Phishing attacks have become an unfortunately common occurrence. A relatively new wrinkle is called spear phishing where the phishing email targets a specific individual, business, or organization. Spear phishing is used for two main purposes:
- Steal data for malicious purposes
- Install malware on the target’s computer for use in against another organization
Regardless of intention, if executed properly, a spear phishing ploy is bad news for your company.
How Are Spear Phishing Attacks Performed?
Here’s a general rundown of how spear phishing scams work:
- An email arrives in a colleague’s inbox, seemingly from a trustworthy source like a supplier, vendor or even your own corporate website. Spear phishing emails often use clever tactics like matching logos, verbiage and even similar looking URLs to those you would find normal to get the victim’s attention.)
- The message leads the unsuspecting recipient to a well-designed bogus website either with a login portal or with a hidden cache of malware that they attempt to download and install.
- Hackers will then sell the login credentials or malware networks to governments, private entities or other hackers for further exploitation.
Cybercriminals use tailored approaches that leverage social engineering techniques to encourage victims to act before they think to personalize messages and websites used in their scams. According to a March report on spear phishing from cybersecurity firm Barracuda Networks, these attacks are frequently researched in advance and intended to capture data, such as login credentials or other highly sensitive information. Analyzing 360,000 emails that involved spear phishing over a three-month period, the company’s researchers found that 83% of these attacks involve brand impersonation of companies users know and trust.1
Moreover, to increase success rates, spear phishing messages often contain urgent explanations on why sensitive information is needed. The combination of realistic branding and urgent need to act pushes users to act before they think. This kind of social manipulation is “becoming the key ‘attack vector’ in cybersecurity attacks.”2 Victims are usually asked to open a malicious attachment or click on a link that takes them to a spoofed website where active passwords, account numbers, PINs, or access codes are requested.
How to Fight Spear Phishing
Since spear phishing attacks are becoming more difficult to detect, protecting your business email is even more important. Traditional security can stop some of these scams but not all because of the clever customization. A single mistake enables fraudsters to gain access to commercially sensitive intel, forever damaging your company’s brand. In addition, spear phishing attacks can deploy malware to hijack computers, organizing them into enormous networks (botnets) that can be used for denial of service attacks.
To fight spear phishing scams, employees need to be aware of the threats, such as the possibility of bogus messages landing in their inbox. It’s a simple answer, but informed employees are the first line of defense in combatting malicious online attacks. Besides education, technology that focuses on email security is necessary.
In addition, it is important for email senders to protect their brands from use in spear phishing attempts. Big brands like American Express, Amazon.com and PayPal were once often leveraged by fraudsters because of their wide usage, credibility and access to financial and personal information. Now, large corporations are deploying technologies to prevent use of their brands so fraudsters are forced to use smaller, less protected brands.
Protecting Your Brand – MxToolbox Delivery Center
To protect your brand from use in phishing and fraud emails, you need to deploy new technologies like SPF, DKIM, DMARC and actively manage the information your receive from inbox providers about your email delivery status. MxToolbox’s Delivery Center provides your business with the email deliverability insight you need. Our Experts combine best practices on email delivery with new technologies and our own experiences to give you best-in-class incite into the deliverability of your known email senders and early warning on emerging threats emails like spearphishing. We can even manage your email delivery with our Managed Services program.
1, 2 Gizmodo, Privacy and Security. https://gizmodo.com/spear-phishing-attacks-are-on-the-rise-security-firm-s-1833455812