The Alarming Surge Of Lateral Phishing – Are We All Just Sitting Ducks?

A new report from Barracuda has just dropped, and it’s nothing short of a cyber-crime horror show. The headline? Nearly 42% of email attacks on companies with 2,000 employees or more are driven by the insidious menace of lateral phishing.

That’s right – nearly HALF of these targeted email threats are coming straight from compromised internal accounts, making your sprawling corporation a perfect playground for these cyber scoundrels.

If you haven’t heard of it yet, congratulations on living under a rock. But for those who have, let me spell it out for you—this is not just another run-of-the-mill phishing scam. It’s the sinister cousin, the kind of attack that sneaks around, infiltrates, and makes a mockery of our so-called "security measures." And let me tell you, it’s more than just a problem—it’s an outright crisis.

First off, let’s talk about the "lateral" part. This is not your garden-variety phishing where some shady character tries to fool you into giving up your password. No, this is way more insidious.

The attacker doesn’t just want your credentials; they want to infiltrate your entire network. They get their dirty little hands on one account and suddenly, they're playing puppet master with your entire organization. And guess what? Most businesses are sitting ducks because they haven’t got a clue about how to defend against this.

Now, before you get too comfy thinking this is a problem only for the big leagues, let’s talk about the small fish. For companies with up to 100 employees, lateral phishing is almost non-existent, making up a mere 2% of attacks. But don’t get too cozy if you’re running a smaller operation.

You’re not off the hook! Smaller businesses are getting hammered with external phishing attacks, which account for a staggering 71% of the threats over the past year. That’s over twice the rate of larger companies, which experience these external attacks 41% of the time.

And it gets worse. Smaller businesses are three times more likely to face extortion attacks compared to their larger counterparts. For the little guys, extortion attacks make up 7% of all targeted threats, while the big companies see a paltry 2% of these nasty tactics.

Despite the variance, business email compromise (BEC) and conversation hijacking are striking across the board, showing no preference for company size. Olesia Klevchuk, Barracuda's product marketing director, spells it out: Large companies are a veritable buffet for attackers.

With a plethora of mailboxes and communication channels, attackers find ample opportunities to exploit. Employees might trust emails that look like they’re from within the organization, even if they don’t recognize the sender.

But don’t think that smaller companies are safe. They often lack layered security defenses and have poorly configured email filters thanks to limited resources and skills. Klevchuk warns that while large firms have more entry points for attackers, smaller businesses often suffer from inadequate security measures.

Lateral Phishing Exposed: The Sneaky Scam That's Making Your Inbox a Minefield.

We’re about to dive into the murky waters of lateral phishing – a devious cyber trick that’s spreading like wildfire and turning your inbox into a battleground. Think phishing is just about those annoying emails from fake princes or shady lottery wins? Think again! Lateral phishing is a whole new level of sneakiness, and it’s hitting businesses hard.

So, what in the cyber world is lateral phishing? Here’s the lowdown: Imagine your company’s email system is a giant, interconnected web of messages and accounts. Now, picture a hacker sneaking in and hijacking one of these accounts.

Sounds bad, right? But here’s where it gets worse: instead of blasting out their scam to the outside world, they use the already compromised account to launch attacks internally.

That’s right! The attacker sends out phishing emails from an account that’s already inside your organization’s network. These emails might look like they’re coming from a trusted coworker or a familiar source, tricking your unsuspecting colleagues into clicking on malicious links or handing over sensitive information. It’s the ultimate con game – using the trust that’s already built within your organization to break it down from the inside out.

Why is this such a big deal? Because it’s the cyber equivalent of a Trojan horse. The attacker doesn’t need to go through all the trouble of breaching your defenses from the outside. They’re already in the door, using legitimate accounts to carry out their dirty work. This makes detecting and stopping them a real nightmare.

•  Lateral Phishing - According To Barracuda

Attackers use recently hijacked or compromised accounts to send phishing emails to unsuspecting recipients, such as close contacts in the company and partners at external organizations.

So what’s the takeaway? Barracuda’s advice is clear: Regular security awareness training is a must. Employees need to stay sharp and be able to spot suspicious emails before they wreak havoc. Implementing multi-layered, AI-powered defenses is crucial to detect and neutralize these advanced attacks.

Steps to Protect Against Lateral Phishing Attacks

 1. Educate Employees:

• Phishing Awareness Training: Regularly train employees to recognize phishing attempts. This includes spotting suspicious emails, understanding common phishing tactics, and knowing how to verify the legitimacy of messages.

• Simulated Phishing Campaigns: Conduct periodic simulated phishing exercises to help employees practice identifying and responding to phishing threats.

 2. Implement Strong Authentication Practices:

• Multi-Factor Authentication (MFA): Enforce MFA across all accounts. Even if an attacker gains access to a password, MFA provides an additional layer of security.

• Strong Password Policies: Require complex passwords and encourage the use of password managers to store and manage them securely.

3. Monitor and Respond to Security Incidents:

•  Threat Detection Systems: Use security tools that monitor for suspicious activities and anomalous behavior within your network.

• Incident Response Plan: Develop and regularly update an incident response plan to ensure a swift reaction to potential phishing attacks or other security incidents.

4. Restrict and Monitor Access:

• Principle of Least Privilege: Ensure that users only have access to the information and systems necessary for their roles. Limiting access reduces the potential damage of a compromised account.

• Regular Access Reviews: Periodically review and adjust access permissions based on changing roles and responsibilities.

5. Secure Communication Channels:

• Verify Requests: Implement processes for verifying requests for sensitive information or financial transactions, especially when these requests come via email or other online methods.

• Use Encrypted Channels: Ensure that sensitive communications are conducted over secure, encrypted channels

6. Regularly Update and Patch Systems:

• Patch Management: Keep all software, systems, and applications up to date with the latest security patches to reduce vulnerabilities that attackers might exploit.

7. Establish a Culture of Security:

• Encourage Reporting: Foster an environment where employees feel comfortable reporting suspicious emails or potential security threats without fear of reprimand.

• Security Champions: Designate security champions within departments who can provide additional support and guidance on security matters.

Phishing Attack Trends

The phishing landscape is looking like a total dumpster fire, and it’s high time we faced the grim reality of this cyber mess.

Let’s talk stats: In the second quarter of 2023, a staggering 23% of phishing attacks worldwide were aimed straight at financial institutions.

Why? Because nothing says "easy target" like your bank account. Trailing close behind, social media platforms were hit by about 22.3% of these digital scams. And guess what? Web-based software services and webmail services were in the same boat, also accounting for 22.3% of the attacks. It's like they’re on a mission to ruin every corner of our online lives.

Now, let’s dive into the nitty-gritty from Cloudflare's so-called Phishing Threats Report, based on a jaw-dropping 13 billion emails. First off, businesses are no longer just getting hit by phishing in their inboxes—nope, they’re getting hit across multiple channels. Email? Sure. Texts? Probably. Carrier pigeons? At this point, who knows?

The top phishing strategy? Deceptive links, making up nearly 36% of threats. Oh, joy. So now instead of just dodging shady attachments, you’ve got to steer clear of every single link that pops up in your inbox.

And, just to make your life even more fun, these attacks are usually disguised under the names of a handful of “trusted” brands like Microsoft, Google, Salesforce, and Amazon. Yep, only 20 brands are behind most of these schemes. It's like the cybercriminals all decided to join the same scam club.

And if you thought ransomware attacks were bad, guess what? A whopping 35% of them come through email. That’s right. Your inbox is basically a minefield now.

But wait, there’s more! Identity deception threats are on the rise, with millions of attacks successfully bypassing email authentication methods like SPF, DKIM, and DMARC. In other words, your email security protocols are getting schooled by some really sneaky crooks.

Now let’s break down the causes of phishing attacks according to the 2023 Verizon Data Breach Investigations Report (DBIR):

• Negligence: This is the top culprit, showing up in a whopping 98% of breaches. Basically, people just aren’t paying attention, and it’s causing a mess.

• Stolen Credentials: These are responsible for 86% of breaches. Yep, hackers love getting their hands on your passwords and login info

• Misdelivery: Sending sensitive information to the wrong person is a factor in 43% of breaches. Oops, wrong recipient!

• Social Engineering: This trickery is behind 17% of breaches and 10% of incidents. Scammers are still making a living by fooling people into handing over their info.

• Financial Loss: Data breaches are hitting wallets hard, with an average financial loss of $26,000 in 7% of cases. That’s more than double the FBI’s old average loss of $11,500 from 2021.

• Ransomware: This nasty stuff is involved in 24% of breaches. Your data’s held hostage, and it’s becoming all too common.

• Financial Motivation: A staggering 95% of data breaches are driven by financial gain. Follow the money, right?

• Human Element: Humans are the weak link, playing a role in 74% of breaches. It’s not just about the tech; it’s about how people handle it.

Phishing Frenzy: The Cybercrime Epidemic of Our Times

Hold onto your keyboards, folks, because the cybercriminals are out in full force, and they're not taking a day off. Let’s break down the appalling truth about phishing attacks that’s making our digital world a hazardous minefield.

Lets talk about the sheer volume of these malicious assaults is enough to make anyone’s head spin. Brace yourselves: an astounding 31,000 phishing attacks are launched every single day. That's not a typo; that's 31,000 deceitful emails or messages aimed at tricking unsuspecting victims into handing over their sensitive information.

If you thought that was bad, here’s a kicker—phishing isn’t just some niche problem. No, it’s an epidemic. According to the Anti-Phishing Working Group (APWG), there were a jaw-dropping 1.3 million unique phishing sites detected in just the final quarter of 2022 alone. That’s a record, folks. A record we’d rather not have.

And it gets worse. The Verizon 2023 Data Breach Investigations Report reveals that a staggering 36% of all data breaches are directly tied to phishing attacks. That's over a third of all breaches, and it’s no surprise considering that every 20 seconds, a new phishing website springs up like a particularly nasty mushroom.

Digital Guardian’s latest findings are even more sobering. They’ve found that a whopping 90% of security breaches in corporations are the result of phishing attempts. In simpler terms, if you're working in any corporate environment, there’s a 90% chance that your security woes started with a phishing scam.

And guess what? The cost of all these breaches? IBM’s Cost of a Data Breach Report confirms that compromised credentials are the prime culprits, fueling 19% of cyber attacks.

Let’s not forget the sheer scale of phishing operations. Cybercriminals are dispatching a staggering 3.4 billion malicious emails every day. Yes, billion with a 'B'. If that’s not a wake-up call, I don’t know what is.

Data Breaches

Phishing is the second most frequent cause of data breaches, and it’s one of the top four strategies used by cybercriminals to infiltrate organizations. Over 60% of social engineering attacks are phishing-related, so when you’re getting a sketchy email, it’s not just your inbox at risk; it’s your entire organization.

And who are these cyberthieves trying to impersonate? The usual suspects are all here. Microsoft takes the crown as the most impersonated brand, followed closely by heavyweights like the World Health Organization, Google, and even SpaceX. The list goes on with Salesforce, Apple, Amazon, T-Mobile, YouTube, MasterCard, Notion.so, Comcast, and LinePay also falling prey to these deceptive tactics.

Smaller businesses, listen up: consider teaming up with a managed service provider for that extra layer of protection. As it stands, nearly 1.2% of all global emails are malicious – that’s around 3.4 billion phishing emails daily. And guess what? Human error is a factor in 74% of breaches, thanks to social engineering tricks, mistakes, or outright misuse.

Wake up, world! We’re in a cyber war zone, and the threats are real!

The bottom line is that phishing is no longer a small-scale issue. It’s a full-blown crisis, and it’s only getting worse. So, the next time you get an email from a supposed CEO asking for urgent wire transfers or a mysterious message claiming you’ve won a prize, remember: it’s not just spam—it’s a potentially devastating phishing attack. Stay vigilant, and for the love of cybersecurity

Source