Header Monthly Email Threat Review

Email Threat Review December 2021

Written by Security Lab / 20.01.2022 /
Home » Blog » Email Threat Review December 2021

Summary

In this installment of our monthly email threat review, we present an overview of the email-based threats observed in December 2021 and compare them to the previous month’s threats.

The report provides insights into:

Unwanted emails by category

The following table shows the distribution of unwanted emails per category.

Email category%
Rejected80.70
Spam14.27
Threat4.15
AdvThreat0.84
Content0.04

The following time histogram shows the email volume per category per day.

Readers of our previous reports likely already guessed that the spike in rejected emails at the start of December can be attributed to a large-scale monthly re-occurring sextortion scam spam campaign targeting German-speaking victims.

Methodology

The listed email categories correspond to the email categories listed in the Email Live Tracking of Hornetsecurity’s Control Panel. So our users are already familiar with them. For others, the categories are:

CategoryDescription
SpamThese emails are unwanted and are often promotional or fraudulent. The emails are sent simultaneously to a large number of recipients.
ContentThese emails have an invalid attachment. The administrators define in the Content Control module which attachments are invalid.
ThreatThese emails contain harmful content, such as malicious attachments or links, or they are sent to commit crimes like phishing.
AdvThreatAdvanced Threat Protection has detected a threat in these emails. The emails are used for illegal purposes and involve sophisticated technical means that can only be fended off using advanced dynamic procedures.
RejectedOur email server rejects these emails directly during the SMTP dialog because of external characteristics, such as the sender’s identity, and the emails are not analyzed further.

File types used in attacks

The following table shows the distribution of file types used in attacks.

File type (used in malicious emails)%
Archive28.8
HTML22.8
PDF18.5
Excel11.8
Disk image files4.8
Other4.4
Executable4.4
Word3.6
Email0.7
Script file0.2

The distribution of file types in attacks using attachments is virtually the same as in previous months.

Industry Email Threat Index

The following table shows our Industry Email Threat Index calculated based on the number of threat emails compared to each industry’s clean emails received (in median).

IndustriesShare of threat in threat and clean emails
Manufacturing industry4.8
Media industry4.6
Education industry4.3
Research industry4.1
Mining industry4.1
Healthcare industry4.0
Agriculture industry3.9
Automotive industry3.9
Hospitality industry3.7
Entertainment industry3.5

The following bar chart visualizes the email-based threat posed to each industry.

The research industry threat index has dropped from 6.0 to 4.1. Further, the Hospitality industry made it into the top 10. This is likely due to targeting criminals who know that other industries will have reduced email traffic due to the holidays, making it harder for threat emails to blend in, while the hospitality industry (hotels, restaurants, etc.) has increased business over the holidays.

Methodology

Different (sized) organizations receive a different absolute number of emails. Thus, we calculate the percent share of threat emails from each organization’s threat and clean emails to compare organizations. We then calculate the median of these percent values for all organizations within the same industry to form the industry’s final threat score.

Attack techniques

The following table shows the attack techniques used in attacks.

Attack technique%
Phishing49.2
Other31.4
URL7.3
Extortion3.3
Impersonation3.0
Advance-fee scam2.5
Executable in archive/disk-image2.5
Maldoc0.8
LNK0.0

The following histogram shows the email volume per attack technique used per hour.

Impersonated company brands and organizations

The following table shows which company brands and organizations our systems detected most in impersonation attacks.

Impersonated brand or organization%
Sparkasse50.1
Volks- und Raiffeisenbank24.0
Amazon5.2
Postbank4.2
Other3.8
Deutsche Post / DHL3.6
PayPal1.5
DocuSign1.0
LinkedIn0.9
Microsoft0.8
1&10.7

The following histogram shows the email volume for company brands and organizations detected in impersonation attacks per hour.

On 2021-12-05, the long-running large-scale phishing campaign against the two German banking associations, Sparkasse and Volks- und Raiffeisenbanken also targeted the German Postbank. The emails use the same lure as the campaigns we previously reported on. The user is informed about an alleged change at the bank concerning the European Payment Services Directive 2 (PSD2). The user is requested to review and confirm the changes to their data.

Emotet Christmas campaign

Emotet is known for sending campaigns for specific seasonal events. We previously reported on Emotet’s Halloween campaign. Emotet also sent threat emails this Christmas.

The emails were very primitive and only featured one link.

As usual, the link in the email downloads an Office document which malicious macro code downloads and executes the Emotet malware.

You might also be interested in