Nearly one in two phishing attacks are polymorphic, according to research by IRONSCALES. The self-proclaimed world's first automated phishing prevention, detection and response platform identified 11,733 email phishing attacks that underwent at least one permutation over 12 months, with 52,825 permutations impacting 209,807 inboxes across the world.
Polymorphism occurs when an attacker implements slight but significant and often random changes to an email, such as its content, copy, subject line, sender name or template, in conjunction with or after an initial attack has deployed. This approach means that attackers can quickly develop phishing attacks that trick signature-based email security tools that were not built to recognize such modifications to threats, ultimately allowing different versions of the same attack to land undetected in employee inboxes.
This brings extra complexities to security teams who try to defend against polymorphic phishing attacks. According to IRONSCALES, thee attacks remain one of the "most time-consuming and burdensome tasks," especially as phishing kits can be inexpensive on the dark web. Currently, decentralized and distributed intelligence, coupled with non-signature-based email security tools that use artificial intelligence and machine learning to cluster similar attacks together, has proven most successful at mitigating polymorphic email phishing threats.
“Polymorphic email phishing threats represent an incredibly difficult challenge for SOC and IT security teams to overcome,” said Eyal Benishti, founder and CEO, IRONSCALES. “Just as security personnel think that they may have a phishing threat under control, attackers can augment the artifacts to give the message an entirely new signature, thereby enabling what is for all intents and purposes the same malicious message to bypass the same human and technical controls that might have stopped a previous version of the attack.”
These findings come weeks after the company found that secure email gateways (SEGs) failed to stop 99.5% of all non-trivial email spoofing attacks.
No tags.
