Spear Phishing with Malicious Advancements

The term “phishing” refers to emails generally sent by cyber criminals and identity thieves in an effort to trick people into trusting the message so they will follow the instructions included in it. Often these instructions will direct the recipients to follow a link to a website where they are asked to supply potentially damaging personal information. In other cases, the user may be directed to open an attachment that often will contain malicious software that will install onto the victim’s computer.  The most recent Verizon report study shows that over the past two years the amount of people falling victim to phishing attacks has actually increased. The fact that most people know what phishing is and are far more cautious about the emails they receive would make one think that people would be less likely to fall victim. So why does it appear to be getting worse?  The primary reason is the quality of the phishing attacks themselves.

It wasn’t that long ago that you might have received an email claiming to be from a well-known financial institution or online auction company. However, after reading just a line or two you would become suspicious.  Often there were a number of typos or broken English was used throughout the email.  Often the email would not even address you by your name and in many cases, it didn’t represent a business with which you did business. All of this added up to a quick realization that the email was a fake and you would simply delete it. Unfortunately, criminals continue to adapt and as such, have begun to shift their focus to a more targeted type of phishing attack known as spear phishing.

Like general phishing, spear phishing starts with an email sent from a malicious source pretending to be someone legitimate in the hopes of tricking the recipient. What makes spear phishing unique is that it looks like it comes from a trusted source. It often contains specific information that relates to your relationship with that source, as well as your complete name. In some cases it includes your job title, home address, or other data points in order to lend credibility to the email.

While spear phishing has been around for years, the increase in use of these types of attacks has created a more difficult landscape in which email users need to navigate. For example, by simply using the site LinkedIn, cyber criminals can obtain a large amount of information about you, your co-workers, and your management. Armed with this information, they can send emails to you and your co-workers that appear to come from other co-workers or management. The email may contain a message that reads “Hey Jim, when you have a second can you take a quick look at this document and let me know what you think?”  The message might also reference something specific about the business you are in and may be signed by one of your co-workers. This email will look no different from a legitimate email that you have probably received from someone else within the previous two weeks. Only this time, if you open the attached document, malware will automatically install on your computer. Of course you won’t have any idea that it just happened. Instead, the document will open, have some text in it, and look real.  No warning; no alarms; just another day at the office. 

It’s important to remember that with spear phishing attacks, the sender has done some level of research on you, your friends, your co-workers, or your company. It takes very little time and effort to gather enough information to make an email look just like every other legitimate message you receive daily.  In addition, not all spear phishing attacks are designed to gain access to your computer. In some cases, the senders may be looking for you to reply with additional information, give them access to third-party software, or even want to schedule a call to talk with you more about confidential business operations.  This is why it is so important to treat all received unsolicited emails with a certain level of skepticism.  Even if the email appears to come from someone you know and trust, you have to remember that it could still be a fake. 

While malicious links and attachments in emails are the most common forms of spear phishing, in some cases criminals may also send emails with meeting requests or phone numbers and instructions the recipient is to follow. For example, the email may explain that your organization has purchased new software and a technician will be contacting you to help with the installation of the product. 

To reduce your risk of falling victim to spear phishing there are a few things to keep in mind. When you receive any unsolicited email that requires you to click on a link, open an attachment, or follow instructions to work with third parties, just stop. Pay attention to the message included in the email. It is easy for a criminal to include your first and last name; so that is not enough to validate the email. Instead, look to see if the sender has included personal information regarding recent events.  For example, do they mention specific details for a recent conversation you had with them? This helps to confirm they really are who they claim to be.

In addition, there could also be mention about specific projects or upcoming deadlines that can confirm the legitimacy of the email. Often, malicious emails will contain generic sentences that attempt to look like details but really contain nothing more than public information. Don’t let these emails fool you. As always, when in doubt pick up the phone and call the sender. That extra 30 seconds can often be the difference between remaining secure and a devastating breach.