Lower-Level Employees Become Top Spear-Phishing Targets
Cybercriminals seek employees who will be a "weak link" in the organization when designing phishing attacks, a new report finds.
![](https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/bltc94608acf452fd67/655cf371ab171e040a838b2a/329050_DR23_Graphics_Website_V5_Default_Image_v1.png?width=1280&auto=webp&quality=95&format=jpg&disable=upscale)
The average organization is targeted by over 700 social engineering attacks each year, according to a new report that reveals current trends in phishing and spearphishing.
Between May 2020 and June 2021, researchers with security firm Barracuda analyzed more than 12 million spearphishing and social engineering attacks related to 3 million mailboxes at more than 17,000 organizations. Results reveal some of the common methods attackers use to breach victims' defenses, such as trying to exploit a widespread interest in cryptocurrency and tailoring attacks to target less suspicious employees in low-profile roles.
For example, researchers found one in ten social engineering attacks involve business email compromise (BEC). Of these, 77% of BEC attacks target employees outside of financial and executive roles.
"Cybercriminals are getting sneakier about who they target with their attacks, often targeting employees outside the finance and executive teams, looking for a weak link in your organization," said Don MacLennan, SVP of engineering & product management, email protection with Barracuda. "Targeting lower-level employees offers them a way to get in the door and then work their way up to higher value targets."
Other highlights include:
43% of phishing attacks impersonate Microsoft
The average CEO will receive 57 targeted phishing attacks in a year
One in five BEC attacks target employees in sales roles
IT staffers receive an average of 40 targeted phishing attacks in a year
The full report is available here.
About the Author
You May Also Like
Catch the Threat Before it Catches you: Proactive Ransomware Defense
September 5, 2024How to Evaluate Hybrid-Cloud Network Policies and Enhance Security
September 18, 2024DORA and PCI DSS 4.0: Scale Your Mainframe Security Strategy Among Evolving Regulations
September 26, 2024Harnessing the Power of Automation to Boost Enterprise Cybersecurity
October 3, 2024
[Virtual Event] The Essential Guide to Cloud Management
October 17, 2024Black Hat Europe - December 9-12 - Learn More
December 10, 2024SecTor - Canada's IT Security Conference Oct 22-24 - Learn More
October 22, 2024