Microsoft’s latest partner release of the 2019 Security Intelligence Report was put together to inform Microsoft and Office365 Partners of the latest threat analytics to hit the landscape. Of the 470 billion emails analyzed, the year-to-date trend was well over 250% since its last publication in 2018. As phishing attacks continue to trend upwards, attackers are beginning to leverage more sneaky tactics to accomplish their end goal, including blackmail, extortion, and worst of all, data corruption.
For many businesses, encryption has become the norm as cybercriminals begin looking to disrupt operations to turn a quick profit. One of the largest goals behind any cyber attack is stealth: the longer a malicious activity goes on unnoticed in your systems, the greater the chances of their attack succeeding. One popular avenue has begun involving SSL encryption to disguise the transmissions of the attack from your local anti-virus or malware agents.
As previously warned, these attackers are persisting to utilize website encryption to provide users with a false sense of confidence while surfing or researching something on the web. As we have mentioned here, Security Awareness Training can assist in informing your employees of the perils found in today’s connected businesses. Begin scrutinizing the sender’s domain name and the content they want from you.
- Phishing – 2.7 Million phishing attacks occur monthly, a 400% increase since we’ve been tracking these states in 2017.
- Content is King – 196 Million instances of “malicious content” including websites, malicious scripts, and malvertising we all found on some of the most well-known websites this year.
- Botnets – 32 Million botnet callbacks were performed and blocked on average each month since 2018
- Domains – 32% of all spoofed domains or websites were using SSL to deliver content.
Most Phished Brands through HTTPS:
- Microsoft Office365 or OneDrive – 58%
- Facebook – 12%
- Amazon – 10%
- Apple or iTunes – 10%
- Adobe – 4%
- Dropbox – 4%
- DocuSign – 2%
By preparing your employees with a security mindset, we broaden the business stance on security to better prevent things like SSL attacks from reaching your end users. Each of these acts leverages more ways for cybercriminals to establish credibility and the context needed to fool business.
Recently, I received an email from one of our clients in the North Bay and they copied me on an email that was dressed up to represent a Microsoft Office 365 notice. Now this notice contained links to an invoice that were crafted and carefully coded to send the staff to a fake Russian URL where Office365 logos were plastered everywhere. Even more conveniently, was the willingness for this HTTPS encrypted website to take down ANY information relating to my own personal Office 365 account. Thankfully, this partner reached out to our staff to double-check the status of their Office 365 account, and wouldn’t you know it, no issues were reported.
(Email Pictured Below)
