IT Pro is supported by its audience. When you purchase through links on our site, we may earn an affiliate commission. Learn more

HTTPS-based attacks soar over 300%

Tech companies hit hardest by attacks using encrypted protocol

Https attacks on the increase

Attacks using the encrypted HTTPS protocol rose threefold over the last year as online criminals get more sophisticated, said security company ZScaler in a report released today. 

The State of Encrypted Attacks 2021 report found that as the adoption of HTTPS increases, attackers are using it to cloak their activities and blend in with other traffic. 

HTTPS is the encrypted version of the Hypertext Transfer Protocol (HTTP), which is the transfer protocol for web sessions. Browsers use it to communicate with websites, protecting traffic from local snoopers. The major browsers now warn users when they are visiting non-HTTPS sites. 

Technology companies got the brunt of it, suffering from a 2,344% rise in HTTPS attacks. Retail and wholesale companies saw an 841% increase. 

The report noted a drop in HTTPS-based attacks against healthcare companies and government organizations, which it attributed to increased scrutiny by law enforcement. 

The types of attacks launched over HTTPS are also changing rapidly. Cryptomining and cross-site scripting attacks are dropping off just as other types of attacks rise dramatically. 

Malware (including ransomware) grew by 212% and was the most prevalent type of attack. Nine in ten attacks via HTTP involved malware. It was followed by ad spyware, which grew the most, at 435%, followed by browser exploits. 

Related Resource

Prevent fraud and phishing attacks with DMARC

How to use domain-based message authentication, reporting, and conformance for email security

Prevent fraud and phishing attacks with DMARC - whitepaper from MimecastFree download

Phishing, a common infection route for ransomware attacks, grew by 90%, driven by attacks launched through legitimate services. Microsoft 365 was by far the most common attack vector for phishers, as criminals can host credible-looking credential-harvesting sites and malicious files on this service. 

Attackers also use HTTPS to target web applications with attacks including credential stuffing, where they try to log into applications using a collection of stolen logins. Attackers interacted with almost 70% of HTTPS-based web-facing applications, the report warned. 

Zscaler said that companies should inspect their HTTPS packets to analyze their activities and gain visibility into attacks.

Featured Resources

2023 Strategic roadmap for data security platform convergence

Capitalise on your data and share it securely using consolidated platforms

Free Download

The 3D trends report

Presenting one of the most exciting frontiers in visual culture

Free Download

The Total Economic Impact™ of IBM Cloud Pak® for Watson AIOps with Instana

Cost savings and business benefits

Free Download

Leverage automated APM to accelerate CI/CD and boost application performance

Constant change to meet fast-evolving application functionality

Free Download

Recommended

How to trust your inbox with Cloudflare Area 1
Whitepaper

How to trust your inbox with Cloudflare Area 1

19 Oct 2022
Best antivirus for Windows 10
antivirus

Best antivirus for Windows 10

13 Oct 2022

Most Popular

Warning issued over ransomware attacks targeting VMware ESXi servers globally
cyber attacks

Warning issued over ransomware attacks targeting VMware ESXi servers globally

6 Feb 2023
ION Trading reportedly pays LockBit ransom demands
ransomware

ION Trading reportedly pays LockBit ransom demands

6 Feb 2023
Tips for Boosting your Organisation’s Security Posture with Encryption
Sponsored

Tips for Boosting your Organisation’s Security Posture with Encryption

6 Feb 2023