sb-au logo
Story image

Email fraud attacks take fast and furious approach to their business targets

22 May 2018

Socially-engineered email fraud attacks are becoming ever more frequent as criminals opt to conduct fewer mass attacks and instead hit specific organisations more frequently.

New research from Proofpoint’s analysis of thousands of organisations in Q1 2018 found that 90% were targeted by email fraud in the quarter.

Email fraud attacks also rose 55% compared to the previous quarter, and 103% year-over-year.

Overall, the average number of emails targeting a specific firm in Q1 totalled 28 – a 36% increase over the previous quarter and a 28% increase year-over-year.

Organisations of all sizes and verticals in all countries are at risk, Proofpoint says. The most commonly targeted vertical in Q1 was the real estate industry as fraudsters seek to take advantage of high-value, time-sensitive transactions.

“We found no statistical correlation between the size of the company and how frequently it was targeted by email fraud. While larger organisations may be richer targets, small companies may be more vulnerable,” Proofpoint says.

Fraudulent emails rely on similar tactics to those used in the past: the top three subject lines included ‘request’, ‘payment’, and ‘urgent’. Proofpoint notes that these words align with the fact that wire transfer scams are the most common form of email fraud.

Fraudsters are also spoofing an average of 13 identities and targeting 17 people within a given organisation.

“Email fraud has truly become a multi-dimensional problem as 41% of companies had more than 5 people’s identities spoofed and more than 5 people targeted,” Proofpoint notes.

In Q1, 98.42% of email attacks uses ‘display name’ spoofing as part of their attacks. More than half (53%) of the fraudulent emails were sent from webmail accounts such as Gmail.

Attackers also used domain spoofing for 27% of all email fraud attacks. This is where an attacker hijacks an organisation’s trusted domain.

“Lookalike domains, or cousin domains, represented 4% of the domain types used in Q1. Of these attacks, the most common technique used was to swap individual characters (i.e. replacing a “5” for an “s” or a “0” for an “o”). Other leading techniques included adding or removing the leading/trailing characters (i.e. adding an “s” at the end of a domain) and inserting an additional character (i.e. using “rn” to replace “m”),” Proofpoint states.

Proofpoint says that business email compromise fraud cost organisations more than $675 million in 2017.

Proofpoint’s advice for protecting against email fraud:

  • Email fraud continues to rise at unprecedented rates. Cybercriminals can leverage multiple tactics to try and evade detection, leaving your employees, customers, and business partners as the last line of defense. Organisations need to solve this problem with multiple layers of security that include:
  • Dynamic classification. Analyse the content and context of the email and stop display name and lookalike domain spoofing at the email gateway.
  • Email authentication. Validate the identities of email senders that use an organisation’s trusted domains and instruct the gateway what to do with messages that fail authentication.
  • Lookalike domain monitoring. Identify and flag potential risky domains outside of your control.
Story image
Cybersecurity spending to increase following SolarWinds hacking
Hackers breached software provider SolarWinds, directly infecting the company’s Orion software as well as several local, state and federal agencies.More
Story image
Palo Alto Networks advances attack surface management with Expanse
"By integrating Expanse's attack surface management capabilities into Cortex after closing, we will be able to offer the first solution that combines the outside view of an organisation's attack surface with an inside view to proactively address all security threats."More
Story image
Dark net vendors wanting Bitcoin payments for unverified COVID-19 vaccines
As the medicines are being offered on the dark net, purchasers have no way of knowing whether they are genuine, according to Check Point.More
Story image
Cyberattacks on healthcare organisations "out of control" - Check Point
There has been a 45% increase in cyberattacks on healthcare organisations worldwide in the last two months, making healthcare the most targeted industry by cyber criminals.More
Story image
Red Hat to acquire Kubernetes-native security provider StackRox
Red Hat will further expand its security offering, adding StackRox's complementary capabilities to strengthen integrated security across its open hybrid cloud portfolio.More
Story image
Check Point exposes Android malware vendor using dark net to rebrand products
Check Point security researchers have exposed an Android malware vendor using a marketer on the dark net to rebrand its products, with the intention of supercharging business and throwing off security vendors. More