Gone Phishing

This stat always hooks me: 91% of cyberattacks begin with spear phishing emails.

91%! Yes, more than 9 out of 10 successful attacks start with spear phishing.

As you may know, phishing is all about attempting to gain access to sensitive information by acting as a trusted source over email. In normal phishing, this generally involves sending bulk emails. In spear phishing, it’s about targeting a specific person or related group of individuals. Fun fact: Phishing was first described at an International HP Users Group…. in 1987!

Correlate phishing with someone acting as a foreign prince trying to share his inherited wealth and spear phishing with someone masquerading as a customer and requesting equipment to be sent to a fishy address. Both scams work, but spear phishing has seen a major uptick, casting a much wider net, and can be considered the more elevated or professional attack method. After all, the major Target breach in 2014 started with a successful spear phishing campaign against a small HVAC vendor.

In addition, ransomware is commonly distributed via spear phishing. A user will click on a malicious link or attachment that results in a malware program executing on the machine and encrypting all files. Even more troubling than the aforementioned statistics is that 77% of surveyed organizations impacted by ransomware were running up-to-date endpoint security at the time of attack. This tells us that not only are spear phishing emails successfully avoiding email filters on a normal basis, but common endpoint security solutions (e.g., anti-virus) are incapable of stopping most malware and ransomware strains.

So what should we look for? 94% of targeted emails had malicious file attachments attached to the email itself as the source of delivery, while only 6% utilized a malicious link. Amongst that 94%, .RTF, .XLS, and .ZIP files accounted for 66% of file types. The typical .EXE we’ve learned to avoid is no longer prevalent amongst common attacks. In my industry, I personally believe an Excel .XLS file type is the most likely to be clicked on. Imagine receiving an email from someone who appeared to be a customer or partner with an Excel attachment labeled as a quote or inventory list – how likely would you be to click on it?

Consider the enormous task you have of protecting your end users. You should begin by establishing robust human firewalls (i.e., your employees), while also adopting leading solutions capable of detecting and stopping modern malware. In the end, it’s a carefully crafted combination of people, processes, and platforms that enable a safe digital workplace.  If you are struggling with this, it’s time to partner with a team of experts to ensure the safety of your information—as well as your customers’ information.

 
[ GUIDE ] Building HUMAN FIREWALLS:
10 Steps to Cyber AWareness

Are your employees equipped to act as a human firewall, defending your organization against attempted cyber attacks?

The statistics are staggering: spear phishing accounts for 95% of enterprise network attacks, according to the SANS Institute. Since attacker can craft messages to your employees posing as a reputable contact, technology can only do so much. To effectively prevent your organization from falling victim to cyber attacks, it’s essential that your employees develop strong cyber instincts. 

This guide contains an overview of ConvergeOne’s 10 steps to creating a cyber aware culture, including key questions and ideas for tackling each step.