In a cybersecurity firm’s 2023 email attack incident data, various tactics to evade detection and boost scale were analyzed

Based on its own user ecosystem metrics, a cybersecurity firm has reported fending off 69m attacks on 4.5m mailboxes over a year, with hints of cybercriminals adapting their tactics and taking advantage of generative AI (GenAI) to help them scale their attacks, bypass traditional security measures, and target and trick potential victims.

Among the attacks analyzed, business email compromise (BEC) attacks accounted for 10.6% of the total, while comprising 8% of all social engineering attacks in 2022.

Meanwhile, “conversation hijacking”, comprising 0.5% of all social engineering attacks in 2023, was found to have increased by almost 70% in the firm’s protection ecosystem since 2022. Conversation hijacking attacks require a lot of effort to execute, but the payouts can be significant.

Other findings

In the last quarter of the analyzed metrics, around one in 20 mailboxes had been targeted with “QR code attacks”. The latter are difficult to detect using traditional email filtering methods. They also led victims away from corporate machines and forced them to use a personal device, such as a phone or iPad, which were not protected by corporate security software.

Another finding was that Gmail was the most popular free webmail service used for social engineering in the attacks analyzed, accounting for 22% of the domains used for social engineering attacks. Just over half the detected Gmail attacks had been used for BEC attacks.

Finally, nearly 40% of social engineering attacks analyzed involved the use of the URL-shortening service bit.ly.

According to Sheila Hara, Senior Director, Product Management, Barracuda Networks, the firm disclosing its metrics analysis: “IT and security professionals need to stay focused on the evolution of email threats and what this means for security measures and incident response. This involves understanding how attackers can leverage GenAI to advance and scale their activities, and the latest tactics they’re using to make it past security controls.”