According to the FBI, organizations are targeted by spear phishers and have lost around $5 billion to such scams. You might have come across an email or text message saying, “You’ve won iPhone 12!” Next, you will be guided to click on a link to claim the offer. This is how people are tricked into a scam such as phishing, and spear-phishing is one step ahead of this. The attackers send more personalized emails looking genuine and tricking people into revealing confidential information and sending money. But how to stay protected from such attacks, and most importantly, how to detect one? In this article, I’ll discuss spear phishing and answer these questions. So, stay tuned!
What Is Phishing?
Phishing is a cyberattack in which the attacker tries to communicate with the target, usually through emails, text messages, or telephone, pretending to be a legitimate source. It aims to steal sensitive business or individual data such as login details, credit or debit card credentials, passwords, etc. They do this by luring the target to open the malicious link, downloading an attachment sent via emails or text messages, and installing malware on their device. This way, the attacker gains access to the target’s personal data and online accounts, obtains permissions to change data, and compromises connected systems or hijacks their complete computer network. Hackers may do this for financial gains by leveraging your credit card details and personal data. They may also demand a ransom to give back the systems, networks, and data. In other cases, the hacker may trick employees into stealing business information to target a company. Things that constitute a phishing campaign are:
Legitimate and alluring messages are designed to grab the receiver’s attention, such as an email claiming, “You have won a lottery!”, “Claim your iPhone 12”, and so on.Creating a sense of urgency and telling you to act fast due to limited time to make a deal, respond to a scenario, update information, etc.Coming from an unusual sender or looking unexpected, out-of-character, or suspiciousHyperlink directing to a suspicious or misspelled link to a popular siteAttachments you don’t expect or don’t make sense
What Is Spear Phishing?
Spear phishing is a type of phishing campaign targeting specific groups or individuals in an organization by sending them highly customized emails and attachments. The perpetrators of spear-phishing represent themselves as trusted or known entities in an attempt to trick the victims into believing them and providing them with sensitive information, downloading malware, or sending money. Spear phishing can also be considered a social engineering tactic where the cybercriminal disguised as a known or trusted individual tricks the target into downloading an attachment or clicking on a malicious email or text. This leads the target to expose sensitive information or install malicious programs unknowingly on their organizational network. The goal of spear phishing is to access an individual’s account, impersonate someone like a high-ranking official, people with confidential information, military officers, security admins, and so on. Example: In 2015, Google and Facebook were believed to be losing around $100 million to a Lithuanian email scam.
Phishing vs. Spear Phishing
- Type: Phishing is a broader term, while spear phishing is a type of phishing. Both are cyberattacks targeted at specific individuals or businesses to gain confidential information through emails and messages.
- Target: Phishing scams are general where one malicious email can be sent by the attacker to thousands of people at once. They aim to cast a wider net and try to catch any victim to gain information or money. On the other hand, spear phishing is specifically targeted at a certain individual or group from an organization possessing highly sensitive information related to their business information, personal information, military information, money-related documents like credit or debit card details, and banking passwords, account credentials, etc.
- Email type: Phishing can have general information, luring people and tricking them into revealing sensitive information or sending money. In contrast, spear-phishing uses customized, well-crafted emails for a specific individual or group, which becomes hard to distinguish from a legitimate source. It may include their names, ranks, etc., in an attempt to establish more trust and make them a victim of this kind of attack.
- Example: An example of a phishing campaign can be something like this – “You’ve won an iPhone XI”. It’s not geared at a specific individual but anyone who clicks on the link provided to claim the “prize”. It also doesn’t reveal where and how you win a contest. It’s targeted at a bigger audience who can become victims. An example of a spear-phishing campaign can be a well-crafted email appearing to have come from a genuine source or someone you know by including your name or rank in an organization. However, cybercriminals use both kinds of scams – phishing and spear-phishing based on their end goal. They can employ phishing to increase their chances of success by focusing on quantity over quality. On the contrary, they can employ spear phishing to enhance their success chances within an organization but focus on quality over quantity.
Types of Spear Phishing
Spear phishing can be of different types, such as:
Clone Phishing
Close phishing is an attack where the perpetrator designs an “update” of a genuine email to trick the receiver into thinking it’s real and actually an update of the previous email. But, in this new email, the attacker inserts a malicious attachment or link, replacing the real one. This way, the receiver is scammed and made to reveal critical information.
Malicious Attachments
This type of spear phishing is common. The attacker sends a targeted attack at an individual or a group in an organization by sending an email with malicious attachments and links. The attacker will also leverage the stolen information and can demand ransomware too. If you find such an email in your inbox that looks suspicious or unexpected, don’t click or open the link or attachment. And if you still think that email is legitimate and you should open the link, just hover over it to see the complete address of that link. This will help you assess the address and confirm its integrity. A malicious link will have an address with misspellings and other irregularities that can be ignored if not paid attention to. So, check the link source before downloading an attachment or clicking on a link to be on the safer side.
Impersonation
Scammers can impersonate reputed and famous brands in emails, replicating regular email workflows that a user genuinely receives from the brands. Here also, the attackers replace the original link with a malicious one like spoofed login web pages to steal account details and other information. Banks, video streaming services, etc., are frequently impersonated.
CEO and BEC Scams
Cybercriminals may target employees in the finance or accounting departments of an organization by impersonating themselves as the CEO or other higher-ranking official. Employees ranked way lower in positions than they find it difficult or nearly impossible to say no to certain instructions from higher-ranking officials. Through Business Email Compromise (BEC) frauds and CEO email scams, attackers can use the influence of high-ranking officials to trick employees into giving out confidential data, wiring money, and so on.
How Does Spear Phishing Work?
Spear phishing attacks are specifically tailored to a target and are carefully designed based on the information collected about the target.
Choosing the Target
Attackers first choose an individual or a group from an organization to target and then keep researching about them and collecting information. Now, scammers also take specific considerations to choose a target. It is done based on the type of information an individual has access to and what data the attackers can collect about the target. They usually choose people whose data they can research easily. Spear phishing is not generally targeted at high-level officials or executives. They may instead choose someone lacking experience or knowledge as it’s easy to manipulate them. In addition, new or lower-level employees may be unaware of organizational security policies and measures; hence, they may make mistakes, leading to security compromises.
Collecting Information about the Target
The attackers then hunt the target’s publicly available data from sources like social media, including LinkedIn, Facebook, Twitter, etc., and other profiles. They may also collect information about their geographical location, social contacts, email address, etc.
Creating Harmful Emails
After accumulating the target’s details, the attacker uses them to create emails that look credible and personalized per the target’s name, rank in an organization, preferences, and more. They insert a malicious attachment or link in the email and send it to the target. Not only the emails, but spear-phishing campaigns can make their way into the target’s devices via social media and text messages. They come from an unknown individual making you a generous, attention-grabbing offer or giving a sense of urgency to complete a task immediately, such as giving out debit/credit card details, OTP, etc.
The Scam
Once the target believes the email or text message is legitimate and does what’s asked, they are scammed. They may click on the malicious link or attachment sent by the attacker to reveal sensitive information, make payments, or install malware to further compromise the systems, devices, and network. This is devastating for any individual or an organization, making them suffer in terms of money, reputation, and data. Such organizations may also be penalized for not protecting customer data. Sometimes, the attacker may also demand ransomware to give back the stolen information.
How to Detect Spear Phishing?
Although spear-phishing attacks are sophisticated, there are ways to identify them and stay alert.
Identify the Sender
Sending emails from a similar domain name as that of a famous brand is a common technique used in spear phishing. So, when you receive an email you don’t expect, check its sender. Spell the domain name carefully, and if that looks suspicious, don’t engage with it.
Evaluate the Subject Line
A spear-phishing email’s subject line can give a sense of fear or urgency to prompt you to act immediately. It may contain keywords like “Urgent”, “Important”, etc. In addition, they may also try to establish trust with you by using “Fwd”, “Request”, etc., and gain attention while doing so. Furthermore, advanced spear-phishing tactics may involve long-term strategies to build a connection with you and steal information or fool you with money. So, check for such red flags in the subject line and read the whole message carefully. Don’t follow if the email looks suspicious.
Inspect the Content, Attachments, and Links
Inspect the complete email or text message content carefully, including the links and attachments that come with it. If you have given some personal information on your social accounts, it’s a chance that the attacker has harnessed it and used it in the mail. So, when you see your name and other personalized information, don’t assume it can be trusted.
Verify the Request
If you can’t spot any suspicious thing in an email after checking it for the factors mentioned above, don’t make any conclusions just yet. If you know the person sending the email and asking for certain data or money, it’s best to verify it by calling or connecting with them in real-time. Example: Suppose you receive an email telling you that your bank account has a particular issue that needs to be addressed, and for that, they need your debit card details or OTP immediately. Instead of revealing the information, call your bank branch and ask if they really need all this. The answer would be a no because this crucial information is not done over an email or call.
How to Protect Yourself from Spear Phishing?
You may not avoid security incidents altogether but employ specific strategies to be safe. Here are some spear phishing prevention methods you can follow:
Enforce Strict Security Policy
Enforcing a strict security policy throughout your organization is the first step to mitigating any kind of cybersecurity risk, including spear phishing. All the employees must be bound to the policy while sharing data, making payments, storing customer and business details, etc. You must also strengthen your password policy by telling everyone to:
Use unique, strong, and complex passwordsNever use one password for many accounts, applications, or devicesProhibit sharing of passwords with anyoneManage passwords carefully
Use MFA
Multi-factor authentication (MFA) is a security technique to reduce risks. It needs the user to produce more than one proof of identity for verification while accessing an account or application. It creates additional layers of security and reduces the likelihood of an attack. So, even if one password is compromised, there will be other layers to extend security and increase the attacker’s difficulty. It also gives you buffer time to spot abnormalities and fix them before the account is hijacked.
Creating Security Awareness
Technology is evolving and so do cyberattacks and techniques. Hence, it’s necessary to keep up with the latest risks and know how to detect and prevent them. So, train your employees and make them aware of the present scenario so they don’t commit a mistake that could convert into an attack.
Use Email Security Systems
Most spear phishing scams come via emails. Therefore, protecting your emails with the help of an email security system or software can help. It is designed to spot suspicious emails and block them or remediating threats so you can have a clear, legitimate list of emails in your inbox. You can use email security software such as Proofpoint, Mimecast, Avanan, etc.
Patches and Backups
You must patch and update all your systems, software, and applications regularly to keep them running optimally while ensuring there are no vulnerabilities to exploit them. In addition, creating data backups periodically helps you keep your data secure. So, even if an attack or natural calamity happens, your lost data won’t be truly lost. However, if you already have clicked on a malicious link or downloaded a harmful attachment, take these steps:
Don’t provide any dataChange passwords quicklyInform your IT security departmentDisconnect from the webThoroughly scan your system with antivirus software
Conclusion
Cybersecurity attacks are evolving and becoming more advanced. Spear phishing is one such attack harming individuals and businesses alike in terms of data, money, and reputation. Hence, knowledge about cybercrimes like spear phishing is important to understand and detect to protect yourself and your organization.
