Historically, phishers have been in the game to make a buck. Sometimes, that’s a lot of bucks. And they still are. However, the attitude seems to be shifting a bit now. While financial institutions remained the top target for such attacks in 2016, they were very closely followed by cloud storage service providers. PhishLabs released a report called “2017 Phishing Trends and Intelligence Report” noting that financial institutions (FIs) were still targeted 23% of the time, but providers including mainly Google Docs, Google Drive, and Dropbox were the focus 22.6% of the time. At this rate, these services are likely to surpass FIs as the top targets in 2017.
Why is this? Mainly because the data cyberthieves can steal from cloud storage can be used to commit other and more lucrative types of crimes. Rather than immediately logging into someone’s bank account using stolen credentials and emptying the associated bank account, the information often in cloud storage includes employment information, financial data, security information such as the answers to challenge questions, as well as the login credentials. All of this is valuable on the Dark Web and can be sold for a lot of money; often much more than what a victim has in a bank account.
How are they being successful? It’s because of a vulnerable and widely used method for logging into sites these days. Many cloud providers, as well as others allow or require the use of an email address as a login ID. The issue is that many people use the same password when their email is used which leaves them more open to password reuse attacks.
The phishing attacks noted in the report target organization in the U.S. 81% of the time. Thirty three percent (33%) of them used techniques intending to evade detection. Also discovered were more than 29,000 unique phishing kits that included templates for spoofing more than 300 companies. This is kind of a phishing as a service business model.
While the phishing messages targeting cloud service providers were successful, they didn’t tend to be very authentic. However, in the early days of phishing for financial login credentials, the phishing email messages were far easier to detect also. It’s only a matter of time before this is true for other targeted industries.
The overall attacks against financial institutions did in fact increase in 2016. In 2013, the number was 33% of the time. Last year, that dropped to the previously mentioned 23%. The primary targets for phishing were in only five industries. That was 91% of the time and other than FIs, included cloud storage/hosting services, webmail and online services, payment services such as PayPal, and ecommerce companies.
What didn’t change in 2016 was phishing used as the main delivery method for ransomware, which often results in a rather large payout. Cybercriminals are now turning their attention to those industries that are more likely to pay up should they get infected with ransomware such as healthcare organizations, small businesses, schools, and companies involved in critical infrastructure.
For banks and credit unions
Share this article with your members
Copy a ready-made summary and link for your newsletter, website or social posts.
