Spear Phishing Scams, BEC Attacks on the Rise

A new report from Barracuda showed how well cyber threat actors are honing their skills.

It showed that a majority of COVID-19-related spear-phishing attacks are essentially scams. Meanwhile, business email compromise (BEC) attacks are rising.

The report, titled “Spear Phishing: Top Threats and Trends Vol. 5 - Best practices to defend against evolving attacks,” studied more than 2.3 million spear-phishing attacks between August and October, 2020, that targeted more than 80,000 organizations around the world.

The first significant insight from the report is that business email compromise (BEC) made up 12% of the spear-phishing attacks analyzed. The increase from just 7% in 2019 showed that threat actors are beginning to target corporate networks, probably because many employees are now working outside the corporate firewalls. 

While COVID-19 was the major theme of many of the attacks, the report noted that 72% of COVID-19-related attacks were scams. In comparison, 36% of overall attacks are scamming, highlighting how much security threat actors are using the pandemic as cover.   

Barracuda researchers also found a 667% increase in COVID-19 related spear-phishing attacks in March since January 2020. Attackers prefer to use COVID-19 in their less targeted scamming attacks that focus on fake cures and donations. 

Thirteen percent of all spear-phishing attacks come from internally compromised accounts. The report advised companies to invest in protecting their internal email traffic as much as they do in protecting from external senders. 

While 71% of spear-phishing attacks include malicious URLs, only 30% of BEC attacks included a link. This shows that cyber threat actors are now looking to establish trust with their victims and expect a reply to their email. The lack of a URL also makes it harder to detect the attack.  

Threat actors are also attacking more frequently during the work week when most companies operate. The report noted that 87% of all spear-phishing attacks analyzed were sent between Monday to Friday.

“Phishing email is a major threat vector to Hong Kong organizations as the report found the number of phishing events jumped four times from 399 in the first quarter to 2,017 in the second quarter of 2020. Cybercriminals adapt very quickly when they find a new tactic or current event that they can exploit, as their response to the COVID-19 pandemic proved only too well,” said James Forbes-May, vice president of APAC for Barracuda.

“Staying aware of the way spear-phishing tactics are evolving will help organizations take the proper precautions to defend against these highly targeted attacks and avoid falling victim to scammers’ latest tricks,” he added.  

Image credit: iStockphoto/ehrlif