Phishing emails are now
being deployed in pairs to create the illusion of authenticity, says security awareness training
firm PhishMe.
Phishing emails try to trick the recipient into doing something risky by disguising malicious
attachments or links in seemingly genuine content.
In this new type of phishing email campaign, attackers typically send out a benign email that
contains nothing harmful and does not ask for any information or response from the recipient.
It could be a friendly introduction such as, “Hello, we met at XX Conference last week, I have a
report I’d like you to review, I will send it over shortly,” said Aaron Higbee, co-founder and CTO
of PhishMe.
“An hour or so later, the report arrives, just as promised,” Higbee said.
This tactic is aimed at improving the odds that even a fairly security-savvy employee would be
tricked into opening the malicious attachment that could launch an information-stealing Trojan.
Similarly, attackers are even responding to potential phishing victims, as shown by the recent
report by US security company Mandiant.
On 18 February 2013, the company published
a report that identified a secretive branch of China’s military based in Shanghai as one of the
world’s “most prolific cyber espionage groups”.
The report described a tactic used by the group of responding to queries from potential phishing
victims to create the illusion that the phishing email was trustworthy.
To counter this new type of attack, PhishMe has introduced the scenario to its product features
that is particularly aimed at customers with mature training programmes.
“This is for a user base that is already resilient to basic phishing tactics,” said Higbee.
“Just as the “P” in APT stands for persistent, organisations need to be persistent in training
their user base, and the new ‘double barrel’ feature will allow our customers to enhance their
already successful programmes in a meaningful way that addresses a real world problem,” he
said.
Double barrel scenarios can be customised to send the lure after the malicious email, stagger
the delay between emails and flag one or both emails as urgent.
Daily phishing emails
In January 2013, A poll of 1,000 office workers across the UK showed that nearly
60% of UK office workers receive phishing emails every day and 6% receive more than 10 a
day.
Other research
has shown that spear-phishing attacks – attacks that target specific people at enterprises with
the aim of gaining a foothold into the corporate network – are at the core of most targeted
attacks
In an analysis of targeted attack data collected between February and September 2012, Trend
Micro found 91% of targeted attacks involved spear phishing.
Related Topics:
Security policy and user awareness,
IT for consulting and business services,
IT for transport and travel industry,
IT for telecoms and internet organisations,
IT for leisure and hospitality industry,
IT for small and medium-sized enterprises (SME),
IT for government and public sector,
IT for media and entertainment industry,
Hackers and cybercrime prevention,