The Minefield of Corporate Email

Employee email accounts are prime targets for fraudsters, phishing attacks, and malware delivery as hackers assume someone will click, download, or respond to fall into their traps.

The threats causing concern are far from new — in fact, they're among the oldest. As Cisco researchers point out in a new report, "Email: Click with Caution," spam is 40 years old and phishing is over 30. Over time they've grown in prevalence and sophistication, joined by malware and fraud as criminals find new ways to cause problems for security practitioners.

"It seems never-ending sometimes, the kinds of threats that arrive through email," says Ben Munroe, director at Cisco Security, who also says "the fact that it's still a problem for us … is incredible. Things are not getting better and in fact, things are getting worse."

Incredible, yes, but as researchers note in the report, email's structure is "an almost ideal format" for scammers. Employees are forced to read every message, make judgment calls about what they receive, and decide what to open, click, download, and respond to. The right amount of social engineering can manipulate recipients into accidentally letting attackers in.

More than half (56%) of CISOs say defending against user behavior is "very" or "extremely" challenging, Munroe says, citing Cisco's 2019 CISO Benchmark Study. Only 51% think they're doing an "excellent" job managing employee security. Users often get a bad reputation, but it's tough when cybercriminals have an advantage and their targets don't know what's coming.

"It's not fair for everyone to criticize users for doing what users have to do," he says. Employees have to answer emails, even if an email from their "boss" came from a hacker. "It isn't fair to always say users are not sophisticated — attackers are extremely sophisticated," Munroe adds.

Here, we take a closer look at the emailed threats arriving in their inboxes.

To Click or Not to Click?
Wendy Nather, head of Advisory CISOs at Duo Security, now part of Cisco, says attackers' efforts are going in two directions: one is technological; trying to exploit new methods and plant new payloads. The other is psychological, encompassing social engineering efforts. "You have to defend both on the technical side and the social engineering side," she emphasizes.

Credential theft is one of the most common email-based scams, Cisco researchers found. Cybercriminals send emails from fake addresses ([email protected], for example) and users who click a link are redirected to a fake webpage where they're prompted to enter credentials. Those go to the attacker, who may use them to log in to other Microsoft services.

Cisco cites an Agari report that says 27% of advanced email attacks are launched from compromised accounts — up from 20% in the last quarter of 2018. Microsoft accounts aside, attackers also target popular cloud-based email services like Gmail and G Suite.

Business email compromise (BEC), which caused $1.2 billion in losses in 2018, is another threat to watch. Researchers note attackers don't typically use compromised accounts for these; instead, two-thirds of BEC scams still use free webmail attacks and 28% use registered domains. BEC messages are often personalized; one in every five includes the name of the recipient.

Digital extortion, in which attackers try to convince their victims they have footage of them accessing an adult film site or other content, is another lucrative move for attackers. Munroe notes how advancements in technology have changed the game in extortion: "the improvement in hardware, allowing all of us to have a camera; the improvement in bandwidth, allowing us to stream video" have also driven techniques for malicious activity. Researchers do point out profits from extortion have fluctuated along with the value of Bitcoin over time.

Malware Delivery
Email is still a reliable vector to deliver malware, though attackers have been forced to change their tactics as their victims learned the risk of clicking .exe files. Now, malware is more likely to be served indirectly via documents with less suspicious file types or malicious URLs in messages.

Between January and April 2019, binary files only made up 2% of all malicious attachments. Attackers now gravitate toward .zip files, which make up one-third of attachments. JavaScript files make up 14.1% and, researchers note, and attackers are more frequently using them. It's now the third most-common malicious extension, following .doc (41.8%) and .zip (26.3%).

"Throw PDF documents into the mix, and more than half of all malicious attachments are regularly used document types, ubiquitous within the modern workplace," according to the report.

Malware itself has also evolved, Munroe points out. "I'd say in terms of what they're distributing — the idea of malware or what you could call modular malware — having landed on a host or an endpoint, it's able to detect a number of different parameters about where it is or what to do." Is it in a low-cost environment? Valuable environment? Is there high bandwidth?

"That idea is certainly quite worrisome and given email is a prevalent attack vector, it's certainly concerning for CISOs," he adds.

What's a CISO to Do?
The challenge of email security lies in its commonality. "It's the mundane nature of email, especially trying to trick people into clicking things they spend all day clicking," says Nather.

Some CISOs recognize different users have different risk profiles, she continues, and they adjust their security practices accordingly. Human resources employees, who have to open attachments all day, or financial analysts, who are prime BEC targets, are some examples. "They're putting more security controls around them, isolating them more, hardening their systems more," Nather explains. Some employees have different external email addresses.

In the report, researchers explain how to spot a phishing attempt. A few telltale signs:

Related Content: