60% increase in phishing attacks targeting businesses
The massive recent cyber attack against MTU has highlighted the huge threat many businesses face.
Now leading cybersecurity firm Smarttech247 has released figures showing an increase of 60% in the number of phishing attacks against business in 2022.
The company’s Security Operations Centres have broken down the motivations behind the attacks they recorded into the following categories:
- 78% were aimed at stealing personal information
- 13% were trying to steal login credentials
- 5% were trying to compromise a business
- 4% targeted malicious file delivery.
Of all malicious email contacts recorded, 39% were designed to be part of a social engineering attack, a figure Smarttech247 says is growing massively every year. The majority of malware email attacks aimed to deliver the QBot Malware, a banking Trojan that steals financial data, browser information, keystrokes, and credentials.
CEO of Smarttech247 Raluca Saceanu will be discussing the figures at the upcoming Zero Day Con cybersecurity event in Dublin on 9 March. She says her teams are constantly adapting their skills to keep ahead of hackers.
“Phishing attacks have become more sophisticated, requiring human interaction with legitimate resources before redirecting users to malicious resources. Threat actors use this method to bypass email security solutions such as a sandbox, because that measure cannot resolve a captcha or a form.”
Smarttech247 also announced a 20% rise in supplier attacks during 2022, some of which can result in the theft of up to €1m each.
A typical case of this would be invoice redirect fraud, which sees a malicious actor pretend to be a supplier of goods or services that someone already does business with and requests that the bank account details recorded for the legitimate supplier are changed on the victim’s financial system.
Using their system of monitoring malicious alerts, Smarttech247 investigators also identified the top exploited vulnerabilities from 2022, which were Log4Shell and Spring4Shell.
Together they accounted for approximately 30% of the total exploit attempts observed. Log4shell is a critical vulnerability in the widely-used logging tool Log4j, which is used by millions of computers worldwide running online services.
Raluca says certain businesses are more likely to be targeted in all kinds of cyberattacks: “From our experience, threat actors are most likely to try to attack healthcare, education, manufacturing, and utility companies.
“Our security experts urge individuals and organisations to stay vigilant and take necessary precautions to protect themselves from cyber-attacks.
“Such precautions include regularly updating software, using strong passwords, being cautious when opening emails and attachments from unknown sources, and staying informed about current cyber threats. By doing so, we can collectively work towards a safer online environment.”
The rapidly evolving landscape facing cybercrime experts will be discussed in detail at the upcoming Zero Day Con event at Dublin Convention Centre on 9 March. The event powered by Smarttech247 will have the theme of ‘connect’ and delegates will discuss topics including the task of navigating emerging geopolitical tensions, a new era for ransomware and mitigating the threat from within.