Kaspersky experts identified a trend in targeted business attacks using highly realistic phishing emails. Attackers leverage specific industry contexts, real job titles, and corporate communication styles to deceive employees. These emails often contain password-protected archives with malicious files disguised as legitimate documents.
Common attack scenarios include urgent requests for project document approval, fake notifications regarding new cybersecurity requirements, and announcements of upcoming visits by foreign delegations. Opening these attachments can grant attackers remote access to devices, compromise credentials, or allow them to monitor user activity.
To mitigate these risks, Kaspersky recommends that companies implement security awareness training and enforce the use of unique, complex passwords managed by specialized software. Organizations should also establish formal incident response plans and keep all software updated to patch potential vulnerabilities.
The security firm advises deploying automated solutions to filter suspicious emails and using verified endpoint protection products. Employees are encouraged to verify unexpected requests through known communication channels, such as calling the sender directly, rather than interacting with suspicious attachments.
