Report: Phishing attacks on government up 110%
GettyImages/ calvio
Connecting state and local government leaders
Rising phishing activity is directly linked to phishing- as-a-service options, according to a new report by Zscaler.
As organizations increase their resilience against malware and cyberattacks, hackers have turned to social engineering tactics, like phishing, to breach secure systems, compromise login credentials and steal sensitive information. According to Zscaler’s 2022 ThreatLabz Phishing Report, phishing attempts rose by 110% in the government sector between 2020 and 2021.
Phishing attacks are one of the most pervasive cyberthreats, showing a 29% global rise over the past year.
The United States has long been the most targeted country. In 2021, The U.S. was still the top phishing target, but attempts only rose by 7% while there were steeper increases everywhere else. Even so, the U.S. still accounts for 60% of all phishing attempts.
The report lists over 20 common types of phishing attacks, but it breaks them down into three main categories: link, prompt or attachment. Typically, victims are encouraged to click a malicious link to a phishing site, hosted file or malware. Others are prompted to submit sensitive information, often resulting in data theft. Another common tactic tricks users into clicking email attachments that may deliver malicious software.
Email phishing remains the most common form of attack, according to Zscaler, making up 96% of tracked phishing attacks. Hackers have also turned to voice phishing and SMS phishing attacks that allow malicious actors to pose as known brands or acquaintances of the recipient. Termed “vishing” and “smishing” respectively, these tactics allow attackers to ramp up social engineering ploys.
Among other common phishing tactics, cloud scams lure victims by imitating file sharing or cloud storage services, sending phony account notifications and fake access requests. Commercial scams do much of the same, except bad actors impersonate general services like FedEx.
In corporate scams, phishers masquerading as specific companies or executives send employees fake company updates, HR tasks and invoice requests to collect personal information or get money sent to them. Scammers also impersonate federal agencies like the IRS and send fake offers for benefits or relief loans or make overdue payment requests to lure users into turning over personal or banking information.
Threat actors are also tapping into a burgeoning underground marketplace for phishing-as-a-service resources, according to the report. On the dark web, pre-built phishing tools are readily accessible to non-technical cybercriminals who can then deploy scams at scale.
The prevalence of phishing kits, often ZIP files containing all the components required to wage and scale an attack, are also contributing to the increase in attacks. Kits usually include PHP and HTML files for various functions such as generating a phishing page, enabling attacker access, evading detection, exfiltrating data, and fingerprinting users, the report said.
“Now, attackers can simply copy templates from the kit to a compromised web server or a hosting service to spawn a phishing page for a targeted brand.” the report said.
According to a 2020 Stanford study cited in the report, 88% of data breaches are caused by human error, with young male employees being the most vulnerable. End user awareness training is critical to preventing users from falling for these scams, the report said.
Continuous training will contribute to a vigilant culture where employees are aware of the most common phishing tactics. Encouraging users to flag phishing emails is also helpful, the report said. Security teams can add a “report phishing” button directly in employee email inboxes, and they should also implement email scanning, antivirus software, encrypted traffic inspection and other automated solutions.
To defend against the most advanced threats, Deepen Desai, Zscaler CISO and VP of security research and operations, recommends a multipronged strategy built on a cloud-native zero trust platform that combines full SSL inspection with artificial intelligence-powered detection. This will “limit the blast radius” for a compromised user, safeguard against data theft and block high-risk destinations such as newly registered domains, he said.
“Phishing attacks are impacting businesses and consumers with alarming frequency, complexity, and scope - with the rise in phishing-as-a-service making it easier than ever for non-sophisticated actors to launch successful attacks,” Desai said.
NEXT STORY: Microsoft raises bug bounties by up to 30%