Skilled hackers have found ways to infiltrate corporate emails, which has caused $12 billion in damage over the past 5 years. Compromised corporate emails are often traded on the dark web, where cybercriminals try to gain access to critical company information, related to each company's financial data.
According to research, security researchers found 33.568 email accounts that have been compromised by third-party services. Of these, 83% were breached because the hacker knew the password, and more than 18.000 of them were .com domains. The research includes images from online marketplaces of the dark web, where there were listings for addresses from the accounting department, for companies based in the USA and South Africa.
These breaches are becoming increasingly common, using many different techniques. The most common tactics are through phishing, or by paying a hacker who takes on the job. On a forum, a hacker offers to crack corporate email passwords for as little as $150, which shows that he has extensive experience and does not find it particularly difficult.
With social engineering techniques and email spoofing, these types of “campaigns” are executed with great precision in terms of their target, while many companies unwittingly make these attacks easier. In fact, according to the research, companies are exposing their entire inbox to services that are not secured with strong passwords, or sometimes even with any password at all. Some of these are rsync, FTP, SMB, S3 buckets and NAS drives.
The researchers also discovered that some of the exposed corporate emails contained 27,000 invoices, and 21,000 payments, as a result of exposed backups.
