How attackers are using targeted spear phishing to evade cybersecurity defenses'

Are you one of those organizations that continue to stay nonchalant about Spear Phishing? The level of complacency regarding spear phishing attacks which has seeped into a number of companies is both disconcerting and detrimental for business security. With an ever-growing technology stack and relentless advancement in computing skillsets, phishing artists have come a long way since their seemingly humble origin. Spear phishing has evolved considerably in the last few years from simple scam mails that could be easily detected by email security gateway filters.

Now the impact as well the attack surface of spear phishing strikes has burgeoned substantially. Companies can no longer afford to be naïve or unaffected about the looming threat of spear- phishing attacks. Growing in both volume and complexity, the impact of these attacks has significantly thwarted the operations of companies across the globe. A recent survey shed light on over 2.3 million spear phishing attacks that targeted more than 80,000 organisations around the world. Needless to say, the pandemic-induced turbulence provided a suitable environment for spear phishing attacks to thrive.

Amid the general confusion and anxiety, countless spear-phishing emails managed to gain the trust of unwary employees. By clicking or responding to these phishing emails masquerading as medical notifications or greetings or motivational messages, countless employees unwittingly compromised organizational defenses. With attack vectors becoming more calculated and complex, spear-phishing has started utilizing more subtle and targeted methodologies such as brand impersonation, conversation hijacking and business email compromise (BEC).

Murali Urs, Country Manager, India, Barracuda Networks

At the end of 2020, these sophisticated tactics made about 12% of all spear phishing attacks. The end-objective of these strikes to has sufficiently evolved. Attackers no longer want you to merely click on a malicious URL; they want to create trust in you and invoke a response as well. Once the attackers have attained access to an organisation’s internal systems, they can use the compromised e-mail account to easily communicate and convince people to perform certain actions like transferring money to some shady account, and the like, without initially raising any suspicion. There are many companies today that remain blissfully oblivious of the spear-phishing situation and that further adds to the problem.

There have been instances when a company remained unaware of a phishing attack that had managed to breach their defenses several months ago. The attacker had managed to hoodwink every defense and had positioned himself neatly within the internal system. Moreover, he even interacted with suppliers to have invoices paid to different bank accounts while staying undetected, all this time. The attacker had successfully gotten hold of over 15 different email accounts within the company and then using the compromised email account(s) to target other users internally within the company. These attacks are also called lateral movements and are more difficult to pin-point as they emerge from internal, legitimate email accounts that may appear to be from a trusted colleague.

To secure your internal data and official accounts from phishing strikes, you have to go beyond inbox defense and incident response. The unparalleled growth in tech-arsenals has enabled phishing artists to elude defenses and remain undetected for a significant time. However, the growth in technology has been two-sided. It is high time that organizations embrace and optimize the latest new-age anti-spearphishing tools and technologies to safeguard themselves. These include:

• Zero trust network access control: A zero-trust security framework aids in restricting unwanted accesses to your network. This is an imperative security feature as even if one of your email account gets breached by a phishing attack, the hacker can’t use that account as a stepping stone to other accounts and areas of the internal environment.

• Multilayered email security: In-depth defense is a commonly used terminology in the cybersecurity front and it remains one of the most effectual methods for dealing with spearphishing threats. Make sure your company’s intranet is secured through the quintessential email security gateway along with novel additions such as inbox-defense and spear-phishing protection.

• Educate all personnel: This is perhaps the most overlooked aspect when it comes to an organization’s business security. Your staff must be adeptly trained to detect and report attacks. Security training is an essential feature of ‘Best cybersecurity practices’ and should not be considered an annual drill. Employees must be granted proper training through simulated attack scenarios and experiential modules that can impart a real-time understanding of such attack vectors.

To conclude, the spear-phishing attack surface continues to expand at a tremendous pace. Only by ensuring timely action and deploying the latest cybersecurity stratagems, can a company hold its own in the wake of this ever-burgeoning threat matrix.

By Murali Urs, Country Manager, India, Barracuda Networks