Phishing attacks tend to focus on executive level targets
They focus on high-ranking targets who have considerable system access. That appears to be changing. A recent trend tracked by researchers from Avanan (recently acquired by Check Point) has revealed that nearly half of all phishing emails analyzed in recent months were crafted to impersonate non-executives.
Additionally, more than three quarters of them (77 percent) targeted employees on the same level.
This is something of a departure and it allows those who orchestrate phishing campaigns to target a significantly larger pool of potential victims. The reason behind the shift in focus is easy enough to understand.
The Avanan researchers summarize it as follows
"Security admins might be spending a lot of time providing extra attention to the C-Suite and hackers have adjusted. At the same time, non-executives still hold sensitive information and have access to financial data. Hackers realized, there is no need to go all the way up the food chain."
Increasingly hackers and scammers are coming to rely on spoofed DocuSign emails to gain access.
If you're unfamiliar with-it DocuSign is a legitimate platform used to digitally sign documents. In this case a scammer creates a dummy DocuSign document and emails a request to a low to mid-level employee to update direct deposit information or something similar.
A real DocuSign email doesn't ask for creds
By all outward appearances the DocuSign request looks completely legitimate but there is one important difference. An actual DocuSign email won't ask the recipient for login credentials. The spoofed ones do. Naturally this is done so that the hackers can harvest those credentials.
Given the crush and volume of daily business emails the difference is easy to overlook which explains why this approach has enjoyed an uncannily high degree of success.
My perspective
Be sure your employees are aware of this latest threat and stay on their guard against it. One moment of carelessness could wind up being costly indeed.
Just like before Eddie Haskell says:
"Gee, Mrs. Cleaver"
By Denis Wilson
Thanks for reading this short post. For more tips on thriving with small business technology, check out the other blog posts at DWPIA Blogs. You can also find me on LinkedIn, Facebook, and Twitter.
I am also a published author and speaker on cloud computing, work@home, and cybersecurity. I work extensively with business and professional associations to provide free small business technology education programs.
Contact me if you would like me to speak to your association
