Researchers at Barracuda warn that attackers are sending non-malicious emails as a precursor to targeted phishing attacks.
“Bait attacks are a class of threats where the attackers attempt to gather information they can use to plan future targeted attacks,” the researchers write. “The bait attacks, also known as reconnaissance attacks, are usually emails with very short or even empty content. The goal is to either verify the existence of the victim’s email account by not receiving any ‘undeliverable’ emails or to get the victim involved in a conversation that would potentially lead to malicious money transfers or leaked credentials. Because this class of threats barely contains any text and does not include any phishing links or malicious attachments, it is hard for conventional phishing detectors to defend against these attacks.”
The researchers replied to one of these messages and confirmed that their email address was targeted by a spear phishing attack two days later.
“While it is known that bait attacks usually precede some sort of targeted phishing attack, our research team ran an experiment by replying to one of the bait attacks that landed in one of our employee's private mailboxes,” the researchers write. “The original attack on August 10, 2021 was an email with a subject line ‘HI’ and an empty body content. As part of the experiment, the Barracuda employee then replied on August 15, 2021 with an email containing, ‘Hi, how may I help you?’ Within 48 hours on August 17, 2021, the employee received a targeted phishing attack. The original email was designed to verify the existence of the mailbox and the willingness of the victim to respond to email messages.”
The researchers note that more than one-third of organizations were targeted by these emails in September 2021.
“While the number of bait attacks is still low overall, they are not unusual,” Barracuda says. “Based on analysis by Barracuda researchers, just over 35% of the 10,500 organizations analyzed were targeted by at least one bait attack in September 2021, with an average of three distinct mailboxes per company receiving one of these messages.”
New-school security awareness training can enable your employees to recognize phishing and other social engineering attacks.
Barracuda has the story.
Here's how it works:
