What Is Spear Phishing?

Spear phishing is a highly targeted form of phishing designed to deceive individuals or organisations into revealing sensitive information. Unlike regular phishing, a broad and untargeted approach, spear phishing is a highly personalised attack aimed at specific individuals, businesses, or roles within an organisation.

The spear phisher begins by gathering detailed information about the intended target, often using social engineering techniques. This can include information gleaned from public sources like social media, corporate websites, or industry publications. The information can include topics surrounding the recipient’s expertise, role in the organisation, interests, and public and residential tax information. The attacker then uses this information to craft a convincing and seemingly legitimate communication, often an email, that appears to come from a trusted source like a well-known business partner, a colleague, or a socially significant contact.

These specific details make the scam email appear more legitimate and increase the chances of the recipient clicking links or downloading attachments.

Spear phishing is a sophisticated cyber-attack that’s carried out in several stages:

1. Target Selection: The attacker identifies and chooses an individual or organisation as the target of the spear phishing attack. Motives like potential financial gain or access to sensitive information influence the choice of target.
2. Reconnaissance: The attacker researches the target to gather as much information as possible. This might include job roles, work relationships, personal interests, or other details that make the attack more convincing.
3. Email Crafting: Using the collected information, the attacker creates a personalised email or other type of message that appears to come from a trusted source. This could be a coworker, manager, or other authority figure known to the target. The message usually contains a compelling reason for the target to take immediate action.
4. Call to Action: The main goal of the spear phishing email is to trick the target into performing a specific action. This could involve clicking on a malicious link or downloading a malicious attachment, both of which can lead to installing malware. Alternatively, the email may ask the recipient to provide sensitive information like login credentials, financial details, or other personal data.
5. Exploitation: If the target falls for the trick and takes the bait, the attacker then uses the access or information for malicious purposes. These might include stealing sensitive data, conducting financial fraud, launching further attacks within the organisation, or even espionage.
6. Covering Tracks: After the attack, cybercriminals often try to delete any traces of the attack, such as emails or logs, to avoid detection and prolong their unauthorised access.

The elaborate and targeted nature of spear phishing attacks makes them one of the most effective and dangerous cybersecurity threats today. Individuals and organisations must be aware of these tactics and implement measures to guard against them.

Spear phishing and standard phishing share similarities but also have some distinct differences. Both effectively trick targeted users into divulging sensitive information, but spear phishing involves more effort from the attacker. Spear phishing requires reconnaissance and an understanding of the targeted user so that emails contain just enough information to make them seem like they are from a legitimate sender.

First, let’s discuss standard phishing to identify the differences. Generally, phishing campaigns have no specific target. In most cases, an attacker casts a wider net by sending thousands of phishing emails to an email contact list. In some attacks, the domain name used to send malicious messages looks similar to the official one. For example, an attacker might register the domain “payypal.com” and use it to make the sender look official. Another phishing strategy uses email spoofing. Spoofing uses open email servers to manipulate the sender domain to “paypal.com”, even though the message is not actually from a legitimate PayPal employee.

While standard phishing is effective for smaller payouts, spear phishing takes a more targeted approach for bigger gains. They normally target high-privileged organisational users, such as accountants, human resources employees, and C-level executives. These attacks require much more research into the target organisation or individual to understand what messages will work. Spear phishing can also be combined with social engineering to be more effective.

Spear phishing uses much more compelling messages than standard attacks. For example, attackers who claim to be the CEO could trick finance executives into sending money to their bank accounts. Using fake invoices could trick accounts payable employees into sending money to the attacker. To steal credentials, an attacker might create messages that seem like IT is asking for information. To mislead users, the messages must sound like they’re from a legitimate person the recipient knows, which is why social engineering might also be used.

Because spear phishing is much more targeted, fewer users receive messages. Oftentimes, an attacker researches the organisation and creates messages for the few high-privileged users selected as targets. The users chosen are typically from organisational charts on the organisation’s website or information on LinkedIn.

A spear-phishing attack targets specific people, but “whaling”, also known as CEO fraud, refers to an attacker targeting one or several C-level executives. The term “whaling” is a play on the word “phishing” and is meant to imply the “big fish” nature of an executive’s high-privilege account permissions. These attacks are usually more elaborate because the stakes are much higher. Executives are much more likely to fall victim to a spear phishing attack, so it’s a lucrative venture for a threat actor who conducts thorough reconnaissance.

Both whaling and spear phishing attacks are more tailored and researched than untargeted, mass untargeted phishing attempts. The key difference is each type’s target. While whaling targets high-profile individuals like CEOs, CFOs, or other company executives, small and large businesses can be targets for threat actors and spear phishing. Whaling strategies may also involve sophisticated social engineering in large attacks.

For example, the attacker might work with a partner who contacts the executive to make the threat more compelling to the targeted user. Home Depot, Anthem, Target, and JP Morgan have all been targets for whaling and spear phishing. Epsilon lost $4 billion to a spear-phishing attack targeting email providers. The damage was so severe that the cost to recover from damages and lawsuits made it one of the biggest cyber-attack payouts to date.

Spear phishing attacks are personalised and sophisticated, exploiting a target’s interests or habits. Here are some examples and tactics to look out for:

1. Shared Interests: An attacker may send an email based on the target’s publicly known interests. For example, if Wade is a known wine enthusiast and friends with Bob, who shares the same passion, a spear phisher might send an email suggesting they visit the e-store of Domaine Maleficent, a spoofed or compromised website, citing Bob’s positive experience. The attacker’s ability to customise the email based on the recipient’s interests sets spear phishing apart from generic phishing attacks.
2. Impersonation of Known Businesses: Cybercriminals often pose as well-known businesses like PayPal, Amazon, Google, and Microsoft to instil trust. These brands have millions of customers who could be tricked into clicking on malicious links embedded in an email.
3. Lottery Scams: In another instance, the attacker could pretend to be Google or Microsoft, claiming the recipient has won a lottery. The email instructs the recipient to send a small fee for mailing costs to receive the prize. Gmail is good at filtering these messages, but users sometimes respond to them from their spam inboxes. Such messages should be quarantined in a business environment.

Some popular spear-phishing strategies involve:

• Customer Complaints: The customer might complain about a recent purchase, and the attacker posing as a customer service agent will direct the recipient to a website that mimics the official company page and prompts for authentication.
• Security Alerts: A fake text message or email alert about a compromised bank account, encouraging the recipient to click on a link that leads to a fake page asking for authentication.
• Vendor Impersonation: The attacker impersonates a legitimate vendor, informing the recipient that their account is about to expire and they must click a link and authenticate.
• Charitable Requests: Emails asking to donate or send money to a specific group can also be spear-phishing attempts.

Any organisation, regardless of size, can be a target for spear phishing. Cybercriminals know smaller businesses often have fewer cybersecurity resources, making them attractive targets.

In many spear phishing attempts, the attacker targets the financial department. Attackers targeted a US network technology company named Ubiquiti Networks and managed to steal $46.7 million using spear phishing. Attackers impersonated executives and convinced the finance department to transfer money to an offshore bank account.

In another costly case of spear phishing, French cinema group Pathé lost €19.2 million (about $22 million) in a wire fraud scheme where numerous emails were sent from the personal account of CEO Marc Lacan. The attack was carried out after hackers successfully used a business email compromise scheme to target the organisation.

Being a pioneer in cybersecurity doesn’t mean you’re resistant to spear phishing. RSA security fell victim to a spear phishing attack when an employee opened an Excel spreadsheet with an embedded Adobe Flash object. The malicious Flash object took advantage of a zero-day Flash vulnerability and installed a backdoor on local computers. The backdoor gave attackers access to credentials and threatened security for defence contracts such as Lockheed Martin and Northrop Grumman.

Since 2020, reports of phishing and spear phishing have significantly increased. Verizon’s 2021 Data Breach Investigations Report (DBIR) indicates that 74% of organisations in the United States experienced a successful phishing attack. Ninety-six percent of these attacks were delivered via email, which makes email the most common vector for spear phishing.

One report highlighted spear phishing as the most popular attack among threat actors used by 65% of all known groups. A study from Norton found that around 88% of organisations encounter spear phishing attacks in a year, indicating that businesses are targeted by these attacks nearly every day.

Spear phishing is much more targeted, so active groups of attackers rely on it for credential theft, ransomware, and other forms of financial gain. These groups used spear phishing 65% of the time. Other reports suggest spear phishing is quickly becoming more popular than standard phishing. Reports from Proofpoint indicate that 64% of security professionals and 88% of organisations have experienced a sophisticated spear phishing attack. Many of these attacks were targeted for account compromise, malware (e.g., ransomware), and data theft.

To effectively counter spear phishing threats, businesses should adopt a comprehensive approach that includes cutting-edge technology solutions, continuous education, and a proactive security posture. Here’s a guide on how to structure these strategies and prevent spear phishing attacks:

1. Deploy Advanced Email Protection Solutions: Opt for dynamic malware analysis and email protection solutions that use analytics to detect suspicious emails. Such solutions actively analyse destination websites for malicious activities and simulate a real user system, forcing malware to reveal itself in a sandboxed environment. By performing sandboxing when a suspicious email is delivered or when users click on a URL, you can enhance the detection of these highly targeted threats.
2. Implement Security Awareness Training Programs: As emphasised by an Osterman Research survey, a combination of security awareness training and technology-based solutions is advocated by most security decision-makers. The survey noted that 37% believed spear phishing solutions primarily involve training enhanced by technology, while 44% said that training and technology are equally important. The best training simulations mimic real-world attack techniques, tying into current trends and the latest threat intelligence.
3. Adopt a People-Centred Security Posture: Attackers don’t view your organisation as a network diagram. Deploy a solution that provides visibility into who is being attacked, how they’re being attacked, and whether they fell prey to it. Consider each user’s individual risk, including how they’re targeted, what data they can access, and their susceptibility to attacks.
4. Implement User Training and Reporting: Regularly train users to spot and report malicious emails. Simulated phishing attacks not only help stop many attacks but also identify particularly vulnerable individuals.
5. Invest in Proactive Defence Measures: Assume that users might occasionally fall for spear-phishing attempts. Therefore, invest in a solution that can identify and block inbound email threats before they reach the user’s inbox.
6. Implement DMARC Rules: For administrators, setting up Domain-based Message Authentication, Reporting & Conformance (DMARC) rules on the email server can prevent phishing messages from reaching their intended recipients.
7. Establish Verification Procedures: Any message asking for a financial transaction needs to be verified, even if the sender appears to be a legitimate employee or vendor. Encourage employees to type the domain into a browser and authenticate from the official website instead of clicking links in an email message.
8. Avoid Sharing Credentials: Instruct users to never share their credentials during phone calls, as network administrators should never ask for passwords from employees. This practice is critical as social engineering is frequently used in spear-phishing and whaling attacks.

By adopting these methods, you can establish a robust defensive line against spear-phishing attacks and protect your organisation from potential security breaches.

Proofpoint provides a comprehensive suite of products and services designed to help businesses protect against spear-phishing threats.

• Proofpoint Email Protection: This solution can help detect, block, and respond to threats in inbound email. It provides multi-layered defences against a variety of threats, including spear-phishing and malware. It also gives visibility into who is being attacked and how, providing valuable insights to better understand and counter threats.
• Proofpoint Advanced Threat Protection (ATP): This service integrates multiple advanced threat solutions to provide effective protection. It leverages a defence-in-depth approach combining several security measures to prevent, detect, and respond to phishing attacks. Proofpoint’s Advanced Threat Protection includes threat intelligence, sandboxing, and predictive analysis, among other features.
• Proofpoint Targeted Attack Protection (TAP): This innovative solution uses advanced technologies, including machine learning, to detect and block malicious emails that may otherwise slip past traditional defences. TAP provides real-time protection against targeted attacks, including spear-phishing and ransomware.
• Proofpoint Security Awareness Training: Proofpoint believes in a people-centric approach to cybersecurity. Its Security Awareness Training educates employees about the latest threat trends, including spear-phishing simulations, helping them recognise and report such threats. Regular, engaging content ensures that users are up to date with the evolving threat landscape.
• Proofpoint Phishing Simulation: Proofpoint’s phishing simulations emulate real-world attack techniques, providing practical, hands-on experience for users. These simulations help to identify potential vulnerabilities within your organisation and provide the basis for targeted training, enabling users to recognise and report phishing attempts.

By leveraging these services and products, businesses can significantly enhance their resilience against spear phishing and other advanced cyber threats. Proofpoint’s comprehensive, integrated solutions offer robust defences and aim to keep organisations one step ahead of cybercriminals. For more information, contact Proofpoint.