Business email compromise (BEC) attacks spiked in the third quarter of 2023, according to Huntress' inaugural threat report. Huntress provides a cyber security platform designed for managed service providers to protect their small- and mid-sized business (SMB) clients.
The Ellicott City, Maryland-based company said that more than half of all attacks during Q3 were malware-free, meaning hackers exploited legitimate tools instead of malicious software.
The Huntress report revealed 64% of identity-focused incidents in Q3 2023 involved malicious forwarding or other malicious inbox rules, a key indicator of BEC. Another 24% of identity-focused incidents involved logons from unusual or suspicious locations.
Huntress recently added managed detection and response (MDR) for Microsoft 365 capabilities to its SMB platform to enhance protection against BEC and account takeover attacks. SMBs can use MDR for Microsoft 365 to respond to suspicious logins, permission changes and privilege escalations.
“The threat landscape is not slowing down. Threat actors are evolving their tradecraft to significantly impact SMBs, and our goal is to educate them and give them a fighting chance against the ever-evolving adversarial landscape,” said Joe Slowik, Huntress threat intelligence manager.
A Closer Look at Q3 Cyber Attacks: RMM Exploited
Other key takeaways from the research:
