These are golden times for hackers. The scale at which they attack email accounts has been growing for years and the digital password cracking tools have never been more advanced. Email addresses are there for the taking. In 2019, 2 billion unique email addresses were rendered useless in a single leak.
The storm has certainly not subsided this year. Due to the corona crisis, we are working from home en masse and e-mail communication has become even more popular than before. In addition, the hunger for information surrounding Covid-19 is a sought-after bait for phishing campaigns. Never before have hackers been savvier about email-based attacks than they are now.
These are the biggest email threats right now:
Table of Contents
1. Phishing
When phishing, attackers fish for personal information and login credentials. They often pretend to be a reliable person or party. For example, they try luring users via a deceptive email to a real-looking website on a forged domain. They then ask for login details, which are sent straight to the attackers.
This data often provides access to other email domains, where hackers can monitor the email traffic and thus retrieve more contextual information. Think of names of higher management or business contacts. With that information, they can then set up fraudulent attacks, such as sending fake invoices.
2. CEO fraud
CEO fraud, in particular, is a very dangerous and fast-growing phenomenon. Hackers are very patient and focused when carrying out this type of phishing. They aim for specific organizations, often companies with a lot of valuable data or liquid assets.
The CEO fraud is often preceded by extensive preparation. Attackers spend months or even years unseen on the corporate network and master the trade and business of an organization there.
With this information, they can then credibly pretend to be a manager in phishing emails. They can extract sensitive information from the account of a high-ranking person or, for example, order employees to make a payment to a false account number.
3. Loss of (sensitive) data
One of the biggest email threats comes from within through our own employees. On a daily basis, sensitive data sent via email ends up in the wrong hands due to inattention. For example, when an employee accidentally sends an email to the wrong person or uses a personal email address for business purposes.
The problem is widespread. No less than 60 percent of companies worldwide have experienced the loss of sensitive data. This is partly due to the lack of policy. Many organizations have not established rules about sending sensitive data via email.
4. Ransomware
Ransomware is another email-related risk that can lead to data loss. Hackers encrypt valuable data and only make it available again in exchange for ransom. The result: data loss, downtime, and when organizations pay the ransom, of course, direct financial damage. When ransomware has encrypted files containing personal data, this is also seen as a data breach.
Email accounts are often the starting point of these attacks. Hackers send a ‘dropper’, a Trojan horse that downloads the actual ransomware via phishing emails. The dropper is disguised as an innocent attachment, for example as an Office document or zip file.
Ransomware is a specific type of malware. Malware in general is a risk factor for email traffic. 94% of all malware arrives via email.
