Half of Businesses Were Victims of Spear-Phishing in 2022 – Barracuda
50% of businesses in Asia-Pacific and across the globe were victims of spear-phishing in 2022, and 24% had at least one email account compromised through account takeover, according to the 2023 spear-phishing trends report from Barracuda, a trusted partner and leading provider of cloud-enabled security solutions.
Taking in 50 billion emails across 3.5 million mailboxes, including nearly 30 million spear-phishing emails, the report also includes findings from Barracuda-commissioned research. Conducted by independent researcher Vanson Bourne, the survey questioned 1,350 frontline and senior IT professionals across a range of industries in Asia-Pacific, the U.S and EMEA, revealing how cybercriminals continue to barrage organisations with targeted email attacks.
Spear-phishing attacks see cybercriminals sending tailored emails to specific individuals within a company or organisation, often impersonating known or trusted entities in order to trick victims into providing sensitive information, sending money, or downloading dangerous malware.
According to Barracuda’s report, most organisations in 2022 received around 5 highly personalised spear-phishing emails per day, which took an average of two days for them to detect.
Of those affected by these attacks, 55% reported machines infected with malware or viruses, while 49% reported having sensitive data stolen. Furthermore, 48% reported having stolen login credentials; and 39% reported direct monetary loss resulting from these attacks.
According to Barracuda, while spear-phishing attacks are low-volume, making up only around 0.1% of all e-mail-based attacks, they are widespread and highly successful compared to other types of email attacks, being responsible for 66% of all breaches.
Too slow to respond
The report shows that threat detection and response remain a challenge in APAC and beyond, with most organisations taking nearly 100 hours to identify, respond to and remediate these threats, including 43 hours to detect an attack and 56 hours to respond and remediate it.
According to the report, the risk of spear-phishing attacks is increased for remote workforces, which tend to be targeted more than non-remote ones, with companies with 50% remote workers receiving around 12 suspicious emails per day, compared with just nine, for companies with less than 50% remote workers.
Results also show that companies with 50% remote workers were also typically slower to detect and respond to email security incidents – taking around 55 hours to detect and 63 hours to response and mitigate, compared to an average of 36 hours and 51 hours for organisations with fewer remote workers.
“Even though spear-phishing is low volume, with its targeted and social engineering tactics, the technique leads to a disproportionate number of successful breaches, and the impact of just one successful attack can be devastating,” said Fleming Shi, CTO, Barracuda.
“To help stay ahead of these highly effective attacks, businesses must invest in account takeover protection solutions with artificial intelligence capabilities. Such tools will have far greater efficacy than rule-based detection mechanisms. Improved efficacy in detection will help stop spear-phishing with reduced response needed during an attack.”
