A third, 33 per cent of hijacked email accounts had attackers dwelling in the account for more than a week. That is according to a report, Spear Phishing: Top Threats and Trends Volume 4 – Insights into attacker activity in compromised email accounts.
Researchers from the cyber firm Barracuda with UC Berkeley in the United States looked at the end-to-end lifecycle of a compromised email account. They examined 159 compromised accounts spanning 111 organisations, and concluded that a specialised economy is emerging around email account takeover, using brand impersonation, social engineering, and spearphishing to hijack email accounts and monetise them. Barracuda’s researchers also found that 20 per cent of compromised accounts appear in at least one online password data breach, which suggests that cybercriminals are exploiting credential reuse across employees’ personal and organisation accounts.
In 31 per cent of account compromises analysed, the initial set of attackers would focus on compromising accounts and then sells account access to another set of cybercriminals who focus on monetising the hijacked accounts. This reflects an increasingly specialised, and layered criminal market for account compromise.
The researchers observed that most, 78 per cent of attackers did not access any applications outside of email. The report concluded that either many organisations’ cloud accounts do not have access to interesting data and functionality outside of email, or that attackers have yet to adapt and exploit these additional sources of information.
Don MacLennan, SVP Engineering, Email Protection at Barracuda said: “Cybercriminals are getting stealthier and finding new ways to remain undetected in compromised accounts for long periods of time so they can maximise the ways they can exploit the account, whether that means selling the credentials or using the access themselves.
Being informed about attacker behaviour will help organisations put the proper protection in place so they can defend against these types of attacks and respond quickly if an account is compromised.”
Download the full report at: https://www.barracuda.com/spear-phishing-report-4. See also the blog post: http://cuda.co/40984.
