CISA Discovers Spear Phishing and Valid Account Compromise Are the Most Common Attack Vectors

The US Cybersecurity and Infrastructure Security Agency (CISA) has found that compromise of valid accounts and spear phishing attacks were the two most common vectors of initial access in 2022, Decipher reports. Valid accounts were compromised in 54% of successful attacks.

“Valid accounts can be former employee accounts that have not been removed from the active directory or default administrator accounts,” CISA said. “When organizations do not change default passwords, threat actors can compromise a valid administrator account. In many cases, this attack technique is possible because the valid account allowed unauthorized users to install or execute insecure software (such as unpatched or out-of-date software) on a system or network.”

The report found that spear phishing links were successful in 33% of attacks.

“Successful spear phishing requires an attacker’s malicious email to pass through network border protections and deliver malware to execute on the local host,” CISA says. “Host-level protection stops spear phishing attempts as they pass through network perimeter protection. At the network border level, CISA observed 13% of spear phishing attempts blocked. At the host or endpoint level, CISA observed 78% of links or attachments blocked, preventing the execution of a malicious activity. A cyber threat actor’s success rate with this type of attack depends on factors, such as the perceived authenticity of the email’s content and presentation, host protections (e.g., antivirus and malware detection software), and the network’s boundary protection mechanisms.”

CISA offers the following recommendations for organizations to defend themselves against these attacks:

• “Implement a secure password policy requiring phishing-resistant multi-factor authentication (MFA) for remote access, strong passwords, unique credentials, and the separation of user and privileged accounts, effectively revoking unnecessary or inactive accounts.
• “Configure email servers to filter out and block emails with malicious indicators and implement authentication protocols, such as Sender Policy Framework (SPF) and DomainKeys Identified Mail (DKIM) to prevent spoofed or modified emails.
• “Implement a phishing awareness training program that includes guidance on identifying phishing attacks and how personnel should report suspected phishing attempts and verified incidents.”

New-school security awareness training can teach your employees to follow security best practices so they can avoid falling for social engineering attacks.