Story image

Phishing declines, but targets increase - report

11 Jun 18

Article by RiskIQ threat analyst Andrew Geiger

Phishing actors are always innovating and creating new methods to lure victims into gaining access to their financial information, personally identifiable information, and user accounts.

Understanding the latest phishing techniques and threat actor tendencies helps position customers to stay one step ahead of phishing threats targeting their organisations.

The first 2018 quarterly iteration of the Phishing Roundup details the trends in phishing activity as observed by RiskIQ over Q1 of 2018, drawing upon data used in the Q4 Report of 2017 for comparison and recapping trends that have been seen entering into the new year.

More diversity in targets

For the second quarter in a row, Q1 saw a slight decrease of over 2% in overall phishing detections from Q4 of 2017, with 26,671 unique domains identified.

The data we observed, however, was much richer than in the past regarding targeted brands.

During Q1, RiskIQ saw a total of 299 unique brands targeted through phishing pages, up from the 259 brands we observed in Q4 of 2017.

The breakdown of the top 10 targeted brands is as follows:

  • 40% financial institutions
  • 20% digital transaction providers
  • 10% large tech company
  • 10% major health insurance provider
  • 10% cloud storage provider
  • 10% social media platform

As usual, the same financial institutions make up a significant portion of the top-ten targeted brands for Q1 of 2018 and much of the social media targeting trend that we observed in Q4 of 2017 is now mostly gone, which may indicate a return to tried and trusted tactics by threat actors.

However, the top 10 percentage breakdown for Q1, which includes the arrival of cloud storage providers which were not present last quarter, may indicate an overall more diverse detection of targeted brands.

This diversity of targets helps RiskIQ’s detection models improve their ability to detect phishing attacks.

Detections by registrar

Hostinger proved to be a flash in the pan in Q4 2017, leading the list of registrars used by phishing URLs and then dropping out of the top-five entirely.

GoDaddy, which is no stranger to the top of this list, reclaimed its place ahead of the pack, which isn’t surprising as phishing attacks, as well as the infrastructure used therein, tend to be extremely cyclical.

Detections by hosting provider

The list of top hosting providers used by phishing actors in Q1 saw more changes, with all five spots in flux and three of the five new to the list.

Phishing actors are constantly changing infrastructure, so they have shopped elsewhere in Q1 rather than using the same tools from Q4.

2019 threat landscape predictions - Proofpoint
Proofpoint researchers have looked ahead at the trends and events likely to shape the threat landscape in the year to come.
InternetNZ welcomes Govt's 99.8% broadband coverage plan
The additional coverage will roll out over the next four years as part of the Rural Broadband Initiative phase two/Mobile Black Spots Fund (RBI2/MBSF) programme expansion.
Commerce Commission report shows fibre is hot on the heels of copper
The report shows that as of 30 September 2018 there were 668,850 households and businesses connected to fibre, an increase of 45% from 2017.
Dr Ryan Ko steps down as head of Cybersecurity Researchers of Waikato
Dr Ko is off to Australia to become the University of Queensland’s UQ Cyber Security chair and director.
Businesses in APAC are ahead of the global digital transformation game
“And it’s more about people and culture - about change management - along with investing in the technology.”
HubSpot announces fund for 'customer first' startups
HubSpot is pouring US$30 million (NZ$40 million) into a new fund to support startups that demonstrate ‘customer first’ approach of not only growing bigger, but growing better.
Mac malware on WatchGuard’s top ten list for first time
The report is based on data from active WatchGuard Firebox unified threat management appliances and covers the major malware campaigns.
LearnCoach closes $1.5m seed round
The tutorials are designed for students who want to learn NCEA subjects but can’t make it to a physical classroom.