How Business Email Compromise Attacks Threaten Organizations

Share post:

Email is one of the most important tools used by cybercriminals to launch attacks against organizations.

A particular tactic often used by criminals is the Business Email Compromise (BEC), where the fraudster forges a trusted contact to defraud a business.

The “The 2021 Business Email Compromise Report” by security provider GreatHorn focuses on the latest BEC campaigns. Based on an online survey of 270 IT and cybersecurity experts in the U.S. from May 2021, the report highlighted various trends, challenges and gaps in the fight against BEC attacks and related email threats.

71% of respondents pointed to BEC attacks that manipulate e-mail accounts or websites.

69% cited spear-phishing, which targets specific individuals or roles in an organization, with the most targeted department funded, followed by the CEO and then the IT group.

Other susceptible departments include HR, marketing and sales.

Another 24% cited malware, in particular, emails containing malicious files or other content.

The survey also revealed an increase in spear-phishing attacks.

65% of respondents said their organization will be affected by these types of attacks in 2021, while 39% of respondents said they now experience spear phishing attempts weeklyly.

Malicious emails remain a threat: one in four respondents said that 76% to 100% of the malware they receive is sent by email.

57% of these malicious links are used to steal internal account data, often from C-suite executives and financial employees. Such links also aim to install malware as a setup for ransomware and payment fraud.

43% of respondents said they had been affected by a security incident in the last 12 months, with many citing BEC and phishing attacks as the source.

As a result, 36% reported that accounts were compromised, 24% that malware was installed, 16% that company data was lost, and 16% reported payment fraud.

Here are some ways to avoid BEC attacks:

  • Focus on defense in depth and not one-stop “anti-phishing” solutions.
  • Identify malicious links in emails.

For more information, read the original story in TechRepublic.

Featured Tech Jobs

SUBSCRIBE NOW

Related articles

Cyber Security Today, March 27, 2024 – A botnet exploits old routers, a new malware loader discovered, and more warnings about downloading code from...

This episode reports on a new network of 40,000 infected small and home office routers and other devices that are part of a criminal botnet

Cyber Security Today, March 25, 2024 – A suspected China threat actor going after unpatched F5 and ScreenConnet installations

This episode reports on a new campaign stealing email passwords ,the latest data breaches

A hacker’s view of the civic infrastructure: Hashtag Trending, the Weekend Edition for March 23rd, 2024

What does the civic infrastructure look like through the eyes of a hacker? The legendary general Sun Tzu in the Art of War said that in order to defeat your enemy, you must first understand your enemy. How do you do this? He said, “to know your enemy, you must become your enemy.” If we

Cyber Security Today, Week in Review for week ending Friday, March 22, 2024

This episode features discussion on lessons learned from the ransomware attack on the British Library, advice for managing expectations of IT/security teams, why firms are leaving Google Firebase unprotecte

Become a member

New, Relevant Tech Stories. Our article selection is done by industry professionals. Our writers summarize them to give you the key takeaways