Spear phishing vs. evasive spear phishing attacks
Like typical spear phishing campaigns, the evasive variety identified by researchers is highly targeted and personalized to the recipient. Communications include information about the target gleaned through social engineering to create an illusion of authenticity, increasing the chances of response. The email messages are equipped with attachments or links that install malware or direct the user to malicious websites designed to collect sensitive information such as passwords.
However, where traditional spear phishing ends, evasive spear phishing takes things a step further. The standard definition of spear phishing, according to the bulletin, “falls short of describing totally unique events, one among millions of daily events that occur across the IT infrastructure.”
Evasive attacks differ from traditional spear phishing in the attacker’s time- and resource-intensive techniques. Adversaries “typically spend months and months researching and gathering intelligence to make sure their attack is going to be as under the radar as possible,” Henderson said. And by under the radar, he means by users and security technology.
Lewis Henderson
“The evasive spear phishing attack is carried out by a single-use email address that malicious actor uses,” Henderson said. “They are very quick to create and quick to dispose of. A completely unique file is sent to one recipient.”
In his research, Henderson observed attacks that went so far as to appear to be originating from customers’ supply chains or third parties. “The attackers were in their supply chain partner’s system just watching various transactions happen over email,” he said. This access provided plenty of material to help attackers create customized emails that would present as convincing to even the biggest security skeptic.
These highly sophisticated communications are threatening, but rare. According to the report, evasive spear phishing attacks “present one of the highest business risks in terms of financial and reputational impact, yet represents the lowest occurring threat in terms of volume that an organization needs to defend against.”