• Ingenious imitation, fake GDPR notices, and phishing on behalf of internet giants found in 120 million malicious emails targeting businesses in 2018.
Spam and phishing techniques are still heavily used by cybercriminals to attack businesses, according to Kaspersky Lab’s Spam and phishing in 2018 report. The report reveals cybercriminals tried to use more tricks to reach businesses in 2018; with 120 million attempted attacks through malicious emails. Fraudsters put more effort into imitating genuine business communications and even disguised themselves as large internet companies. They also took advantage of global business policies, such as GDPR. To avoid becoming victims, companies should ensure their mailboxes have special protection to safeguard them against such techniques.
In many cases, corporate email is the first gateway to corporate infrastructures. For cybercriminals, outwitting employees with phishing emails is one of the most efficient ways to instigate a breach. Kaspersky Lab’s research for 2018 revealed a trend in highly detailed malicious messages, designed to mimic an authentic piece of communication, like a real letter from a bank or accountancy firm. Often they contain a genuine logo, name and title of a real employee, as well as attachments not typically used by spammers (such as ISO, IQY, PIF, and PUB) so as to bypass security solutions.
Global internet companies were the biggest victims of phishers in 2018. Among a wide range of different sectors, it was found that 24% of attacks were made against web portals. The most common companies that criminals posed as in their phishing emails were Microsoft, Facebook, and PayPal.
Cybercriminals could get user’s credentials after such phishing and illegitimately selling them. After bank accounts, credentials to access well-known internet services fetch the highest prices on the dark web. For example, Facebook logins have almost doubled in value since 2017.
In the second quarter of 2018, when companies all over the world were busy adopting GDPR, there was an increase in the number of spam and phishing emails connected to the legislation. Scammers attacked financial organizations by sending GDPR-related phishing emails to their customers asking them to update their login credentials. When a user clicked on a link, they were redirected a fake bank page. Once they entered their credentials, fraudsters were given control and became able to take advantage of them.
“Communication is key for any organization. As email continues to be the most popular method of corporate communications, it remains a tempting target for criminals. Phishing allows them to circumvent protected information systems. Social engineering continues to deceive and, as the statistics show, criminals remain highly active in using it to infiltrate systems. Preventive measures, such as educating employees about cyberthreats, are extremely important. But businesses should also ensure they have specific protection on their mail servers and mail gateways,” comments Sergey Martsynkyan, Head of B2B Product Marketing, Kaspersky Lab.
To ensure businesses minimize the potential to be breached by email spam and phishing, Kaspersky Lab recommends that they implement the following steps:
- Companies should educate their employees to always check the address of a link in emails or messages that have come from an unfamiliar sender. In addition, check the sender’s email address before clicking anything or opening attachments
- Show employees how to recognize fake or insecure websites and to never enter their credentials before checking a website’s credibility
- Introduce security awareness initiatives, including gamified training with repetition of simulated phishing attacks
- Use a dedicated security solution for the mail server. To help businesses securely use Exchange Online inside the Microsoft Office 365 suite, Kaspersky Lab offers Kaspersky Security for Microsoft Office 365 that reinforces protection from spam, phishing, malicious attachments and unknown threats that may be spread through emails
