Research by Barracuda Networks shows that cybercriminals are increasingly cracking email accounts and using them for lateral phishing. This is to contact company accounts with fake messages from an already hacked account. In a large number of cases, employees do not report the incident.

While studying 180 lateral phishing attacks, researchers found that 11 percent of the attacks caused other accounts within the organization to be cracked. In addition, 42 percent of these attacks were not reported to the IT department or the security team of the organisation concerned. This makes it possible to use the accounts for multiple attacks.

The study also showed that the majority of phishing attackers used a fake warning about a problem with the recipient’s email account. A fake link to a shared document was also often used. The mails contain links that lead the recipients to phishing sites. Here the victim has to fill in false forms that are used to steal bank account details, for example. Most of these e-mails used generic messages or messages aimed at companies in general, but a small percentage were strongly focused on a specific organisation.

Dodging Discovery

Some cybercriminals were actively engaged in preventing discovery by a hacked user, for example by deleting sent messages. Some also responded to victims’ reports to ensure that they were genuine. These tactics, combined with the fact that phishing is often not reported, make it difficult to combat this form of cybercrime.

Barracuda recommends using two-factor authentication (2FA) to prevent account hacking in the first place. Organisations should also be pro-active through training and education for employees to learn to recognise phishing. Moreover, according to Barracuda, it would help if more anti-phishing security software were used.

This news article was automatically translated from Dutch to give Techzine.eu a head start. All news articles after September 1, 2019 are written in native English and NOT translated. All our background stories are written in native English as well. For more information read our launch article.