9 types of phishing attacks and how to identify them

Spear phishing: Going after particular targets

Phishing assaults get their identify from the notion that fraudsters are fishing for random victims through the use of spoofed or fraudulent e-mail as bait. Spear phishing assaults lengthen the fishing analogy as attackers are particularly focusing on high-value victims and organizations. As an alternative of making an attempt to get banking credentials for 1,000 customers, the attacker could discover it extra profitable to focus on a handful of companies. A nation-state attacker could goal an worker working for an additional authorities company, or a authorities official, to steal state secrets and techniques. For instance, Iranian cyberespionage group APT42 is understood for utilizing refined spear-phishing strategies that contain impersonating a number of organizations and people which are recognized or of curiosity to their victims.

Spear phishing assaults are extraordinarily profitable as a result of the attackers spend a whole lot of time crafting data particular to the recipient, akin to referencing a convention the recipient could have simply attended or sending a malicious attachment the place the filename references a subject the recipient is focused on.

In a 2017 phishing marketing campaign, Group 74 (aka Sofact, APT28, Fancy Bear) focused cybersecurity professionals with an e-mail pretending to be associated to the Cyber Battle US convention, an occasion organized by america Army Academy’s Military Cyber Institute, the NATO Cooperative Cyber Army Academy, and the NATO Cooperative Cyber Defence Centre of Excellence. Whereas CyCon is an actual convention, the attachment was really a doc containing a malicious Visible Fundamental for Functions (VBA) macro that may obtain and execute reconnaissance malware known as Seduploader.