The latest data from security vendor Barracuda suggests that attackers heavily rely on lookalike domains as part of BEC scams that can result in CEO fraud, malware infection, or ransom.
In just six months – from July to December of 2019 – attackers have stepped up their use of domain impersonation. A critical element in establishing credibility, the impersonating of a domain helps the cybercriminal put the potential victim at ease that the email being sent is legitimate.
Used today as part of conversational hijacking attacks – where access to corporate email is established, email threads are monitored, and attackers insert themselves into the conversation, the use of lookalike domains would be very important, as the spear phishing email needs to be extremely contextual to be successful.
This is one of the most sinister attack types we’ve seen; because the attack occurs in the middle of an already existing email conversation, a user’s defenses are completely down – it’s a known person, one you’ve been interacting in the email thread with, and the email-borne attack is contextually appropriate (e.g.: providing a link to a website with detail related to the conversation).
There are two lines of defense against these kinds of attacks:
- Stop the attacker from ever gaining access – this is tough, as the compromised access may be little more than hijacking Office 365 credentials and using the web to access corporate email. Use of multi-factor authentication makes sense here. And in the case of attacks bent on compromising the endpoint itself, having solid antimalware and endpoint protection solutions in place are good start.
- Stop the hijack from being successful – users that undergo Security Awareness Training work at the same level of suspicion that most IT pros do. So, even if a known person sends an email about a familiar topic, if anything looks out of the ordinary, the user has been trained to spot it and not fall for the scam.
Remember, when you see increases in the use of a particular cyberattack tactic, it’s a sign that the bad guys are seeing repeated success and will continue to leverage this technique.
