Floor purple 1 FINAL

Abnormal Stops the Most Sophisticated Lateral Phishing Email Attacks

See how the Abnormal platform has improved the effectiveness of lateral attack detection and how it stops the most advanced attacks.

One of Abnormal’s primary goals is to provide the maximum level of precision detection in order to prevent never-seen-before threats. This includes text-only payloadless attacks like social engineering attempts and account takeovers. Abnormal accomplishes this without requiring clients to manage and maintain a plethora of rules, unlike traditional secure email gateways (SEGs).

Announcing Increased Lateral Email Attack Detection Efficacy

We are constantly improving our differentiated technology and superior efficacy when it comes to stopping email attacks. As a result, we have created and trained a new machine learning model that quickly eliminates identified false negatives, particularly for payloadless attacks like advanced socially-engineered emails to extract personally identifiable information (PII) of the victim.

The Abnormal detection engineering team has been busy at work, further enhancing our detection precision by decreasing our false-negative rate for lateral email attacks by a staggering 27.2%.

Lateral Attack Scenario

You might be wondering: what exactly is a lateral attack? Well, it’s defined as attacks sent from a compromised user to another internal employee with malicious intent. Lateral attacks are exceptionally challenging for traditional SEGs to detect as they usually have little to no visibility into internal email traffic.

A lateral attack consists of two components. The lure is the first and most crucial component, as the attacker must persuade the victim to take some action. This is accomplished by impersonating someone that the user will most likely trust.

The exploit is the second component. The victim is enticed to perform an action, such as opening an attachment with a malicious payload or visiting a URL that tricks the user into providing their valid network credentials.

Abnormal detecting a lateral phishing attack from a compromised internal email account

Image: Compromised internal account attempting to perform a lateral phishing attack.

In this example, Abnormal’s explainable from within the admin console explains why we detected and blocked this attack.

Once the attacker gains access to a corporate network, they will use various tools and techniques that elevate their privileges to achieve their objectives. For example, some will exfiltrate sensitive information to either sell to the highest bidder or put up for ransom. In other cases, the bad actor will deploy ransomware across the environment and demand a payment to access your information and bring your critical business systems back online.

Abnormal’s Innovative Solution to Stopping Lateral Attacks

Abnormal engineering determined that a heuristics rules-based approach is not overly effective at detecting lateral email attacks, given there are too many permutations. Instead, the engineering team took the following approach:

  1. The engineering team did a deep dive into lateral attacks that identified clear attack trends within the data and retrained the detectors while directly addressing the attacker’s strategy. One notable example is students at educational institutions being targeted with fake job offers, enticing them to provide personally identifiable information or account credentials.

  2. The analysis also surfaced sender-based behaviors like deviations in normal communication frequency and content that are strong signals of lateral phishing behavior. We have built a new feature-engineering platform that enables us to craft these new signals to adapt to bad actors' ever-changing tactics.

  3. Retraining our detectors with the new signals to more effectively identify anomalous behavior in internal email communications has led to detection gains in lateral phishing and other aspects of the product, such as vendor fraud detection.

The net result is that the detection improvements effectively address the lateral attack strategies we have previously seen, and can accurately and automatically identify novel lateral phishing attacks that evade traditional email solutions. This allows us to provide our customers with the most effective email protection.

Abnormal is devoted to rapidly innovating to improve our detection capabilities, built-in automation, and processes to assist security teams in staying one step ahead of attackers. Updates to our revised algorithm prioritize key advancements, particularly those connected to detection enhancements, and provide a better overall experience for our consumers. At Abnormal, we stop the attacks that matter the most.

Want to learn more about how our advanced algorithms stop advanced attacks? Request a demo today.


Prevent the Attacks That Matter Most

Get the Latest Email Security Insights

Subscribe to our newsletter to receive updates on the latest attacks and new trends in the email threat landscape.

Demo 2x 1

See the Abnormal Solution to the Email Security Problem

Protect your organization from the attacks that matter most with Abnormal Integrated Cloud Email Security.

Related Posts

B 05 11 22 Scaling Out Redis
As we’ve scaled our customer base, the size of our datasets has also grown. With our rapid expansion, we were on track to hit the data storage limit of our Redis server in two months, so we needed to figure out a way to scale beyond this—and fast!
Read More
B 05 17 22 Impersonation Attack
See how threat actors used a single mailbox compromise and spoofed domains to subtly impersonate individuals and businesses to coerce victims to pay fraudulent vendor invoices.
Read More
B 05 14 22 Best Workplace
We are over the moon to announce Abnormal has been named one of Inc. Magazine's Best Workplaces of 2022! Learn more about our commitment to our workforce.
Read More
B 05 13 22 Spring Product Release
This quarter, the team at Abnormal launched new features to improve lateral attack detection, role-based access control (RBAC), and explainable AI. Take a deep dive into all of the latest product enhancements.
Read More
B 05 11 22 Champion Finalist
Abnormal has been selected as a Security Customer Champion finalist in the Microsoft Security Excellence Awards! Here’s a look at why.
Read More
Blog series c cover
When we raised our Series B funding 18 months ago, I promised our customers greater value, more capabilities, and better customer support. We’ve delivered on each of those promises and as we receive an even larger investment, I’m excited about how we can continue to further deliver on each of them.
Read More
B 05 09 22 Partner Community
It’s an honor to be named one of CRN’s 2022 Women of the Channel. Here’s why I appreciate the award and what I love about being a Channel Account Manager at Abnormal.
Read More
B 05 05 22 Fast Facts
Watch this short video to learn current trends and key issues in cloud email security, including how to protect your organization against modern threats.
Read More
B 05 03 22
Like all threats in the cyber threat landscape, ransomware will continue to evolve over time. This post builds on our prior research and looks at the changes we observed in the ransomware threat landscape in the first quarter of 2022.
Read More
B 04 28 22 8 Key Differences
At Abnormal, we pride ourselves on our excellent machine learning engineering team. Here are some patterns we use to distinguish between effective and ineffective ML engineers.
Read More
B 04 26 22 Webinar Re Replacing Your SEG
Learn how Microsoft 365 and Abnormal work together to provide comprehensive defense-in-depth protection in part two of our webinar recap.
Read More
Blog mitigate threats cover
Learn about the most common socially-engineered attacks and why these tactics are still so successful—despite a growing awareness from employees.
Read More