No matter what else is going on in the cybersecurity world, it seems that phishing is always the number one topic. This is because it’s still the main conduit used to spread a wide variety of different attacks.
Just consider how you use email in your business. It can be used for internal communications, customer marketing, coordination with vendors, and the list goes on. Phishing is used similarly as an all-purpose method to send out attacks for everything from ransomware to credential theft.
In order to combat phishing and avoid falling victim to a cyberattack, it’s important to know what new tactics are being used to fool people into clicking on malicious links or to open malware-laden file attachments.
Your employee awareness training should be updated regularly to keep your team sharp, so they’ll be on the lookout for ever more sophisticated phishing attacks.
Here are some of the new and alarming phishing trends being seen by cybersecurity experts.
Use of Phishing via SMS
Most people tend to trust the text messages they receive and wouldn’t suspect a fake message. A mobile phone number is generally seen as more protected than an email address, which can be easily shared throughout the internet as soon as you use it to create an account.
But this is becoming less the case. Text messaging is beginning to replace emails for company communications; thus, those numbers are also getting leaked and shared more often.
For example, you may get a text from your favorite retailer about a new sale, from your dentist’s office for your next appointment, and from Amazon about a shipment delivery. We’ve come to expect these.
Phishing scammers are increasingly using SMS as a way to spread malware. Links are not as easy to discern in a text message, as you can’t hover over them the same way you can when using a mouse on a desktop.
Spear Phishing of Smaller Businesses
Spear phishing involves spending some time to learn about a company and its personnel to send a targeted phishing campaign. These are much more successful at fooling users than generic phishing emails because they contain personal elements.
Spear phishing elements might include:
- Making an email appear as it’s from one of your vendors
- Using the signature of a company executive
- Personalising the email with the name and position of the recipient
Increasingly, spear phishing is being used on smaller companies, not just large enterprise organisations. This is due in large part to the lucrative nature of ransomware. Even smaller companies can be scammed out of thousands of dollars in a ransomware attack.
Employees need to be aware that they can’t trust an email just because it may have personal details in it that are real.
Threats of Having an Incriminating Recording
One of the new phishing scams going around is extortion by threatening to release an incriminating recording.
The attacker might use a mention of a recent malware hack in the news, just to add some legitimacy to the message and then note that the victim’s computer was hacked, and spyware was used to record the sites they were visiting.
In most cases, no such recordings exist, but if a person was visiting a site recently that they’d be embarrassed to have others know, they may just pay the attacker out of fear.
Increased Use of Brand Impersonation
Brands are often impersonated in emails that are spoofed using the company’s logo and signature. This has been done for a while to large companies like Amazon, with fake receipts being sent out containing links to phishing sites designed to steal logins.
This is happening increasingly, and not just with larger organisations. Scammers will often impersonate a smaller company as part of a spear-phishing campaign to get users to believe an email is being sent internally. When employees see their company domain as the “sender” they can immediately be fooled into believing what the message tells them.
One way to combat this in your company is to institute an email security policy that alerts the recipient when an email originated outside the company network.
More Use of Initial Access Brokers
Cyberattacks keep getting more sophisticated because they’re now being largely run by large criminal organisations and state-sponsored hacking groups. They are run like any other business venture and optimised for efficiency and effectiveness.
One way that criminal groups are doing this is through the use of initial access brokers. These are hackers that specialise in the first step of a hack, getting inside a company network or cloud account.
Phishing attackers are outsourcing that initial breach to these experts, who then hand over the access keys once they’ve breached the victim’s system.
How Strong Are Your Safeguards Against Phishing?
NetCare can help your Sydney area business review your phishing safeguards and put any needed precautions in place to protect your network and cloud accounts.
Contact us today to learn more. Call (02) 9114 9920 or .