Story image

Impersonation attacks rise 400% as email security struggles to keep up

12 Jun 2017

20% of all risky emails are bypassing security in systems worldwide, despite efforts to deal with the problem, according to Mimecast's quarterly Email Security Risk Assessment.

The company says that both unknown and known attacks are on the rise. Those attacks are continuing to get through 'incumbent' email systems.

Impersonation attacks grew 400% quarter over quarter. These attacks involve social engineering emails that appear to be from a trusted C-level executive, employee or business partner.

Business email compromise (BEC) scams are a particularly worrying trend because they contain no malware -- instead they fool victims into sending money or sensitive data. In addition, there were 8605 impersonation attacks.

The report analysed 44,000 items of inbound email over 287 days. Over that period, there were 8.9 million spam items, 8318 dangerous file types, 1669 known malware attachments and 487 unknown malware attachments.

Most of those emails had already made it through organisations' email security systems.

“Cybercriminals are constantly adapting their attack methods. For instance, this latest ESRA analysis reflects how impersonation attacks are getting through existing email security defenses at an alarming rate. If a CISO isn’t reviewing its current email security solution on a 12-18 month basis, they may be surprised at what threats are now getting into employees’ inboxes,” comments Ed Jennings, chief operating officer at Mimecast.

According to US statistics from the FBI, BEC scams cost businesses more than US$5.3 billion in fewer than three years. Between January 2015 and December 2016, identified exposed losses shot up by 2370%.

“Email security providers need to ensure they’re doing their due diligence to protect customers from new attacks, whether they be advanced or simple. The Mimecast ESRA results show a clear need for the security industry to come together in the fight against email-borne threats," Jennings says.

Partnership brings AI maths tutor to NZ schools
“AMY can understand why students make a mistake, and then teach them what they need straight away so they don't get stuck."
Polycom & Plantronics rebrand to Poly, a new UC powerhouse
The name change comes after last year’s Plantronics acquisition of Polycom, a deal that was worth US $2 billion.
Unencrypted Gearbest database leaves over 1.5mil shoppers’ records exposed
Depending on the countries and information requirements, the data could give hackers access to online government portals, banking apps, and health insurance records.
Mozilla launches Firefox Send, an encrypted file transfer service
Mozille Firefox has launched a free encrypted file transfer service that allows people to securely share files from any web browser – not just Firefox.
VoiP new-comer upgraded and ready to take on NZ
UFONE is an Auckland-based VoIP provider that has just completed a massive upgrade of its back-end and is ready to take on the market.
Online attackers abusing Kiwis' generosity in wake of Chch tragedy
It doesn’t take some people long to abuse people’s kindness and generosity in a time of mourning.
Apple launches revamped iPad Air & iPad mini
Apple loves tinkering with its existing product lines and coming up with new ways to make things more powerful – and both the iPad Air and iPad mini seem to be no exception.
IntegrationWorks continues expansion with new Brisbane office
The company’s new office space at the Riverside Centre overlooks the Brisbane River and Storey Bridge.