chat
expand_more

Attackers Exploit Proofpoint to Target Customers with Brand Impersonation Attacks

Learn about the recent EchoSpoofing attack that exploited Proofpoint's relay servers and how Abnormal's AI-driven approach provides superior protection against brand impersonation and advanced phishing attacks.
July 31, 2024

580,000+ EchoSpoof Attacks Blocked for Abnormal Customers

Proofpoint’s architecture introduced a flaw that enabled an attack known as “EchoSpoofing”. When emails are relayed through Proofpoint (impacting all of their customers), email authentication checks (SPF, DKIM, and DMARC) are passed and the end user inherently trusts the emails delivered to their inbox. Let's look at an example attack that bypassed Proofpoint and was stopped by Abnormal.

Disney Spoof

How did it get by Proofpoint?

  • SEGs like Proofpoint rely upon mail relays, a misconfiguration passed all required email authentication (SPF, DKIM, and DMARC).

  • The email leveraged a known brand with a sense of urgency to engage in social engineering to prompt the user to take action and click on the link.

  • Proofpoint heavily relies upon outdated methods (e.g., authentication and IOCs) to stop attacks.

What is Proofpoint’s recommendation?

  • Proofpoint advises its customers to conduct “health checks” at least quarterly to ensure appropriate configuration.

  • Dedicate additional employees to actively manage and tune their configuration on a regular basis.

  • Rely upon their TRAP product to perform post-remediation on all of the attacks they miss.

The better way to solve the problem?

  • Use a modern API architecture as provided by Abnormal that avoids these types of problems (and avoids being a point of failure in delivering email).

  • Abnormal’s AI uses thousands of signals to understand behavioral context, identifying brands like Disney through NLP and computer vision for deeper analysis.

  • Abnormal's AI goes beyond traditional indicators to keep pace with ever-shifting attack techniques (keep pace with the attackers while letting legitimate emails through)

Future-Proof Your Email Security

Don’t take our word for it. Because of our modern approach, it’s easy to see the actual attacks that are getting past Proofpoint with a 30-second integration to your cloud email provider.

Interested in learning more about Abnormal’s AI-powered solution? Schedule a demo today!

Schedule a Demo
Attackers Exploit Proofpoint to Target Customers with Brand Impersonation Attacks

See Abnormal in Action

Get a Demo

Get the Latest Email Security Insights

Subscribe to our newsletter to receive updates on the latest attacks and new trends in the email threat landscape.

Get AI Protection for Your Human Interactions

Protect your organization from socially-engineered email attacks that target human behavior.
Request a Demo
Request a Demo

Related Posts

B SOC Prod
Learn how AI-driven automation boosts SOC productivity by reducing false positives, addressing skills gaps, and enhancing threat detection. Discover strategies to future-proof your SOC and strengthen cybersecurity defenses.
Read More
B Proofpoint Customer Story F500 Insurance Provider
A Fortune 500 insurance provider blocked 6,454 missed attacks and saved 341 SOC hours per month by adding Abnormal to address gaps left by Proofpoint.
Read More
B Malicious AI Platforms Blog
What happened to WormGPT? Discover how AI tools like WormGPT changed cybercrime, why they vanished, and what cybercriminals are using now.
Read More
B MKT748 Open Graph Images for Cyber Savvy 7
Explore insights from Brian Markham, CISO at EAB, as he discusses cybersecurity challenges, building trust in education, adapting to AI threats, and his goals for the future. Learn how he and his team are working to make education smarter while prioritizing data security.
Read More
B Manufacturing Industry Attack Trends Blog
New data shows a surge in advanced email attacks on manufacturing organizations. Explore our research on this alarming trend.
Read More
B Dropbox Open Enrollment Attack Blog
Discover how Dropbox was exploited in a sophisticated phishing attack that leveraged AiTM tactics to steal credentials during the open enrollment period.
Read More