SAN FRANCISCO: Business emails laced with malicious URLs in the message body have spiked by more than 125 percent in Q4 2018 in comparison with the quarter before.
According to Mimecast’s latest Email Security Risk Assessment (ESRA) report, released at the RSA Conference 2019 in San Francisco this week, at least 463,546 malicious URLs appeared in the 28.4 million analyzed emails delivered in the quarter that were deemed “safe” by email security systems.
That averages out to one malicious URL in every 61 emails. Other recent Mimecast research also confirms that malicious URLs are a rampant problem, with 45 percent of the 1,025 respondents saying that the volume of these URL-based attacks or those with dangerous attachments has increased over the last year.
So, despite the majority of cyberattacks starting with an email, the lines between email and web security are blurring, the firm pointed out.
“Email and the web are natural complements when it comes to the infiltration of an organization,” said Matthew Gardiner, cybersecurity strategist at Mimecast. “Email delivers believable content and easily clickable URLs, which then can lead unintended victims to malicious websites. URLs within emails are literally the point of intersection between email and the web.”
Impersonation fraud also continues to balloon, according to the report: About 41 percent of respondents reported seeing an increase in impersonation fraud from vendors or business partners asking for money, sensitive information or credentials – with 38 percent saying they’ve seen an increase in impersonation fraud with emails purporting to be from well-known internet brands.
“Cybercriminals are constantly looking for new ways to evade detection, often turning to easier methods like social engineering to gain intel on a person or pulling images from the internet to help ‘legitimize’ their impersonation attempts to gain credentials or information from unsuspecting users,” Gardiner said.
The latest ESRA report also found that 24.9 million spam emails, 26,713 malware attachments, 53,753 impersonation attacks and 23,872 dangerous file types made it through corporate filters during the quarter.
Follow all of Threatpost’s RSA Conference 2019 coverage by visiting our special coverage section.
