Cofense Report Reveals Weaknesses in Secure Email Gateways, Illustrates Critical Role of Human Intelligence in Phishing Defense
2019 Phishing Threats and Malware Review highlights the latest evolutions to threat actor campaigns and enhanced capacity for malware to evade perimeter controls and penetrate user inboxes
LEESBURG, Virginia, June 4, 2019 /PRNewswire/ -- Cofense™, the global leader in intelligent phishing defense solutions, today released the findings of their report, "2019 Phishing Threats and Malware Review", which reveals key insights about how threat actors are evolving phishing campaigns, and provides direction to everyone from network defenders to CISO's on how to prepare for the unknown. Despite significant investments in next-gen technologies, phishing threats continue to become more sophisticated and effective. The report uncovers how dangerous threat actors, armed with an ever-growing arsenal of tactics and techniques, continue to tweak their campaigns and enhance their capacity to deliver malware, ultimately getting more messages past perimeter controls to user inboxes.
The report features real and simulated threat findings generated from the Cofense Phishing Defense Center (PDC), Threat Intelligence and Research teams, and across a sampling of their global customer base; including real data from 1,400 customers in 50 countries and 23 major industries, and half of the Fortune 100. Specifically, between October 2018 and March 2019, the Cofense PDC verified over 31,000 malicious emails, 90 percent of which were found in environments running one or more secure email gateways (SEGs).
Key findings from the 2019 report include:
- Between October 2018 and March 2019, 31,429 total threats were reported by end users after delivery to the inbox, which included 23,195 via credential phishing; 2,681 via business email compromise (BEC); 4,835 via malware deliver; and 718 via other scams.
- Ninety percent of the malicious emails verified by the Cofense PDC during this period were found in environments running one or more SEG.
- Threat actors are innovating relentlessly and are constantly refining their tactics, techniques, and procedures (TTP's) as they develop new delivery mechanisms, phishing techniques, and ways to get around network defense technologies. Cofense is seeing activity such as the use of public, open source tools to evade detection and the leveraging of genuine O365 accounts to harvest credentials to increase the odds of reaching the inbox and delivering malware. The report outlines that sextortion and bomb scare extortion pay off significantly when utilized by threat actors.
- Technologies like email gateways can't keep pace with the speed of threat actors' "product development". SEG's play a key role in phishing defense, but they are not infallible. The report identifies SharePoint, OneDrive and ShareFile as some of the most abused cloud providers and states that threat actors use geo-location to help prevent analysis by security tools or human researchers; enabling malware to slip through a SEG's defenses.
- Collective human intelligence is vital to phishing defense. When the phishing and malware threats analyzed in this report land in users' inboxes, the human factor becomes decisive. It's imperative to educate users through a phishing awareness program, focusing on threats that utilize the latest TTP's. Both user education and incident response thrive when fed by threat intelligence on emerging TTP's.
"Adversaries are constantly evolving their techniques and changing their infrastructure to complicate detection, meaning that indicators of compromise (IOCs) can grow stale extremely quickly. For holistic defense, users need to be prepared to identify and report any threats that do reach their inbox," said Aaron Higbee, Co-Founder and CTO, Cofense. "Automated technical defense controls must be blended with a human element in today's threat landscape. While timely threat intelligence helps head-off attacks and drown out the noise so that SOC teams can prioritize and focus on the most pernicious threats, Cofense is observing an ever-increasing surge of malicious emails that reach user inboxes daily. Once a message reaches an inbox, that end user is your last line of defense."
Cofense is the only phishing defense company that holistically confronts phishing threats, looking at both the phishing tactics and techniques used to bypass perimeter controls to reach users inboxes, as well as how the malware is executed after delivery. Cofense's multi-dimensional intelligence enables customers to prioritize and understand threats to mitigate phishing attacks faster.
To download the full report, please visit https://cofense.com/phishing-threat-malware-review-2019
About Cofense
Cofense™, formerly PhishMe®, is the leading provider of intelligent phishing defense solutions world-wide. Cofense delivers a collaborative approach to cybersecurity by enabling organization-wide engagement to active email threats. Our collective defense suite combines timely attack intelligence sourced from employees with best-in-class incident response technologies to stop attacks faster and stay ahead of breaches. Cofense customers include Global 1000 organizations in defense, energy, financial services, healthcare and manufacturing sectors that understand how changing user behavior will improve security, aid incident response and reduce the risk of compromise.
Media Contact
press@cofense.com
Logo - https://mma.prnewswire.com/media/645799/Cofense_Logo.jpg
Share this article