BLOG

Researchers at Barracuda have found that smaller companies tend to receive a higher rate of phishing attacks spread across the organization, according to a report looking at the phishing attack surfaces of companies of different sizes.

This is likely due to the smaller number of potential targets and the higher level of access possessed by each employee. At larger organizations, spear phishing attacks generally focus on specific, high-value targets, such as executives or employees with access to financial decisions.

“Smaller companies tend to have flatter organizational structures with easier access to names or contact details,” Barracuda explains. “This could mean that attackers can target a wide range of employees. Due to their smaller size, they are also likely to have more people with privileged access to data and systems. There are fewer degrees of separation between employees, enabling attackers to move laterally quickly. As a result, inbound attack emails are more evenly distributed across the business and could target the intern as well as the CEO.”

Phishing remains a top threat for large organizations as well. Barracuda found that attacks against large companies often involve lateral phishing, in which threat actors use compromised accounts to send phishing emails to other accounts within the organization.

“Just under half (42%) of the targeted email attack detections in the largest companies involved lateral phishing, compared to only 2% for the smallest organizations,” the researchers write. “This internal attack vector is a major risk for large businesses. The prevalence of account compromises among larger businesses may reflect the fact that credentials for many companies are likely already available for purchase on the dark web, making lateral phishing a straightforward attack.”

The Federal Trade Commission provided some helpful tips to help you and your users to donate safely this holiday season and all year round:

1. Do some research online – Start by searching for causes you care about along with phrases like “best charity” or “top rated charity”. When you consider giving to a specific charity, search its name plus “complaint,” “review,” “rating,” or “scam.” You can use resources such as Charity Navigator or CharityWatch to verify your search.
2. Be careful how you pay – If someone wants donations in cash, by gift card, or by wiring money, don’t do it. That’s a trap for scammers to take your money. Be on the safe side and pay by credit card or check, and keep records of your donations. Before you click on a donation link, check out this FTC article to help you make sure your money is going where you think it is.
3. Keep scammers’ tricks in mind – Some cybercriminals try to trick you into paying them by thanking you for a donation that you never made, or use a local area code when making a call. Make sure to watch out for red flags such as guaranteeing sweepstakes winnings in exchange for a donation (it’s illegal) or claims that your donation is tax-deductible when it’s not. If you’re feeling rushed or pressured to make a donation, that should also be a red flag that something isn’t quite right.

Every year cybercriminals prove there is no social engineering scheme too low for them to use in their attacks. New-school security awareness training can train your users on how to spot and report any malicious activity.

Take time to read the article on

Shocking Charity Scam Statistics: VPNRanks Predicts Staggering $6.2 Million in Losses by 2025

It shed more light on this topic.

Happy reading.

Analysis of current phishing attacks by security researchers have uncovered an increase in the use of trusted shortlink services.

To be successful, phishing scammers need to establish legitimacy as much and as early as possible.

Brand impersonation within an email has long been one method, but to establish legitimacy to security solutions, scammers have had to do more than just have a look-alike domain.

According to security researchers at Barracuda, a wave of phishing attacks is leveraging legitimate URL shortening services to add a layer of obfuscation to their malicious links in emails.

While some security solutions actually follow links to – and analyze – their final destination, many solutions simply look at the link itself. By using a shortlink – like those created by bit.ly that look similar to “bit[dot]ly[slash]FakeURL”, solutions that take the link at face value will see it as legitimate.

Barracuda theorizes that threat actors are compromising credentials at these shortlink services to gain access and utilize them as part of phishing attacks.

There’s really only two ways to counteract this:

1. Employ security solutions that traverse links and scan final web destinations for malicious content
2. Teach users through continual new-school security awareness training to be vigilant each and every time they interact with an email, at attachment, or a web link, not trusting the content or context in front of them and choosing to scrutinize before proceeding.

And because cybercriminals will continue to evolve their methods, both of the ways mentioned should be put in place.

KnowBe4 empowers your workforce to make smarter security decisions every day. Over 65,000 organizations worldwide trust the KnowBe4 platform to strengthen their security culture and reduce human risk.

First National Bank has warned of an increase in phishing and smishing attacks, IT-Online reports.

Trish Ramdhani, head of fraud at FNB Card, stated, “In recent cases, some consumers received SMSes claiming that their bank requires them to urgently FICA by clicking on a link that takes them to the fraudster’s platform, where their information is then compromised. The technique now includes attempting to entice the user to divulge both their card information and the one-time password (OTP), which is subsequently used to complete successful transactions using smart devices.”

FNB offers the following recommendations to help people avoid falling for these scams:

• “Don’t panic: Fraudsters rely on people acting hastily due to a sense of panic. The tactics include threats that your accounts will be blocked or that fraud has been identified and must be stopped immediately. Whatever the scenario, keep in mind that such things will never compel you to give away OTPs, PINs, or passwords. It is safer to end such communication and contact your financial institution right away.
• “Do not click on email or SMS links: When opening emails from unknown sources or those that appear suspicious, proceed with caution. Clicking on links or downloading attachments from these kinds of messages should be avoided because they may include harmful malware or redirect you to fake websites.
• “Enable two-factor authentication (2FA): Enable 2FA wherever possible since it adds an extra layer of security by requiring a second verification step, which is often transmitted to your mobile device or an authenticator app, such as the FNB Apps for FNB customers.
• “Take note of the card and digital safety measures recommended by your financial institution: There is a lot of misleading information about how people may protect themselves from fraud, but it is always preferable to follow your financial institution’s recommendations on how to secure your money.
• “Keep software and devices up to date: Update your operating system, web browsers, and antivirus software on a regular basis to guard against vulnerabilities. To ensure that you get the most recent security fixes, enable automatic updates whenever possible.”

50% of organizations surveyed were victims of spear phishing attacks in the last twelve months, according to a new report from Barracuda. The report also found that, on average, organizations receive five “highly personalized spear phishing emails per day.”

“In an analysis of 50 billion emails across 3.5 million mailboxes, Barracuda researchers uncovered nearly 30,000,000 spear phishing emails,” the report states. “While these emails make up less than 0.1% of all emails sent, they greatly impact organizations when attacks are successful. (For comparison, high-volume attacks, such as spam and malware, make up about 16% of emails, but their impact is not as high.) The average cost of a data breach caused by business email compromise was nearly $5 million in 2022, according to IBM. And no business is immune.”

The researchers found that while spear phishing makes up a very small percentage of email attacks, it’s responsible for a majority of successful breaches.

“Three-quarters of respondents surveyed said they fell victim to an email attack in the last 12 months. Half said they were the victims of spear phishing,” the report says. “That means 2 out of 3 successful email attacks are spear phishing attacks that use personalized messages, social engineering, and other tactics. This is significant because these attacks make up only 0.1% of all email-based attacks according to Barracuda’s data but are responsible for 66% of all breaches. On the other hand, high-volume attacks such as spam and malware, make up 16% of emails but are only responsible for one-third of breaches. Spear phishing protection is critical because even just one successful attack can be devastating.”

Almost all the organizations that fell victim to spear phishing suffered adverse effects.

“Nearly every victim of a spear phishing attack in the last 12 months saw impacts on their organization, including malware infections, stolen data, and reputational damage,” the researchers write. “While a direct monetary loss is one of the effects, all the other impacts could also result in some financial damage for an organization as a result of an attack.”

New-school security awareness training can enable your employees to thwart targeted social engineering attacks.