Phishing attacks up 400% hitting retail and wholesale sectors hardest

According to the FBI Internet Crime Complaint Center (IC3), phishing attempts are the most frequently reported cyber attack.

Zscaler’s ThreatLabz research team analysed data from more than 200 billion daily transactions and 150 million daily blocked attacks in order to identify emerging threats and track malicious actors from across the globe.

This year’s report showed a dramatic 29 per cent growth in overall phishing attacks compared to previous years, with retail and wholesale companies bearing the brunt of the increase. The report also showed an emerging reliance on phishing-as-a-service methods, as well as new attack vectors, such as SMS phishing, becoming one of the more prevalent methods of intrusion.

According to Deepen Desai, CISO and VP of Security Research and Operations at Zscaler, phishing attacks are impacting businesses and consumers with alarming frequency, complexity, and scope – with the rise in phishing-as-a-service making it easier than ever for non-sophisticated actors to launch successful attacks.

“Our annual report highlights how cyber criminals continue to escalate their usage of phishing as a starting point to breach organisations to deliver ransomware or steal sensitive data.

“To defend against advanced phishing attacks, organisations must leverage a multi-pronged defensive strategy anchored on a cloud native zero trust platform that unifies full SSL inspection with AI/ML-powered detection to stop the most sophisticated phishing attempts and phishing kits, lateral movement prevention and integrated deception to limit the blast radius of a compromised user, proactive controls to block high risk destinations such as newly registered domains that are often abused by threat actors, and in-line DLP to safeguard against data theft,” Desai said.

Phishing has always been one of the most pervasive cyber threats, with various methods used to steal private information.

VIEW ALL

One of the reasons this type of attack grows in prevalence every year is its low barrier to entry. Cyber criminals use current events, such as the COVID-19 pandemic or cryptocurrency, to convince unwitting victims to hand over confidential data, such as passwords, credit card information, and login credentials.

The 2022 ThreatLabz Phishing Report found that phishing attacks lure victims by posing as top brands or promoting topical events. The top phishing themes in 2021 included categories such as productivity tools, illegal streaming sites, shopping sites, social media platforms, financial institutions and logistical services.

A global problem

In 2021, the US was the most-targeted country globally, accounting for over 60 per cent of all phishing attacks blocked by the Zscaler security cloud. The next most frequently attacked countries include Singapore, Germany, the Netherlands, and the United Kingdom.

Not all countries experienced the same attention from phishing attacks. For example, the Netherlands experienced a decrease of 38 per cent, which may have resulted from recently passed legislation that increased the penalties for online fraud.

Phishing attacks were also not evenly distributed across different industries.

Retail and wholesale businesses experienced an increase of over 400 per cent in phishing attempts – the most out of all tracked industries. These businesses were followed by financial and government sectors, with organisations in these industries seeing over 100 per cent increases in attacks on average. However, some industries experienced partial relief from phishing attacks last year. Healthcare saw a notable drop of 59 per cent, while the services industry saw a decline of 33 per cent.

Phishing-as-a-Service – the growing threat

While phishing has long been one of the most common tactics used in cyber attacks by sophisticated threat actors, it’s becoming more accessible to non-technical cyber criminals due to a maturing underground marketplace for attack frameworks and services. By selling their pre-built phishing tools and services on the dark web, cyber criminals are making it easier to deploy phishing scams at scale, creating a greater chance for more phishing activity in 2022.

Countering phishing attacks

According to the Zscaler ThreatLabz research team, an average-sized organisation receives dozens of phishing emails every day. This means that employees at all levels must be aware of the most common phishing tactics and empowered to spot phishing attempts that can result in financial losses and damage to the business’ brand.

Facing the threats outlined in the 2022 ThreatLabz Phishing Report can be daunting, and while it’s impossible to eliminate phishing risk, effective management can prevent business-critical information from falling into the hands of cyber criminals.

Among other recommendations, Zscaler suggests the following tactics for countering phishing growth:

• Learning and understanding the risks posed by phishing to better inform policy and technology decisions.
• Leveraging automated tools and actionable intelligence to empower employees with the tools needed to reduce phishing incidents.
• Delivering timely employee training to build security awareness and promote user reporting.
• Simulating phishing attacks to identify gaps in security policies and procedures.
• Evaluating security infrastructure to ensure access to the latest research and system capabilities.

User compromise is one of the most difficult security challenges to defend against. The Zscaler Zero Trust Exchange is designed to incorporate phishing prevention controls into a holistic zero trust architecture that disrupts every stage of attacks and minimises damages.

Capabilities include:

• Preventing compromise with full SSL inspection at scale, threat analysis using natively integrated threat intel and IPS signature detection, AI/ML phishing detection, and policy-defined high-risk URL categories commonly used for phishing such as newly observed and newly registered domains.
• Eliminating lateral movement by connecting users directly to apps, not the network, to limit the blast radius of a potential incident.
• Shutting down compromised users and insider threats with in-line application inspection and integrated deception capabilities to trick and detect attackers.
• Stopping data loss by inspecting data both in motion and at rest to prevent theft by an active attacker.

Methodology

The ThreatLabz team evaluated data from the Zscaler security cloud, which monitors over 200 billion transactions daily across the globe. ThreatLabz analysed a year’s worth of global phishing data from the Zscaler cloud from January 2021 through December 2021 to identify key trends, industries and geographies at risk, and emerging tactics.

[Related: Tenable-enhanced ServiceNow partnership to streamline secure OT operations workflow]