Types of Email Attacks, Major Attacks, and Lessons Learned

What Are Email Attacks? 

Email attacks are malicious activities carried out by cybercriminals using email as a primary vector to compromise, exploit, or steal sensitive information from individuals, businesses, or organizations. The goal of these attacks is often to gain unauthorized access to systems, steal data, or facilitate other cybercrimes. 

To protect against email attacks, it’s essential to use strong email security practices, such as using secure email providers, enabling spam filters, implementing multi-factor authentication, and educating employees or users about potential threats and how to recognize and avoid them.

Learn more about security practices in our detailed guide to email security.

Types of Email Cyber Attacks 

Phishing

Phishing attacks involve sending fraudulent emails disguised as legitimate ones to trick recipients into revealing sensitive information, such as login credentials or financial data. These emails often include links to fake websites that closely resemble legitimate ones, making it difficult for users to differentiate between them.

Business Email Compromise (BEC)

In a BEC attack, attackers impersonate other key employees within an organization, typically high-level executives. They use this false identity to send targeted emails to other employees, typically in the finance department, requesting wire transfers or other financial transactions. BEC attacks rely on social engineering tactics to manipulate victims into acting on the fraudulent requests. One example of a BEC attack is thread hijacking:

Malware Attacks

Malware attacks involve sending emails with malicious attachments or embedded links that, when opened or clicked, install malware on the recipient’s device. This malware may be used to collect sensitive information, encrypt data for ransom (ransomware), or create a backdoor for unauthorized access to the system.

Man-in-the-Middle (MitM) Attacks

MitM attacks occur when a cybercriminal intercepts and alters email communications between two parties without their knowledge. This can be used to steal sensitive information, modify the contents of emails, or redirect communications to different recipients.

Denial of Service (DoS) Attacks

DoS is a technique used to slow or shut down services. Threat actors can use DoS to overwhelm an email server or network with a flood of traffic, rendering it unable to process legitimate requests. This can result in temporary or even permanent disruption of email services for the targeted organization.

Account Takeover (ATO) Attacks

In an ATO attack, cybercriminals achieve unauthorized root access to a user’s email account, often through phishing or credential theft. Once in control of the account, they can send fraudulent emails from the legitimate user’s address, access sensitive information stored within the account, or use the account to launch further attacks.

Spam

Spam refers to unsolicited, unwanted, and often irrelevant email messages sent in bulk to a large number of recipients. While not always malicious, spam can be a nuisance and consume valuable resources. In some cases, spam may contain links to phishing sites or include malicious attachments, turning it into a vector for more serious cyber attacks.

3 High Profile Email Attacks and Lessons Learned

Mailchimp Data Breach 

Mailchimp, the email marketing platform, experienced a security breach in March 2022, leaving an undetermined number of individuals vulnerable to phishing attacks. This incident offers critical cybersecurity insights for users.

The Mailchimp breach occurred due to a social engineering attack targeting company employees, who inadvertently provided the attackers with their account credentials. This enabled the hackers to access an internal Mailchimp tool employed by customer support teams and account administrators.

Lessons learned:

This breach serves as a valuable reminder that any organization can fall victim to a security breach. Such breaches can lead to highly convincing phishing emails or scams. The cybersecurity community often cautions users to be skeptical of emails from unknown or untrusted sources. However, in cases like this, the phishing email appears to originate from a trusted sender whose account has been compromised.

Toyota Boshoku Corporation Scam

In August 2019, Toyota Boshoku Corporation, a major supplier of Toyota auto parts, lost over $37 million due to a BEC scam. In this incident, cybercriminals posed as a subsidiary of the corporation and convinced employees to redirect funds to their fraudulent account.

Lessons learned:

• Implement robust security measures: Organizations should establish strong authentication protocols, including multi-factor authentication (MFA), to minimize the risk of unauthorized access to sensitive systems and communications.
• Employee training: Employees should be trained to recognize and report potential phishing attempts, BEC scams, and other email-based threats. Regular security awareness training can help in this regard.
• Verify changes in payment details: Any changes in payment instructions or account details should be thoroughly verified using established communication channels, preferably through direct contact with the concerned party.

Saint Ambrose Catholic Parish 

In April 2019, Saint Ambrose Catholic Parish in Ohio fell victim to a BEC scam that cost them $1.75 million. Cybercriminals impersonated the construction company working on the church’s renovation project and requested payment to a new bank account. Church staff complied without verifying the request, and the funds were transferred to the fraudulent account.

Lessons learned:

• Establish strong communication protocols: Organizations should have clear procedures for verifying financial requests and changes in payment details, ideally involving multiple stakeholders and direct communication with the requesting party.
• Encourage a culture of security: Encourage employees to be vigilant and report any suspicious activity. Foster an environment where employees feel comfortable seeking clarification or raising concerns without fear of repercussion.
• Regularly review and update security policies: Security policies should be periodically reviewed and updated to address emerging threats and to ensure that they remain effective in the face of new tactics employed by cybercriminals.

Learn more in our detailed guide to email security issues 

How to Prevent Email Attacks 

Implement Multi Factor Authentication

MFA adds an extra layer of security to the login process by requiring users to provide at least two forms of identification before gaining access to an account. MFA can significantly reduce the risk of unauthorized access, even if an attacker manages to steal a user’s password. 

Some common forms of MFA include one-time codes sent via SMS or email, authentication apps, biometrics (such as fingerprint or facial recognition), and physical security tokens.

Use a Spam Filter

Spam filters help reduce the amount of unwanted email messages that reach users’ inboxes. By automatically filtering out spam, organizations can minimize the risk of employees accidentally opening malicious emails. 

Spam filters use a variety of techniques, such as content analysis, machine learning, and reputation-based filtering, to identify and block spam messages. Many email security solutions include built-in spam filtering capabilities, but standalone spam filters are also available.

Educate Employees

Employee education and awareness are critical components of email security. Regular security awareness training can help employees recognize and respond to various email-based threats. Training should cover:

• Identifying phishing emails: Teach employees how to spot phishing emails, such as by examining the sender’s email address, checking for typos and grammatical errors, and hovering over links to verify their destinations.
• Safe email practices: Encourage employees to avoid clicking on suspicious links or opening unexpected attachments. Instead, they should verify the sender’s identity through an established communication channel before engaging with the email.
• Reporting incidents: Establish clear procedures for reporting suspected phishing attempts, malware infections, or other email-based threats. A prompt response to such incidents can help minimize the impact of an attack and prevent further damage.
• Updating software: Ensure that employees keep their software, including email clients, web browsers, and operating systems, up to date with the latest security patches.

Deploying an Email Security Solution

While there is no replacement for email security practices in your organization, a dedicated email security solution can provide stronger email safety. For example, Perception Point’s Advanced Email Security contains multiple scanning engines and threat intelligence for enhanced protection against attacks like phishing, spam, commodity malware and BEC. 

For advanced threats, the solution leverages hardware-based and software-based tracking to identify evasive threats. Proprietary software algorithms scan code at the CPU-level to intercept attacks at the earliest stage possible – the exploit – before malware is even delivered. 

Perception Point is easy to deploy, analyzes email in seconds, and can scan email traffic at any scale, leveraging the flexibility of the cloud.

Learn more about Perception Point’s Advanced Email Security