Безпечна інтеграція в майбутнє


Безпечна інтеграція в майбутнє

Secured integration to the future

Secured integration to the future

Trends in Phishing Development and Countermeasures

Майстер-клас: секрети випікання найсмачніших млинців!

10.07.2024

In 2023–2024, the proliferation of cyber threats continues to accelerate. Researchers have noted a 45% increase in malicious attacks compared to the previous year, encompassing spearphishing, smishing (SMS phishing), malware, and other social engineering attacks. The majority of these threats are spearphishing attacks. According to SlashNext, the number of malicious phishing emails surged by 1265% in 2023. The launch of ChatGPT at the end of 2022 and the subsequent spike in phishing emails are no coincidence, as the use of chatbots has facilitated the increase in such attacks.

Emerging Phishing Trends and Key Threats

Utilisation of Artificial Intelligence in Phishing Attacks

Artificial intelligence (AI) and chatbots, such as ChatGPT, have significantly simplified the creation of sophisticated Business Email Compromise (BEC) attacks and enhanced malware for cybercriminals. Concurrently, cybersecurity professionals leverage generative AI to detect threats. Besides ChatGPT, criminals use custom chatbots (FraudGPT, WormGPT) that have analysed data from other breaches and are trained to generate high-quality phishing content (emails, messages).

Rise in Business Email Compromise (BEC) Attacks

A 2023 study among cybersecurity and IT professionals confirmed concerns regarding phishing attacks, particularly BEC attacks. According to the FBI IC3 report, the average cost of a successful BEC attack is $174,000. SlashNext's research indicated that 46% of cybersecurity professionals reported BEC attacks on their employees. The diversity and complexity of BEC types have significantly increased due to the availability of AI chatbots.

Payroll Diversion Attacks

This attack involves a cybercriminal redirecting an employee's salary to their account. These attacks often succeed because many organisations cannot detect this type of attack, where criminals contact the HR or finance department to modify payroll data. For example, a cybercriminal posing as a company employee sent a request to change payment information using a compromised Gmail account to bypass domain/IP filtering.

Illustration

Increase in Multi-Stage Account Attacks

Additionally, SlashNext has recorded a rise in cybercriminals using spearphishing attacks that mimic colleague communications. Below is an example of a multichannel attack involving invoice fraud and executive message impersonation. The criminal impersonated a supplier and the Chief Operations Officer, sending a payment request to the finance manager. Using a domain similar to Salesforce, the criminal forged instructions from the COO regarding the payment of an invoice. The finance manager responded to the request and asked for confirmation of the invoices.

Illustration

Microsoft Remains the Most Abused Brand

Imitating system messages from well-known brands remains one of the most prevalent tactics for delivering phishing and malware. In 2023, over 68 million messages were associated with Microsoft's brand and products, making it the most abused brand among cybercriminals. Adobe and DHL ranked second and third, with fewer than 10 million messages each utilising these brands.

How to Protect Against Phishing Attacks

Employee Education

Phishing attacks rely on deceiving or compelling the target to take a specific action. Educating employees to identify and correctly respond to phishing messages reduces the likelihood of a successful attack.

Email Scanning

Phishing attacks are usually conducted via email and may contain malicious links or attachments. Email scanning solutions can employ various methods to detect malicious emails, allowing the organisation to block them before they reach the user's inbox.

Antivirus

Phishing emails frequently deliver malware through malicious attachments or links. Antivirus solutions can detect and block malware that reaches corporate devices.

DNS Authentication

Cybercriminals typically send emails that mimic messages from the organisation or trusted companies. DMARC, DKIM, and SPF (email authentication methods) help ensure emails originate from the claimed source.

Multi-Factor Authentication (MFA)

Criminals may use phishing emails to steal user credentials, which can be used to take over accounts, possibly for sending targeted phishing emails. MFA makes it harder to use stolen credentials since it requires access to another factor.

Types of Solutions for Phishing Protection

Companies have access to various solutions designed to protect against phishing attacks. Some protection and prevention features to consider include:
● Email Scanner: Emails are the most common method for delivering phishing content. Email scanners can use a combination of signatures and machine learning to detect emails containing malicious content or part of a BEC attack.
● Sandbox Execution: Not all malware can be detected by scanning email attachments. Sandboxes execute suspicious files and monitor their behaviour for signs of malicious activity before delivering the file to the end user.
● Content Disarm and Reconstruction (CDR): Criminals often use Microsoft Office documents and other files to deliver malware via macros and embedded features. CDR solutions can deconstruct the document, remove malicious features, and rebuild a clean version to send to the recipient safely.
● Endpoint Protection: Phishing attacks are typically used as an initial access vector to deliver malware to the target system. Endpoint protection solutions, such as Endpoint Detection and Response (EDR), can help detect and mitigate these infections.
● Mobile Security: Mobile devices are becoming increasingly frequent targets for phishing attacks via email, SMS, social media, and corporate communication apps. Mobile security solutions are crucial for managing phishing risks to an organisation's mobile devices.

Conclusions

The development of artificial intelligence has led to its use in both cyber threat protection tools and the significant complexity of cyberattacks. The weakest link in most companies' cybersecurity remains its employees, so criminals use generative AI to create deep fakes, phishing emails, and messenger messages. However, cybersecurity solutions are also advancing, with the latest products from vendors like Tenable, Check Point, IBM, and others applying AI to detect and block such threats.
IT Specialist is ready to consult your organisation on phishing protection. To have our specialists contact you and help select the solution that fits your company, please fill out the form on our website.


Call Us

Office+38 (044) 390 81 90

Sales Department
+38 (096) 390 81 90

Write Us

moc.tsilaicepsti-ym%40olleh

Meet for coffee

Sigma Business Center,Vatslav Havel Boulevard, 6, building 3,Ukraine, Kyiv, 03124


Call Us

Office+38 (044) 390 81 90

Sales Department
+38 (096) 390 81 90

Write Us

moc.tsilaicepsti-ym%40olleh

Meet for coffee

Sigma Business Center,Vatslav Havel Boulevard, 6, building 3,Ukraine, Kyiv, 03124

Illustration


Зателефонувати

+38 (044) 390 81 90

Написати

moc.tsilaicepsti-ym%40olleh

Приїхати на каву

Бізнес-центр Sigma,
бульвар Вацлава Гавела, 6, корпус 3,
Україна, Київ, 03124

Illustration


Зателефонувати

+38 (044) 390 81 90

Написати

moc.tsilaicepsti-ym%40olleh

Приїхати на каву

Бізнес-центр Sigma,
бульвар Вацлава Гавела, 6, корпус 3,
Україна, Київ, 03124