Trend Micro Cloud App Security Threat Report 2020

Credential phishing attacks grow in number and level of sophistication

As remote work has become universal, credential phishing attacks have also become more rampant. For example, credential phishing, an attack where malicious actors steal email account credentials of employees through fake login pages, has grown in 2020.

Our Trend Micro Cloud App Security data shows that in 2020, 5,465,969 credential phishing attacks were detected and blocked — a 14% jump from the previous year. In contrast to last year’s credential phishing detections, the number of known credential phishing links outnumbers the unknown ones by 34%.

Unfortunately, a large number of threats still manage to infiltrate the built-in filters of cloud-based email services. One of these services is Microsoft 365, which has always been on the crosshairs of credential phishing actors. The Trend Micro Cloud App Security service effectively detected and blocked 314,302 credential phishing attacks from one organization with 10,000 Microsoft 365 users and 2,585 for another organization with 550 Microsoft 365 users in 2020. It’s important to note that for both organizations, the bulk of the phishing threats that were detected and blocked are credential phishing attacks.

Aside from the greater number of credential phishing attacks, we also saw how credential phishing actors made use of sophisticated techniques. The SideWinder group delivered a malicious LNK file on a malicious server that was also used to host credential phishing pages that targeted government and military units in Nepal and Afghanistan. Based on our investigation, the credential phishing pages had been copied from their victims’ webmail login pages and modified to make phishing attacks more effective.

Cybercriminals are also launching voice phishing or vishing campaigns, calling and duping employees via VoIP systems. The malicious actors trick the victims to log into fake phishing sites to harvest their usernames and passwords in order to look for administrator accounts within the network and cause substantial financial problems for the organization. The FBI released a warning to the public to be wary of such attacks, as the shift to remote work might have made organizations more vulnerable to vishing attacks.

In May 2020, we saw how attackers targeted C-suite company executives with emails containing fake Microsoft 365 password expiration reports to dupe victims into revealing their usernames and passwords. Our investigation shows that the credential phishing campaign’s high-ranking victims come from manufacturing, real estate, finance, government, and technological industries in Japan, the United States, UK, Canada, Australia, and Europe.

Malware attacks grow in numbers, advance in complexity

There is a 16% growth in the number of malware files that were found and blocked in emails in 2020. At over 1.1 million malware detections, we saw that both known and unknown malware variants that were detected and blocked by Trend Micro Cloud App Security increased by 14% and 17% respectively.

Early in 2020, malware actors disguised the Emotet malware variant as coronavirus notifications in a spam campaign. As a lure to download the malware, malicious actors asked the victims to download an attachment that purportedly has a list of Covid-19 preventive measures. Fortunately, as of January 2021, a global alliance of law enforcement agencies has managed to take down Emotet’s operations and take over its command-and-control (C&C) infrastructure.

Threat actors behind malware variants that are sent via spam emails are not only taking advantage of the global pandemic to fool their victims but are also continuously developing their techniques.

A good example is the banking trojan Trickbot, which we found to have updated its arsenal to include detection evasion, screen-locking, and remote application credential-grabbing. Another Trickbot campaign spreads a fileless backdoor called the “BazarBackdoor” via spam emails and social engineering techniques.

Interestingly, despite the fact that the total number of malware found and blocked in 2020 is higher than that of the previous year, the number of ransomware files blocked for 2020 is still significantly lower compared with that in 2019. The Trend Micro Cloud App Security service detected and blocked 178,893 ransomware threats in 2020.

This paradoxical trend is something that we started seeing in 2017. While there is a lower number of major ransomware families that are at large upon successful infection, these players yield a large payoff. As opposed to sending ransomware via spam to as many potential victims as possible, modern ransomware actors are now more careful and intentional with regard to targeting victims, ensuring that they infect enterprises or organizations who will pay large sums of money for their data. They also use multi-stage attacks where phishing emails are used as entry vectors to spread ransomware across victim organizations.

This might explain the number of ransomware threats that Trend Micro Cloud App Security blocked in several organizations in 2020.

Protect your email and cloud-based collaboration tools during the pandemic and beyond with Trend Micro Cloud App Security

The global health crisis has not impeded cybercriminals from wreaking havoc using email-based threats. Rather, they have simply exploited it for ill gain. In 2020, Covid-19-related malware were sent via spam email to millions of people. In fact, for the first five months of 2020, 92% of all cyberthreats that took advantage of Covid-19 were spam or phishing emails. Data shows that Trend Micro™ Smart Protection Network™ blocked 16,393,564 pandemic-related threats and that Trend Micro Cloud App Security thwarted a total of 1,119,504 malware threats.

Despite the dip in BEC attacks in 2020, malicious actors are looking for bigger payouts from BEC — in Q1 of 2020, the average cost of a fraudulent wire transfer jumped to US$80,183.

Meanwhile, credential phishing attacks increased 14% from the previous year, totaling at 5,465,969. Notably, majority of the credential phishing attacks came from known links as opposed to unknown ones. In 2020, we also saw how malicious actors used unique techniques such as vishing and fake Microsoft 365 password expiration reports.

Security, during a pandemic and even beyond, should be a priority for all businesses, regardless of size. Now more than ever, enterprises and organizations rely heavily on cloud-based email services and tools to keep up with the high productivity demands of remote business operations. On top of having a company-wide security training and a checklist for all employees to keep their networks, devices, and connections secure, businesses need to have a multilayered approach to keep a wide variety of ever-evolving threats at bay.

Organizations should consider a comprehensive multilayered security solution such as Trend Micro Cloud App Security. It supplements the pre-existing security features in email and collaboration platforms like Microsoft 365 and Google Workspace (formerly known as G Suite) by using machine learning (ML) to analyze and detect any suspicious content in the message body and attachments of an email. It also acts as a second layer of protection after emails and files have passed through Microsoft 365 or Gmail’s built-in security.

Trend Micro Cloud App Security uses technologies such as sandbox malware analysis, document exploit detection, and file, email, and web reputation technologies to detect malware hidden in Microsoft 365 or PDF documents. It provides data loss prevention (DLP) and advanced malware protection for Box, Dropbox, Google Drive, SharePoint Online, OneDrive for Business, and Salesforce while also enabling consistent DLP policies across multiple cloud-based applications. It also offers seamless integration with an organization’s existing cloud setup, preserving full user and administrator functionality, providing direct cloud-to-cloud integration through vendor APIs, and minimizing the need for additional resources by assessing threat risks before sandbox malware analysis.

Trend Micro Cloud App Security stands on the cutting edge of email and software-as-a-service (SaaS) security, offering ML-powered features that combat two of the primary email-based threats: BEC and credential phishing. Writing Style DNA can help determine if an email is legitimate by using ML to check a user’s writing style based on past emails and then comparing suspicious emails against it. Computer vision, on the other hand, combines image analysis and ML to check branded elements, login forms, and other site content. It then pools this information with site reputation elements and optical character recognition (OCR) to check for fake and malicious sites — all while reducing instances of false positives to detect credential phishing email.

Trend Micro Cloud App Security also comes with the advanced and extended security capabilities of Trend Micro XDR, providing investigation, detection, and response across your endpoints, email, and servers.