One third of hackers dwell in hijacked email accounts for more than a week

A new report from Barracuda Networks, a trusted partner and leading provider of cloud-enabled security solutions, reveals that over 33% of hijacked email accounts had attackers dwelling in the account for more than a week.

The report, titled Spear Phishing: Top Threats and Trends Vol. 4 – Insights into attacker activity in compromised email accounts, saw Barracuda researchers team up with leading researchers at UC Berkeley to study the end-to-end lifecycle of a compromised email account. Researchers examined 159 compromised accounts spanning 111 organisations, and concluded that a specialised economy is emerging around email account takeover, using a combination of brand impersonation, social engineering, and spear phishing to hijack email accounts and monetise them.

Barracuda’s researchers also found that 20% of compromised accounts appear in at least one online password data breach, which suggests that cybercriminals are exploiting credential reuse across employees’ personal and organisation accounts.

Furthermore, in 31% of account compromises analysed, the initial set of attackers would focus on compromising accounts and then sells account access to another set of cybercriminals who focus on monetising the hijacked accounts. This reflects an increasingly specialised, and layered criminal market for account compromise.

Interestingly, the researchers observed that 78% of attackers did not access any applications outside of email. Therefore, the report concluded that either many organisations’ cloud accounts do not have access to interesting data and functionality outside of email, or that attackers have yet to adapt and exploit these additional sources of information.

Don MacLennan, SVP Engineering, Email Protection at Barracuda said, “Cybercriminals are getting stealthier and finding new ways to remain undetected in compromised accounts for long periods of time so they can maximize the ways they can exploit the account, whether that means selling the credentials or using the access themselves.

“Being informed about attacker behavior will help organizations put the proper protection in place so they can defend against these types of attacks and respond quickly if an account is compromised.”