Phishing Attacks Rise 54% as the Initial Attack Vector Across All Threat Incidents
As cybercriminal groups hone their craft, one analysis shows them shying away from zero-day exploits, use of valid accounts, and third-party vulnerabilities to gain initial access during attacks.
If you were an attacker, the challenge with getting initial access is that most methods have a limited window of time for success. Buying an account off the dark web is only good until the password is changed. Use of a third-party vulnerability or a zero-day exploit will eventually be patched.
But phishing users… well, there’s plenty of those to go around, right? Whether you are spear phishing to target specific individuals within an organization, or broadly phishing anyone who’ll engage with your malicious email content, it seems like there will always be someone willing to “help”.
According to new data from Kroll’s Q1 2022 Threat Landscape report, we find that threat actors have – at least for the first quarter of this year – shifted initial access tactics and put a lot of emphasis on phishing, used in 60% of all attacks. This is a 54% increase from Q4 2021’s number, where only 39% of attacks leveraged phishing.
If this trend continues – and, really, even if it doesn’t – attackers know there are plenty of fish in the “phishing sea”. That is, unless you put that same kind of limitation on the viability of an initial attack vector on phishing.
And just how do you do that?
Unlike the other three attack vectors mentioned in the report (and above), phishing doesn’t have a limited lifespan; users can repeatedly be used as pawns in the next attack and the next. That is, unless you minimize the viability of users assisting phishing attacks by enrolling them in Security Awareness Training designed to educate them on how phishing attacks work, what to look for to avoid assisting the attacker, and keep them abreast of the latest campaigns, trends, and uses of social engineering.
Free Phishing Security Test
Would your users fall for convincing phishing attacks? Take the first step now and find out before bad actors do. Plus, see how you stack up against your peers with phishing Industry Benchmarks. The Phish-prone percentage is usually higher than you expect and is great ammo to get budget.
Here’s how it works:
- Immediately start your test for up to 100 users (no need to talk to anyone)
- Select from 20+ languages and customize the phishing test template based on your environment
- Choose the landing page your users see after they click
- Show users which red flags they missed, or a 404 page
- Get a PDF emailed to you in 24 hours with your Phish-prone % and charts to share with management
- See how your organization compares to others in your industry
PS: Don’t like to click on redirected buttons? Cut & Paste this link in your browser: https://info.knowbe4.com/phishing-security-test-partner?partnerid=001a000001lWEoJAAW