The internet is an incredible tool for education. Unfortunately, not everyone uses it to better themselves or the world around them. There are plenty of opportunities to learn how to defraud, damage, and steal from organizations – so many in fact, that this open source of hacking knowledge is a new technology service industry in its own right: crime-as-a-service.
How does crime-as-a-service work?
These days an aspiring hacker can find everything they need to carry out a high-profile cyberattack online. Networks of cybercriminals are working together to create and share software, toolkits, and methodologies for carrying out cyberattacks.
Just like businesses, criminals specialize in different areas of cybercrime. That means a hacker can pick and choose from a variety of vendors to craft the perfect phishing attack. Some will specialize in using open-source intelligence (OSINT) to find the best targets for phishing attacks. Others may specialize in creating the initial breach into an organization or building ransomware.
Often hosted on the dark web, these marketplaces offer access to hacking tools and tactics that would usually be out of the hands of people without advanced IT skills. And because email phishing is the most common vector for carrying out these attacks, they’re simple for anyone with an internet-connected device to put into action.
Why is crime-as-a-service such a concern?
The main issue with crime-as-a-service is that it makes cybercrime accessible to more people. This means less sophisticated attackers are able to compromise businesses without needing expert system hacking skills or the ability to build powerful malware. Sending a phishing email is far simpler than hacking into an IT system, opening up the opportunity for anyone with a phishing toolkit to infiltrate and defraud organizations – from anywhere.
For example, a prospective cybercriminal could buy a list of targets, ransomware software, phishing templates and automation tools. They simply need to click and download, then set the attack in motion. There would be an initial outlay, but their potential gains are huge. As the crime-as-a-service networks grows larger, the rate of attacks and the likelihood of their success will increase too.
How can organizations defend themselves?
To mitigate the threat, organizations need to understand the risks they’re facing and put appropriate procedures and technology in place to defend themselves. A good starting point is to find out what OSINT is available about your organization, as this is the first step an attacker will take when planning an attack.
Secondly, it’s vital to defend your employees from phishing attacks with advanced email technology. Email phishing is the favoured attack vector for cybercriminals as it’s free, easy to use, and can be used to launch multiple attacks at once. Email users are prime targets for the human error needed to make a phishing attack successful. People tend to be much easier targets than IT systems – which is why over 90% of ransomware is delivered via email phishing.
Traditional anti-phishing technology such as secure email gateways (SEGs) are too reactive, and are unable to keep employees safe from the increasingly sophisticated, ever-evolving phishing attacks we see today. Organizations need something that’s able to detect the latest toolkits and templates that attackers are purchasing and using.
What’s the solution?
Intelligent anti-phishing software is the only way to even up the odds. Egress Defend uses machine learning and natural language processing to analyze the content and context of every email that enters your business. That means it’s able to detect the most sophisticated attacks that traditional anti-phishing technology will let slip through the net.
Don’t become a victim of crime-as-a-service. Learn more about Egress Defend here, or see what it can do first-hand by booking yourself a no-strings-attached demo.