New data shows a surge in attacks, what industries are targets, which users are at risk, and what you can expect to see in the future.

It’s a simple trend, really: cybercriminals are getting smarter on how they play the cyberattack game. They are no longer resorting to shotgun blast-type mass attacks in the hopes someone will fall victim; they are doing their homework, choosing victims, coming up with targeted and contextual campaigns, and executing their plans. And, from the looks of the data found in ProofPoint’s latest report, Protecting People: A Quarterly Analysis of Highly Targeted Attacks, the cybercriminals are stepping up their game.

Let’s start with a few stats from that report to set the stage:

• Malicious email volume has risen 35% over last quarter.
• Targeted companies are experiencing 25% more email fraud attacks than last quarter, and 85% more than the same quarter last year.

Cybercriminals are leveraging email even more to get to your employees. According to the report, 90% of emails used some form of name spoofing to make the email look like it’s coming from a legitimate source. And that source in many cases is your own staff: 65% of targeted companies have more than 5 employee’s identities spoofed!

Who’s Being Targeted?

There’s a rise in vertical-specific campaigns. According to the report, Automotive has seen a 400% increase over the same quarter last year and education a 250% increase. This year Real Estate and Biotech top the list.

But targeting isn’t stopping with just an industry or company; cybercriminals are focusing in on specific roles and even people within the organization. The majority of email attacks (60%) focus on individual contributors and lower-level management – an easy target for ransomware (which accounts for 11% of all malicious email volume) and cryptojacking.

What’s the Right Response?

Let’s put this all together: The bad guys are sending more malicious emails, are using targeted campaigns to attack your specific industry, and are doing their homework to even spoof users in your organization.

With so much interaction with email, users are likely to open and interact with email they perceive is from someone they know and become a victim. That is, unless you’ve educated them using Security Awareness Training on the need to be vigilant, looking for malicious email content, social engineering techniques, and even vishing tactics like customer support fraud (which, according to the ProofPoint report, rose 39% over the previous quarter).

Your users are going to fall for these attacks if they’re not prepared. It’s time to do something to effectively protect your organization from email attacks.