Cyber Defense eMagazine November Edition for 2021

Our report also suggests that employees need to keep an eye out key calendar events in the year, as
cybercriminals jump on key trends or holidays as lures in their attacks. For example, last year, the most
malicious emails were received on the days surrounding Black Friday, one of the busiest days for online
shopping.
How are they evading detection?
Employees – and the traditional security defences in place to protect them – typically rely on a set of
guidelines and rules to determine whether something is malicious. For instance, does the email have a
suspicious attachment or link? Does the message contain certain words that signal a threat? Does the
sender’s domain contain incorrect characters?
Cybercriminals are aware of these rules - and they are doing everything they can to reverse engineer the
rules and remove these tell-tale signs from their campaigns to evade detection.
In our report, for example, 75% of the malicious emails we detected and analysed didn’t contain an
attachment.
Zero payload attacks, which don’t rely on a malicious payloads like attachments or links, were used
instead – a technique whereby the attacker builds a rapport with victims over time and persuades them
to action a request once trust is established. Zero payload attacks can be as devastating as malicious
payload attacks, and traditional antivirus and anti-phishing software – which often rely solely on keyword
detection and deny/allow lists – struggle to detect them every time.
What’s more, our researchers also found examples of account takeover – a type of attack whereby a
cybercriminal sends an email to their victim using a legitimate account that they hacked into previously.
To all intents and purposes, the sender’s email looks like the real deal. There would be no reason to flag
it as malicious – if you’re relying on rules to detect threats.
To sophisticate cyber defence policies, then, business decision makers must ensure employees are
trained and made aware of the types of threats they could be exposed to. The training must be delivered
regularly, if they are to keep up to date with the evolving threat scape.
But it’s unrealistic to expect your employees to spot every threat, every time. Regardless of training,
employees are prone to mistakes and can be tricked. So, businesses must also consider how to bolster
their defences to keep the bad guys out of the inbox. Rules are not enough. For advanced threats, you
need advanced machine intelligent security solutions which can detect, and flag, potentially malicious
emails based on people’s behaviours on email and alert employees before it’s too late.
Cyber Defense eMagazine – November 2021 Edition 103
Copyright © 2021, Cyber Defense Magazine. All rights reserved worldwide.