Over the past year, Barracuda researchers had teamed up with leading researchers at UC Berkeley to study the end-to-end lifecycle of a compromised account. After examining 159 compromised accounts that span 111 organisations, they identified the ways account takeover happens, how long attackers have access to the compromised account, and how attackers use and extract information from these accounts.
The research found fresh insights into these widespread and dangerous attacks; behavior of cybercriminals in compromised accounts, and how organisation’s can make defense strategies accordingly. Highlights from the report include:
-
More than one-third of the hijacked accounts analysed by Barracuda researchers had attackers dwelling in the account for more than one week.
-
20% of compromised accounts appear in at least one online password data breach, which suggests that cybercriminals are exploiting credential reuse across employees’ personal and organization accounts.
-
In 31% of these compromises, one set of attackers focuses on compromising accounts and then sells account access to another set of cybercriminals who focus on monetising the hijacked accounts.
-
78% of attackers did not access any applications outside of email.
“Cybercriminals are getting stealthier and finding new ways to remain undetected in compromised accounts for long periods of time so they can maximize the ways they can exploit the account, whether that means selling the credentials or using the access themselves. Staying informed about the attackers’ behavior will help organisations remain vigilant and put the proper protection in place so they can defend themselves against these types of attacks and respond quickly if an account is compromised,” said Don MacLennan, SVP Engineering, Email Protection at Barracuda.
