Keeping Up With The Increase In Phishing Attacks

The annual State of the Phish report from Proofpoint provides an in-depth overview of the real-world threats, as sourced by Proofpoint’s telemetry encompassing more than 18 million end-user reported emails and 135 million simulated phishing attacks sent over a one-year period. 

Eight in 10 organisations (84%) experienced at least one successful criminal email-based phishing attack in 2022. 

These phishing attacks have direct financial losses and have increased by 76% compared to 2021, and while brand impersonation, business email compromise (BEC), and ransomware remained popular tactics among threat actors, cyber criminals also scaled up their use of less familiar attack methods to infiltrate global organisations.

This year’s report examines perceptions of 7,500 employees and 1,050 security professionals across 15 countries, revealing startling gaps in security awareness and cyber hygiene that propagate the real-world attack landscape.“While conventional phishing remains successful, many threat actors have shifted to newer techniques, such as telephone-oriented attack delivery and adversary-in-the-middle (AitM) phishing proxies that bypass multifactor authentication. 

These techniques have been used in targeted attacks for years, but 2022 saw them deployed at scale.” said Ryan Kalember, executive vice president, cyber security strategy, Proofpoint. 

“We have also seen a marked increase in sophisticated, multi-touch phishing campaigns, engaging in longer conversations across multiple personas. Whether it’s a nation state-aligned group or a BEC actor, there are plenty of adversaries willing to play the long game.” Kalember added.

Key Findings Include

Cyber Extortion Continues to Wreak Havoc:   Seventy-six percent of organisations experienced an attempted ransomware attack in the past year, with 64% suffering a successful infection; yet only half regained access to their data after making the initial ransomware payment.

Alarmingly, over two-thirds of respondents said their organisation experienced multiple, separate ransomware infections.

Most infected organisations paid up, and many did so more than once. Of the organisations impacted by ransomware, the overwhelming majority (90%) had a cyber insurance policy in place for ransomware attacks, and most insurers were willing to pay the ransom either partially or in full (82%). 

This also explains the high propensity to pay, with 64% of infected organisations paying at least one ransom, a six-point increase year-over-year.

End Users Fall Prey to Bogus “Microsoft” Emails:   In 2022, Proofpoint observed nearly 1,600 campaigns involving brand abuse across its global customer base. While Microsoft was the most abused brand name with over 30 million messages using its branding or featuring a product such as Office or OneDrive, other companies regularly impersonated by cyber criminals included Google, Amazon, DHL, Adobe, and DocuSign. 

It’s worth noting that AitM attacks will display the organisation’s real login page to the user, which in many cases will be Microsoft 365.

Considering the volume of brand impersonation attacks, it’s alarming that nearly half (44%) of employees indicate they think an email is safe when it contains familiar branding, and 63% think an email address always corresponds to the matching website of the brand. 

Half of the 10 phishing simulation templates most used by Proofpoint customers were brand-impersonation related, which also tended to have high failure rates.

Business Email Compromise - Cyber Fraud Goes Global:   On average, three-quarters of global organisations reported an attempted BEC attack last year. While English is the most common language employed, some non-English-speaking countries are starting to see higher volumes of attacks in their own languages. 

BEC attacks were higher than the global average or experienced a notable increase compared to 2021:

  • The Netherlands 92% (not featured in prior analysis)
  • Sweden 92% (not featured in prior analysis)
  • Spain 90% vs. 77% (13% increase)
  • Germany 86% vs. 75% (11% increase)
  • France 80% vs. 75% (5% increase)

Insider Threats:   Pandemic-related job mobility, coupled with post-pandemic economic uncertainty, has resulted in large numbers of workers changing or leaving jobs to the tune of one in four employees in the past two years. 

This job market trend makes data protection more difficult for organisations, with 65% reporting they have experienced data loss due to an insider’s action. Among those who have changed jobs, nearly half (44%) admitted to taking data with them.

Threat Actors Scale Up More Complex Email Threats:   Over the past year, hundreds of thousands of telephone-oriented attack delivery (TOAD) and multi-factor authentication (MFA) bypass phishing messages were sent each day, ubiquitous enough to threaten nearly all organizations. At its peak, Proofpoint tracked more than 600,000 TOAD attacks, emails that incite recipients to initiate a direct conversation with attackers over telephone via bogus ‘call centers’, per day, and the number has been steadily rising since the technique first appeared in late 2021.

Room for Improvement with Cyber Hygiene:   Threat actors always innovate, and once again this year’s report shows that most employees suffer security awareness gaps. Even basic cyber threats are still not well understood, more than a third of survey respondents cannot define “malware,” “phishing,” and “ransomware.” 

Furthermore, only 56% of organisations with a security awareness program train their entire workforce, and only 35% conduct phishing simulations, both critical components to building an effective security awareness program. 

As email remains the favoured attack method for cyber criminals and they adopt new  techniques which are much less familiar to employees, there is clear value in building a culture of security across the entire organisation.  

You Might Also Read:  

Human Error Is A Hacker's Dream:

___________________________________________________________________________________________

If you like this website and use the comprehensive 6,500-plus service supplier Directory, you can get unrestricted access, including the exclusive in-depth Directors Report series, by signing up for a Premium Subscription.

  • Individual £5 per month or £50 per year. Sign Up
  • Multi-User, Corporate & Library Accounts Available on Request

Cyber Security Intelligence: Captured Organised & Accessible


 

 

« The Dark Side Of AI
Cyberwar: Lessons From Ukraine »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

NordLayer

NordLayer

NordLayer is an adaptive network access security solution for modern businesses — from the world’s most trusted cybersecurity brand, Nord Security. 

Cyber Security Supplier Directory

Cyber Security Supplier Directory

Our Supplier Directory lists 6,000+ specialist cyber security service providers in 128 countries worldwide. IS YOUR ORGANISATION LISTED?

ON-DEMAND WEBINAR: What Is A Next-Generation Firewall (and why does it matter)?

ON-DEMAND WEBINAR: What Is A Next-Generation Firewall (and why does it matter)?

Watch this webinar to hear security experts from Amazon Web Services (AWS) and SANS break down the myths and realities of what an NGFW is, how to use one, and what it can do for your security posture.

CSI Consulting Services

CSI Consulting Services

Get Advice From The Experts: * Training * Penetration Testing * Data Governance * GDPR Compliance. Connecting you to the best in the business.

Alvacomm

Alvacomm

Alvacomm offers holistic VIP cybersecurity services, providing comprehensive protection against cyber threats. Our solutions include risk assessment, threat detection, incident response.

it-sa 365

it-sa 365

it-sa 365 is a digital platform for connecting IT security vendors and experts with those who bear responsibility for IT security in management and technology.

IoT Security Foundation (IoTSF)

IoT Security Foundation (IoTSF)

IoTSF is a collaborative, non-profit organisation with a mission to raise the quality and drive pervasive security in the Internet of Things.

Centre for Cyber Security (CFCS) - Denmark

Centre for Cyber Security (CFCS) - Denmark

The Centre for Cyber Security is the Danish national IT security authority, Network Security Service and Centre for Excellence within cyber security.

Cybersecurity Credentials Collaborative (C3)

Cybersecurity Credentials Collaborative (C3)

C3 provides a forum for collaboration among vendor-neutral information security and privacy and related IT disciplines certification bodies.

Asseco Group

Asseco Group

Asseco Poland stands at the forefront of the multinational Asseco Group. We are a leading provider of state-of-the-art IT solutions in Central and Eastern Europe.

Seculert

Seculert

The Seculert Attack Detection & Analytics Platform combines machine-learning based analytics and threat intelligence to automatically detect cyber attacks inside the network.

Neurosoft

Neurosoft

Neursoft is a fully integrated ICT company with Software Development, System Integration and Information Technology Security capabilities.

Quokka

Quokka

Quokka (formerly Kryptowire) is the source for mobile security and privacy solutions, staying steps ahead of the threat and delivering peace of mind.

National Cybersecurity Student Association (NCSA)

National Cybersecurity Student Association (NCSA)

The National Cybersecurity Student Association is a one-stop-shop to enhance the educational and professional development of cybersecurity students through activities, networking and collaboration.

Privacera

Privacera

Privacera enables consistent data governance, security, and compliance across all your data services - on-premises and in the cloud - so you can maximize the value of your data.

Newtec Services

Newtec Services

IT should be responsive, adaptive, and smart. Now more than ever, you need a business that runs efficiently and can adapt to today's challenges. We can help with custom IT solutions.

Axis Security

Axis Security

Axis Security technologies transform open networks and vulnerable applications into fully protected resources that the business can trust.

Secura B.V.

Secura B.V.

Secura is an independent specialized cybersecurity expert, providing insights to protect valuable assets and data.

Panther Labs

Panther Labs

Panther’s mission is to make security monitoring fast, flexible and scalable for all security teams.

CyberGate Technologies

CyberGate Technologies

CyberGate Technologies is a world-class, customer focus cyber security service and consultancy company operating the UK, Europe, Middle East, and Africa.

XONA

XONA

XONA is The Zero Trust user access platform for the OT enterprise. Secure operational access to critical systems - from anywhere.