Why Your Email Authentication Strategy Needs an Upgrade: 3 Real-World Attacks That Prove It's Time to Step Up

In the first half of 2024, a staggering 62% of phishing emails bypassed DMARC email authentication checks. As phishing and email-based attacks continue to rise—up 293% year-over-year according to Acronis—it's becoming clearer that traditional email authentication tools are no longer enough to fend off cybercriminals. Even more concerning, Microsoft’s October 2023 report revealed that a vast majority of phishing attacks now rely on social engineering tactics, primarily using fake and malicious emails.

So, what can your organization do to combat this increasing threat? While technologies like Sender Policy Framework (SPF), DomainKeys Identified Mail (DKIM), and Domain-based Message Authentication, Reporting, and Conformance (DMARC) have long been staples in email security, relying solely on them is no longer enough. In this post, we’ll examine why these tools fall short and explore strategies for strengthening your email authentication game.

---

The Core of Email Authentication: What’s in Your Security Toolbox?

SPF, DKIM, DMARC, and BIMI are the foundational tools used by organizations to secure their email communications. Here’s a quick breakdown of each:

• Sender Policy Framework (SPF): A DNS text record that lists which mail servers are authorized to send emails on behalf of your domain. This helps prevent unauthorized senders from impersonating your domain.

• DomainKeys Identified Mail (DKIM): A cryptographic method that adds a digital signature to emails, allowing recipients to verify that an email was sent by a legitimate sender and hasn’t been tampered with during transit.

• Domain-based Message Authentication, Reporting, and Conformance (DMARC): This policy framework builds on SPF and DKIM, instructing recipients on how to handle emails that fail authentication checks (e.g., quarantine or reject) and provides valuable reporting to the sender.

• Brand Indicators for Message Identification (BIMI): BIMI enhances security by allowing companies to display their verified logo alongside their email, providing recipients with a visual clue that the email is legitimate.

These tools are like digital "ID cards" for your email, helping recipients confirm that a message is authentic and not part of a phishing or spoofing attempt. However, as we'll see, these checks aren't foolproof.

---

Why Traditional Authentication Methods Are Falling Short

Despite the widespread use of SPF, DKIM, and DMARC, 89% of phishing emails successfully bypassed these checks, according to Cloudflare’s 2023 Phishing Threats report. So, how are attackers getting around these defenses? Here are three real-world examples that shed light on why traditional email security methods aren't enough:

1. The Kimsuky Spear-Phishing Campaign

The infamous Kimsuky hacking group, known for targeting organizations globally, took advantage of DMARC policies set to “none” in 2024. This setting essentially does nothing when an email fails authentication checks, allowing spoofed emails to sneak through.

This loophole was so concerning that the FBI and NSA issued joint advisories warning organizations to ensure their DMARC policies were correctly configured. Without proper protections, attackers can easily impersonate trusted domains and fool recipients into falling for phishing scams.

2. The SubdoMailing Phishing Attack

In February 2024, a cybercriminal exploited over 21,000 legitimate domains—including trusted names like PWC, McAfee, and eBay—to send up to 5 million phishing emails daily. The attacker targeted SPF records for domains that had lapsed and were available for re-registration. By acquiring these expired domains and adjusting their SPF settings, they managed to make their phishing emails appear legitimate.

This case highlights how email authentication checks can be circumvented when SPF records are misconfigured or exploited, showing that attackers are getting more resourceful.

3. SMTP Server Vulnerabilities

SMTP (Simple Mail Transfer Protocol) is the standard protocol for email communication, and it supports SPF, DKIM, and DMARC to prevent spoofing. However, vulnerabilities (CVE-2024-7208 and CVE-2024-7209) in some SMTP servers have been discovered, allowing attackers to bypass these protections and send malicious emails while impersonating trusted domains.

These vulnerabilities, which have already affected major companies like Proofpoint, demonstrate that even the most well-established email protocols aren’t immune to exploitation.

---

Strengthening Your Email Authentication Strategy

Clearly, relying solely on SPF, DKIM, and DMARC isn't enough to safeguard your organization from today's sophisticated phishing attacks. As email threats evolve, it's time to take a more proactive and multi-layered approach. Here are some actionable steps to enhance your email security:

1. Verify Your SPF, DKIM, and DMARC Records

Ensure that your email authentication records are properly configured and up-to-date. Use trusted tools like DMARCLY or MxToolbox to check your settings. If you haven’t set up these records yet, there are plenty of easy-to-use wizards and generators to help you get started.

2. Add Multi-Layered Security

Email security shouldn’t be one-dimensional. Alongside SPF, DKIM, and DMARC, implement strong firewalls and up-to-date antivirus software. Also, consider using certificate-based mutual TLS, which eliminates the need for usernames and passwords, making phishing attempts much less likely to succeed.

3. Invest in Next-Gen Threat Protection

Modern email security requires advanced tools that use real-time threat intelligence, behavioral analytics, and machine learning to detect even the most sophisticated phishing, malware, and spam attacks. By adding next-gen spam filters, you can spot emerging threats—like zero-day attacks—before they cause harm.

4. Use Secure Email Gateways (SEGs)

SEGs act as a barrier between your email infrastructure and the outside world. They scan all inbound and outbound email traffic for potential threats, blocking dangerous messages and redirecting them to spam folders, where they can be analyzed.

5. Train Employees to Recognize Phishing Attempts

No security tool can replace human vigilance. Continuously educate your staff on how to recognize phishing emails, and conduct regular phishing tests to keep them alert. The more your team knows about how phishing works, the less likely they’ll fall for these schemes.

6. Implement BIMI for Visual Authentication

Add another layer of protection by using BIMI. This allows you to display your brand’s logo next to your emails, giving recipients a quick visual cue that your messages are legitimate. Generating a BIMI record is easy, and it can provide a strong defense against spoofing and phishing.

---

Conclusion: It's Time to Step Up Your Email Security

While SPF, DKIM, and DMARC are essential components of any email authentication strategy, they are no longer sufficient to keep your organization secure. As the threat landscape evolves, so too must your defenses.

By taking a proactive approach and implementing multi-layered security, regularly auditing your email authentication settings, and training employees to recognize and respond to phishing threats, you can significantly reduce the risk of successful attacks. Don't wait for a breach to occur—upgrade your email authentication strategy today to safeguard your business, your reputation, and your customers.

New Spam Tactics and Malware Revival by Cisco Talos Concern New Security Threats

New tactics of spam now use increased sophistication to evade strong defenses in just a short time. Although most enterprises have invested lots of money into the enterprise class spam filtering tools, Cisco Talos has shown some disturbing trends on how bad actors are finding their way around the defenses.

As the detec­tion and fil­ter­ing capa­bil­i­ties of orga­ni­za­tions con­tin­ue to improve, spam is just as dan­ger­ous, more sin­is­ter, and more related with user trust as at­tackers become clev­er­er in their tric­kery and make use of legit­i­mate web infra­struc­tures to deliv­er spam­mers' undesired poten­tially harm­ful e-mails. Cisco Talos recent research sheds light on these alarming trends.

Expe­ri­en­tial Tricks of Mod­ern Spam­mers
In other words, spammers learned how to exploit this creativity as an end-run around traditional filters. Since the bad guys use legitimate Web services and email systems for their nefarious activities, the tactics taken to prevent unwanted messages add complexity by the same very systems intended for good.

This shift creates new vulnerability for the individual but also opens up an opportunity for organizations to be hit with malware, ransomware, and phishing attacks.

Using Real Infrastructure
Manipulation of web forms to backend SMTP systems is perhaps one of the busiest schemes that spammers are engaged in. The spammers have learned that any form capable of generating a response via email can be easily exploited. Those include account registrations, signups for events, and contact forms, which typically become casualties of insufficient input validation and sanitization.

The list of resources exploited brings us to the assumption that attackers somehow had automated the search for vulnerabilities in web-infrastructure, but complex attacks, in particular those with services like Google Quizzes, Calendar, and Groups, would involve a highly human-controlled activity. Such a combination of resourcefulness in terms of automation as well as manual efforts characterizes current spammers.

In addition, a host of attackers focus on so-called credential stuffing attacks on SMTP servers that use the login details captured from data breaches. This allows spammers to send spam from real accounts, meaning that most RBLs have a hard time catching their messages.

The Severe Consequences of Emerging Spamming Methods
Such changing trends pose significant challenges. Spam filters, which have been the traditional solution, are also under question. Since most of these coming through the web forms appear legitimate, spam messages tend to intermingle with true communications, and it is hard for both the automatic systems and the human eye to distinguish between harmless and malicious communications.

Furthermore, the revival of spam as a malware and ransomware delivery method brings new risks into the play of both personal and organizational cybersecurity. Many users believe that the spam filter of their firm catches everything nasty that comes through, giving them a false sense of security to open links and attachments in suspect email. Such a misconception can have severe repercussions, where a single click on a deadly hyperlink can jeopardize an entire network.

Trust and Its Risks
The psychological component of trust makes the situation even worse. The users are left helpless in case someone emails them from an address that appears known and trusted.

Antisnaf Strategies
The Cisco Talos approach to such emerging threats is holistic. Educating users about potential risks will encourage users to be more cautious when receiving unsolicited emails, even if they come from seemingly trustworthy sources.

Strong password security is also one area wherein organizations and individuals should focus. Having a different complex password for each of their online account managed through a password manager would help eliminate the threat of credential stuffing attacks.

Similarly, the administrators and developers of websites should ensure proper validation and sanitization on web forms to avoid such attacks. This would give the developers the chance to protect their very legitimate infrastructures from spammer exploits.

Reemergence of spam as a usable attack vector reminds everyone that complacency is an unsafe enemy in the realm of cybersecurity. In the never-ending growing sophistication of challenges, our defenses must continue to grow even stronger as cybercriminals do.