The volume of Business Email Compromise (BEC) attacks caught by a leading security provider jumped by 80% over the past quarter.
Mimecast’s latest Email Security Risk Assessment (ESRA) report revealed the provider blocked over 41,000 impersonation attempts over the latest three-month period which were missed by other vendors. This could indicate its detection is getting better, rival vendors are getting worse and/or BEC attacks are becoming more popular.
Business Email Compromise occurs when typically members of the finance team are socially engineered into making massive fund transfers from the corporate bank account to third parties. Attackers do this either by spoofing the email of the CEO or CFO, or even by phishing and hacking their email account first.
There was a 136% increase in BEC losses between December 2016 and May 2018, with over $12.5bn lost globally between October 2013 and May 2018, according to the FBI.
Mimecast’s ESRA also revealed that the vendor caught over 19 million pieces of spam, 200,000 malicious links, 13,176 emails containing dangerous file types and 15,656 malware attachments.
“Targeted malware, heavily socially-engineered impersonation attacks, and phishing threats are still reaching employee inboxes. This leaves organizations at risk of a data breach and financial loss,” said Matthew Gardiner, cybersecurity strategist at Mimecast.
The findings highlight email as the enduring threat vector of choice for cyber-attackers.
Trend Micro’s annual round-up report, The Paradox of Cyberthreats, revealed that of the 66.4 billion threats blocked by the security vendor in 2017, over 85% were in emails containing malicious content.
It also recorded a doubling of BEC attack volumes in the second half of 2017 versus the first half of the year.