Researchers from Google’s Threat Analysis Group (TAG) released details on recent state-sponsored phishing campaigns from around the world. The researchers said that Google’s phishing defenses have forced attackers to turn to more targeted attacks.
“In 2019, we sent almost 40,000 warnings, a nearly 25 percent drop from 2018,” they said. “One reason for this decline is that our new protections are working—attackers' efforts have been slowed down and they’re more deliberate in their attempts, meaning attempts are happening less frequently as attackers adapt.”
Google warns that state-sponsored threat actors are increasingly impersonating news outlets and journalists. The researchers specifically call out Iran and North Korea for doing this. The attackers pose as these outlets to spread disinformation and to distribute malware.
“For example, attackers impersonate a journalist to seed false stories with other reporters to spread disinformation,” the researchers said. “In other cases, attackers will send several benign emails to build a rapport with a journalist or foreign policy expert before sending a malicious attachment in a follow up email. Government-backed attackers regularly target foreign policy experts for their research, access to the organizations they work with, and connection to fellow researchers or policymakers for subsequent attacks. “
The researchers also stressed that state-sponsored attackers are persistent and will repeatedly target the same person until they succeed.
“In 2019, one in five accounts that received a warning was targeted multiple times by attackers,” the researchers said. “If at first the attacker does not succeed, they’ll try again using a different lure, different account, or trying to compromise an associate of their target.”
Phishing is a cheap and effective way to compromise an account, and the victim only needs to slip up once in order for the attacker to gain a foothold. New-school security awareness training can help your employees defend themselves against these attacks by teaching them how to thwart social engineering tactics.
Google has the story: https://www.blog.google/technology/safety-security/threat-analysis-group/identifying-vulnerabilities-and-protecting-you-phishing/
Here's how it works:
