Email is still part of our daily lives and a vital communication tool, especially for business. Unsurprisingly, it remains among cybercriminals’ favorite attack targets. You likely already know about phishing and may think it can’t affect you.
While it’s true that many ordinary phishing attempts are about as transparent as letters from your friendly Nigerian prince, spear phishing takes these malicious attacks to a new level. What is spear phishing? How does it differ from the regular kind? How can you recognize it, and what can you do about it? Read on to find out.
What Is Spear Phishing?
Phishing is a cyberattack that attempts to exploit a victim’s trust by impersonating someone in authority. These authority figures are either well-known brands, financial institutions, tech giants, or any other source that looks credible and important enough to take seriously.
The attack happens via emails that closely mimic the genuine source. These emails prompt victims to download malware or click links to spoofed sites. Such sites look like the real deal and usually require entering credentials or downloading something. Instead of logging the user into a service, they harvest the credentials. This allows cybercriminals to gain access to the compromised account.
Spear phishing is a more sophisticated version of this attack. Whereas regular phishing attempts try to reach as many targets as possible without discriminating, spear phishing is a tailored attempt to extract valuable information from specific individuals.
Who Does Spear Phishing Target?
While spear phishing often involves impersonating higher-ups in a business, they are rarely the targets. Rather, the attacks focus on individuals with access to company funds or sensitive information. Employees working in payroll and HR departments are the most common targets. They deal with valuable data, yet most don’t necessarily have the technical know-how to recognize a spear phishing attempt.
How Does a Spear Phishing Campaign Unfold?
Successful spear phishing requires a lot of preparation, attention to detail, and sometimes even resources.
It starts with reconnaissance. In this stage, the criminals identify potential targets and collect as much data as possible. They might scrape a company’s website or turn to sources like LinkedIn. Even cursory searches can identify information like names, positions, and email addresses that could be enough to pull off the attack.
Then comes the email crafting stage. Hackers use the info gained during the first step to create credible emails; even tech-savvy people will want to act on them. They’ll mention coworkers, reference past events, and do anything to make their request appear legitimate. Such emails have an urgent tone, deadline, or interesting information that makes the recipient want to follow the instructions within.
When posing as being sent from another company, spear phishing emails painstakingly mimic the original sender’s tone and layout. The sites they funnel victims to are also indistinguishable from real ones unless you pay close attention. Techniques, like address spoofing, add further legitimacy, making it look like you logged into your account from that site before.
Some spear phishing emails will contain a payload, i.e., how the sender can get illegitimate access to data or accounts. Think ransomware, keyloggers, and other malicious code.
However, the emails that appear to come from within the company ask that the recipient carry out a task instead. For example, some might tell them to transfer money to an account to supposedly cover a late payment. Others may ask for payroll details and use the information to transfer employee wages to the criminals’ accounts.
How to Prevent Spear Phishing?
Social engineering is at the heart of any phishing attempt. Criminals prey on our sense of professionalism, loyalty, and carelessness to achieve their goals. Raising awareness is the best method to combat this.
Poor password policies contribute much to spear phishing’s success. Instead of reusing passwords or keeping track of each one manually, investing in a password manager is a good idea. These tools create, manage, and update as many unique passwords as any employee needs for all their accounts. Combined with two-factor authentication, they make for empty spear phishing nets.
Employee training is indispensable in curbing not just spear phishing but other kinds of cyberattacks. Holding regular training sessions will expose employees to the latest threats. It will teach them how to uncover spear phishing fraud by following proper procedures and paying more attention to details like the sender’s email address.
Training will prime employees to accept other cybersecurity measures more readily. For example, keeping encrypted files on a secure cloud storage platform instead of a local computer will make them considerably harder to obtain if an attack compromises a company’s network.
Examples & Consequences
A spear-phishing attack can be devastating on multiple levels. The most infamous ones, like the attacks on Google & Facebook and the Belgian Crelan Bank, cost the victims tens of millions.
In the first instance, a Lithuanian man masterminded a scam where he created a fake copy of an electronics manufacturing company. He and his associates targeted employees that routinely handled high-value transactions through convincing emails and shell accounts.
In the second, anonymous attackers either hacked or created a credible copy of a high-ranking executive’s email. They then used that email to ask for payments to their accounts. Not suspecting fraud, the employees who got these requests complied.
Spear phishing is also the leading attack vector for data breaches. While not as prominent as the cases above, such breaches still cost companies millions annually. This doesn’t account for the loss of trust and reputation, nor further damages suffered by a company’s clients.
