Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Threat Intelligence

08:00 AM
Connect Directly

The Minefield of Corporate Email

Email security challenges CISOs as cybercriminals target corporate inboxes with malware, phishing attempts, and various forms of fraud.

Employee email accounts are prime targets for fraudsters, phishing attacks, and malware delivery as hackers assume someone will click, download, or respond to fall into their traps.

The threats causing concern are far from new — in fact, they're among the oldest. As Cisco researchers point out in a new report, "Email: Click with Caution," spam is 40 years old and phishing is over 30. Over time they've grown in prevalence and sophistication, joined by malware and fraud as criminals find new ways to cause problems for security practitioners.

"It seems never-ending sometimes, the kinds of threats that arrive through email," says Ben Munroe, director at Cisco Security, who also says "the fact that it's still a problem for us … is incredible. Things are not getting better and in fact, things are getting worse."

Incredible, yes, but as researchers note in the report, email's structure is "an almost ideal format" for scammers. Employees are forced to read every message, make judgment calls about what they receive, and decide what to open, click, download, and respond to. The right amount of social engineering can manipulate recipients into accidentally letting attackers in.

More than half (56%) of CISOs say defending against user behavior is "very" or "extremely" challenging, Munroe says, citing Cisco's 2019 CISO Benchmark Study. Only 51% think they're doing an "excellent" job managing employee security. Users often get a bad reputation, but it's tough when cybercriminals have an advantage and their targets don't know what's coming.

"It's not fair for everyone to criticize users for doing what users have to do," he says. Employees have to answer emails, even if an email from their "boss" came from a hacker. "It isn't fair to always say users are not sophisticated — attackers are extremely sophisticated," Munroe adds.

Here, we take a closer look at the emailed threats arriving in their inboxes.

To Click or Not to Click?
Wendy Nather, head of Advisory CISOs at Duo Security, now part of Cisco, says attackers' efforts are going in two directions: one is technological; trying to exploit new methods and plant new payloads. The other is psychological, encompassing social engineering efforts. "You have to defend both on the technical side and the social engineering side," she emphasizes.

Credential theft is one of the most common email-based scams, Cisco researchers found. Cybercriminals send emails from fake addresses ([email protected], for example) and users who click a link are redirected to a fake webpage where they're prompted to enter credentials. Those go to the attacker, who may use them to log in to other Microsoft services.

Cisco cites an Agari report that says 27% of advanced email attacks are launched from compromised accounts — up from 20% in the last quarter of 2018. Microsoft accounts aside, attackers also target popular cloud-based email services like Gmail and G Suite.

Business email compromise (BEC), which caused $1.2 billion in losses in 2018, is another threat to watch. Researchers note attackers don't typically use compromised accounts for these; instead, two-thirds of BEC scams still use free webmail attacks and 28% use registered domains. BEC messages are often personalized; one in every five includes the name of the recipient.

Digital extortion, in which attackers try to convince their victims they have footage of them accessing an adult film site or other content, is another lucrative move for attackers. Munroe notes how advancements in technology have changed the game in extortion: "the improvement in hardware, allowing all of us to have a camera; the improvement in bandwidth, allowing us to stream video" have also driven techniques for malicious activity. Researchers do point out profits from extortion have fluctuated along with the value of Bitcoin over time.

Malware Delivery
Email is still a reliable vector to deliver malware, though attackers have been forced to change their tactics as their victims learned the risk of clicking .exe files. Now, malware is more likely to be served indirectly via documents with less suspicious file types or malicious URLs in messages.

Between January and April 2019, binary files only made up 2% of all malicious attachments. Attackers now gravitate toward .zip files, which make up one-third of attachments. JavaScript files make up 14.1% and, researchers note, and attackers are more frequently using them. It's now the third most-common malicious extension, following .doc (41.8%) and .zip (26.3%).

"Throw PDF documents into the mix, and more than half of all malicious attachments are regularly used document types, ubiquitous within the modern workplace," according to the report.

Malware itself has also evolved, Munroe points out. "I'd say in terms of what they're distributing — the idea of malware or what you could call modular malware — having landed on a host or an endpoint, it's able to detect a number of different parameters about where it is or what to do." Is it in a low-cost environment? Valuable environment? Is there high bandwidth?

"That idea is certainly quite worrisome and given email is a prevalent attack vector, it's certainly concerning for CISOs," he adds.

What's a CISO to Do?
The challenge of email security lies in its commonality. "It's the mundane nature of email, especially trying to trick people into clicking things they spend all day clicking," says Nather.

Some CISOs recognize different users have different risk profiles, she continues, and they adjust their security practices accordingly. Human resources employees, who have to open attachments all day, or financial analysts, who are prime BEC targets, are some examples. "They're putting more security controls around them, isolating them more, hardening their systems more," Nather explains. Some employees have different external email addresses.

In the report, researchers explain how to spot a phishing attempt. A few telltale signs:

  • Sense of urgency: if it demands immediate action, act with caution and confirm with the sender
  • Illegitimate-looking URL: Phishing URLs often look unusual. If it's hidden within text, hover over the link for a closer look. Hesitant? Don't click.
  • Unusual file types: most business emails rely on the same few file types. If you don't recognize it, don't open it.
  • Spelling mistakes and blurred logos: Emails that seem careless may be signs of a phish.

Related Content:

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio

Recommended Reading:

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
User Rank: Apprentice
6/26/2019 | 12:10:27 PM
Evaluate automated AI based tools to remove phishing emails from inboxes
Employees can never get enough awareness training and the hackers are always steps ahead.

Suggest evaluating and deploying the next generation of API based phishing defense/prevention tools that have APIs into Office 365 and Gsuite and are scanning the inboxes.  These new automated, AI and ML-based tools do improve the detection and prevention of phishing attacks
User Rank: Strategist
6/26/2019 | 10:04:23 AM
The Minefield of Corporate Email, requires continued reminders and awareness training.
Schedule once a month quick simple training reminders to all your email accounts. Internet quick information is a very useful resource training tool, unfortunatly very little of it can be trusted. Not even the best Vendor software can catch everthing. Things from an email like copy and past this URL to your browser, attachments with embeded malicous malware, even training demos, or YouTube sites that have secondary links to malicous sites are all things that should be sent out as reminders. Even experienced technicians get tired or too fasted paced and slip once in awhile. 
User Rank: Ninja
6/13/2019 | 9:46:48 AM
Re: Needs awareness
i feel your pain as this is NOT rocket science material.  True age does begin to show up sometimes and being TOLD to do something to the right mindset is always an order so they follow along like true lemmings over a cliff.  Still the basic basics would have helped here.  
User Rank: Apprentice
6/13/2019 | 4:34:15 AM
Needs awareness
At the previous company which I worked for, there was a cyber attack and the loophole was detected to an employee's computer. She was an old lady with not much background on computer knowledge. She said she received an email asking her to click a link to enter her new credentials as her old set had been tempered with. I wouldn't say she was too naive or gullible but it was a lack of knowledge or awareness from the company that caused the mishap to happen.
User Rank: Ninja
6/7/2019 | 9:42:23 AM
First mistake
Never assume - that users have learned to be careful on clicking on email.  True many more may be saavy but I doubt the number of dumb bunnies has really been reduced.  That small subset of the user population still exists and so whatever controls we have in place can still be worthless if dear Greta clicks on an invoice she should know better about.   She may even KNOW better but just .... well, kinda curious.   Never EVER assume that people have gotten smarter by any yardstick. 
Inside the Ransomware Campaigns Targeting Exchange Servers
Kelly Sheridan, Staff Editor, Dark Reading,  4/2/2021
Beyond MITRE ATT&CK: The Case for a New Cyber Kill Chain
Rik Turner, Principal Analyst, Infrastructure Solutions, Omdia,  3/30/2021
Register for Dark Reading Newsletters
White Papers
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2021-04-12
Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.28.0 requests to user provided domains were not restricted to external IP addresses when transitional IPv6 addre...
PUBLISHED: 2021-04-12
Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.28.0 Synapse is missing input validation of some parameters on the endpoints used to confirm third-party identif...
PUBLISHED: 2021-04-12
In Gradle before version 7.0, files created with open permissions in the system temporary directory can allow an attacker to access information downloaded by Gradle. Some builds could be vulnerable to a local information disclosure. Remote files accessed through TextResourceFactory are downloaded in...
PUBLISHED: 2021-04-12
Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.28.0 Synapse is missing input validation of some parameters on the endpoints used to confirm third-party identif...
PUBLISHED: 2021-04-12
Advanced Authentication versions prior to 6.3 SP4 have a potential broken authentication due to improper session management issue.