Cofense Report: 90% of Verified Phish Found in Environments Using Email Gateways

By Kaustubh Jagtap

Our recently released 2019 Phishing Threat and Malware Review highlights how perimeter protection technologies can’t stop all advanced phishing threats. Email gateways are a critical first line of defense, but as attackers have continued to innovate gateways haven’t kept up.  The CofenseTM report also underscores the importance of human intelligence to identify these advanced attacks once they make it past gateways. Trained users can effectively detect and report advanced phishing to allow SOC teams to accelerate incident response.

Credential Phish Are the Most Common Threat

90% of verified phishing emails were found in environments using email gateways. This included over 23k credential phishing emails and approximately 5k emails that delivered dangerous malware. The Cofense Research and Cofense IntelligenceTM teams also noted a change in tactics with Business Email Compromise (BEC) attacks. Threat actors are now targeting payroll administrators, as compared to the usual CEO/CFO targets. Our teams also found an increase in extortion tactics including sextortion and bomb threats to create urgency and panic.

Threat Actor Tactics Are Evolving

As they shifted malware delivery mechanisms, threat actors showed a strong preference for the exploitation of CVE-2017-11882, an older Microsoft Equation Editor vulnerability. Over 45% of all malicious attachments over the past year exploited this CVE to deliver malware.

Between August 2018 and February 2019, Cofense observed malicious .ISO files bypassing gateways, indicating the use of novel file types to escape detection. There were also significant developments in Installation-as-a-service (IaaS). Emotet embraced the IaaS business model in 2018 to deliver other malware like TrickBot, IceID, and QakBot. Cofense Research observed 678k unique Emotet infections through April 2019.

Cloud Filesharing Services Are Being Badly Abused

Cofense saw widespread abuse of cloud filesharing platforms to host and spread malicious content, including “legitimate” links to the content embedded in the phishing email. We found 9445 phishing emails that abused cloud filesharing services to deliver a malicious payload. Threat actors preferred SharePoint (55%) and OneDrive (21%) over other cloud filesharing providers.

How to Protect against Phishing and Malware

The report details numerous ways to defend against email threats. They include:

  • Educate users – Train and condition users to spot phishing emails. Faster incident response begins with better human intelligence.
  • Focus education on new TTPs – Make sure to educate your SOC team and end users on emerging threats and phishing tactics. Threat actor TTPs are constantly evolving. Complacency can breed painful consequences.
  • Train users to spot credential phish – Pay special attention to phishing scenarios where users are asked to login and supply credentials.
  • Enable multifactor authentication- It’s especially urgent if you have single sign-on.

To see more tips and the full story on phishing and malware threats, download your copy of the Cofense Phishing Threat & Malware Review 2019.


All third-party trademarks referenced by Cofense whether in logo form, name form or product form, or otherwise, remain the property of their respective holders, and use of these trademarks in no way indicates any relationship between Cofense and the holders of the trademarks.

New Phishing Attacks Use PDF Docs to Slither Past the Gateway

By Deron Dasilva and Milo Salvia

Last week, the CofenseTM Phishing Defense CenterTM saw a new barrage of phishing attacks hiding in legitimate PDF documents, a ruse to bypass the email gateway and reach a victim’s mailbox. The attacks masquerade as a trusted entity, duping victims into opening what appears to be a trusted link, which in turn leads to a fake Microsoft login page. Once there, victims are tricked into providing their corporate login credentials.

The Cofense Phishing Defense Center Sees Threats That Most Don’t

The CofenseTM Phishing Defense CenterTM analyzes suspicious emails reported by customers’ users and alerts their security teams when they need to take action. Because we live and breathe phishing analysis and response, and because we operate 24/7/365, we have visibility into threats most teams can’t see.

Here’s a Real Example Involving Compromised Email Accounts

A few months back, an organization exploring our services did a proof-of-concept trial, during which we analyzed emails its users found suspicious and reported for inspection. Soon enough, we saw emails sent from compromised email accounts within the organization.

In fact, they utilized a technique known as the Zombie Phish, so called because it revives a dormant email conversation the user had had to disarm the user and lure him into clicking. We provided the indicators of compromise to the customer’s point of contact, plus included a link to a Cofense blog about the Zombie Phish.

We Found Over 2000 Malicious Emails—in Just 3 Days

A couple of weeks passed uneventfully. Then, we saw a new batch of reported emails from compromised accounts, followed the next day by a spike in similar messages. In a 3-day period, we found 2053 malicious emails sent through 77 internal accounts. Subject lines varied, but every one of these emails contained a link to “Display Message,” which redirected to a login page spoofing the customer’s actual page. It asked users to enter the password for their company account.

The techniques in these emails seemed to be part of a global phishing campaign targeting UK organizations. The target’s email address was encoded in the link. When someone clicked, the login page displayed the organization’s logo. The links’ behavior varied, sometimes redirecting to a fake site instead of the spoofed login page, other times displaying a message that the URL was unavailable.

The team in the Cofense Phishing Defense Center was glad to be of assistance. Learn more about our phishing defense services.


All third-party trademarks referenced by Cofense whether in logo form, name form or product form, or otherwise, remain the property of their respective holders, and use of these trademarks in no way indicates any relationship between Cofense and the holders of the trademarks.

Finding the Whole Phishing Attack: Problems and Solution

Mitigating a phishing attack is a little like zapping termites. If you don’t eliminate the whole problem, trouble continues to breed.

To help, CofenseTM has announced the general availability of Cofense VisionTM. We knew that existing email search and quarantine tools weren’t fast enough, making it hard for the SOC to find and remove every phish.

Integrated with the latest release of Cofense TriageTM, Cofense Vision lets incident responders see the entire phishing attack, including emails not reported by users. With a single click, the SOC can quarantine every bad email and stop the attack in its tracks.

Cofense Vision copies and stores all emails in the customer’s cloud, so the SOC can look for a phishing campaign without creating more work for the email team. The solution also provides a compliant, auditable workflow.

Let’s take a closer look at some of the problems it solves.

“Searching takes too long.”

Every day, phishing emails bypass perimeter defenses to land in users’ inboxes. As the Cofense Phishing Defense Center has reported, 1 in 7 reported emails is malicious. In 2018 alone, for example, our team found over 55,000 credential phishing attacks. A single well-crafted phish can cost a business big. It’s critical to perform searches quickly and efficiently, especially since threat actors are more creative in evading network security with polymorphism, encryption, and obfuscated malware.

But traditional native tools, Powershell, for instance, make email searching complex and extremely time-consuming. To search and purge with Powershell you’re limited to 50,000 mailboxes. If the mail environment is larger, you have to create multiple searches.

You also have to build searches for multiple senders or multiple subject lines, which complicates the hunt and slows it even more. It’s also tough to know that you’re hitting every mailbox and not missing any threats.

In old-school searching, emails are grouped together, or “clustered,” based on an exact match to criteria like sender and subject. This allows you to find emails that match criteria you know about. However, such an approach to clustering doesn’t account for the way malware morphs and avoids exact matching, in some cases changing the sender, subject, or content for each recipient.

“We create more work for the email team.”

Traditionally, every step described above is handled by the IT team that owns the email platform—not by the SOC, the team responsible for stopping attacks. There’s a built-in conflict, one of competing priorities. The messaging team needs to make sure legitimate emails go through, while the SOC is trying to defend the business by mitigating attacks.

In this set-up, the messaging team is doing its day job AND handling SOC requests to find and quarantine phishing emails. The issues detailed in the previous section—the limits of native search tools and the inadequacies of old-school clustering—make life even more difficult for the messaging team. They’re asked to perform searches that (a) take a lot of time because they’re so complex and (b) get in the way of their regular duties.

Without a solution that empowers the SOC to search and quarantine on its own—with no heavy lift from the messaging team besides determining the fate of quarantined emails—the hunt for phishing threats is going to be inefficient. It’s a lot easier to send a command than to make a request.

With Cofense Vision, operators search an offline copy of the email environment hosted in their own cloud. There is thorough and strict auditing of who is searching for what. The SOC team gets what it needs while the mail team doesn’t have to hand over the keys to the kingdom.

If complicated email searching is slowing your phishing response, get more details on Cofense Vision. Learn more here.


All third-party trademarks referenced by Cofense whether in logo form, name form or product form, or otherwise, remain the property of their respective holders, and use of these trademarks in no way indicates any relationship between Cofense and the holders of the trademarks.

Introducing the Cofense Triage Certification Program

By Kiarra Grant

Want to be a certified expert in phishing response? Now you can.

Introducing the Cofense Triage TM Operators Certification. It’s our second industry-specific certification program, complementing our program for operators of Cofense PhishMeTM. The new program is focused on Cofense Triage, the first and only phishing-specific incident response platform. Become an expert in Cofense Triage while taking your phishing defense program to the next level.

The Cofense Triage Certification program provides:

  • Validation and certification of skills in the operation of Cofense Triage
  • Training in running a successful phishing response program
  • The ability to augment Cofense solution expertise with free threat landscape education modules
  • Complete education and testing for certification in about two hours, at the user’s pace

Upon completing the course, you may earn CPEs for your certifications by self-reporting to third-party organizations such as (ISC)² for review. This certification is included with your Cofense Triage license, so there is no charge for this program.

Users can request access to the certification by going to the “Request Cofense Triage Certification” button at the top of any Cofense Community page. Or click here.


How to Orchestrate a Smarter Phishing Response

We’ve been talking a lot recently about phishing-specific SOAR (Security Orchestration Automation and Response). It’s a capability CofenseTM has pioneered to help you mitigate phishing emails faster and more efficiently. Recently, we examined automation, the ‘A’ in the acronym. Now let’s take a deeper look at the ‘O,’ orchestration.

Involve the Right Teams Faster with Cofense TriageTM

Like a symphony conductor waving a wand, your phishing response needs to engage the right teams at the right time. To make that happen, Cofense TriageTM starts by reducing noise with an advanced spam engine, removing benign emails your employees have reported and freeing security teams to focus on real threats.

We also have out-of-the-box integrations with almost two dozen leading security solutions, including:

View the complete list.

Our integrations make it possible, for example, to connect intelligence on a suspicious URL to logs generated by your firewall and end points. Or, an operator working within Cofense Triage can push details about a phishing campaign to the help desk.

For solutions Cofense Triage isn’t integrated with (yet), we have a new API. It syncs to SIEM solutions, ticketing systems, threat intelligence system, and even sandboxing tools, so you can examine reported emails for overt threats or links to compromised servers. Email headers, which are often spoofed in phishing, can be examined too. And even the full text of the message, rendered but not actually assembled to protect the IT teams working within our solution, can be read and displayed.

Our fully documented REST API can pull information on individual emails, entire clusters (phishing campaigns), attachments, reporters, integrations, health stats and more. You can use it the preprocessing stage to notify teams of malicious attachments at soon as they’re reported.

This release also extends syslog alerting with Cofense Triage. With syslog enabled, Cofense Triage can send out alerts to other systems. Syslog alerts can be used to share information like the cluster velocity, operational SLA alerts, platform health, ingestion health and triage recipe monitoring.  This enables Cofense Triage to share alerts across the entire incident response team.

Automation is great—it’s a must in today’s world. But orchestration makes it work all the more effectively. Put the two together and your phishing defense wins. To learn more about Cofense Triage, sign up for a live 1:1 demo.


All third-party trademarks referenced by Cofense whether in logo form, name form or product form, or otherwise, remain the property of their respective holders, and use of these trademarks in no way indicates any relationship between Cofense and the holders of the trademarks.

Why a phishing-specific SOAR? Because phishing is STILL the #1 cause of breaches.

SOAR is an acronym for Security Orchestration Automation and Response.  And it’s what Cofense™ does for phishing threats and attacks. And, according to researchers at ESG, 19% of enterprises have adopted SOAR technologies extensively, while 39% have dipped their toes in the water and 26% are currently working on SOAR-related projects.1

Why is SOAR soaring? Because organizations need to connect their layers of security systems and make the most of their limited, highly skilled security resources.

Phishing Alert! Alert! Alert!

Phishing isn’t going away. To the contrary, it’s still growing because it works. In fact, enterprises receive up to 150,000 security alerts a day2, many of them phishing alerts. When security teams are drowning in alerts and suffering from alert fatigue, they may miss actual attacks. The Cofense Phishing Defense Center (PDC) sees customers deal with widely fluctuating rates of crimeware—the same organization can go from 2% of reported emails verified as malicious to 20% or higher within a matter of weeks.

Even with a rate that high, 80% of reports are duds. Which is good, of course—false alarms being better than dangerous threats—but manual verification eats up lots of time. And, most organizations lack the needed resources to sift through phishing alerts, find genuine threats, and stop attacks in progress.  In fact, many organizations use a “best effort” approach to sorting through their abuse mailbox.

Automation, Orchestration and Response

A SOAR platform is meant to connect your systems for broader coverage, but it does require configuration and skilled resources to manage it. But, if the majority of your threats are from phishing, do you need a full SOAR platform or could you augment a full-service SOAR with a phishing-specific solution?

Using a phishing SOAR lets you respond to the crush of phishing alerts with fewer skilled man hours and powers a faster, automated, and more coordinated response. Again, automation drives this advantage, along with strong integrations. You gain operational efficiency as you disrupt unfolding attacks.

Cofense TriageTM, our phishing response platform, uses its Noise Reduction feature to help automate the filtering of spam or commercial emails that get reported as threats. By eliminating the noise, you can verify at scale and much faster. Speeding up the analysis means speeding up any needed response—the task at which you want your incident responders to excel.

To be clear, Cofense believes the human factor is still a key ingredient. Which brings us to recent upgrades to Cofense Triage, namely the addition of SOAR functionality.

The Cofense Approach to Phishing SOAR Leverages Human Intelligence

The Cofense approach to phishing response begins with training users to recognize attacks and easily report suspicious emails. Remember, perimeter defenses like secure email gateways don’t catch everything—witness the resurgence of the ZeroFont exploit and the FBI’s report that business email compromise (BEC) scams are fleecing targets to the tune of $12 billion annually.

One of the upgrades to Cofense TriageTM is an improved ability to score user-reporters for accuracy. This, coupled with automated analysis, makes human intelligence more usable as you act against threats.

Cofense Triage speeds the response with greater orchestration, thanks to API integrations as well as Noise Reduction. Our platform offers out-of-the-box integration with nearly two dozen security solutions, including a fully documented REST API.

Besides automating email analysis, Cofense Triage delivers automated security playbooks and workflows. Threat actors tend to recycle proven tactics and procedures, so Cofense Triage lets you define criteria and, when it’s met, execute an automated response to mitigate risk, for example, key notifications, new help-desk tickets, or proxy-block requests.

Cofense VisionTM, a new addition to our phishing response arsenal, helps find phishing threats wherever they may be lurking. Vision stores, indexes, and enriches emails for faster querying and quarantining before any damage is done. You can quickly pinpoint a suspicious email throughout your organization, by querying based on sender, subject, date, attachment name, attachment hash, and more.

And once you find offending emails, you can dig deeper and root out the whole campaign. One click allows you to quarantine emails in Microsoft Exchange and Office365. One more click will allow you to UN-quarantine depending on your findings.

Getting More Value from Phishing SOAR

In an article on the evolution of SOAR, ESG Principal Analyst Jon Oltsik noted that companies are adding to core SOAR functionality with, among other things, integration and canned playbooks:

“Rather than simply trigger a discrete remediation action, SOC teams want to automate their standard operating procedures (SOPs) to the fullest extent possible,” he wrote. “This means aligning automated actions with runbooks in an easy and intuitive way.”3

Cofense is checking those boxes as we evolve Cofense Triage and introduce Cofense Vision. With the SOAR marketplace evolving, it’s the kind of innovation that transforms the acronym into value.

To learn more about Cofense phishing SOAR capabilities, sign up for a 1:1 live demo.



1., May 2018. 

2., February 2018. 

3., May 2018. 


All third-party trademarks referenced by Cofense whether in logo form, name form or product form, or otherwise, remain the property of their respective holders, and use of these trademarks in no way indicates any relationship between Cofense and the holders of the trademarks.