EDITOR’ S QUESTION

/////////////////////////////////////////////////////////////////////////////////////////////////////////

In the detected wave the criminals not only attacked industrial companies together with other organisations, they were predominantly focused on them. They sent out emails containing malicious attachments and tried to lure unsuspecting victims into giving away confidential data, which they could then use to make money.

According to Kaspersky Lab’ s data, this wave of emails targeted around 800 employee PCs, with the goal of stealing money and confidential data from the organisations, which can then be used in new attacks. The emails were disguised as legitimate procurement and accounting letters, containing content that corresponded to the profile of the attacked organisations and considered the identity of the employee – the recipient of the letter. It is noteworthy that the attackers even addressed the targeted victims by name. This suggests that the attacks were carefully prepared and that criminals took the time to develop an individual letter for each user.

When the recipient clicked on the malicious attachments, modified legitimate software was discreetly installed on the computer so that criminals could connect to it, examine documents and software related to the procurement, financial and accounting operations. Furthermore, the attackers were looking for different ways to commit financial fraud, such as changing requisites in payment bills to withdraw money for their benefit.

Moreover, whenever criminals needed additional data or capabilities, such as obtaining local administrator rights or stealing user authentication data and Windows accounts to spread within the enterprise network, the attackers uploaded additional sets of malware, prepared individually for an attack on each victim.

This included spyware, additional remote administration tools that extend the control of attackers on infected systems and malware to exploit vulnerabilities in the operating system, as well as the Mimikatz tool that allows users to obtain data from Windows accounts.

Meanwhile, Mimecast has released its second annual State of Email Security report that identifies the latest email-borne threats facing organisations of all sizes and industries globally.

More than 50 % of organisations reported seeing the volume of phishing attacks increase over the last 12 months, while 40 % said they saw the volume of impersonation attacks rise. Making cybersecurity a priority should start from the top, yet this isn’ t always the case; 20 % of respondents said their C-level executive sent sensitive data in response to a phishing attack and 49 % admitted that their management and finance teams aren’ t knowledgeable enough to identify and stop an impersonation attempt.

“ Email-based attacks are constantly evolving and this research demonstrates the need for organisations to adopt a cyber resilience strategy that goes beyond a defence-only approach,” said Peter Bauer, Chief Executive Officer of Mimecast.

“ This is more than just an IT problem. It requires an organisation-wide effort that brings together many stakeholders, puts the right security solutions in place and empowers employees – from the C-suite to the reception desk – to be the last line of defence.”

28 INTELLIGENTCIO www. intelligentcio. com