Due to the sensitive nature of the work performed, a Non-Disclosure Agreement (NDA) was signed with the client, preventing the disclosure of their name, location, and specific infrastructure details. This case study highlights the key cybersecurity challenges faced and the solutions implemented while maintaining client confidentiality.
7%-8% of phishing emails still land in the inboxes of employees after deploying state-of-the-art email security solutions. Advanced Persistent Threats (APTs), as the name suggests, are persistent in hacking organizations. They use multiple methods to obtain information.
Only one email triggering the right nerve is enough for the entire organization to fall. This is exactly what happened to one of our clients in the government sector. The attacker repeatedly targeted a fixed set of employees using various methodologies. Six employees fell for a phishing email, leading to the exposure of the entire database containing personal identifiable information (PII) of the organization's employees.
At P.I.V.O.T, we believe in customizing services and solutions for our clients. This case study involves a government organization (in the power sector) facing persistent phishing threats from APTs. Given the sensitive nature of the client's operations and the presence of sensitive data (PII), employee awareness training and phishing simulations became necessary for the 5,000+ workforce.
The government organization was persistently targeted by phishing attacks, affecting a group of mid-level employees. Initially, the phishing emails were unsophisticated, and no employee fell for them. However, after four months, the emails became more targeted, and employees began receiving phishing attempts every few weeks.
Although the organization had a basic email security system and spam filter in place, it wasn’t enough to detect advanced phishing emails. While employees were aware of phishing tactics, the advanced emails eventually tricked them. Over 1,800 email addresses were publicly exposed, along with the hierarchical details of each department in the organization.
Our team conducted a basic security check through our advanced offensive security platform and discovered critical email passwords available on the web. This revelation came as a surprise to the organization.
The phishing email that employees fell victim to had the following characteristics:
Employees refreshed the page several times and entered different credentials, giving attackers more data.
Our team at P.I.V.O.T was initially pleased that it required an advanced phishing email to deceive the employees of this organization, but we were also concerned about the results once we launched our sentiment-driven, smart templates using the latest attack vectors through Phish-E.
Automated phishing simulations through Phish-E and security awareness training helped the organization reduce the phishing rate from an initial 30% to 6.44% after 3 months and 4 simulations. Easy reporting structures and automated report delivery to the executives allowed for tailoring the training initiatives within the company. Employee awareness increased significantly through live simulations and real-life demonstrations of phishing campaigns.