The new report from GreatHorn found that almost 1 out of 3 organizations (30%) say that a majority of links received via email lead to malicious sites
Waltham, MA, Tuesday, June 22, 2021 – Business Email Compromise (BEC) attacks are one of the most financially damaging cybercrimes and have been on the rise over the past year. This is according to the 2021 Business Email Security Landscape Report released today GreatHorn, which revealed that spoofed email accounts or websites were the most experienced form of a BEC attack as 71% of organizations acknowledged they had seen one over the past year. This is followed by spear phishing (69%) and malware (24%).
To develop this report, GreatHorn collected data from 270 IT and cybersecurity professionals to identify the latest enterprise adoption trends, gaps and solution preferences related to phishing attacks. The report with full details and data can be downloaded here.
Spoofing Identifiers to Harvest Credentials Takes Precedence
Nearly 50% of all BEC attacks result from the spoofing of an individual’s identity in the display name. Among those spear phishing emails, cybercriminals are also using company names (68%), names of individual targets (66%), and the name of boss/managers (53%) to conduct their attacks. What makes BEC attacks so successful is the availability of basic personal information online, that can be used against an employee who might be suffering from screen or email fatigue – thus stealing credentials to gain access to confidential and important data. Employees are more susceptible to clicking on malicious links after recognizing a familiar name or other relevant identifiers that could pertain to their job. A majority of respondents (57%) say that malicious links in phishing emails intend to steal credentials, giving cybercriminals full access to confidential information.
“The findings in this report confirm the industry trends we’ve seen over the past year. With the majority of organizations operating on a fully remote or hybrid work schedule, the floodgates for cybercriminals have been opened,” said Kevin O’Brien, CEO of GreatHorn. “Cybercriminals want the keys to the castle, which they achieve by stealing credentials. To do so they often target C-suite and finance employees as they have the most privileged information available to access. However, no employee is immune to these attacks; they can appear in anyone’s inbox and all it takes is a momentary lapse in judgement from an unsuspecting party to compromise an organization’s security.”
Remote Employees and Finance Departments Remain Hardest Hit By Cybercriminals
One of the largest factors that has played into the rise of BEC attacks and impersonation efforts is the continued remote work policies in place with the majority of organizations. Almost 1 out of 3 organizations (30%) state that over 50% of links received via email lead to a malicious site, demonstrating the never ending assault on inboxes perpetrated by criminals. On top of that, respondents identified that their finance departments have the largest target on their backs as 34% said finance-related employees are the most frequent victims of spear-phishing attempts. When employees return to physical offices, real person interactions may help reduce the number of successful phishing attacks as people can verify the legitimacy of an email in an easier fashion.
Additional Key Stats Include:
- 43% of organizations have experienced a security incident in the last 12 months, with 35% stating that BEC/Phishing attacks account for >50% of the incidents.
- 1 out of 4 organizations say 76-100% of malware they detect is delivered via email.
- In the current work from home environment, 39% of organizations say they experience spear phishing on a weekly cadence.
- 65% of IT security pros say their organization has experienced spear phishing in 2021, while over half (51%) say it has increased in the last 12 months.
- The good news – 69% say that their organization is prepared to handle a cyberattack, and 71% believe their employees are prepared to identify a malicious email.
About GreatHorn
GreatHorn safeguards cloud email from advanced threats like impersonations, credential theft, malware, and social engineering attacks by protecting organizations before, during, and after an email attack. Through its proactive threat detection engine, end-user education, and robust remediation capabilities, GreatHorn frees security teams from time-consuming email security management to enable them to respond to genuine threats faster. More information is available at www.greathorn.com.
