Spear Phishing.

What is spear phishing?

Spear phishing is phishing aimed at a chosen person or group instead of a large crowd. The message is written for the target, so it can look more believable than a mass email.

NIST describes phishing as a technique for trying to get sensitive data, such as bank account numbers, through a fraudulent request in email or on a website, where the sender pretends to be a legitimate business or a reputable person. Spear phishing uses the same idea with a narrower aim.

How does a spear phishing attack work?

MITRE ATT&CK is a public catalog of attacker behavior. It says adversaries may send phishing messages to gain access to victim systems, and that all forms of phishing are electronically delivered social engineering. Social engineering means tricking a person instead of breaking a system.

MITRE lists spearphishing as part of its Phishing technique (T1566) and names four variants.

• Spearphishing Attachment (T1566.001)
• Spearphishing Link (T1566.002)
• Spearphishing via Service (T1566.003)
• Spearphishing Voice (T1566.004)

What is the difference between an attachment and a link?

MITRE says a spearphishing attachment is different from other forms of spearphishing because it uses malware attached to an email. Users are typically manipulated into opening files such as Word documents, executables, PDFs or archives. MITRE also says attackers often disguise file extensions and icons so the file looks like another type.

MITRE describes a spearphishing link as a specific variant of spearphishing. The email carries links used to download malware, instead of attaching malicious files. MITRE says this can help avoid defenses that inspect email attachments.

What does a simple illustration look like?

This is a generic illustration only. An employee receives an email that appears to come from a known contact and asks them to open a file or follow a link. If the employee trusts the message and does so, the attacker may gain access to the employee’s system.

How can you reduce the risk?

MITRE lists these mitigations for spearphishing attachments: antivirus and antimalware, audit, network intrusion prevention, restricting web-based content, software configuration, user account management and user training. For spearphishing links it lists audit, restricting web-based content, software configuration, user account management and user training.

For detection, MITRE describes a strategy for attachments that correlates suspicious email delivery with file creation and abnormal process execution.

CISA gives general advice for phishing messages. Verify the sender by contacting the organization using contact details you already know. Check that a website address starts with https and shows a padlock before entering sensitive data. Use antivirus software, firewalls and email filters. Enforce multifactor authentication, which asks for more than a password to sign in.

How does it relate to nearby terms?

Phishing is the wider term, and spear phishing is a targeted form of it. Social engineering is the wider idea of manipulating people. Multi-factor authentication is the sign-in control CISA recommends.

Is spear phishing the same as phishing?

Not exactly. Phishing is the general term for fraudulent messages that pretend to come from a trusted source. Spear phishing is a targeted kind of phishing. MITRE places spearphishing under its Phishing technique.

Is spear phishing only done by email?

No. MITRE lists variants that use a service and a voice call, as well as email attachments and links. MITRE’s attachment and link descriptions both refer to spearphishing emails.

Where does Brandefense fit?

Brandefense monitors phishing and domain abuse that are often used to impersonate trusted organizations.