As cybercriminal groups hone their craft, one analysis shows them shying away from zero-day exploits, use of valid accounts, and third-party vulnerabilities to gain initial access during attacks.
If you were an attacker, the challenge with getting initial access is that most methods have a limited window of time for success. Buying an account off the dark web is only good until the password is changed. Use of a third-party vulnerability or a zero-day exploit will eventually be patched.
But phishing users… well, there’s plenty of those to go around, right? Whether you are spear phishing to target specific individuals within an organization, or broadly phishing anyone who’ll engage with your malicious email content, it seems like there will always be someone willing to “help”.
According to new data from Kroll’s Q1 2022 Threat Landscape report, we find that threat actors have – at least for the first quarter of this year – shifted initial access tactics and put a lot of emphasis on phishing, used in 60% of all attacks. This is a 54% increase from Q4 2021’s number, where only 39% of attacks leveraged phishing.
If this trend continues – and, really, even if it doesn’t – attackers know there are plenty of fish in the “phishing sea”. That is, unless you put that same kind of limitation on the viability of an initial attack vector on phishing.
And just how do you do that?
Unlike the other three attack vectors mentioned in the report (and above), phishing doesn’t have a limited lifespan; users can repeatedly be used as pawns in the next attack and the next. That is, unless you minimize the viability of users assisting phishing attacks by enrolling them in Security Awareness Training designed to educate them on how phishing attacks work, what to look for to avoid assisting the attacker, and keep them abreast of the latest campaigns, trends, and uses of social engineering.
