Users encounter threats through email twice as often as other infection vectors
The latest ISTR special report, Email Threats 2017, casts a light on a threat landscape where attackers are actively spreading malicious threats, BEC scams, and a variety of spam through email. At first glance, it seems like a fairly run-of-the-mill email. The subject line said “New Order” and it goes on to explain that this import and export company has a customer interested in your products. The company wishes to discuss the order with you further and has attached a PDF outlining their needs. If you open the PDF, you find it contains the following message:
https://www.symantec.com/connect/sites/default/files/users/user-2598031/Figure.%20Malicious%20PDF%20attached%20to%20spam%20email.png
This is all that’s contained within the one-page PDF. The question is, do you click the link?
This scenario details an actual malicious email campaign that is currently playing out on the threat landscape. And while there’s nothing new to note in the entire infection process, we see similar scenarios day in and day out.
It may seem obvious when broken down as we have here, but there’s no question it yields results for attackers. In fact email is the most commonly used infection vector on the threat landscape.
In Symantec’s latest ISTR special report, Email Threats 2017, we describe how people are more than twice as likely to encounter threats through email than any other infection vector. In fact, one out of every nine email users will have had a malicious email sent to them in the first half of 2017. And the likelihood rises further depending on which industry the user works in. For instance, if the user is in Wholesale Trade, as they likely would in the scenario outlined above, that ratio climbs to one out of every four users.
But email with malicious code isn’t the only threat out there. Business email compromise (BEC) scams are another continuing threat. These are scenarios where a scammer impersonates someone along the lines of an executive within your company, or another person of power within the supply or administrative chains, and attempts to get users to wire money or share sensitive information with them.
It’s an attack that’s proven quite lucrative for scammers—the FBI estimates over US$5 billion has been stolen through these scams between late 2013 and the end of 2016. According to our latest analysis, we see approximately 8,000 businesses targeted by BEC scams in a given month. On average these businesses receive more than five BEC scam emails each month.
Spam also continues to be an email annoyance as well. While the spam rate has been in a slow but steady decline since 2011, our latest research has discovered that the spam rate may have bottomed out and is now beginning to climb again. In fact, the spam rate for the first half of 2017 hit 54 percent, which equates to around 11 more spam emails in your inbox each month compared to a year ago.
Once again, these rates are much higher in some industries. For instance, our friends in the Wholesale Trade industry can see twice as much spam as the average user would. But they’re not alone, as other industries, such as Manufacturing, Retail Trade, Construction, and Mining—all industries that can also be targeted by campaigns such as the one above—saw spam rates that were all 1.5 times above the average.
Email is one of the most popular tools for communication, but this ubiquity has also made it a hotbed full of scammers looking to wreak havoc. These are just a few of the insights uncovered in our latest ISTR special report.
