In 2020, 75% of companies worldwide experienced a phishing attack. Phishing remains one of the biggest dangers to your business’s health and well-being because it’s the primary delivery method for all cyberattacks. You don’t have to be in business to be susceptible to cyber-attack, especially since we all get hundreds of emails a day from companies we do work with as well as some we don’t
One phishing email can be responsible for a company succumbing to ransomware and facing costly downtime. It can also lead a user to unknowingly hand over the credentials to a company email account the hacker uses to send targeted attacks to customers.
Phishing takes advantage of human error, and some phishing emails use sophisticated tactics to fool the recipient into divulging information or infecting a network with malware.
Mobile phishing threats skyrocketed by 161% in 2021
Technology Press
Your best safeguards against the continuous onslaught of phishing include:
- Email filtering: Domains (where your email is stored) get inundated with emails to the point that it is normal to have hundreds, even thousands of emails, in your typical inbox. Email filtering looks out for emails from less than reputable sources and tries to route those emails out of your inbox so that there is no temptation to fall for a phishing scam.
- DNS filtering: Websites get visits from many people and robots every second or every day. When you are shopping online, your IP address is what distinguishes you from someone else. Suppose specific IP addresses get regularly flagged as threats by their behavior or reputation. In that case, DNS filtering blocks those IP addresses from accessing the site, reducing hack attempts on your business or nonprofit website.
- Next-gen antivirus/anti-malware: Traditional antivirus software uses definition libraries and heuristics (uses observed patterns to try and protect you based on observations.) It was effective, but as the bad guys got more advanced, developers used cloud learning and artificial intelligence to predict better what might be a virus with the power of our collective computing experience.
- Ongoing employee cybersecurity awareness training: To properly train your employees and ensure your IT security is being upgraded to meet the newest threats, you need to know what new phishing dangers are headed your way. Here are some of the latest phishing trends that you need to watch out for in 2022.
PHISHING IS INCREASINGLY BEING SENT VIA TEXT MESSAGE
Fewer people are suspicious of text messages than unexpected email messages. Most phishing training is usually focused on the email form of phishing because it’s always been the most prevalent. But cybercrime entities are now taking advantage of the easy availability of mobile phone numbers and using text messaging to deploy phishing attacks.
This type of phishing (called “smishing”) is growing in volume. People are receiving more text messages now than ever, mainly due to retailers and service businesses pushing their text updates for sales and delivery notices. This makes it even easier for phishing via SMS to fake a shipment notice and get a user to click on a shortened URL.
BUSINESS EMAIL COMPROMISE IS ON THE RISE
Ransomware has been a growing threat over the last few years largely because it’s been a big money-maker for the criminal groups that launch cyberattacks. A new up-and-coming form of attack is beginning to be quite lucrative and thus is also growing. Business email compromise (BEC) is rising and being exploited by attackers to profit from gift card scams and fake wire transfer requests.
What makes BEC so dangerous (and lucrative) is that when a criminal gains access to a business email account, it can send very convincing phishing messages to its employees, customers, and vendors. The recipients will immediately trust the familiar email address, making these emails potent weapons for cybercriminals.
SMALL BUSINESSES ARE BEING TARGETED MORE FREQUENTLY WITH SPEAR PHISHING
There is no such thing as being too small to be attacked by a hacker. Small businesses are targeted frequently in cyberattacks because they tend to have less IT security than larger companies. 43% of all data breaches target small and mid-sized companies, and 40% of small businesses that become victims of an attack experience at least eight hours of downtime.
Spear phishing is more dangerous because it’s targeted and not generic. It’s the type deployed in an attack using BEC. It used to be that spear-phishing was used for larger companies because it takes more time to set up a targeted and tailored attack. However, as large criminal groups and state-sponsored hackers make their attacks more efficient, they can easily target anyone. Small businesses receive more tailored phishing attacks that are harder for their users to identify as scams.
THE USE OF INITIAL ACCESS BROKERS TO MAKE ATTACKS MORE EFFECTIVE
We just discussed that large criminal groups continually optimize their attacks to make them more effective. They treat cyberattacks like business and work to make them more profitable. Hackers process-improve phishing attacks by using outside specialists known as Initial Access Brokers. This hacker only focuses on getting the initial breach into a network or company account. The increasing use of these experts makes phishing attacks even more dangerous and difficult for users to detect.
BUSINESS IMPERSONATION IS BEING USED MORE OFTEN
As users have gotten savvier about being careful of emails from unknown senders, phishing attackers have increasingly used business impersonation. This is where a phishing email will look like a legitimate email from a company with which the user may know or even do business. Amazon is a common target of business impersonation, but it also happens with smaller companies.
For example, there have been instances where website hosting companies have had client lists breached. Those companies sent emails impersonating the hosting company and asking the users to log in to an account to fix an urgent problem. More business impersonation used in phishing attacks means users must be suspicious of all emails, not just those from unknown senders.
ARE YOU ADEQUATELY PROTECTED FROM PHISHING ATTACKS?
Using a multi-layered strategy is essential to defend against one of the biggest dangers to your business’s well-being. Get started with a cybersecurity audit to review your security posture and identify improvement ways.
The article is used with permission from The Technology Press.