Latest Mimecast Research Finds Threat Actors More Motivated by Money Than Intelligence or IP

BLACK HAT 2020 – Mimecast Limited (NASDAQ: MIME), a leading email security and cyber resilience company, today launched the Threat Intelligence Report: Black Hat U.S.A. Edition 2020. The report provides technical analysis of United States targeted attacks that attempted to infiltrate the security environment of Mimecast customers.  Two main trends ran throughout the analysis: the desire for attacker’s monetary gain and a continued reliance on COVID-19-related campaigns, especially within certain vertical industries. One of the most significant observations was that threat actors are launching opportunistic and malware-based campaigns across multiple verticals at volumes at an alarming rate. The report also forecasts what types of attacks will likely spike in the next six months and offers recommendations on how to help organizations become more secure and resilient.

A Sign of the Times

The majority of attacks seen by the Mimecast Threat Center during this period were simple, high volume forms of attacks, such as spam and phishing that is likely a reflection of the ease of access to tools and kits available online. As the attacks progressed, exploits evolved to more potent forms of malware and ransomware with the attacker’s goal appearing to be monetary gain.

In addition, malware-centric campaigns have been a fixture of 2020 and have become increasingly sophisticated. 42 significant campaigns were identified during the six-month period that the report covers. The campaigns showed a significant uptick in the use of short-lived, high volume, targeted and hybridized attacks against many sectors of the U.S. economy. Mimecast researchers believe it is highly likely a consequence of threat actors targeting industries that remained opened during the ‘stay at home’ period in the U.S., as well as those essential to the nation’s recovery from the current pandemic. Interestingly, the media and publishing sectors suffered high volumes of impersonation attacks, potentially as a vehicle for cybercriminals to spread disinformation across the U.S.

“If one thing is for certain, the pandemic we’re living in today has caused significant challenges. We’ve continued to see threat actors tap into the vulnerabilities of humans and launch campaign after campaign with a COVID-19 hook, in attempt to get users to click harmful links or open malicious files,” said Josh Douglas, vice president of product management, threat intelligence at Mimecast. “The ultimate goal of Mimecast’s Threat Intelligence reports are to help organizations better understand today’s threat landscape, so they can prepare for tomorrow’s threats and make better informed decisions to improve their cybersecurity and resilience.”  

Key findings within Mimecast Threat Intelligence Report: Black Hat U.S.A Edition include:

• Threat actors go where the money flows. The attacks from January-June 2020 incorporated a vast array of threats, including Azorult, Barys, Cryxos, Emotet, Hawkeye, Lokibot, Nanocore, Nemucod, Netwired, Remcos, Strictor, and ZLoader, and involved a combination of mass generic Trojan delivery with phishing campaigns with the goal of monetary gain.
• Industries that remained opened during the pandemic where the hardest hit. The top sectors for attacks in the U.S. were: manufacturing, retail/wholesale, finance and insurance. In addition, the media and publishing sector suffered high volumes of impersonation attacks (48.4 million detections), potentially was a vehicle to spread disinformation across the U.S.
• Organizations are at a higher risk of being attacked by ransomware. Researchers found that it is highly likely that U.S. businesses are at risk of ransomware attacks, due to threat actors’ efforts towards the high volume, opportunistic attack of multiple verticals. The circumstances of the pandemic make organizations more vulnerable to ransomware, so it will likely remain a significant threat for the second half of 2020.
• Impersonation attacks continue to accelerate. The volume of sender impersonation attacks increased by 24% between January and June to nearly 46 million per month.

Methodology

The Mimecast Threat Intelligence Report: Black Hat U.S.A. Edition provides analysis of 195 billion emails processed by Mimecast for its customers during the period of January through June 2020, 92 billion of which were rejected (47%) for being malicious or spam. Four primary threat categories were analyzed in this report: spam, impersonation attacks, opportunistic attacks and targeted attacks.  Mimecast Threat Intelligence is designed to improve the efficacy of our Email Security 3.0 approach that delivers security and resilience at the perimeter, inside the network and organization, and outside the perimeter.

For the full Threat Intelligence Report and a list of recommendations to better protect your organization, visit here.

Mimecast: Relentless protection. Resilient world.™

Mimecast (NASDAQ: MIME) was born in 2003 with a focus on delivering relentless protection. Each day, we take on cyber disruption for our tens of thousands of customers around the globe; always putting them first, and never giving up on tackling their biggest security challenges together. We are the company that built an intentional and scalable design ideology that solves the number one cyberattack vector – email. We continuously invest to thoughtfully integrate brand protection, security awareness training, web security, compliance and other essential capabilities. Mimecast is here to help protect large and small organizations from malicious activity, human error and technology failure; and to lead the movement toward building a more resilient world. Learn more about us at www.mimecast.com.

Mimecast and Relentless protection. Resilient world. are either registered trademarks or trademarks of Mimecast Services Limited in the United States and/or other countries.  All other products or services referenced are trademarks of their respective companies.