Firms urged to protect against spear phishing

Brand impersonation is being used in 83% of spear phishing attacks, making it the most popular form of this type of targeted attack, research shows.  

These attacks are designed to impersonate well-known companies and commonly-used business applications and are well designed as an entry point to harvest credentials, carry out account takeovers and steal Personally-identifiable information (PII), according to a report by security researchers at Barracuda Networks.

Using carefully-designed templates that impersonate top brands, scammers send an email claiming that the targeted individual’s account has been frozen and providing a link to reset the account password. The link typically takes victims to a legitimate-looking phishing website designed to harvest login credentials.

Microsoft and Apple are the most-impersonated brands in spear phishing attacks, the researchers said, based on an analysis of 360,000 spear phishing emails in a three-month period.

Spear phishing attacks are designed to evade traditional email security, including gateways and spam filters. They are typically sent from high-reputation domains or already-compromised email accounts and do not usually include malicious links or attachments, enabling them to bypass most traditional email-security techniques rely on blacklists and reputation analysis, the report said.

The attacks also typically use spoofing techniques and include zero-day links hosted on domains that have not been used in previous attacks or that have been inserted into hijacked legitimate websites. As a result, they are unlikely to be blocked by link-protection technologies.

The attackers also take advantage of social engineering tactics in their attacks, including urgency, brevity and pressure, to increase the likelihood of success, the report said.

The second most popular form of spear phishing attacks, accounting for 11% of attacks monitored, are blackmail scams, which include sextortion attacks.

In these attacks, scammers typically claim to have a compromising video, images or other content allegedly recorded on the victim’s computer. They threaten to share this content with the targeted individual’s email contacts, unless they pay up.

With about 1 in 10 emails being a sextortion attack, employees are twice as likely to be the target of blackmail than business email compromise (BEC), which accounted for just 6% of attacks monitored.

Although BEC attacks – also known as CEO fraud, whaling and wire-transfer fraud – make up only a small proportion of spear phishing attacks, they have resulted in more than $12.5bn in losses since 2013, according to the FBI.

In BEC attacks, scammers usually impersonate an executive, partner or another trusted person in an email by compromising their email account, requesting a wire transfer or personally-identifiable information from finance department employees or others with access to sensitive information.