Study Shows Smaller, Shorter, and Targeted is Better for Phishing

Ironscales, an Israel-based company that creates anti email phishing products released a study that evaluated verified attacks on its customers. It showed that smaller, shorter, and specific is better at being successful when it comes to email phishing campaigns. However, when it comes to the longer ones that went on for a year or more, it helped significantly to change the messages often if they wanted to bypass traditional email filtering tools.

The report titled, “How Modern Email Phishing Attacks Have Organizations On The Hook,” analyzed data from more than 100 of its customers, using more than 500,000 mailboxes from 2016-2017. It looked at phishing trends, attacker patterns, tools and techniques used, as well as hacker preferences using over 8,500 verified attacks. These all made it past spam filters. They came up with some very interesting statistics and information.

Before we get to that, this is a reminder that phishers are not only getting more sophisticated, but they are also putting effort into figuring out how to circumvent the tools. You see, people are always going to be the weakest link because we can be tricked into opening malicious attachments and links. And getting someone to do this means all they have to do is get their message past those filters. As this study shows, and as we found from the recent WannaCry outbreak, there is no need for them to perpetrate big attacks, but taking a bit of time to focus on certain items can result in significant success. It just takes one person to set off something big. So, if they can impersonate someone the recipient trusts, or if they can create a believable message or merely pique the interest of someone, it’s worth the effort for them.

Here is what the study found:

2

• 77% of the attacks targeted 10 mailboxes or fewer
• 33% targeted only one mailbox

2

• A bit over 47% of the phishing campaigns lasted less than 24 hours
• 65% lasted less than 30 days

2

• If they wanted to bypass filtering tools, items such as the subject, IP addresses from where they were sent, or body text were changed.

2

• In addition, those attacks that used very specific language and details had more success. Those types are increasing and 95% of email phishing attacks that impersonated internal communications team members and executives (AKA business email compromise or BEC), such as CEOs also made it past the security tools.
• Of the attacks that took advantage of brands, for every five of them, there were 20 spear-phishing attacks that passed the filters.

However, if the cybercriminals did spoof a brand, the top three used were DHL with over 30%, Google with over 20%, and Amazon at approximately 10%. These were followed, in order, by PayPal, Yahoo, Microsoft, Apple, Vodafone, Facebook, and FedEx.