Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Business email compromise (BEC) is big business for malicious actors. According to the 2021 FBI Internet Crime Report, BEC was responsible for nearly $2.4 billion in cyber crime losses in 2021. At its root, it’s a type of phishing attack. And with the rise of smartphones and tablets, attackers are expanding well beyond email. They now leverage other platforms such as SMS messages, messaging apps like Signal and WhatsApp, and social media apps to target and compromise their targets.

At Tines, we understand there’s no such thing as a universal workflow. While there are often some standard best practices, whether carrying out a workflow manually or automating it, every team has a unique approach and set of tools to solve challenges. This is especially true for security teams, who constantly have to evolve their processes and infrastructure to stay ahead of cyber attackers in today’s rapidly changing threat landscape.

The Anti-Phishing Working Group (APWG) Phishing Activity Trends Report reveals that in Q2 of 2022 there were 1,097,811 total phishing attacks. This marks the worst quarter for phishing observed to date, exceeding Q1 of 2022 which was the first time the three-month total exceeded one million.

The theme of this year’s Cybersecurity Awareness Month theme – “See Yourself in Cyber” – focuses on how both individuals and organizations can better protect themselves from cybercrime. One of the most important steps we can all take is learning to recognize and report phishing attempts.

This past month, Trustwave SpiderLabs observed that HTML (Hypertext Markup Language) file attachments had become a common occurrence in our spam traps, which is not unusual since malware is often delivered through phishing spam. For the past 30 days, SpiderLabs has found the combination of.HTML (11.39%) and.HTM (2.7%) files are our second most spammed file attachment, totalling 14.09%, followed by.EXE files at 12.84%.

There is an exploitation method that can automatically forward emails CC’d to external addresses via an Outlook Desktop rule, even when this action is prevented on the corporate Exchange server. This can be a serious data exfiltration risk allowing post-exploitation persistence in a previously breached account. The legitimate email account owner is highly likely to be unaware of the creation of this rule.

Email is a popular channel for hackers: phishing attacks and malware usually originate from email. In 2022, Verizon found that 82% of breaches involved the human element: phishing emails and ransomware delivered via email continue to plague organizations of all sizes. For an organization with 1–250 employees, roughly one in 323 emails will be malicious, according to Comparitech.

There’s a high chance that you or someone you know has been impacted by email fraud or identity theft. At the very least, you’ve likely received a variety of spam emails and text messages asking to provide a payment or confirm your identity. The good news is that cybersecurity protection is constantly evolving and improving, with cybersecurity education programs preparing skilled professionals to enter the front lines against cybercrime.

This post is the first of a multi-part blog series on various sources of telemetry. At LimaCharlie, we’re a firm believer in visibility. The more an analyst can see about their environment, the more impactful decisions they can make. We are huge fans of multi-source telemetry, bringing visibility from almost anywhere in your environment to one place for analysis, detection, and response capabilities.