Greater than 9 in 10 (92%) organizations skilled a median of six credential compromises attributable to email-based social engineering assaults in 2023, in line with a brand new report by Barracuda.
Scamming and phishing continued to make up the overwhelming majority (86%) of social engineering assaults final 12 months.
There have been some notable tendencies in how attackers are focusing on customers by way of social engineering strategies:
- Dialog hijacking: That is the place attackers compromise enterprise accounts by way of phishing assaults, after which monitor the compromised account to know enterprise operations and to find out about offers in progress, cost procedures and different particulars. This info is leveraged to craft authentic-looking and convincing messages from the impersonated domains to trick victims into wiring cash or updating cost info. Dialog hijacking solely made up 0.5% of social engineering assaults in 2023, however this represents an almost 70% rise in comparison with 2022.
- Enterprise electronic mail compromise (BEC): These assaults, through which the hacker usually impersonates an execute to trick workers to switch cash, typically by way of reward playing cards and wire transfers, made up 10.6% of social engineering assaults final 12 months, up from 8% in 2022.
- Extortion: These assaults contain hackers threaten to show delicate or embarrassing content material to their victims’ contacts until a ransom is paid out. Extortion assaults made up 2.7% of the entire social engineering assaults in 2023.
Attackers Evolving Use of Reputable Companies
The Barracuda report highlighted the evolving use of professional companies to focus on workers by way of these social engineering strategies.
Gmail was by far probably the most used electronic mail area for social engineering assaults, making up 22% of assaults final 12 months.
The subsequent mostly used free webmail companies by hackers have been Outlook (2%), Hotmail (1%), iCloud (1%) and Mail.com (1%). All different domains made up 73% of assaults.
Assaults that used Gmail have been significantly skewed in direction of BEC, with greater than 50% Gmail assaults used for this objective.
Scamming accounted for 43% of assaults utilizing Gmail in 2023.
The researchers additionally discovered that cybercriminals are more and more leveraging in style business URL shortening companies to embed malicious hyperlinks in phishing emails.
This tactic will help disguise the true nature and vacation spot of the hyperlink as they typically seem to come back from legitimate-looking websites.
Essentially the most extensively used URL shortening service final 12 months was bit.ly, which was leveraged in almost 40% of assaults that included a shortened URL.
The subsequent mostly used of those companies was from X (previously Twitter), utilized in 16% of assaults that included a shortened URL.
This marks a significant change in comparison with earlier analysis in 2020, when X’s shortening service was utilized in round two-thirds of those assaults (64%), and bit.ly in simply 3%.
One other notable development highlighted within the report was a major rise in QR code phishing assaults in late 2023. Round 5% of mailboxes have been focused with QR code assaults within the final quarter of the 12 months.
In these assaults, cybercriminals embed the QR codes in phishing emails, prompting customers to scan the code and go to a pretend web page that seems to be a trusted service or software. These pages are usually designed to trick customers into downloading malware or enter their login credentials.
The researchers famous that QR code assaults are troublesome to detect utilizing conventional electronic mail filtering strategies as there is no such thing as a embedded hyperlink or malicious attachment to scan.
QR codes despatched by way of electronic mail additionally take victims away from company machines and power them to make use of a private system, corresponding to a telephone or iPad, which isn’t protected by company safety software program.
