How Business Email Compromise Attacks Threaten Organizations

Share post:

Email is one of the most important tools used by cybercriminals to launch attacks against organizations.

A particular tactic often used by criminals is the Business Email Compromise (BEC), where the fraudster forges a trusted contact to defraud a business.

The “The 2021 Business Email Compromise Report” by security provider GreatHorn focuses on the latest BEC campaigns. Based on an online survey of 270 IT and cybersecurity experts in the U.S. from May 2021, the report highlighted various trends, challenges and gaps in the fight against BEC attacks and related email threats.

71% of respondents pointed to BEC attacks that manipulate e-mail accounts or websites.

69% cited spear-phishing, which targets specific individuals or roles in an organization, with the most targeted department funded, followed by the CEO and then the IT group.

Other susceptible departments include HR, marketing and sales.

Another 24% cited malware, in particular, emails containing malicious files or other content.

The survey also revealed an increase in spear-phishing attacks.

65% of respondents said their organization will be affected by these types of attacks in 2021, while 39% of respondents said they now experience spear phishing attempts weeklyly.

Malicious emails remain a threat: one in four respondents said that 76% to 100% of the malware they receive is sent by email.

57% of these malicious links are used to steal internal account data, often from C-suite executives and financial employees. Such links also aim to install malware as a setup for ransomware and payment fraud.

43% of respondents said they had been affected by a security incident in the last 12 months, with many citing BEC and phishing attacks as the source.

As a result, 36% reported that accounts were compromised, 24% that malware was installed, 16% that company data was lost, and 16% reported payment fraud.

Here are some ways to avoid BEC attacks:

  • Focus on defense in depth and not one-stop “anti-phishing” solutions.
  • Identify malicious links in emails.

For more information, read the original story in TechRepublic.



Related articles

Microsoft announces enhanced security feature for OneNote

Microsoft has released further information on the increased security measures it is deploying for OneNote in order to...

Russian hacker group steals Emails of NATO officials and diplomats

Since February 2023, a Russian hacking gang known as TA473 or 'Winter Vivern' has targeted unpatched Zimbra endpoints...

Canadian cybersecurity accelerator counts its accomplishments

A Canadian university-associated business accelerator for helping early-stage cybersecurity companies says its first two years of operation have been more than satisfactory. The Rogers Cybersecure Catalyst Accelerator has had “an incredible impact” on Canadian cybersecurity entrepreneurs and founders, executive director Charles Finlay said this week in the first report on the program’s progress. Despite having

Crackdown on ransomware gangs yet to show an impact: OpenText

In its annual cybersecurity report OpenText also looked at malware, phishing and infec

Become a member

New, Relevant Tech Stories. Our article selection is done by industry professionals. Our writers summarize them to give you the key takeaways