Cyber Defense eMagazine December Edition for 2021

on channels like email. This starts with understanding the latest threats and building a cybersecurity
culture around them.
The State of Spear Phishing
Who is being targeted and when?
Tessian’s report found that the average employee receives 14 malicious emails per year, but that number
jumps significantly for highly targeted industries. For example, retail employees received 49 malicious
emails per year, while manufacturing employees received 31. Those sectors are also experiencing
staffing shortages from The Great Resignation, leaving employees stressed, distracted and potentially
more vulnerable to falling for a scam. These risks must be prioritized as companies navigate hiring and
turnover challenges.
Bad actors try to trick employees by sending malicious emails in the late afternoon, hoping to slip past a
tired or distracted employee. The most common times for spear phishing emails to be sent was 2 p.m.
and 6 p.m. Bad actors also take advantage of the holidays by offering “too good to be true” deals. The
biggest spike in malicious emails came immediately before and after Black Friday.
What’s the latest attack playbook?
Impersonation techniques continue to be a go-to strategy in the spear phishing playbook. Tessian found
that display name spoofing was the most common tactic, found in 19% of malicious emails. These attacks
use deceptive display names on an email to mislead employees. For example, a display name might
show the first and last name of the company's Chief Financial Officer requesting a wire transfer. While
the email address itself may still look suspicious, a recipient often only looks at the name of the sender
and could mistake it for a legitimate request.
Domain impersonation, on the other hand, happens when bad actors secure a domain that looks like it
belongs to a legitimate business. This technique was used in 11% of malicious emails. The brands most
likely to be impersonated were Microsoft, ADP, Amazon, Adobe Sign and Zoom.
What are bad actors after?
Tessian’s analysis found that tricking users into downloading malware remains a common motive of
phishing emails. Malicious links still prove to be a popular and effective technique, with almost half (44%)
of malicious emails containing a URL.
Our researchers found more emails related to wire transfers than credential theft, suggesting
cybercriminals are still largely focused on financial gain. For example, they’re more likely to try to steal
money by impersonating a vendor and requesting a payment than by posing as an IT person requesting
an employee’s password.
Cyber Defense eMagazine – December 2021 Edition 61
Copyright © 2021, Cyber Defense Magazine. All rights reserved worldwide.