Spear Phishing Threats & Trends

Spear phishing is a targeted attempt to steal sensitive information such as account credentials or financial information from a specific victim, often for criminal reasons. A highly targeted form of phishing, spear phishing involves bespoke emails being sent to well-researched victims. 

Spear phishing is an email or electronic communications scam targeted towards a specific individual, organisation or business. Although often intended to steal data for malicious purposes, cyber criminals may also intend to install malware on a targeted user's computer. 

Barracuda Network researchers worked with leading researchers at UC Berkeley and UC San Diego, to study the growing threat to business of email account crime using Spear Phishing methods.

It is all hard to spot without close inspection and difficult to stop with technical controls alone. In 2016 the Fancy Bear attack group used spear phishing tactics to target email accounts linked to Hilary Clinton’s 2016 presidential campaign. They attacked more than 1,800 Google accounts and implemented the accounts-google.com domain to threaten targeted users
And so spear phishing is achieved by acquiring personal details on the victim such as their friends, hometown, employer, locations they frequent, and what they have recently bought online. The attackers then disguise themselves as a trustworthy friend or entity to acquire sensitive information, typically through email or other online messaging. 

While regular phishing campaigns go after large numbers of relatively low-yield targets, spear phishing aims at specific targets using specially emails crafted to their intended victim. 

Often government-sponsored hackers and hacktivists are behind these attacks. Cyber criminals do the same with the intention to resell confidential data to governments and private companies. These cyber criminals employ individually designed approaches and social engineering techniques to effectively personalise messages and websites. As a result, even high-ranking targets within organisations, like top executives, can find themselves opening emails they thought were safe. That slip-up enables cybercriminals to steal the data they need in order to attack their networks.

Email account takeover attacks are a widespread and effective attack that enterprises need to defend against. 
In email account takeover, the attackers use legitimate enterprise accounts they’ve recently compromised to send lateral phishing emails to an array of recipients, ranging from close contacts within the company to partners at other organisations. 
Because attackers send these lateral phishing emails from legitimate accounts, they can effectively fool many existing email protection systems and unsuspecting users. 

In email account takeover, the attackers use legitimate enterprise accounts they’ve recently compromised to send lateral phishing emails to an array of recipients, ranging from close contacts within the company to partners at other organisations. 

Email account takeover and lateral phishing present a growing threat to enterprise organisations. 1 in 7 organisations experienced lateral phishing attacks within a seven-month timespan, based on a random sample of enterprise organisations. 
Of the organisations who suffered from this attack, over 60 percent experienced multiple incidents. Because email account take-over takes advantage of compromised, but nonetheless legitimate, enterprise accounts, these attacks are effective and particularly insidious. 

Over 11 percent of attacks successfully compromised additional employee accounts and over 42 percent of the lateral phishing incidents do not appear to have been reported by a recipient to the organisation’s IT or security team. 

Lateral phishing attacks rely on two popular narratives to trick their victims into falling for the attack: “account error” and “shared document” lures. While 63 percent of the lateral phishing incidents used generic and commonplace messages, 37 percent tailored their content to be more enterprise-oriented or highly specific to the victim organisation. 
A full 98 percent of the lateral phishing incidents occurred during a weekday. 

The study also looked at whether lateral phishing emails occurred at unusual hours by comparing the times when the lateral phishing emails were sent versus the historical times when the hijacked accounts usually sent benign, work emails. from this analysis, researchers found that 82 percent of lateral phishing attacks were sent by an attacker during the compromised account’s typical working hours. 

Spear-phishing attacks targeting high-level executives are often known as whale phishing attacks, and usually involve an attacker attempting to impersonate the CEO or similarly important person within the company with the aim of using superiority to coerce the victim into making payments or sharing information. 

The most obvious warning sign is an incorrect email address or one that looks similar to one you expect but is slightly different, although email addresses can be spoofed or may not be noticeably different without close inspection.

How to Defend against Lateral Phishing 

Security Awareness Training 
Improving security awareness training and making sure users are educated about this new class of attacks will help make lateral phishing less successful. Organisations can put both technical and human controls into place to mitigate the threat of spear phishing. Along with standard controls such as spam filters, malware detection and antivirus, companies should consider phishing simulation tests, user education, and having an established process for users to report suspicious emails to the IT security team. 

Advanced Detection Techniques 
Organisations should invest in advanced detection techniques and services
that use artificial intelligence and machine learning to automatically identify phishing emails without relying on users to identify them on their own. 

Two-factor Authentication 
Traditional security often doesn't stop these attacks because they are so cleverly customised. As a result, they're becoming more difficult to detect. One employee mistake can have serious consequences for businesses, governments and even nonprofit organisations. 

With stolen data, fraudsters can reveal commercially sensitive information, manipulate stock prices or commit various acts of espionage. In addition, spear phishing attacks can deploy malware to hijack computers, organising them into enormous networks called botnets that can be used for denial of service attacks.

To fight spear phishing scams, employees need to be aware of the threats, such as the possibility of bogus emails landing in their inbox. Besides education, technology that focuses on email security is necessary.

One of the most important things that organisations can do to help mitigate the risk of lateral phishing is to use strong two-factor authentication, such as a two-factor authentication app, or a hardware-based token. 

Baracuda:       Kaspersky:      BitPipe:       CSO Online:     Guardian

You Might Also Read:

Dealing With Malicious Emails:

Phishing Scams: UK Tax Service Issues A Warning:

 

 

 

« Cyber Attacks Up 500% In A Month
Marriott Hotels - Millions Hacked Again »

ManageEngine
CyberSecurity Jobsite
Check Point

Directory of Suppliers

Directory of Cyber Security Suppliers

Directory of Cyber Security Suppliers

Our Supplier Directory lists 8,000+ specialist cyber security service providers in 128 countries worldwide. IS YOUR ORGANISATION LISTED?

ManageEngine

ManageEngine

As the IT management division of Zoho Corporation, ManageEngine prioritizes flexible solutions that work for all businesses, regardless of size or budget.

DigitalStakeout

DigitalStakeout

DigitalStakeout enables cyber security professionals to reduce cyber risk to their organization with proactive security solutions, providing immediate improvement in security posture and ROI.

Authentic8

Authentic8

Authentic8 transforms how organizations secure and control the use of the web with Silo, its patented cloud browser.

Syxsense

Syxsense

Syxsense brings together endpoint management and security for greater efficiency and collaboration between IT management and security teams.

Tufin

Tufin

Tufin enables organizations to automate their security policy visibility, risk management, provisioning and compliance across their multi-vendor, hybrid environment.

Maryville Online - Cybersecurity Program

Maryville Online - Cybersecurity Program

The Cybersecurity Program at Maryville Online is designed to help students reach opportunities in cybersecurity leadership and management through an entirely online curriculum.

IGX Global

IGX Global

IGX Global is a provider of information network and security integration services and products.

NXO France

NXO France

NXO is an independent leader in the integration and management of digital workflows with services covering digital infrastructures, communications & collaboration, and security.

Plurilock Security Solutions

Plurilock Security Solutions

Plurilock is a real-time cybersecurity solution that uses artificial intelligence to identify, prevent, and eliminate insider threats.

Secuvant

Secuvant

Secuvant is an independent IT Security firm providing enterprise-grade IT security services to mid-market organizations.

Control System Cyber Security Association International (CS2AI)

Control System Cyber Security Association International (CS2AI)

CS2AI is the premier global not for profit workforce development organization supporting professionals of all levels charged with securing control systems.

Kocho

Kocho

Kocho (formerly TiG) is a provider of identity and access, cyber security, cloud transformation, and managed IT services.

Drata

Drata

Drata is a security and compliance automation platform that continuously monitors and collects evidence of a company's security controls, while streamlining workflows to ensure audit-readiness.

Hybrid Identity Protection Conference (HIP)

Hybrid Identity Protection Conference (HIP)

Hybrid Identity Protection (HIP) is the premier educational forum for identity-centric cybersecurity practitioners charged with defending hybrid cloud environments.

Bright Data

Bright Data

Bright Data Inc is the world’s #1 web data platform, enabling organizations to research, monitor, analyze data, and make better decisions.

Conosco

Conosco

Conosco are industry-leading experts throughout the UK in strategic consulting, project delivery, business communications, support, and security.

Virtual Infosec Africa (VIA)

Virtual Infosec Africa (VIA)

Virtual InfoSec Africa (VIA) is a wholly-owned Ghanaian company specializing in information security and cybersecurity solutions and services.

dWallet Labs

dWallet Labs

dWallet Labs is a cybersecurity company specializing in blockchain technology. We believe that the future of Web3 relies on cutting edge cryptography and unabated security.

Prembly

Prembly

Prembly are a compliance and security infrastructure company.

Royal Impact Certification Limited (RICL)

Royal Impact Certification Limited (RICL)

Royal Impact Certification Limited (RICL), headquartered in New Delhi, is a leading ISO certification and consultancy body in India.