Spear Phishing Threats & Trends

Spear phishing is a targeted attempt to steal sensitive information such as account credentials or financial information from a specific victim, often for criminal reasons. A highly targeted form of phishing, spear phishing involves bespoke emails being sent to well-researched victims. 

Spear phishing is an email or electronic communications scam targeted towards a specific individual, organisation or business. Although often intended to steal data for malicious purposes, cyber criminals may also intend to install malware on a targeted user's computer. 

Barracuda Network researchers worked with leading researchers at UC Berkeley and UC San Diego, to study the growing threat to business of email account crime using Spear Phishing methods.

It is all hard to spot without close inspection and difficult to stop with technical controls alone. In 2016 the Fancy Bear attack group used spear phishing tactics to target email accounts linked to Hilary Clinton’s 2016 presidential campaign. They attacked more than 1,800 Google accounts and implemented the accounts-google.com domain to threaten targeted users
And so spear phishing is achieved by acquiring personal details on the victim such as their friends, hometown, employer, locations they frequent, and what they have recently bought online. The attackers then disguise themselves as a trustworthy friend or entity to acquire sensitive information, typically through email or other online messaging. 

While regular phishing campaigns go after large numbers of relatively low-yield targets, spear phishing aims at specific targets using specially emails crafted to their intended victim. 

Often government-sponsored hackers and hacktivists are behind these attacks. Cyber criminals do the same with the intention to resell confidential data to governments and private companies. These cyber criminals employ individually designed approaches and social engineering techniques to effectively personalise messages and websites. As a result, even high-ranking targets within organisations, like top executives, can find themselves opening emails they thought were safe. That slip-up enables cybercriminals to steal the data they need in order to attack their networks.

Email account takeover attacks are a widespread and effective attack that enterprises need to defend against. 
In email account takeover, the attackers use legitimate enterprise accounts they’ve recently compromised to send lateral phishing emails to an array of recipients, ranging from close contacts within the company to partners at other organisations. 
Because attackers send these lateral phishing emails from legitimate accounts, they can effectively fool many existing email protection systems and unsuspecting users. 

In email account takeover, the attackers use legitimate enterprise accounts they’ve recently compromised to send lateral phishing emails to an array of recipients, ranging from close contacts within the company to partners at other organisations. 

Email account takeover and lateral phishing present a growing threat to enterprise organisations. 1 in 7 organisations experienced lateral phishing attacks within a seven-month timespan, based on a random sample of enterprise organisations. 
Of the organisations who suffered from this attack, over 60 percent experienced multiple incidents. Because email account take-over takes advantage of compromised, but nonetheless legitimate, enterprise accounts, these attacks are effective and particularly insidious. 

Over 11 percent of attacks successfully compromised additional employee accounts and over 42 percent of the lateral phishing incidents do not appear to have been reported by a recipient to the organisation’s IT or security team. 

Lateral phishing attacks rely on two popular narratives to trick their victims into falling for the attack: “account error” and “shared document” lures. While 63 percent of the lateral phishing incidents used generic and commonplace messages, 37 percent tailored their content to be more enterprise-oriented or highly specific to the victim organisation. 
A full 98 percent of the lateral phishing incidents occurred during a weekday. 

The study also looked at whether lateral phishing emails occurred at unusual hours by comparing the times when the lateral phishing emails were sent versus the historical times when the hijacked accounts usually sent benign, work emails. from this analysis, researchers found that 82 percent of lateral phishing attacks were sent by an attacker during the compromised account’s typical working hours. 

Spear-phishing attacks targeting high-level executives are often known as whale phishing attacks, and usually involve an attacker attempting to impersonate the CEO or similarly important person within the company with the aim of using superiority to coerce the victim into making payments or sharing information. 

The most obvious warning sign is an incorrect email address or one that looks similar to one you expect but is slightly different, although email addresses can be spoofed or may not be noticeably different without close inspection.

How to Defend against Lateral Phishing 

Security Awareness Training 
Improving security awareness training and making sure users are educated about this new class of attacks will help make lateral phishing less successful. Organisations can put both technical and human controls into place to mitigate the threat of spear phishing. Along with standard controls such as spam filters, malware detection and antivirus, companies should consider phishing simulation tests, user education, and having an established process for users to report suspicious emails to the IT security team. 

Advanced Detection Techniques 
Organisations should invest in advanced detection techniques and services
that use artificial intelligence and machine learning to automatically identify phishing emails without relying on users to identify them on their own. 

Two-factor Authentication 
Traditional security often doesn't stop these attacks because they are so cleverly customised. As a result, they're becoming more difficult to detect. One employee mistake can have serious consequences for businesses, governments and even nonprofit organisations. 

With stolen data, fraudsters can reveal commercially sensitive information, manipulate stock prices or commit various acts of espionage. In addition, spear phishing attacks can deploy malware to hijack computers, organising them into enormous networks called botnets that can be used for denial of service attacks.

To fight spear phishing scams, employees need to be aware of the threats, such as the possibility of bogus emails landing in their inbox. Besides education, technology that focuses on email security is necessary.

One of the most important things that organisations can do to help mitigate the risk of lateral phishing is to use strong two-factor authentication, such as a two-factor authentication app, or a hardware-based token. 

Baracuda:       Kaspersky:      BitPipe:       CSO Online:     Guardian

You Might Also Read:

Dealing With Malicious Emails:

Phishing Scams: UK Tax Service Issues A Warning:

 

 

 

« Cyber Attacks Up 500% In A Month
Marriott Hotels - Millions Hacked Again »

Perimeter 81

Directory of Suppliers

Jooble

Jooble

Jooble is a job search aggregator operating in 71 countries worldwide. We simplify the job search process by displaying active job ads from major job boards and career sites across the internet.

CYRIN

CYRIN

CYRIN® Cyber Range. Real Tools, Real Attacks, Real Scenarios. See why leading educational institutions and companies in the U.S. have begun to adopt the CYRIN® system.

IT Governance

IT Governance

IT Governance is a leading global provider of information security solutions. Download our free guide and find out how ISO 27001 can help protect your organisation's information.

ZenGRC

ZenGRC

ZenGRC - the first, easy-to-use, enterprise-grade information security solution for compliance and risk management - offers businesses efficient control tracking, testing, and enforcement.

WEBINAR: How to build an effective Cloud Threat Intelligence program in the AWS Cloud

WEBINAR: How to build an effective Cloud Threat Intelligence program in the AWS Cloud

Thursday, Jan 28, 2021 - Join this webinar to learn how to improve your Cloud Threat Intelligence (CTI) program by gathering critical cloud-specific event data in the AWS Cloud.

Practice Labs

Practice Labs

Practice Labs is an IT competency hub, where live-lab environments give access to real equipment for hands-on practice of essential cybersecurity skills.

MIRACL

MIRACL

MIRACL provides the world’s only single step Multi-Factor Authentication (MFA) which can replace passwords on 100% of mobiles, desktops or even Smart TVs.

BackupVault

BackupVault

BackupVault is a leading provider of completely automatic, fully encrypted online, cloud backup.

XYPRO Technology

XYPRO Technology

XYPRO is the market leader in HPE Non-Stop Security, Risk Management and Compliance.

DigitalStakeout

DigitalStakeout

A simple and cost-effective solution to monitor, investigate and analyze data from the web, social media and cyber sources to identify threats and make better security decisions.

Help Net Security

Help Net Security

Help Net Security has been a prime resource for information security news and insight since 1998.

Brite Computers

Brite Computers

Brite provides computing infrastructure, IT services, network security and data security to support critical business applications.

Signal Sciences

Signal Sciences

Signal Sciences Web Protection Platform (WPP) provides comprehensive threat protection and security visibility for web applications, microservices, and APIs on any platform.

NSIDE Attack Logic

NSIDE Attack Logic

NSIDE Attack Logic simulates real-world cyber attacks to detect vulnerabilities in corporate networks and systems.

Red Canari

Red Canari

Red Canari are specialists in penetration testing and security assessments. We think like hackers – and act like them – to disclose discreet dangers to your organization.

Quantstamp

Quantstamp

Quantstamp are experts in Smart Contract Security Audits. We provide verification that your decentralized system works as intended.

Cybersecurity Maturity Model Certification Accreditation Body (CMMC-AB)

Cybersecurity Maturity Model Certification Accreditation Body (CMMC-AB)

CMMC Accreditation Body implements the Cybersecurity Maturity Model Certification for the U.S. Department of Defense.

Offensive Security

Offensive Security

Offensive Security have defined the standard of excellence in penetration testing training.