Everything you need to know about spear phishing cyber attacks

You may have heard of phishing attacks --- where hackers use fraudulent emails and websites to steal personal information from users. Spear phishing is a similar, but more dangerous attack, that can result in the theft of sensitive data or even financial losses.

Below, we discuss everything you need to know about spear phishing: what it is, how it works, and how to protect yourself from these attacks.

What is spear phishing?

Spear phishing is a type of phishing attack that's targeted at a specific (typically senior) individual within an organization. These attacks are usually carried out by email, and the attacker will use personal information to make the email seem more legitimate. 

For example, an attacker may send an email that appears to be from a piece of software or tool a business uses in its everyday operations, asking the recipient to click on a link to update their account information. If they click on the link, they will be taken to a fake website that looks legitimate. The attacker can then use the individual's personal information to gain access to other accounts and data.

Spear phishing attacks are usually more successful than general phishing attacks because they seem more personalized and reasonable. Hackers will often spend time researching their targets before carrying out an attack, so they can use information that will make the email believable. For example, a hacker might find out the name of team members and send an email that appears to be from one of them.

How a spear phishing attack works

As described above, a spear phishing attack usually starts with an email, asking the recipient to click on a link and provide login credentials. Once the personal information has been entered into the fake website, the attacker will be able to access your accounts or make fraudulent charges.

Some spear phishing attacks may also contain attachments that install malware on your computer. This type of attack is called a "malware-based spear phishing attack." If you open an attachment from a spear phishing email, the malware will be installed on your computer and the attacker will be able to access your files or track your keystrokes.

Spear phishing attacks can be difficult to detect because they often look like legitimate emails. However, there are some signs that you can look for that may indicate an attack.

Signs of spear phishing

The following red flags may be a sign of a spear phishing attempt:

• The email is not addressed to you by name.

• The message asks you for something unusual, sensitive, and/or relates to something outside of your corporate channels.

• The email contains a generic greeting, such as "Dear valued customer."

• The sender's address does not match the legitimate website's address and comes from a domain outside of the business. Always check the sender field if you have your doubts.

• You were not expecting the email.

• The email contains misspellings or grammatical errors.

• The email asks you to click on a link or download an attachment.

• You are not able to verify the sender's identity.

• The message demands some sort of urgent action.

If you receive an email that meets any of these criteria, do not open any attachments or click on any links. Instead, delete the email and report it to your IT department or security team.

Spear phishing vs phishing

Spear phishing and phishing are both types of email scams that are used to steal personal information. The main difference between spear phishing and phishing is that spear phishing attacks tend to be targeted at a specific individual, while phishing attacks are sent to a large number of people in an effort to get them to click on a link or download an attachment.

Essentially, phishing is about quantity, while spear phishing is more targeted, is likely to be highly personalized and, therefore, harder to catch.

How to prevent spear phishing

There are several steps businesses can take to prevent spear phishing attacks.

Email hygiene

It used to be common to create email filters to prevent phishing emails from reaching employees' inboxes. For example, you could set up a filter that deletes all emails with the word "invoice" in the subject line. But for obvious reasons, this might be problematic as you could still get legitimate invoices having "invoice" in the subject line. Most mail hygiene systems no longer rely on simple keyword-based filtering rules, but rather use more complex technologies like machine learning.

It is important to ensure that you do have an email hygiene solution in place which quarantines suspicious mail.  Most online email providers tend to include some degree of email hygiene in their service, where they filter suspicious emails into a "quarantine" or "junk" folder.  Third party email hygiene "add-on" services provide an additional level of filtering.

Employee training

Employees should also be trained to identify phishing emails, and they should be instructed not to open any attachments or click on any links in suspicious emails.  Training remains a critical component of your defense, as end-user awareness is still one of the most important defenses against social engineering.

Two-factor authentication

Businesses can also use two-factor authentication for their online accounts. Two-factor authentication requires you to provide two pieces of information before you can log in to your account. For example, you might have to enter your username and password, then enter a code that is sent to your phone or email address. This makes it more difficult for attackers to gain access to your accounts.

Ensure software is up-to-date and install endpoint protection

Businesses should also keep their software up-to-date and install endpoint protection software on all of their devices. This will help protect them from malware-based spear phishing attacks.

Businesses can help prevent spear phishing attacks by scanning all messages for malware-related attachment types and running them through additional malware indicators. This will help to identify potential malicious attachments and protect employees from being tricked into opening them.

Keep remote services, VPNs and MFA solutions configured and integrated

Employees are a valuable target for spear phishing attacks, as they may have access to sensitive information or systems. In order to protect your employees from these attacks, you need to ensure that your remote services, VPNs and MFA solutions are fully patched, properly configured and integrated.

If your remote services are not up-to-date, attackers may be able to exploit vulnerabilities and gain access to your network. Similarly, if your VPNs are not properly configured, attackers may be able to bypass your security measures and access your network. And if MFA solutions are not integrated with your other security measures, attackers may be able to bypass them and gain access to your systems that way.

Ensuring that all of your systems are up-to-date, properly configured and integrated can help protect you from spear phishing attacks.

Training is also a key component of any initiative to protect against spear phishing.

Protect your business from all forms of cyber attack

Knowledge and preparation are key to protecting your business from cyber crime. Samurai XDR provides the detection you need in case an attack - such as an intrusion by spear phishers - bypasses your controls.

Head over to the rest of the Samurai XDR blog for more insights on cyber security best practices.