Phishing is the most common form of cyberattack in the world. Approximately 74% of organizations within the United States will experience a successful phishing attack at some point.
Spear phishing, on the other hand, is a more targeted form of a phishing attack and is far more sinister. Targeted phishing can put your organization at risk. In this guide, we explore what spear phishing attacks are and how to defend against them.
A spear phishing attack is executed by sending emails to well-researched targets to secure money or information, or to successfully install malware on the target’s computer.
These highly effective scams are carried out by sophisticated attackers and can be incredibly difficult to stop.
Phishing campaigns seek out low-level targets in large numbers. They can be easily created by someone with little to no technical experience and are generic in nature.
On the other hand, spear phishing is purpose-built to attack a specific individual or entity. They are highly detailed and require large amounts of research to successfully impersonate a known individual and win the target’s trust.
In short, the difference is that spear phishing is designed for a specific target, whereas conventional phishing campaigns look to cast a wide net.
To make matters worse, attacks exist on an even higher level called whale phishing. These targeted phishing campaigns typically target high-level executives through impersonation. Because these executives have access to financial information, sensitive data, and other high-level items, they are considered a big fish—or a whale.
Using a high-level executive’s superior rank, attackers use whale phishing to coerce lower-level employees into sharing sensitive information or sending funds to the attacker’s account.
A spear-phishing attack has many of the same goals as a conventional phishing campaign as attackers look to extract information or money from the target. That said, global security experts are increasingly finding that attackers are looking to compromise API and session tokens.
Primarily, most spear phishing examples arise through in-depth reconnaissance of the chosen target. At its core, spear phishing (sometimes misspelled spear phising) is little more than a targeted phishing attack in that it still occurs through email spoofing.
Spoofing is possible because of the Simple Mail Transfer Protocol (SMTP), which is unable to authenticate email addresses in its base form. This fundamental flaw enables attackers to impersonate high-value targets to achieve their goals.
Within a spear-phishing email, the target is always well-chosen, with the attacker focusing specifically on that one person or organization. There is also a huge reconnaissance element to a successful attack. Attackers will typically harvest information through dark web data breaches, social media platforms, and company websites, among others.
Once the attacker believes they have enough information on the target, they will launch their attack via conventional email spoofing, though texting and voice calls have also been used. Like a conventional phishing campaign, the email may use easily overlooked variations of a genuine address.
For example, an attacker may switch out an “o” for a “0” or incorporate Cyrillic lettering into their spoof emails.
Attackers use a combination of digital platforms and social engineering to achieve a successful attack. However, the scary fact is that spear phishing requires nothing more than a basic email account.
The dark web increasingly sells out-of-the-box phishing kits to automate much of the process. Criminal services may even offer to carry out research through social media scraping on the attacker’s behalf.
Once the attacker has taken the time to research the chosen target, only two basic tools are required to execute the attack:
The lack of necessary tools needed to carry out a targeted phishing campaign is why 91% of cyberattacks begin with a simple email message. Business leaders must familiarize themselves with how to recognize and protect themselves against these damaging spear-phishing attacks.
Traditional shotgun phishing campaigns are relatively easy to spot because of the lack of personalization. A spear phishing email, on the other hand, will always look different.
However, several commonalities give attackers away, including:
Some of the spear phishing examples every organization should be aware of include:
A 2015 Intel study revealed that 97% of employees could not identify phishing emails of any kind. It’s thus no surprise that these scams cost organizations billions each year.
From Marriott losing 5.2 million records to phishing and Ubiquiti Networks, Inc. unwittingly handing over $40 million to attackers, the costs of a successful spear phishing attack are enormous.
The consequences of these campaigns include:
And this is list is not exhaustive—the impacts of falling victim to spear-phishing attack are wide-ranging and could take years to recover from. One Verizon study revealed that public companies that experience these attacks suffer an average 5% decline in their stock price six months after the fact.
Regardless of the organization’s size, employees at every level must be aware of phishing and how to prevent it. Attackers may target many levels of an organization rather than simply the big decision-makers.
Spotting spear-phishing attempts is becoming increasingly complex, but if you know what to look for, they can be relatively simple to find. If you’re ever in doubt, helpful questions to ask yourself include:
Most vigilant employees can spot spoofing attempts from a mile away. However, all it takes is a simple lapse in judgment or concentration to unwittingly give up sensitive information to a cybercriminal.
Spear phishing may be relatively simple to carry out, but these attacks cost businesses billions worldwide every year, not to mention the general disruption and distrust they cause.
Organizations worldwide are protecting their employees against phishing attacks with Abnormal Security. Investing in our state-of-the-art email security platform can bolster your defenses and decrease your chances of becoming a statistic.
Abnormal is the email security company that stands for trust.
© 2021 Abnormal Security Corporation.
All rights reserved.