Password threat: Hackers massively attack corporate emails
Russian companies have experienced a record surge in phishing attacks: in the third quarter, their number increased 2.5 times compared to the previous period. Hackers pick passwords from leaked databases, send malicious files, and increasingly impersonate supervisors in order to gain access to data and trick employees into doing their bidding. Izvestia investigated how these schemes work and how to protect accounts.
How mail is attacked
The business was hit by a wave of hacker attacks, cybersecurity experts told Izvestia. According to the DLBI service, in July –September, the number of attempts to hack corporate accounts turned out to be 2.5 times higher than in the previous three months.
The service's specialists noted that the attackers also infiltrate personal accounts on free platforms. Compromised mailboxes are used to send out hackers and Trojans with remote access. In corporate networks, this makes it possible to steal data and infect systems with ransomware viruses.
Password reuse technology is most often used for hacking: attackers collect lists of possible combinations for a specific user from stolen data and check them on other accounts. To do this, they log into mail through a browser or special programs, some of which use outdated protocols with weaker protection.
Another popular method is password spraying, recalled Luka Safonov, business partner for innovative development of the Garda company, technical director of the Garda WAF. Attackers try several common login combinations on multiple accounts at once. There are few attempts for each one, so security systems designed to detect mass recruitment may miss such activity.
Data analyst at the .RU/ Domain Coordination Center.Russian Federation Evgeny Pankov confirmed that the number of malware attacks is growing.
"Judging by the requests within the framework of the Domain Patrol project, in the first nine months of 2026, the number of requests for malware distribution increased 1.9 times, and their share in the total volume of threat requests increased from 19.1% to 27.3%," he said. — At the same time, attacks are becoming noticeably more complicated: attackers are increasingly combining phishing and malware, and the development of AI technologies makes it possible to prepare convincing messages and scale mailing lists.
Fraudsters understand that a letter from a colleague causes much less suspicion, especially if it continues a real working dialogue, and actively use it, confirmed Konstantin Melnikov, head of the department of special services at Infosecurity (part of Softline Solutions, Softline Group).
— I'll give you an example from practice. In one of the companies, the attackers got to the critical infrastructure by hacking the mail of a maintenance engineer," he shared. — They found out from the correspondence that he often interacts with the local administrator, who had broad access rights. On behalf of the engineer, they asked for permission to install new software for testing. The administrator did not request an official confirmation, and the miner got on the server. He remained inactive for about two months. As a result, the incident was discovered when the server load increased from the usual 20 to 80%.
What other schemes do hackers use?
Hackers can also blackmail employees through email hacking. Having gained access to personal or work correspondence, criminals are looking for information with which to put pressure on a person or their loved ones.
— Sometimes they demand money for silence, sometimes they try to force a person to hand over documents or help in a further attack on the company. With AI, such schemes have become more convincing: a fake boss's voice or a message written in his usual manner is easier to use to pressure and lure confidential information.
Recently, the Fake Boss scheme has also been widespread: attackers pose as company executives and write to employees on Telegram, Softline Group told Izvestia. The company has already recorded 1,740 cases of such fraud.
"The Fake Boss scheme is based on trust in superiors and the habit of responding quickly to work messages," Konstantin Melnikov added. — AI further expands the capabilities of intruders: it allows you to create personalized appeals and fake a voice.
According to him, in the classic version, an account writes to an employee, the owner of which is represented by the head. The message is sent via social networks or messengers and simulates a regular business message. Identity substitution allows you to issue a fraudulent order as a management order. Experts have documented 31 cases of AI being used to substitute the voices of managers and employees.
"Companies whose employees regularly make payments, gain access to corporate systems and work with confidential data are at risk,— Konstantin Melnikov said. — In order to reduce the likelihood of a successful attack, it is important to additionally confirm requests for transfers and access received through messengers via an independent secure channel.
More sophisticated types of phishing are also developing, Luka Safonov added. For example, a person receives an email with a link to a fake login page. If he enters his data, the attacker intercepts the session and then bypasses some types of two-factor authentication.
"In another case, the link leads to a page where an employee is tricked into providing access to mail to a third—party application," he said. — Such emails are often sent from already hacked emails of colleagues and contractors. A familiar sender and real business correspondence make the attack more convincing.
Mikhail Shekhovtsov, head of the Bastion Information Security Monitoring Center, noted that compromises through contractors have also increased recently.
"They hack into employees' personal devices and mislead them in order to obtain a two—factor authentication code to access the corporate information environment," he said.
How to secure a company
Corporate mail remains one of the main vectors of penetration into the infrastructure of companies, said Mikhail Klimov, Head of services at the RED Security SOC Cyberattack Monitoring and Response Center. You can find a lot of valuable information in mailboxes: information about infrastructure, systems, colleagues, contractors, and even IP addresses and authentication data for various services.
"At the same time, it is becoming increasingly difficult to hack work emails, as companies are strengthening information security measures around the perimeter," the expert explained. — Therefore, the attackers are also targeting the personal accounts of employees. Compromising them can be a starting point for further attacks on the organization. After gaining access to the correspondence, the attackers collect information about the employee and his environment, and then use it for targeted phishing.
Mail is a convenient entry point into the corporate infrastructure: through it you can reset passwords, intercept confirmation codes and send malicious emails on behalf of staff, says Dmitry Karasovsky, head of Information security at Axiom JDK. Google Drive, Microsoft 365, Telegram, VK, as well as banking and work services can be linked to it. Having gained access to the mailbox, the fraudster may try to get to these accounts. One of the reasons for the prevalence of such attacks is the desire of users to simplify their work with accounts.
"It's difficult to remember dozens of unique passwords, so people reuse the same combinations or change only a few characters in them," he said. — Hackers automate the verification of stolen credentials on other services, and a leak on a third-party site can be a starting point for hacking corporate mail. And through it, attackers will have the opportunity to gain access to the internal data of the organization.
According to Ashot Oganesyan, founder of DLBI, such actions of hackers are a consequence of the general change in the situation on the information security market.
"The number of scam calls is gradually decreasing due to blocking, users themselves have become less responsive to phishing, and corporate VPN services, which were previously the main target of hackers, are massively switching from password access to using certificates," he said. — All this forces Internet crime not only to look for new methods, but also to return to the forgotten ones - for example, to abandon social engineering in favor of sending malware. Moreover, its creation with the help of AI has become simple and cheap.
To protect against such attacks, it is necessary to control the compromise of passwords and immediately reset those that fall into the hands of hackers, Ashot Oganesyan recalled.
"Moreover, password resetting should be carried out using automated tools, rather than trusting the users themselves, since a third of them avoid this procedure, not wanting to memorize new data," the expert emphasized. — In the mail systems themselves, it is necessary to use blocking of executable attachments, which is handled by server-side antivirus solutions.
Konstantin Melnikov added that it is important for staff to be able to recognize suspicious messages and know where to contact if they have already opened a file or transmitted confidential information. Experts also noted the need to train managers and business owners: their accounts often provide access to the most valuable information.
Переведено сервисом «Яндекс Переводчик»
