Spear Phishing Attacks - How? Why?

Spear phishing is an e-mail spoofing fraud attempt that targets a specific organization, seeking unauthorized access to confidential data. Spear phishing messages appear to come from a trusted source. Phishing messages usually appear to come from a large and well-known company or website with a broad membership base, such as eBay or PayPal. In the case of spear phishing, the apparent source of the e-mail is likely to be an individual within the recipient's own company and generally someone in a position of authority.

Before crafting a spear phishing message, the attacker will research the intended victim's social media profiles, like LinkedIn, Twitter and Facebook. Afterwards, the attacker will try to build a profile on the victim's life, work and interests. This will be used to create a highly customized message that will come across as credible and relevant to the victim. These e-mails contain infected attachments and links. Once the link is opened, it executes malware that leads the target to a specific website. The attackers can then establish their networks and move forward with the targeted attack.

Most people have learned to be suspicious of unexpected requests for confidential information and will not divulge personal data in response to e-mail messages or click on links in messages, unless they are positive about the source. Spear phishing attacks use familiarity as their first weapon in the attack. They know something about you and use it to gain your confidence. The success of spear phishing depends upon three things: The apparent source must appear to be a known and trusted individual; there is information within the message that supports its validity; and the request the individual makes seems to have a logical basis.

Because spear phishing attacks are highly targeted and customized, they are far more likely to succeed than traditional phishing attacks. This is concerning as the spear phishing attackers usually have very specific goals, like accessing highly confidential information or corporate business secrets.

Many times, government-sponsored hackers and hacktivists are behind spear phishing attacks. Cybercriminals do the same with the intention to resell confidential data to governments and private companies. These cybercriminals employ individually designed approaches and social engineering techniques to effectively personalize messages and websites. As a result, even high-ranking targets within organizations, like top executives, can find themselves opening e-mails they thought were safe.