Small businesses continue to face security threats due to the increase in Trojan attacks

Small and medium-sized enterprises (SMEs) are increasingly affected by cyberattacks, with Microsoft Excel being the number one attack channel, according to a new study.

Kaspersky analysis shows that the number of infections among small and medium-sized businesses (SMEs) increased by 5% in the first quarter of this year compared to the same period last year.

More than 2,400 companies encountered malware and unwanted software hiding in or imitating software products. 4,110 unique files were distributed under the guise of SMB-related software.

This, according to the company, represents an increase of 8% compared to the previous year and means that activity will continue to increase.

“Small and medium-sized businesses (SMEs) may be under the illusion that they are not targets, but they are part of a vast ecosystem of connected assets, and cybercriminals will exploit any vulnerability,” said Vasily Kolesnikov, a cybersecurity expert at Kaspersky.

The most common type of attack remains Trojans. These are particularly dangerous because, unlike viruses, they cannot reproduce themselves and usually imitate legitimate software, which allows them to bypass conventional security measures, according to Kaspersky.

The number of Trojan attacks between January and April this year reached 100,465 – a 7% increase over the same period in 2023.

The next biggest threat came from the DangerousObjects malware. 17,320 attacks were recorded – almost seven thousand more than in 2023 and the fastest growing threat year-on-year.

Microsoft Excel is once again the number one attack channel, climbing from fourth to first place between 2023 and 2024. Microsoft Word is in second place, while Microsoft PowerPoint and Salesforce are the third most attacked applications.

Kolesnikov said threat actors are increasing their attempts to exploit Excel for cyberattacks because the software is widely used, especially among small businesses.

“The ubiquitous use of Microsoft Excel in office environments provides fertile ground for cybercriminals who can hide and manipulate malicious data in large data sets that are then widely distributed throughout the organization,” comments Kolesnikov.

However, human error still poses a major threat, as phishing attacks are spread through various channels, including fake emails and social media.

In recent years, Kaspersky has observed a trend towards the proliferation of websites that imitate the most commonly used Microsoft services, such as Microsoft 365, Outlook and OneDrive.

This technique exploits the tendency of companies to use a single software package for all business purposes, making users more dependent on specific applications and services and therefore more vulnerable to this attack vector.

Meanwhile, attackers are using legitimate Facebook infrastructure to break into corporate social media accounts. Kaspersky has uncovered numerous cases of attackers imitating real social media login pages.

The company said it had discovered several cases of SMB-targeted spam.

“It is critical for all small and medium-sized businesses to establish clear policies for access to all corporate resources and ensure that employees are regularly reminded of the importance of following basic cybersecurity rules,” said Kolesnikov.

Related Posts

Dell is investigating portal security incident and says there is no “significant risk” to customers

1 dead after accident Thursday morning in Ascension Parish

Forest fire near Sofiko in the Corinth region injures firefighters and triggers evacuation alarm