Researchers Discovered Sophisticated Methods Used in Recent Spear-Phishing Attack

Researchers from Menlo Security, a company that provides products for detecting malware in email, have found a recent spear-phishing attack at a high profile company used sophisticated methods to bypass detection.

The attack that was analyzed performed multiple checks on a potential victim’s email password and IP address to determine if it was a legitimate victim or if someone had figured out that it was spear-phishing. If it passed those checks, it went on to customize the attack based on the email of the victim.

For example, if the email address used to log in was a Gmail account, the spear-phishing page would resemble the Gmail login page. The same was true for several other email providers that the attack supported.

Unfortunately, the reason spear-phishing is successful is because traditional tools for weeding out these malicious links rely on reputation-based methodologies. This means that if the link has not been previously analyzed and determined to be a “bad” link, it won’t likely be detected. Spear-phishing attacks usually employ unique links for each victim rendering these methods inadequate.

Training is still the best defense against spear-phishing. All employees and anyone working within an organization should receive regular training on cybersecurity and specifically in how to recognize phishing and spear-phishing. These types of attacks are gaining strength all over the world and continue to work. Both the IRS and the FBI have warned about criminals’ spear-phishing to get W-2 information and for committing wire fraud; otherwise referred to as business email compromise (BEC). Well-known and large companies have been victims of this including Seagate, Ubiquiti Networks, Snapchat, and eHealth.

Recent attacks on small healthcare organizations in Wyoming prove that the size of the company doesn’t matter when it comes to these. While the number that were affected at Campbell County Health is just over 1,600 and may not seem like a lot, it is very significant to an organization that employs just that many people.

Once the personally identifiable information (PII) in this particular attack was retrieved, it was sent back to the perpetrators. After that point, it may have been sold on the black market or used to perform additional attacks.