CISA Discovers Spear Phishing and Valid Account Compromise Are the Most Common Attack Vectors

The US Cybersecurity and Infrastructure Security Agency (CISA) has found that compromise of valid accounts and spear phishing attacks were the two most common vectors of initial access in 2022, Decipher reports. Valid accounts were compromised in 54% of successful attacks.

“Valid accounts can be former employee accounts that have not been removed from the active directory or default administrator accounts,” CISA said. “When organizations do not change default passwords, threat actors can compromise a valid administrator account. In many cases, this attack technique is possible because the valid account allowed unauthorized users to install or execute insecure software (such as unpatched or out-of-date software) on a system or network.”

The report found that spear phishing links were successful in 33% of attacks.

“Successful spear phishing requires an attacker’s malicious email to pass through network border protections and deliver malware to execute on the local host,” CISA says. “Host-level protection stops spear phishing attempts as they pass through network perimeter protection. At the network border level, CISA observed 13% of spear phishing attempts blocked. At the host or endpoint level, CISA observed 78% of links or attachments blocked, preventing the execution of a malicious activity. A cyber threat actor’s success rate with this type of attack depends on factors, such as the perceived authenticity of the email’s content and presentation, host protections (e.g., antivirus and malware detection software), and the network’s boundary protection mechanisms.”

CISA offers the following recommendations for organizations to defend themselves against these attacks:

• “Implement a secure password policy requiring phishing-resistant multi-factor authentication (MFA) for remote access, strong passwords, unique credentials, and the separation of user and privileged accounts, effectively revoking unnecessary or inactive accounts.
• “Configure email servers to filter out and block emails with malicious indicators and implement authentication protocols, such as Sender Policy Framework (SPF) and DomainKeys Identified Mail (DKIM) to prevent spoofed or modified emails.
• “Implement a phishing awareness training program that includes guidance on identifying phishing attacks and how personnel should report suspected phishing attempts and verified incidents.”

New-school security awareness training can teach your employees to follow security best practices so they can avoid falling for social engineering attacks.

---

Free Phishing Security Test

Would your users fall for convincing phishing attacks? Take the first step now and find out before bad actors do. Plus, see how you stack up against your peers with phishing Industry Benchmarks. The Phish-prone percentage is usually higher than you expect and is great ammo to get budget.

Here’s how it works:

• Immediately start your test for up to 100 users (no need to talk to anyone)
• Select from 20+ languages and customize the phishing test template based on your environment
• Choose the landing page your users see after they click
• Show users which red flags they missed, or a 404 page
• Get a PDF emailed to you in 24 hours with your Phish-prone % and charts to share with management
• See how your organization compares to others in your industry

PS: Don’t like to click on redirected buttons? Cut & Paste this link in your browser: https://info.knowbe4.com/phishing-security-test-partner?partnerid=001a000001lWEoJAAW