Story image

Email fraud increased by 476% in last year - Proofpoint

08 Feb 2019

Cybersecurity and compliance company Proofpoint has today released its Q4 2018 Threat Report, highlighting the threats and trends across Proofpoint’s global customer base and in the wider threat landscape.

One of the most notable trends centres on the rapid increase of email fraud attacks, also known as business email compromise.

Overall, Proofpoint researchers observed that the number of email fraud attacks against targeted companies increased 226% between Q3 2018 and Q4 2018, and 476% when comparing Q4 2017 and Q4 2018.

Proofpoint Asia-Pacific and Japan vice president Tim Bentley says, “Email fraud has seen explosive growth and it’s clear that today’s cybercriminals are relentlessly targeting people, rather than infrastructure.”

“As these threats continue to grow in volume and sophistication, it is imperative that organisations implement a people-centric security approach that includes a comprehensive email fraud defence and security awareness training.

“Ultimately, organisations must consider the individual risk each user represents, and understand how they are targeted, in order to better protect them.”

Every day, Proofpoint analyses more than five billion email messages, hundreds of millions of social media posts, and more than 250 million malware samples

Additional Q4 2018 Proofpoint threat findings

Banking Trojans remained the top email-borne threat in Q4 2018, making up 56% of all malicious payloads.

Of those, 76% were classified as Emotet.

Remote access Trojans accounted for 8.4% of all malicious payloads in Q4 and 5.2% for the year, marking a significant change from previous years in which they were rarely used by crimeware actors.

Social media channels remain key vectors for fraud and theft.

While the platforms themselves continue to develop automated protections, social media fraud remains a key challenge for consumers and the brands in which they interact, with fraudulent social media support account phishing, or ‘angler phishing’, increasing by 442% year-on-year. Interestingly, phishing links on social channels continue to drop as platforms address this issue algorithmically.

Steps to improve cybersecurity efforts

Organisations can further protect themselves in the coming months by taking the following steps:

  • Assume users will click – Social engineering is increasingly the most popular way to launch email attacks and criminals continue to find new ways to exploit the human factor. Leverage a solution that identifies and quarantines both inbound email threats targeting employees and outbound threats targeting customers before they reach the inbox.
     
  • Build a robust email fraud defence – Highly-targeted, low volume business email compromise scams often have no payload at all and are thus difficult to detect. Invest in a solution that has dynamic classification capabilities that you can use to build quarantine and blocking policies.
     
  • Protect your brand reputation and customers – Fight attacks targeting your customers over social media, email, and mobile—especially fraudulent accounts that piggyback on your brand. Look for a comprehensive social media security solution that scans all social networks and reports fraudulent activity.
     
  • Partner with a threat intelligence vendor – Smaller, more targeted attacks call for sophisticated threat intelligence. Leverage a solution that combines static and dynamic techniques to detect new attack tools, tactics, and targets—and then learns from them.
     
  • Train users to spot and report malicious email: Regular training and simulated attacks can stop many attacks and help identify people who are especially vulnerable. The best simulations mimic real-world attack techniques. Look for solutions that tie into current trends and the latest threat intelligence.
Venafi and nCipher Security partner on machine identity protection
Cryptographic keys serve as machine identities and are the foundation of enterprise information technology systems.
Why Aussie companies are struggling with data
The top culprits in poor data quality in Oz are human error, different data sources, lack of comms, inadequate strategy, and too much information.
Machine learning is a tool and the bad guys are using it
KPMG NZ’s CIO and ESET’s CTO spoke at a recent cybersecurity conference about how machine learning and data analytics are not to be feared, but used.
Pure Storage expands enterprise data management solutions
It has integrated StorReduce technologies for a cloud-native back up platform, and expanded its data fabric solution for cloud-based applications.
Survey finds DC managers want more efficiency, not horsepower
More servers and more CPU power used to be the answer to boosting data centre performance, but it appears this is no longer the case.
GoCardless to double A/NZ team by end of year
With a successful E round of investment and continuing organic growth globally, the debit network platform company aims to expand its local presence.
Micro Focus acquires Interset to improve predictive analytics
Interset utilises user and entity behavioural analytics (UEBA) and machine learning to give security professionals what they need to execute threat detection analysis.
TechOne bringing solar lights to students in need
The company is partnering with charity SolarBuddy to bring solar-powered lights to children in energy poverty to alleviate study stress after dark.