Latest tactics used by cybercriminals to bypass traditional email security

Cybercriminals are continuously using new strategies to get past email security gateways, with brand impersonation being used in 83 percent of spear-phishing attacks, while 1 in 3 business email compromise attacks are launched from Gmail accounts.

Sextortion scams, a form of blackmail that makes up 10 percent of all spear-phishing attacks, continue to increase. Employees are also twice as likely to be the target of blackmail than business email compromise.

These are the key findings from a report with the title Spear Phishing: Top Threats and Trends released by Barracuda. Researchers evaluated more than 360,000 spear-phishing emails in a three-month period, identifying and analyzing three major types of attacks: brand impersonation, business email compromise, and blackmail.

The report takes an in-depth look at how these three types of attacks work, why traditional email security can’t stop them, the latest techniques scammers are using, and how organizations can protect against these attacks.

A closer look at evolving threats

The research uncovered fresh insights into how these popular attacks are evolving and the tactics they are using to evade detection.

• Impersonating Microsoft is one of the more common techniques used by hackers trying to take over accounts.
• Financial institutions are impersonated in nearly 1 in 5 attacks. Finance department employees are heavily targeted, as they are most likely to deal with banks and other financial institutions.
• The majority of subject lines on sextortion emails contain some form of security alert.
• Attackers often include the victim’s email address or password in the subject line.
• Subject lines on more than 70 percent of business email compromise attack emails try to establish rapport or a sense of urgency; many imply the topic has been previously discussed.
• Scammers use name-spoofing techniques, changing the display name on Gmail and other email accounts to make the email appear to come from a company employee. This tactic can be especially deceiving to those reading the email on a mobile device.

“Spear phishing attacks are designed to evade traditional email security solutions, and the threat is constantly evolving as attackers find new ways to avoid detection and trick users,” said Asaf Cidon, VP, Content Security at Barracuda Networks.

“Staying ahead of these types of attacks requires the right combination of technology and user training, so it’s critical to have a solution in place that detects and protects against spear-phishing attacks, including business email compromise, brand impersonation, and sextortion.”