How Business Email Compromise Attacks Threaten Organizations

Share post:

Email is one of the most important tools used by cybercriminals to launch attacks against organizations.

A particular tactic often used by criminals is the Business Email Compromise (BEC), where the fraudster forges a trusted contact to defraud a business.

The “The 2021 Business Email Compromise Report” by security provider GreatHorn focuses on the latest BEC campaigns. Based on an online survey of 270 IT and cybersecurity experts in the U.S. from May 2021, the report highlighted various trends, challenges and gaps in the fight against BEC attacks and related email threats.

71% of respondents pointed to BEC attacks that manipulate e-mail accounts or websites.

69% cited spear-phishing, which targets specific individuals or roles in an organization, with the most targeted department funded, followed by the CEO and then the IT group.

Other susceptible departments include HR, marketing and sales.

Another 24% cited malware, in particular, emails containing malicious files or other content.

The survey also revealed an increase in spear-phishing attacks.

65% of respondents said their organization will be affected by these types of attacks in 2021, while 39% of respondents said they now experience spear phishing attempts weeklyly.

Malicious emails remain a threat: one in four respondents said that 76% to 100% of the malware they receive is sent by email.

57% of these malicious links are used to steal internal account data, often from C-suite executives and financial employees. Such links also aim to install malware as a setup for ransomware and payment fraud.

43% of respondents said they had been affected by a security incident in the last 12 months, with many citing BEC and phishing attacks as the source.

As a result, 36% reported that accounts were compromised, 24% that malware was installed, 16% that company data was lost, and 16% reported payment fraud.

Here are some ways to avoid BEC attacks:

  • Focus on defense in depth and not one-stop “anti-phishing” solutions.
  • Identify malicious links in emails.

For more information, read the original story in TechRepublic.

SUBSCRIBE NOW

Related articles

Cyber Security Today, May 24, 2024 – A threat actor leverages Windows BitLocker in ransomware attacks, beware of ORB networks, and more

A threat actor leverages Windows BitLocker in ransomware attacks, beware of ORB networks, and more. Welcome to Cyber Security...

Canada centralizing cybersecurity efforts of federal IT departments

Federal departments and agencies are making only marginal progress in improving their cyber maturity, Ottawa said Wednesday as...

Cyber Security Today, May 22, 2024 – LockBit ransomware gang hits more victims, Fluent Bit servers need to be updated, and more

LockBit ransomware gang hits more victims, Fluent Bit servers need to be updated, and more. Welcome to Cyber Security...

Google criticizes Microsoft’s security practices in new report

Google has publicly criticized Microsoft for a series of security missteps, suggesting that organizations might consider more secure...

Become a member

New, Relevant Tech Stories. Our article selection is done by industry professionals. Our writers summarize them to give you the key takeaways