Navigating the Rising Tide of Phishing and BEC Threats

Phishing and Business Email Compromise (BEC) attacks are not just prevalent but are growing more sophisticated. Businesses worldwide are grappling with these challenges, facing advanced threats that bypass traditional security measures. The following insights drawn from the ReliaQuest Annual Cyber-Threat Report: 2024 provide an in-depth look at the evolving threat landscape and emphasize the need for robust defenses and thoughtful automation beyond just more workforce training.

Phishing Threats Intensify

Phishing attacks, particularly through Phishing-as-a-Service (PhaaS) platforms, have seen a marked increase. These services, like BulletProofLink, offer a buffet of nefarious tools, including credential harvesters and scripts that facilitate adversary-in-the-middle (AITM) attacks. This trend indicates a shift towards more service-oriented cybercrime, where sophisticated tools are available for rent to execute widespread phishing campaigns.

The ReliaQuest report also reveals that phishing tactics have evolved to bypass Multi-Factor Authentication (MFA) systems, combining technology with traditional deceit to exploit human error and technological vulnerabilities. For instance, attackers use AITM techniques to intercept communication between the user and the security system, capturing MFA tokens and gaining unauthorized access.

Business Email Compromise: A Growing Concern

BEC attacks manipulate email accounts to commit fraud, such as redirecting financial transactions or stealing confidential information. The ReliaQuest report highlights a surge in BEC incidents fueled by the use of sophisticated phishing kits and PhaaS. These platforms provide tools that mimic legitimate company pages, enabling attackers to capture credentials and hijack email threads.

Moreover, the integration of AI in phishing campaigns allows attackers to automate the creation of emails and web pages, making them indistinguishable from legitimate sources. This automation increases the scale and precision of BEC attacks, presenting a formidable challenge to traditional email security defenses.

The report states, “Our investigation of incident metrics data revealed that attackers frequently use BEC-compromised email accounts to conduct additional phishing operations. This strategy is effective because it uses legitimate email addresses, which can easily pass basic security checks; the potential results include additional breaches and reputational damage.”

Combating Phishing and BEC

To combat these threats, organizations must enhance their security frameworks and educate their employees about the risks and indicators of phishing and BEC attacks. This involves deploying advanced threat detection and response tools that can identify and mitigate threats in real-time.

Enhanced Email Security

Organizations need to adopt email security solutions that offer comprehensive protection against phishing and BEC. These solutions should include spam filters, phishing detection algorithms, and sandboxing technologies to test email attachments in a secure environment before they reach the user. Large enterprises should also adopt automations around phishing identification and remediation, such as ReliaQuest’s GreyMatter Phishing Analyzer.

Employee Training and Awareness

While proper technology and automation are crucial for large enterprises to combat business email compromise, continuous education and training programs for employees remain important. Regular training sessions can help employees recognize phishing attempts and understand the procedures for reporting suspicious emails. Simulated phishing exercises can also prepare employees to handle phishing attempts effectively.

The report also shares guidance to help organizations mitigate the risk of Business Email Compromise:

• Monitor high-risk users: Develop detection rules for high-risk users when creating email inbox rules, allowing for a “tuning period” of at least 30 days to increase the rule fidelity.
• Block newly registered domains: Configure forward proxy devices to block domains using categories like “newly registered domains.” This helps prevent BEC operators from using recently registered domains.
• Verify transaction requests: Implement a dual authorization policy whereby a manager or co-worker must authorize large payments or banking changes. Require that employees have an alternative line of communication (not email) with individuals requesting transactions, to prevent unauthorized transfers.
• Create a BEC alert playbook: Develop a playbook of steps to inform third-party providers and partners about potential BEC phishing emails, ensuring quick response to limit a compromise’s scope.
• Educate employees: Teach employees to scrutinize email headers, links, and attachments and to report any suspicious activity.

Using AI and Machine Learning

Leveraging AI and machine learning can help in detecting patterns and anomalies that signify phishing attempts and BEC fraud. These technologies can analyze email traffic to flag emails that deviate from typical communication patterns, providing an additional layer of security.

Reversing the Tide

As phishing and BEC tactics grow more sophisticated, so must the countermeasures.

By understanding the nature of these threats and implementing a multi-layered security approach, organizations can better protect themselves from the financial and reputational damage caused by these cyber-attacks. The insights from the ReliaQuest report underscore the importance of proactive defense strategies and the need for continuous improvement in cybersecurity measures.

Organizations are encouraged to keep abreast of the latest cybersecurity trends and innovations as the digital threat landscape continues to evolve rapidly. By fostering a culture of security awareness and utilizing advanced security technologies, businesses can safeguard their critical assets against the ever-present threat of phishing and BEC.