Impossible to Guard Against! The Rise of New Cyber Attack Strategies

The latest research shows that although phishing, business email compromise (BEC), and ransomware remain the three most prevalent cyber attack techniques, a combination of new types of attacks is quietly emerging.

Many attackers are no longer satisfied with traditional phishing methods and have turned to newer techniques, such as telephone-oriented attack delivery (TOAD) and adversary-in-the-middle (AitM) phishing proxies to bypass multi-factor authentication. These techniques have been used in targeted attacks for years, but it wasn't until 2020 that they began to be deployed on a large scale.

Proofpoint recently released a report based on a survey of 7,500 employees and 1,050 security professionals across 15 countries, as well as internal telemetry data monitoring over 18 million user-reported emails and 135 million simulated phishing attacks over a year.

▍Ransomware and Email-Based Attacks Are the Top Culprits

In 2022, 76% of organisations were targeted by ransomware attacks, with 64% experiencing actual attacks. Only 50% of these organisations retrieved their data after paying the ransom. Additionally, over 66% of respondents reported being infected by isolated ransomware multiple times.

Almost all affected organisations (90%) have cybersecurity insurance policies covering ransomware attacks, and 82% of insurers agreed to pay part or all of the ransom. Data shows a high percentage of companies with cybersecurity insurance, which is why a large number of organisations are willing to pay the ransom, with 64% of victims paying the ransom at least once, slightly higher than the previous year.

Among the surveyed Canadian organisations, only 24% filed a claim after a ransomware attack because of their broad policy coverage. South Korea remains the least affected country in the Asia-Pacific region.

According to the report, 84% of organisations experienced at least one successful email-based phishing attack in 2022, with direct financial losses increasing by 76% compared to 2021.

Globally, 75% of organisations reported an attempted business email compromise (BEC) attack last year. While English remains the most commonly used language, some companies in non-English speaking countries found a higher number of attacks using their own language.

▍Microsoft Remains the Most Imitated Brand

Cybercriminals mostly abuse Microsoft's brand name in phishing attacks, with over 30 million messages impersonating Microsoft or mentioning products like Office or OneDrive. However, other companies are also frequently impersonated by cybercriminals, including Amazon (mentioned in 6.5 million attacks), DocuSign (3.5 million), Google (2.6 million), DHL (2 million), and Adobe (1.5 million).

44% of surveyed employees believe that emails with familiar brand logos are safe, while 63% of employees believe that the email address always belongs to the corresponding website of that brand. The large number of attacks impersonating well-known brands is deeply concerning.

If employees have gaps in security knowledge and poor security habits, they make organisations more vulnerable to potential risks, whether they work remotely or on-site. The survey shows that over 33% of respondents cannot distinguish between terms like malware, phishing, or ransomware.

▍New Cyber Attack Threats on the Rise

Over the past year, the number of telephone-oriented attack delivery (TOAD) and multi-factor authentication (MFA) bypass phishing messages sent daily has increased significantly.

Over the past two years, greater workforce mobility and economic uncertainty caused by the global pandemic have led to one-quarter of employees leaving or changing jobs. This has made data protection more challenging for organisations, with 65% of organisations reporting data loss caused by insider actions. Almost half of job-switchers admitted to taking organisational data with them after leaving.

Although many enterprises take steps to train employees in security awareness, pervasive phishing email attacks and the endless emergence of new attack methods show that enterprises cannot base data security on highly uncertain employee awareness. It is necessary to adopt technical means to practically validate security defence effectiveness.

The CXASecurity Validation Platform can simulate a series of cyber deception attacks such as phishing emails containing malicious links or attachments, providing enterprises with safe and effective defence system validation services. Through visual reports, it helps enterprises identify weak spots in their defence systems and make corresponding adjustments and preparations, reducing the cost spent by security teams on handling phishing emails.

You can easily select validation experiments for phishing emails containing malicious links or attachments in the CXASecurity Validation Platform, and designate AI offensive and defensive bots to send these emails to specified addresses in the enterprise email system to verify if your enterprise email security products have the capability to detect these phishing emails and isolate or delete them.

CXASecurity also provides enterprises with ransomware defence assessment services to help you conduct technical evaluations of ransomware defence capabilities. Our assessment services cover all attack stages of the entire ransomware attack kill chain, identifying risks existing at each attack stage for enterprises.