It may not come as a surprise that as the remote work became the norm, cybercriminals shifted and amplified their attacks on employees working from home. This is one of the findings of the latest report from cybersecurity firm Sophos titled “Phishing Insights, 2021.”

The research looked into the experience and understanding of phishing in organizations around the world during 2020 when the COFID-19 pandemic forced lockdowns.

The results show that phishing attacks targeting organizations ramped up significantly during the pandemic, as millions of home-working employees became a prime target for adversaries. The vast majority (70%) of all IT teams said the number of phishing emails hitting their employees increased during 2020. This rose to 82% of IT teams in organizations that had been struck by ransomware during the year.

Sophos discovers Gootloader mothership controls malicious content

Keep ransomware at bay with Sophos Managed Threat Response

“Phishing has been around for over 25 years and remains an effective cyberattack technique,” said Chester Wisniewski, principal research scientist at Sophos. “One of the reasons for its success is its ability to continuously evolve and diversify, tailoring attacks to topical issues or concerns, such as the pandemic, and playing on human emotions and trust.”

Phishing definition

However, the research found that IT professionals can’t agree on a single definition of phishing. The most common understanding of phishing, selected by 57% of respondents, is “emails that falsely claim to be from a legitimate organization, usually combined with a threat or request for information.” Forty-six percent (46%) consider Business Email Compromise (BEC) attacks to be phishing, and more than one-third (36%) think threadjacking (when attackers insert themselves into a legitimate email thread as part of an attack) is phishing.

“The temptation for organizations can be to see phishing attacks as a relatively low-level threat, but that underestimates their power,” Wisniewski said. “Phishing is often the first step in a complex, multi-stage attack. According to Sophos Rapid Response, attackers frequently use phishing emails to trick users into installing malware or sharing credentials that provide access to the corporate network. The team has seen first-hand how a seemingly innocuous email can ultimately lead to a multi-million-dollar ransomware attack.

Cybersecurity awareness programs

Sophos also revealed that most (90%) organizations run cybersecurity awareness programs to address phishing. But the cybersecurity firm said that in the light of the survey results, “phishing awareness and education programs need to consider the wide range of perceived phishing definitions and include training for non-technical employees that explain the different facets of phishing and email attacks in general.”

Cryptojacking, data (even financial) theft are all potential outcomes after a phishing attack has opened a door for adversaries.

“The ideal would be to prevent phishing emails from ever reaching their intended recipient,” Wisniewski said. “Effective email security solutions can go a long way toward achieving this, but this should be complemented by alert and primed employees who are able to spot and report suspicious messages before they get any further.”