The Rise of Remote Access Phishing Scams

Over the past several years, phishing scams have become increasingly common. Cybercriminals employ a range of tactics - from social engineering to advanced technologies - in order to evade security systems and gain access. One particularly dangerous scam is Remote Access Phishing Scams. Recent research states that employees get 14 phishing emails on average every year and CISCO’s cybersecurity threat trends suggest that 90% of data breaches happen due to phishing emails.

What are Remote Access Phishing Scams?

Remote Access Phishing Scams are phishing attacks in which the attacker sends an email or message posing as a trusted source, such as a vendor or a customer, and ask for remote access to the employee's computer. Once the employee grants access, the attacker steals sensitive information, installs malware, or even holds the business's data hostage for ransom.

Types of Remote Access Phishing Scams

The most common type of Remote Access Phishing Scam is the "Tech Support" scam. In this scam, the attacker poses as a technical support representative and asks the employee to grant them remote access to their computer to resolve a supposed technical issue. The hacker requests the employee to download remote access software that provides them access to the computer.

A joint advisory by the Cybersecurity and Infrastructure Security Agency (CISA) and the National Security Agency (NSA) suggests that cybercriminals actively exploit remote management software, like LogMeIn and AnyDesk, in phishing campaigns.

Another type of Remote Access Phishing Scam is the "Fake Upgrade" scam. In this scam, the attacker sends an email or message posing as a software vendor and asks the employee to upgrade their software. The employee is requested to download the "upgrade," which is likely malware that gives the attacker access to the employee's computer and sensitive information.

Remote Access Phishing Scams: Methods 

The most common methods of remote access phishing scams are:

1. RDP: Remote Desktop Protocol: Organizations frequently use Remote Desktop Protocol (RDP) to facilitate remote work. However, the entire IT infrastructure is at risk if one endpoint device lacks security. Cybercriminals use online scanning tools to identify vulnerabilities in RDP endpoints. The biggest challenge with RDP for remote work is its inability to distinguish between malicious and benign actors once they access the network, making it more straightforward for hackers to gather company information stealthily.

2. RATs: Remote Access Trojans: Hackers can access private networks through various means, including theft of credentials and malware like Remote Access Trojans (RATs). The latter involves sending infected files or links through phishing campaigns. In remote work setups, the unsuspecting victim may mistake the RAT for a required work-from-home program, leading to undetected infiltration by the hackers.

3. Automated Malicious Bots: Organizations are increasingly adopting artificial intelligence and automated bots for various purposes. However, hackers can leverage these through compromised bots. Such bots can scan websites, apps, and APIs to identify vulnerabilities to exploit.

Four Steps to Prevent Remote Access Phishing Scams 

Data breaches can result in considerable losses to an organization—financial, legal, and reputational. Organizations of any scale must stay vigilant and deploy processes to prevent remote phishing scams. Here are four steps that enterprises can take:

1. Proactive Phishing Prevention Tools: Proactive phishing prevention tools prevent phishing emails and take preemptive measures. It involves monitoring Domain Name Server (DNS) traffic and analyzing DNS data to identify, categorize, and block malicious domain names, detect infected devices, and provide actionable information for forensic investigations. 

2. Use AI to Detect Potential Phishing Attacks: Artificial Intelligence (AI) tools can help fight phishing by detecting abnormal and potentially suspicious behaviour, scanning inbound links in real time, determining if a page is fake, and blocking access to verified malicious links.

3. Email Security Awareness Program: Awareness is the key. The best defence against phishing scams is vigilant employees. A strong security awareness program can help employees detect and act when they receive phishing emails. 

4. Conduct Phishing Penetration Testing, a.k.a Simulated Phishing Attack Tests: Phishing penetration tests mimic a phishing attack scenario with emails that result in users submitting sensitive emails on a fake website. When conducted regularly, these tests can assess the robustness of a company's security infrastructure and the effectiveness of security awareness training programs.

Final Thoughts

In this current climate, remote working has become the go-to for many companies. By taking proactive measures, firms can guard themselves against Remote Access Phishing Scams and stay one step ahead of malicious cybercriminals.