Blog

According to a study by IBM, over 95% of all cyber security issues can be traced back to basic human errors. Hackers leverage these human errors in a variety of cyberattacks.  Spear phishing is an example of a cyber threat that potentially targets specific roles and people in an organization in a planned yet malevolent manner. Beginning from the Nigerian Prince scam of the early 90s to the more sophisticated, well-researched and highly targeted campaigns being run today, phishing attacks have become increasingly difficult to identify and curb. That is why, it is crucial to an organization’s cybersecurity that its employees be aware of what spear phishing is, how it operates and how to avoid these attacks. 

This blog aims to arm you with the information to tackle the menace of spear phishing. 

What is spear phishing? 

Spear phishing has a significant impact on an organization. Through spear phishing, hackers impersonate trusted contacts such as friends and employers to acquire sensitive information via email or online messaging. Spear phishing is so successful that 91% of all cyberattacks fall under this category. 

While spear phishing sounds a lot like phishing itself, there are clear distinctions between the two. 

Phishing is a low-yield, low-tech, generic, mass attack form of cyber threat. Hackers using phishing attacks are not looking to target anyone specifically. Their goal is to cast the net wide enough to bait as many people from as many organizations as possible. Hackers usually orchestrate phishing attacks using pre-built kits with fake web pages to gather login information, install malware and ransomware, or stage cryptojacking. 

On the other hand, spear phishing casts a shallow net and targets just a few selected individuals. Spear phishing increases the potency of the attack by giving it its high infiltration success rate. Another factor that comes into play here is using legitimate sites to store malicious documents. Advanced hackers house their payloads on sites such as Dropbox, OneDrive and Google Drive. So, malicious emails from these sites may not be blocked by IT or vetted by the target. 

The last factor that ensures the success of a spear-phishing campaign is the research. As mentioned above, spear phishing targets specific individuals. But these targets are not just randomly selected. Hackers spend a considerable amount of time researching their target organization and role. 

Hackers first begin with email ids harvested from a data breach or commercial lead-generation sites. Then, hackers profile potential targets using the tons of information available publicly on social media platforms and Google. Hackers comb everything, from company websites and LinkedIn profiles to Instagram, Facebook and public interviews, and identify potential targets to impersonate. Their behavioural patterns are replicated and social data leveraged to create fake profiles. Hackers use the collected information to craft a credible narrative and convince their targets to give up information. 

These attacks have also been used to target high-level C-Suite executives. When an executive-level employee is impersonated, there is a higher chance of coercing the juniors into revealing data or paying up. These attacks are known as whale phishing attacks. In fact, some studies even suggest that executives might be easier to fool than normal employees. It is harder to impersonate C-Suite executives because of the added layers of security protecting them. But many hackers believe it is worth their time and effort. So, they put in a lot of effort in researching these high-value targets. 

How to avoid spear phishing attacks? 

• The first step to prevent spear-phishing attacks is cleansing your digital footprint. It is important to be mindful of the information you put out on public forums because it can be used to profile you accurately. 

• Do not just maintain strong passwords. make it a habit to recycle all your passwords regularly. Not changing your passwords can provide leverage to hackers. 

• Do not delay any software updates. These need to be downloaded and installed regularly. 

• Stay away from suspicious emails. Do not open them or click on any unfamiliar links. 

• Keep in mind that friends, banks or other institutions do not ask for personal information such as passwords, OTPs or CVV codes. 

• Implement a stringent cybersecurity awareness program at the organization. Teach all employees about the best cyber hygiene practices. Also, implement a data protection solution to ensure no data is lost in the event of an attack. 

By following the simple tips given above, most spear phishing attacks can be identified and rendered useless. Spear phishing campaigns are only going to get more advanced over time. It is up to us to learn and update our own security protocols to keep the organization safe from such threats.