A brand new report from cybersecurity firm Barracuda has discovered that IT staffers and CEOs proceed to face a barrage of phishing assaults all year long.

Barracuda analysts examined greater than 12 million spear phishing and social engineering assaults impacting greater than 3 million mailboxes at over 17,000 organizations between Could 2020 and June 2021. 

The “Spear Phishing: High Threats and Tendencies Vol. 6 — Insights” report discovered that 43% of phishing assaults impersonate Microsoft and the typical group is focused by over 700 social engineering assaults annually. 

Practically 80% of BEC assaults goal workers exterior of monetary and government roles, with the typical CEO receiving 57 focused phishing assaults annually and IT staffers getting a median of 40 focused phishing assaults yearly.

Cryptocurrency-related assaults additionally grew 192% between October 2020 and April 2021, and the researchers famous that the variety of assaults rose alongside the final worth of assorted

Home windows internet-facing servers are being focused by a brand new risk actor working “nearly utterly in-memory,” in line with a brand new report from the Sygnia Incident Response staff. 

The report mentioned that the superior and chronic risk actor — which they’ve named “Praying Mantis” or “TG1021” — principally used deserialization assaults to load a very risky, {custom} malware platform tailor-made for the Home windows IIS atmosphere.

“TG1021 makes use of a custom-made malware framework, constructed round a standard core, tailored for IIS servers. The toolset is totally risky, reflectively loaded into an affected machine’s reminiscence and leaves little-to-no hint on contaminated targets,” the researchers wrote.

“The risk actor utilized the entry offered utilizing the IIS to conduct the extra exercise, together with credential harvesting, reconnaissance, and lateral motion.”

Over the past 12 months, the corporate’s incident response staff has been compelled to reply to various focused cyber intrusion