More Than Half of Ransomware Infections Are Caused by Phishing

Ransomware is a constant menace to businesses, and the most likely way for a company to encounter a ransomware threat is through a phishing message. In 2021, far too many organizations found themselves staring down the barrel of a potential ransomware disaster.  A recent survey found that a whopping 78% of organizations experienced one or more email-based ransomware attacks in 2021. Drilling down deeper, 68% of the surveyed organizations that fell victim to ransomware revealed that they’d dealt with at least one ransomware infection that originated from a direct email payload, second-stage malware delivery or other similar cause. Data like this makes it clear that organizations that want to avoid ransomware trouble need to make strong, effective email security a priority.  

Phishing Delivers Ransomware 

Human beings are often the weak point that cybercriminals can exploit to penetrate security. Employees have an unfortunate tendency to fall for phishing messages. In a survey, 60% of employees said that they have opened emails they weren’t fully confident were safe for fear of missing an important message. Employees don’t just stop at opening them either. They’re also interacting with suspicious messages at an alarming rate. 1 in 3 employees are likely to click the links in phishing emails, and 1 in 8 employees are likely to share information requested in a phishing email. It’s all too easy for bad actors to set social engineering traps that ensnare employees, persuading them to download a dodgy file, visit a poisoned URL or hand over their password. 

By far, the most common way for ransomware to take root in an organization’s environment is through phishing, but it’s not the only way. IBM’s Cyber Resilient Organization Study offers a snapshot of the roots of the ransomware attacks that their researchers noted in 2021. Four major catalysts drove most ransomware events.  

Stop Phishing to Stop Ransomware 

All ransomware attacks can’t be chalked up to phishing, but the vast majority of them have their roots there. Organizations that want to reduce their exposure to ransomware must take measures to prevent phishing messages from making their way to employees. There are a few steps that organizations can take to combat the danger of a ransomware attack caused by phishing: DMARC, employee training and automated TrustGraph® protection. 

DMARC 

Any company with a domain name can leverage DMARC to help reduce spam and prevent phishing attacks. DMARC (Domain-based Message Authentication, Reporting and Conformance) is an email authentication protocol specification that protects against direct domain spoofing. It can detect when an email is sent by an unauthorized sender of that domain, and block or discard the message before it is received. However, DMARC only protects against direct domain spoofing, not all phishing attacks. For DMARC to protect you against domain spoofing, all of your vendors, partners, and customers (your trusted supply chain) have to implement SPF, DKIM and DMARC.  

Security Awareness Training 

Training your employees to spot malicious emails is another way to lower the probability of a successful phishing attack and a ransomware disaster. Security awareness training is highly effective, and the more employees get the better they are at avoiding incidents. In a UK study on phishing simulations, researchers discovered that 40 – 60% of the employees surveyed were likely to open malicious links or attachments at the start of the study. In follow-up testing, after about 6 months of training, the percentage of employees who took the bait in every industry dropped 20% to 25%. Further training produced a steeper drop. After 3 to 6 months of more training, the percentage of employees who opened phishing messages dropped to only 10% to 18%. However, this still puts human beings in the driver’s seat, and even well-trained employees will fall for the bait sometimes.  

Automated Protection with TrustGraph 

Automated email security solutions spot and stop 40% more phishing messages than old-fashioned conventional security or a SEG. Our patented TrustGraph technology puts a powerful shield between phishing and your business to stop phishing immediately. Machine learning ensures that your protection grows with your business instead of growing obsolete, at a fraction of the cost of competing solutions. Using graph theory, machine learning and artificial intelligence help algorithms to identify trusted relationships between your employees and the people they communicate with, Graphus virtually eliminates the threat of phishing and ransomware attacks delivered through email, automatically identifying and eliminating even sophisticated, socially engineered cyber threats. People are easily fooled. Graphus is not. 

Stop Phishing Immediately with Graphus 

No organization can take chances when it comes to cybersecurity, especially phishing defense. 60% of businesses that experience a cyberattack like ransomware shutter within 6 months, putting businesses just a click away from disaster. But Graphus saves the day.  

• Graphus is virtually plug-and-play, with no complex configurations or tinkering required, and its is quickly deployable to Microsoft 365 and Google Workspace via API. 
• You can’t afford to wait for technicians to upload safe sender lists or threat reports to gain protection from new threats, and you never have to with Graphus – it collects its own threat intelligence. 
• The AI never takes a day off of monitoring your company’s unique communication patterns to quickly spot trouble and take care of phishing threats automatically without human intervention 24/7/365. 

Schedule your demo today! BOOK IT