A Sophos report, Phishing Insights, 2021, has revealed that phishing attacks targeting organisations ramped up considerably during the pandemic, as millions of home-working employees became a prime target for adversaries.
The vast majority (70%) of Australian IT teams said the number of phishing emails hitting their employees increased during 2020, with central government experiencing the highest increase (77%).
Other highlight findings from the research include:
- IT professionals can’t agree on a single definition of phishing. The most common understanding of phishing, selected by 57% of respondents, is “emails that falsely claim to be from a legitimate organisation, usually combined with a threat or request for information.” Forty-six percent consider Business Email Compromise (BEC) attacks to be phishing, and more than one-third (36%) think threadjacking (when attackers insert themselves into a legitimate email thread as part of an attack) is phishing.
- Most (90%) organisations run cybersecurity awareness programs to address phishing. However, in the light of the survey results, phishing awareness and education programs need to consider the wide range of perceived phishing definitions and include training for non-technical employees that explain the different facets of phishing and email attacks in general.
“Phishing has been around for over 25 years and remains an effective cyberattack technique. One of the reasons for its success is its ability to continuously evolve and diversify, tailoring attacks to topical issues or concerns, such as the pandemic, and playing on human emotions and trust.” Chester Wisniewski, principal research scientist at Sophos said.
“The temptation for organisations can be to see phishing attacks as a relatively low-level threat, but that underestimates their power. Phishing is often the first step in a complex, multi-stage attack. According to Sophos Rapid Response, attackers frequently use phishing emails to trick users into installing malware or sharing credentials that provide access to the corporate network. The team has seen at first-hand how a seemingly innocuous email can ultimately lead to a multi-million-dollar ransomware attack. Cryptojacking, data – and even financial – theft are all potential outcomes after a phishing attack has opened a door for adversaries. The ideal would be to prevent phishing emails from ever reaching their intended recipient. Effective email security solutions can go a long way towards achieving this, but this should be complemented by alert and primed employees who are able to spot and report suspicious messages before they get any further.” said Wisniewski.
Read full report here.
