December is an active month for cybercriminals – the uptick in holiday shopping, end of year budgets & contracts, preparations for tax season, end of year surveys, and generally frenetic pace lends itself to a ripe environment for phishing scams. It’s not atypical this time of year to see an uptick in phishing attempts that rely on old standby techniques such as DHL or FedEx impersonations or fake invoices being sent to accounting departments.
Last week, however, came with a twist – a number of high-profile ransom-driven phishing scams that prey on fear.
In a typical phishing scam, you can usually find three key characteristics: a trusted sender or brand, urgent language, and some kind of required response.
In these bitcoin-driven scams, attackers substitute fear for the trusted sender component: Last week saw a dramatic rise in bomb threats requesting bitcoin payment (which so far appear to be hoaxes / scams rather than legitimate threats), whereas starting this past summer, there has been a burst of sextortion scams.
Ultimately, the pattern is the same – threaten personal damage (physical or otherwise) unless the recipient transfers a certain amount of bitcoin to one of several circulating accounts. These scams often include some level of personalization to give the threat greater credibility.
In the business world, this same pattern can be found in other financially motivated phishing attacks: The target is sent a plain text, often personalized, email with no links or attachments that requests a wire transfer due to a late invoice payment, or W2 information for a former employee. Such requests are rarely legitimate but have enough details to encourage action.
From an email security perspective, such emails either completely bypass traditional email security tools because they are “payload-free” with no attachments or associated links or they’re quarantined – which can be problematic if they are legitimate. This binary approach to email security (either something is good or bad) belies the reality of today’s threat landscape which exploits the dangerous gray area of every day communication. The challenge of course is that a percentage of “legitimate” email follows this same pattern, and this good/bad approach to email can result in either exposure for the company or delayed business operations due to blocked or quarantined emails.
Security teams should use the current ransom scams as an impetus to reconsider how such emails should be handled not just from a technology perspective, but also from a business process and user education mindset. For example – what’s the process for authorizing wire transfers or transmitting confidential information? How should physical security threats be handled and to whom should they be reported? How is that information being communicated and reinforced to employees?
Once such decisions are made, technology can not only detect the threats but also be a powerful enabler and reinforcement for that process. For many of GreatHorn’s customers, for example, such emails come with a warning banner that reminds the recipient of the established business process and whether the email deserves extra scrutiny.
In 2019, we’ll be writing more about the Email Security Lifecycle – and GreatHorn’s unique ability to support all aspects of an organization’s comprehensive email security strategy. Stay tuned!