Phishing attacks on corporate mail are one of the easiest and most destructive ways to hack small and medium-sized businesses. The consequences of such incidents are critical: from direct financial losses and disruption of operating activities to leaks of client and commercial data, which can lead to fines from the regulator and lawsuits. Sergey Osipov, head of Positive Technologies mail protection, told why mail remains the company’s most vulnerable place and what small and medium-sized businesses need to do to protect themselves.
Mail remains the main door to attacks
According to a study by Positive Technologies, e-mail remains the main channel for social engineering (86%). The number of successful attacks continues to grow from year to year: the number of incidents in 2025 is 6% higher than the number for the entire 2024. At the same time, according to experts, most cyber attacks are not made public due to reputational risks.
Email is still the main vector of attacks for several reasons at once.
- First, it is a universal corporate communication channel: documents, accounts, contracts, links, archives, notifications from services and correspondence with contractors pass through email. Users are used to trusting emails as part of daily business processes.
- Second, attackers only need to compromise one account or send a letter to gain initial access to the company’s infrastructure. In this case, the action often looks absolutely legitimate: the letter can be from a real partner, be inside an existing correspondence, or come from an employee of his own company, but from a previously stolen corporate account.
Modern threats have long gone beyond the classic “virus letter.” Today, attackers use QR codes, malicious links, covert delivery of malicious code inside seemingly innocuous files, multi-step phishing scripts, and AI content generation. Because of this, traditional filtering mechanisms are no longer always able to identify threats.
The main reasons for the vulnerability of corporate posts
The first is the human factor. Even employees who regularly undergo training and trainings can be mistaken, especially if the letter looks legitimate and comes from a well-known sender.
The second is an insufficient level of technical protection. In many organizations, it is limited to basic antispam without deep analysis of attachments, links, and file behavior.
The third is the compromise of sources that were previously considered trusted. Modern attacks increasingly go through the real mail accounts of counterparties or employees, so they are much more difficult to detect.
To understand that employee mail is an “open door” for cybercriminals, a number of alarming “bells” can be distinguished:
- no separate mail gateway and multilevel filtering;
- using only basic antivirus;
- multi-factor authentication is not enabled for mail accounts;
- a rare update of the postal infrastructure;
- no tracking of forwarding settings;
- no sandbox to detect new viruses, ransomware, and other sophisticated malware;
- lack of incident analysis, even if employees regularly receive phishing emails.
In addition, a serious indicator is the lack of response practice after the delivery of the letter: if the company cannot quickly remove the malicious message from all boxes, this indicates a low level of protection maturity.
Who can fall victim to an attack and what it can lead to
The victims of the attack are increasingly representatives of small and medium-sized businesses, whose level of cyber defense may be lower than that of large corporations. This is due not only to budget shortages, but also to the lack of awareness of employees. According to the survey, in Russia 50% of small and medium-sized companies do not conduct systematic training of employees on information security issues.
If we consider the situation broadly across all business segments, then the most often stolen information from organizations included trade secrets (19%), credentials (19%) and personal data (18%). Almost half (47%) of successful attacks on organizations led to disruption of their core activities.
Attacks themselves are increasingly occurring using compromised legitimate accounts that do not arouse suspicion among recipients. According to Cisco Talos incident investigations, 75% of phishing attacks used hacked email accounts in Q2 2025. In addition, stolen logins and passwords are actively sold on shadow sites – this is done by intermediaries who specialize in hacking companies and reselling access to them.
Finding out exactly where account protection fails is not so easy: usually the problem itself lies in a combination of factors. It can be:
- no division of the company’s IT systems into isolated segments;
- lack of access/privilege control;
- the use of uniform passwords by users in different IT systems and a weak (sometimes uncontrolled) password policy in the company;
- no tracking of how a potential attacker moves within the network from one system to another;
- lack of timely detection of identity theft.
After hacking, a company’s disruption usually develops in one scenario: compromising an account – sending malicious emails within a company or to partners – stealing credentials and confidential information – securing an attacker in the infrastructure – spreading malware – encrypting systems or stopping business processes.
In practice, hacking cases can be different. For example, at one of our clients, the PT Sandbox blocked a malicious email sent on behalf of a real counterparty. During the investigation, it turned out that the partner’s mail server was compromised through the use of the ProxyShell malware, which was aimed at a vulnerability in the corporate Microsoft Exchange platform. The attackers used a trusted corporate domain and sent letters inside an existing mail line, so the letter did not arouse suspicion. Without behavioral analysis, the likelihood of a successful attack would be extremely high.
Conclusions and recommendations: how to build corporate mail protection within a business
Although the human factor remains one of the main vulnerabilities, training employees today is no longer enough. Protection must be built on the principle of “consider what was hacked” – proceed from the fact that some of the attacks will still reach the employee. Therefore, I recommend that small and medium-sized businesses take four steps.
Step 1. Implement automatic mail protection that checks letters even before an employee opens them: launches suspicious attachments and links in the sandbox (the same behavioral analysis from the example above), checks forwarding chains, evaluates the content and tone of the letter, recognizes QR codes and controls forwarding rules in case of hacking a trusted account.
Step 2. Set up your mail infrastructure correctly: set up a separate secure gateway for mail with multi-level filtering, enable multi-factor authentication for all accounts, and configure sender authentication (SPF, DKIM, DMARC) so that you cannot send emails on behalf of your domain.
Step 3. Update this infrastructure regularly. Most mail server hacks occur through long-known vulnerabilities for which there are already updates, as in the example of a partner’s server.
Step 4. Constantly train employees: Conduct anti-phishing training on real attack scenarios and give people an easy way to report a suspicious email.
It is important not only to conduct training regularly, but also to check employees periodically – how successfully they recognize suspicious letters and links. Moreover, the last thing: regulate the response after the delivery of the letter. It is not enough to block the message and delete it from all mailboxes. An investigation is needed: where the letter came from, what the attack could lead to and what other systems could be affected.