Contact us today!

FRS Pros Blog

Poking at Spear Phishing

Poking at Spear Phishing

Hopefully, you’ve heard of phishing at this point: the method cybercriminals use to scam their targets by impersonating someone that their targets would trust, requesting access credentials or other sensitive information. Did you know that there are specific kinds of phishing? Here, we’ll review one of the biggest risks to your business... spear phishing.

What’s the Difference Between Phishing and Spear Phishing?

In a word, personalization. Your typical phishing campaign, in keeping with the analogy, casts a wide net to try and catch as many victims as possible. By writing a very vague and generic email that appears to be from some large company or organization, the typical phishing attack can be leveraged against almost anyone with a reasonable chance of success - although this also makes them easier to spot if one knows what to look for.

Spear phishing, on the other hand, goes for quality over quantity. Instead of casting out a wide net to snare a large group, spear phishing requires a focused approach, as it targets a single, influential individual.

In order to do this effectively, a cybercriminal can’t just rely on a generic message. Instead, the hacker will do some digging, finding out everything they can about their target - where they work, who they work with, and what it is that they do. Once they’ve collected the information they need, the hacker will spoof an email - often referencing some project or mutual contact to prove their “legitimacy” - with a link to a downloadable file.

This link will take the recipient to what appears to be a login page for Google Drive or Dropbox, but is actually another part of the hacker’s trickery. Once the user enters their credentials, the scammer has them to use for themselves, completely undermining the user’s security and potentially causing a business crisis.

How Do Spear Phishers Fool People?

There are a variety of ways that hackers can make their messages more convincing, especially when they’re leveraging a spear phishing strategy. These methods combine some practical skills with a bit of psychology, supported by the research that these types of hackers do.

As a result, instead of the phishing message being vague and generic, it might reference actual events, people, and things relevant to the target. They will often be spoofed to appear to come from an authority figure, like a manager or the CEO, to encourage the recipient to do as the email says without really thinking about it or questioning it too much. Unlike many other phishing messages, spear phishing messages are typically well written, without spelling or grammar errors.

These cybercriminals can be especially devious and will even buy close-match domains to make their attacks that much more convincing.

Let’s say that you owned the domain example-dot-com. Someone trying to phish someone else by posing as you could purchase their own domain, example-dot-com. Looks the same, but by using a capital “i” instead of a lowercase “l”, the phisher can create a lookalike site that truly appears to be legitimate.

Who Do Spear Phishers Target?

This is one of the main reasons that spear phishing requires so much research - not only does the hacker have to identify who they are going to target; they have to also identify the best way to scam them. As a general rule, however, spear-phishing attackers will target those people in an organization who have access to the information that the phisher wants, but not enough clout to question a request from (what appears to be) up the chain of command. In other words, a business’ end users.

So, what can you do to prevent spear phishing from impacting your business? There are a few things:

  • Check to make sure everything about an email is as it should be. Is the sender actually, or is it Are there any files included with the email? They could be a means of installing some kind of malware, so avoid clicking on them.
  • Take any urgency in the message with a grain of salt. Many hackers will make their messages sound more urgent in the attempt to scare their targets into action. You should also keep an eye out for any changes in standard operating procedures as well… like if your company typically utilizes Google Drive to share files, but you’re being asked to download a file from Dropbox instead.
  • Make every effort to confirm any messages you find suspect through another means. The few moments it takes to pick up the phone and ask the person who seems to have sent an email will be well worth it if it helps you avoid a data breach.

Threats like spear phishing are just the start of a business’ security concerns. For more assistance with your business’ IT and its security, subscribe to our blog, and give FRS Pros a call at 561-795-2000.

Taking a Look at Wearable Technology in 2019
Tip of the Week: Bring Your Own Device Policy Cons...


No comments made yet. Be the first to submit a comment
Already Registered? Login Here
Tuesday, June 25 2019

Captcha Image

Mobile? Grab this Article!


Tag Cloud

Tip of the Week Security Technology Best Practices Network Security Privacy Business Computing Internet Productivity Google Hackers User Tips Cloud Business Management Microsoft Tech Term Innovation Software Mobile Devices Efficiency Hardware Malware Data Backup Smartphone Computer Windows 10 Hosted Solutions Data Recovery Browser Data Cybersecurity Smartphones Internet of Things Android Office 365 IT Services Windows Email IT Support Outsourced IT Upgrade Apps Backup Data Security Workplace Tips Gadgets Communication Small Business Cybercrime Disaster Recovery Operating System VoIP Communications Network Business Continuity Phishing Law Enforcement Ransomware Server Users Employer-Employee Relationship Mobile Device Management Vulnerability Money Business Alert Saving Money Miscellaneous Social Media IT Support Virtualization Managed IT Services Applications Wireless Cloud Computing Spam Chrome Best Practice Information Microsoft Office Automation Artificial Intelligence Collaboration Managed IT Services Passwords Computers Managed Service Provider Managed IT Facebook Health Router Unsupported Software Telephone Systems App Google Drive Blockchain Tech Support Managed Service Two-factor Authentication Bring Your Own Device Holiday Networking OneNote Information Technology Windows 10 Word Save Money Update Business Technology Audit Meetings The Internet of Things Google Docs Project Management Shortcut Data Protection Patch Management Wireless Charging Politics VPN iPhone Devices Budget Wireless Technology BDR Cost Management IT Management Data Breach Data Management Augmented Reality BYOD Travel Productivity Commerce WannaCry Quick Tips Sports Access Control File Sharing Application Hosted Solution Excel Search Fraud Encryption Avoiding Downtime Mobility Printing Safety Telephony Mobile Security Password SaaS Proactive IT Evernote User Error Google Assistant Hybrid Cloud Touchscreen Data Storage Risk Management WiFi Cortana Hacking Government Mobile Device Data Loss Gmail Robot Conferencing Wi-Fi Workers Files Gamification Keyboard Shortcuts Unified Threat Management Legislation Language Office DDoS Investment Adobe Accessory Recovery Software as a Service 5G Solid State Drive Personal Information Sabotage Disaster Windows Ink Virtual Assistant E-Commerce Emails Cast Gifts Computing Vendor Management Hard Drive Display Root Cause Analysis Licensing Updates Memory Human Resources Upgrades Comparison Scam Testing Computer Fan Reputation ROI Computer Forensics Peripheral Data storage Microsoft Excel IT budget Education Administrator Bandwidth YouTube Hard Disk Drive History PC Outlook Remote Computing Google Maps Spyware Streaming Media Alexa for Business Payment Cards Marketing Credit Cards App store Lithium-ion battery Samsung Chromebook Co-Managed Services Microsoft Word Financial Payroll Specifications Virus Camera Management Settings Access Employees IT Solutions Paperless Office Legal Apple Chromecast Employee Webinar Antivirus Telephone Tablets Maintenance Security Cameras Consultant Laptop Sales Proactive Projects Transportation PowerPoint Admin Remote Monitoring Storage Social Engineering Battery Internet Exlporer Vendor OneDrive Private Cloud Smartwatch Sync Hyperlink Edge Hacker Break/Fix IT solutions FAQ Social NFL eWaste Emergency Machine Learning Touchpad Retail Websites Uninterrupted Power Supply Identity Going Green Wireless Internet Saving Time Identities Point of Sale Employee-Employer Relationship Voice over Internet Protocol iOS WIndows Server 2008 Server Maintenance Value Wasting Time Ciminal Medical IT Windows 10s HBO Charger Entertainment Device Security Amazon Downtime Screen Mirroring Humor Data Theft Identity Theft Data Privacy Windows 7 Computer Care Nanotechnology Big Data Automobile Twitter Managing Stress USB Worker How To Books PDF Hiring/Firing Mobile Computing Video Games Experience Virtual Reality Work/Life Balance Current Events Electronic Medical Records Text Messaging Crowdsourcing Thank You Employer Employee Relationship Windows Server 2008 R2 Cache Benefits es Phone System Save Time Office tips Congratulations Computer Accessories Training Monitors Music Advertising Smart Technology Flexibility Television CrashOverride Instant Messaging Compliance Printers Company Culture Scalability Analytics End of Support Keyboard Regulation HaaS Relocation Black Market Cleaning