credential theft attacks. Email impersonation threats are proving to be the most difficult to block as social engineering helps cybercriminals successfully deceive both end users and the security tools designed to protect them.

Other key findings from the research compiled by Fortra’s email security group, which includes Agari, Clearswift and PhishLabs, reveal:

•More than 60 percent of email threats impersonated a well-known brand name such as Microsoft or Google.

•36 percent of email display names are altered to a more granular level and pose as specific individuals.

•Google is the most abused email platform (67.5 percent of recorded attacks in 2023), with Microsoft following close behind (18.3 percent).

•BEC actors are moving toward intercepting payments. Instead of asking for an explicit amount, attackers ask for an unspecified sum owed

•Office 365 phishing attack volumes have doubled since Q4 2022

•The fundamentals of BEC attacks remain largely the same, but optimized tactics are improving success rates

•Generative AI is trending among cybercriminals. ChatGPT, and other such language models, are giving criminals the tools to craft well-written messages at scale and avoid the poor spelling and grammar that frequently mark phishing attacks.

Wilson

John Wilson, Senior Fellow, Threat Research at Fortra states, “It isn’t hard to find someone who has fallen victim to email impersonation attacks. Social engineering combined with advancing technology such as generative AI has made attacks more advanced and harder to spot. Organizations must rethink how to defend against such threats.

“For instance, consider if your security awareness training explores enough of current impersonation techniques, as well as how applying algorithms through machine learning can help to detect anomalies and patterns in order to accurately detect signatureless email threats at scale.”

# # #

June 22nd, 2023 | Uncategorized