Cyber incidents and associated financial losses have dropped in the first quarter of 2022 after a record ending to 2021, according to the Government's cybersecurity agency.
CERT NZ's Cyber Security Insights report for Q1 2022 revealed there were 2333 reports from January to March this year, down from the previous quarter but still an increase in 63 percent from the same quarter last year.
There was $3.7 million in associated direct financial loss, up 23 percent on Q1 2021, CERT NZ said.
"The previous quarter saw a spike due to the prevalent Flubot campaign which used text messages to install malicious malware on New Zealanders' devices,'' CERT NZ director Rob Pope said.
"While that has slowed, reporting numbers overall are still high."
One of the spikes this time around is associated with the rise in popularity of non-fungible tokens (NFTs) and the scams associated with them.
CERT NZ said cryptocurrency scams were increasing generally, but it was now seeing campaigns specifically targeting those buying and selling NFTs.
"This new form of investment has created a rich avenue of opportunity for scammers, who are always looking for an edge," Pope said.
NFTs appeal to attackers as they are still mostly unregulated, and payments are difficult to reverse or retrieve, CERT NZ said.
They were also heavily hyped, and people with a fear of missing out could make bad decisions.
The largest category was phishing and credential harvesting, making up 59 percent of all reports. On average CERT NZ receives 73 percent more reports about this category than any other, it said.
"Phishing is an incident type that has been around for decades but has evolved over that time. Attackers change their tactics to reflect current events and use social engineering triggers, like urgency, fear and opportunity," Pope said.
"Phishing is a major concern as it's simple to do, from a technical perspective, and it's a gateway to other kinds of incidents."
Attackers use phishing to steal people's personal credentials that they can use to gain unauthorised access to accounts and systems, Pope said.
They also leverage these attacks to find out who is likely to respond and use that information to run different scams. That's why Kiwis should report these activities, Pope said.
"Reporting phishing attempts to CERT NZ helps all New Zealanders because the sooner we learn of them, the sooner we can work with providers to take down phoney websites and stop others from potentially falling victim to a scam," he concluded.
