More than 55 per cent of the lateral phishing attacks targeted recipients with some personal or work relationship to the hijacked email account, said the report titled "Spear Phishing: Top Threats and Trends Vol. 2".
In email account takeover, the attackers use legitimate enterprise accounts they've recently compromised to send lateral phishing emails to an array of recipients, ranging from close contacts within the company to partners at other organisations.
"Email threats, including account takeover and lateral phishing, continue to evolve, and cybercriminals continue to find new ways to execute attacks, avoid detection, and trick users," said Mike Flouton, Vice President of Email Security at Barracuda Networks.
"Staying ahead of these types of attacks requires an understanding of the latest tactics being used by cybercriminals and the critical precautions available to help defend your business," Flouton said.
Because attackers send these lateral phishing emails from legitimate accounts, they can effectively fool many existing email protection systems and unsuspecting users.
Nearly all the lateral phishing attacks occurred during the regular workweek and during the victims' regular working hours, said the study that involved nearly 100 organisations.
Lateral phishing attacks rely on two popular narratives to trick their victims into falling for the attack - messages that falsely alert the user of a problem with their email account and messages that provide a link to a fake "shared" document.
While 63 per cent of the lateral phishing incidents used generic and commonplace messages, 37 per cent tailored their content to be more enterprise-oriented or highly specific to the victim organisation, the research showed.
( With inputs from IANS )