Millions of malicious emails will slip past security filters in Q4
Researchers at Tessian have published a report looking at recent trends in spear phishing attacks. The researchers found that 45% of employees said that they clicked on a phishing email while they were distracted, and 52% admitted that they make more mistakes when they’re stressed. They also determined that most phishing emails are sent in the afternoon.
“The most malicious emails are delivered around 2PM and 6PM, with very little fluctuation day-to-day (except over the weekend),” the researchers write. “This isn’t an accident. Since employees are more likely to make mistakes when they’re stressed, tired, and distracted, the second half of the workday is a bad actor’s best bet.
This is reinforced by the fact that employees are most likely to mark an email as malicious between 9AM and 1PM, before the afternoon slump. We then see a steady decline starting at 2PM, right when the bad guys are ramping up.”
The report hints that cyber criminals are doing all they can to catch their victims – most of the emails were sent during the holiday season in Q4 2020, with the last three months of the year seeing 45% more malicious emails compared to the quarter before.
The researchers also found that organizations of different sizes offer different pros and cons for attackers: larger organizations can provide a larger payout, while smaller ones are often easier to break into.
“In terms of company size, bad actors will take whatever they can get,” the researchers write. “Wondering why they don’t focus exclusively on the ‘big fish’ (i.e. enterprise)? Because smaller companies – who generally have less money to spend on cybersecurity – are often easier to infiltrate. This can be a foothold for lateral movement, especially for companies with large supply chains.”
Tessian adds that attackers have a wealth of resources at their disposal to craft targeted social engineering attacks. “Between social media, OOO messages, and (free) online tools, it’s impossibly easy for bad actors to research their targets,” Tessian says. “Armed with information about a person’s company, colleagues, and personal life, they’ll be able to craft personalized, convincing, and effective email campaigns to trick them into handing over sensitive information or transferring funds.”
New-school security awareness training can give your organization an essential layer of defense by teaching your employees how to recognize sophisticated social engineering attacks. Tessian has the full story: https://www.tessian.com/research/spear-phishing-threat-landscape/
Free Phishing Security Test
Would your users fall for convincing phishing attacks? Take the first step now and find out before bad actors do. Plus, see how you stack up against your peers with phishing Industry Benchmarks. The Phish-prone percentage is usually higher than you expect and is great ammo to get budget.
Here’s how it works:
- Immediately start your test for up to 100 users (no need to talk to anyone)
- Select from 20+ languages and customize the phishing test template based on your environment
- Choose the landing page your users see after they click
- Show users which red flags they missed, or a 404 page
- Get a PDF emailed to you in 24 hours with your Phish-prone % and charts to share with management
- See how your organization compares to others in your industry
PS: Don’t like to click on redirected buttons? Cut & Paste this link in your browser: https://info.knowbe4.com/phishing-security-test-partner?partnerid=001a000001lWEoJAAW