Spear-phishing attacks on the rise, with risk to small businesses

According to a new report by Barracuda, Spear-phishing attacks are evolving and becoming significantly more common.

The report titled Spear Phishing: Top Threats and Trends Vol. 7 found that between January 2021 and December 2021, an average employee of a small business with less than 100 employees would experience 350% more social engineering attacks than an employee of a larger enterprise.

51% of social engineering attacks were found to be phishing, highlighting the significant danger these types of threats pose to businesses.

Conversation hijacking or vendor impersonation was also found to be a significantly common threat. This occurs when threat actors place themselves into existing business conversations or initiate new conversations based on information they've gathered from compromised email accounts or other sources. This type of attack grew almost 270% in 2021.

When it came to the most impersonated brands, Microsoft was at the top of the list. Around 57% of phishing attacks were found to impersonate one of Microsoft's brands, such as Microsoft 365, OneDrive, SharePoint, or others.

Account takeover was one of the fastest-growing threats highlighted in the report. In 2021, roughly 1 in 5 organisations (20%) had at least one of their Microsoft 365 accounts compromised. This means that in 2021 hackers managed to compromise around 500,000 Microsoft 365 accounts around the globe.

Other brands found to be significant targets for threat actors included DocSign, Google, DHL, USPS, and LinkedIn. These accounts often contain a wealth of sensitive information and will provide hackers with information they can exploit in further attacks.

Job position and role also had an impact on the frequency of attacks, with accounts of CEOs and CFOs almost twice as likely to be taken over compared to average employees.

Executive assistants were also a popular target as they often have access to executive accounts and calendars and can send messages out on behalf of executive teams.

Surprisingly, almost 12,000 compromised accounts showed that they were used to send over 3 million malicious messages and spam in 2021.

"Small businesses often have fewer resources and lack security expertise, which leaves them more vulnerable to spear-phishing attacks, and cybercriminals are taking advantage," says Barracuda SVP, engineering - product management, email protection Don MacLennan.

"That's why it's important for businesses of all sizes not to overlook investing in security, both technology and user education. The damage caused by a breach or a compromised account can be even more costly."

The company recommends a range of factors to help prevent further threats, ranging from implementing DMARC authentication and reporting, to automated incident response and staff training to discover and eliminate threats before they pose damage.

They also say that AI, account-takeover protection and email monitoring can help prevent threat actors from accessing valuable information and finding breach opportunities.