CAMBRIDGE, Mass.--(BUSINESS WIRE)--The APWG reports in its new Phishing Activity Trends Report that the number of phishing attacks increased over the first three quarters of 2105. Phishers in that period increasingly targeted the customers of Internet Service Providers (ISPs), hoping to gain access to user accounts for various nefarious purposes. Phishers also intensified attacks against companies by perpetrating wire fraud scams, known as “Business Email Compromise” or “BEC” scams.
According to contributing APWG member MarkMonitor, Internet Service Providers (ISPs) became the most-targeted industry sector during the first three quarters of 2015, with the Payment Services and Financial Services (banks) sectors coming in second and third during the nine-month period. Phishers sometimes break into users’ ISP accounts so that they can send spam from those accounts, thereby advertising more phishing sites, or other Web destinations crafted to advance some other kind of cybercrime. ISP accounts can also contain other things that phishers want: personally identifiable information, credit card details, and access to domain name and hosting management credentials.
The full text of the report is available here: https://docs.apwg.org/reports/apwg_trends_report_q1-q3_2015.pdf
Business Email Compromise (BEC) scams continue to be a scourge to many businesses in 2015. These often use “spear-phishing” methods to target key employees at specific companies (such as comptrollers and treasury managers), and fool them into transferring large amounts of money into bank accounts controlled by criminals. From January to August 2015 the FBI reported a 270 percent increase in reported global losses from BEC scams. [https://www.ic3.gov/media/2015/150827-1.aspx ]
“BEC scams seek to socially engineer the employees of a business,” according to Carl Leonard, Principal Security Analyst at APWG member Raytheon|Websense. “The attacks use a form of spear-phishing, and initial attacks sent the spear-phishing emails from free domain names that closely resembled the victim company's domain name. Later attacks used a forged "from" address that matched the victim’s domain. We strongly encourage that businesses educate their employees about the dangers of these scams and implement technologies that intercept the incoming emails.”
Luis Corrons, PandaLabs Technical Director and Trends Report contributing analyst urged companies to be prepared because attacks are becoming more complex and harder to distinguish from authentic, workaday communications. “Spear phishing campaigns are growing, all of them with the same goal: set a foot on corporate networks to perpetrate large attacks to steal all kind of financial and confidential information. New approaches are needed, such as having advanced threat detection capabilities. CISOs need to know what is being executed in all servers and endpoints, with forensics capabilities in case an intrusion takes place."
APWG Senior Research Fellow Greg Aaron noted: “All types and sizes of companies are vulnerable to BEC scams. I’ve seen companies with under ten employees being targeted. All businesses should therefore assume that they have been researched by a criminal who has determined the names and email addresses of the employees who can authorize and execute wire transfers. Businesses can also protect themselves by allowing bank transfers only after multiple internal approvals.”
About the APWG
APWG is the coalition unifying the global response to cybercrime across industry, government and law-enforcement sectors and NGO communities. APWG’s membership of more than 1800 institutions worldwide is as global as its outlook, with its directors, managers and research fellows advising: national governments; global governance bodies like the OECD, ITU and ICANN; hemispheric and global trade groups; and multilateral treaty organizations such as the European Commission, the G8 High Technology Crime Subgroup, Council of Europe's Convention on Cybercrime, United Nations Office of Drugs and Crime, Organization for Security and Cooperation in Europe, Europol EC3, the Organization of American States and the Commonwealth Cybercrime Initiative at the Commonwealth of Nations. The APWG, founded in 2003 as the Anti-Phishing Working Group, is the global industry, law enforcement, and government coalition focused on unifying the global response to electronic crime. Membership is open to qualified financial institutions, online retailers, ISPs and Telcos, the law enforcement community, solutions providers, multi-lateral treaty organizations, research centers, trade associations and government agencies. There are more than 1,800 companies, government agencies and NGOs participating in the APWG worldwide. The APWG's www.apwg.org and education.apwg.org websites offer the public, industry and government agencies practical information about phishing and electronically mediated fraud as well as pointers to pragmatic technical solutions that provide immediate protection. The APWG is co-founder and co-manager of the STOP. THINK. CONNECT. Messaging Convention, the global online safety public awareness collaborative https://education.apwg.org/safety-messaging-convention/ and founder/curator of the eCrime Researchers Summit, the world’s only peer-reviewed conference dedicated specifically to electronic crime studies <www.ecrimeresearch.org, held annually with proceedings published by IEEE.
