Security information Archive - Page 3 of 9 - Hornetsecurity – Cloud Security Services for Businesses

Understanding the Adversary-in-the-Middle Attack – How It Works and How to Defend Against It

by hse | Oct 20, 2023 | Security information

What Is an Adversary-in-the-Middle Attack?

An adversary-in-the-middle attack (formerly Man-in-the-middle, sometimes now referred to as Attacker-in-the-middle) is a type of cyber attack in which an attacker intercepts and relays messages between two parties who believe they are communicating with each other. Since most people are linked in some form almost constantly, the internet plays a massive role in modern life.

As a result, most public areas (such as cafes, restaurants, and transportation) are furnished with free public Wi-Fi so that everyone may check their emails, bank accounts, social media, or, more likely, play the newest hot mobile game. Many individuals are unaware that counting on access to free WiFi might not be wise.

Public WiFi, though convenient, allows attackers to exploit users’ devices or intercept traffic for data theft. This can be as simple as setting up a fake network and performing an “Adversary-in-the-Middle Attack”, where they monitor (sniff) connections.

Connecting to such a network and logging into an unencrypted site can expose credentials, but, fortunately, modern websites often use Transport Layer Security (TLS) for encrypted connections.

What Is an Adversary-in-the-Middle Attack?

How Do AitM Attacks Work

AitM attacks hinge on a devious manipulation of trust. Essentially, attackers position themselves between two communicating parties, intercepting their interactions. This interception enables them to eavesdrop on conversations, access sensitive data, or alter the information exchanged. The process involves:

Interception

Attackers establish themselves as intermediaries, intercepting data traveling between victims and legitimate destinations.

Impersonation

Once in the middle, attackers can impersonate either party as legitimate senders or receivers.

Data manipulation

Attackers can modify data, inject malicious content, or withhold information to suit their malicious goals.

Key Concepts of an Adversary-in-the-Middle Attack

Adversary-in-the-middle attacks attempt to eavesdrop on and influence two parties’ communications, although the main motives include stealing sensitive data (passwords, financial info), eavesdropping on confidential conversations, injecting malicious content, and compromising transactions.

Malicious actors use the trust between victims and systems to exploit flaws and get unauthorized access to further their agenda.

There are numerous ways how the threat actor can “position” themselves between the communication of the trusting parties by employing various methods such as:

Interception

The most common, simple yet effective way when threat actors deploy access points that pose as a legit hotspot, and once users are connected, attackers intercept, manipulate, or monitor traffic, enabling eavesdropping, data theft, and data integrity.

Spoofing

Impersonating communication endpoints by spoofing ARP and DNS addresses, also called poisoning, to intercept and modify data:

When the attacker sends phony Address Resolution Protocol (ARP) to reroute traffic through their system, packets that link their MAC address to a valid device’s IP address.
Domain Name System (DNS) poisoning works by fooling your computer by modifying it into receiving false directions and navigating you to a false website owned by the attacker instead, which is similar to diverting traffic signs to the wrong location. Due to the phony website’s potential similarity to the actual one, you might not know that you’ve been rerouted, which can lead to data theft and security breaches.

SSL/TLS stripping

With SSL/TLS stripping, an HTTPS-safe connection is downgraded to a less secure encrypted HTTP connection, making the entire online connection insecure. ARP spoofing or creating a rogue access point could potentially let an attacker establish a position between you and the website you’re attempting to visit.

E-mail hijacking

E-mail hijacking in an AitM attack intercepts and alters email traffic by inserting themselves between your email client and server. They trick your client into a fake secure connection to manipulate or block emails, possibly stealing credentials.

They can forward or alter emails, leaving recipients unaware. To protect against this, use encrypted email protocols, be cautious on public Wi-Fi, update software, and use strong passwords.

Session hijacking

A distinct session that identifies the user on the server is formed when users connect to a server. Threat actors could sniff and access this session token when visiting websites that don’t use encryption or unsecured protocol like HTTP, allowing them to view data on a web application while posing as users.

MFA bypass

A more recent type of AITM is where criminals use an AITM kit to set up a fake login page, and then trick users to visit it (through an email or IM phishing email for example). Normally this type of attack should fail as in addition to entering a username and password, the user should perform another multi factor authentication step, such as approving a notification from a smartphone app, or enter a six digit code sent in a text message.

However, this type of AITM attack seamlessly monitors the MFA challenge, then grabs the users response code and passes that onto the real login site. The end result is that the user is no wiser to the fact that they were compromised, while the attacker now has full access to the users account.

How to Defend Against Adversary-in-the-Middle Attacks

Even though there are a lot of potential attack vectors for AITM attacks, hardening your organization will greatly diminish this type of threat.

Avoid phishing emails

Phishing emails are a common way for attackers to carry out AitM attacks. Phishing emails are designed to look like legitimate emails from a reputable source, such as a bank or an e-commerce website. They often contain a link to a fake website that looks like the real one. When you enter your login credentials or other sensitive information, the attacker can intercept it.

Be cautious of emails from unknown senders, and always verify the authenticity of emails before clicking on any links.

Encryption

One of the best techniques to stop AitM attacks is encryption. Your communication is protected by encryption from being intercepted and read by an adversary. Use secure email and messaging services, and always browse the web using HTTPS.

Today, HTTPS is frequently used by default on websites, adding an extra layer of protection. Use a virtual private network (VPN) to encrypt your communication when connecting to a public Wi-Fi network.

Verify SSL/TLS certificates

Before visiting a website, ensure the SSL/TLS certificate is still in good standing. Websites may be encrypted and authenticated using SSL/TLS certificates. If a website’s certificate is not current, a MitM attack may be underway. Verify that the website’s URL starts with “https://” rather than “http://” by looking at it.

Additionally, check for a lock iconin the address bar of your web browser, which denotes the presence of a working SSL/TLS certificate on the website. Today this is a red flag, most sites use HTTPS, especially as you can use free certificates from Let’s Encrypt and others.

Use secure Wi-Fi networks

Steer clear of insecure Wi-Fi networks wherever possible, especially in public areas like hotels, airports, and cafés. Unsecured Wi-Fi networks are susceptible to AitM attacks because anybody may eavesdrop on communications between networked devices.

Use a secure Wi-Fi or cellular network that needs a password instead. If you must use public Wi-Fi, encrypt your communication with a VPN.

One important factor is how you handle your employees, as over 95% of attacks that are happening are where the human element gets exploited. Being aware of the dangers and potential attack vectors threat actors use can be a great advantage in reducing the chance of being a victim of a AITM attack.

The ultimate way is to educate your employees about the dangers with a cyber security awareness service to protect your critical data.

To keep up to date with the latest articles and practices, pay a visit to our Hornetsecurity blog now.

Conclusion

AitM attacks pose a severe risk to online communication and can potentially cause sensitive data theft, financial loss, and reputational harm. AitM attacks must be prevented by using precautions such as encryption, checking SSL/TLS certificates, and staying away from insecure Wi-Fi networks.

You may lessen your chance of being a victim of a AitM attack by exercising caution and adhering to recommended practices.

FAQ

What is a Adversary-in-the-Middle attack?

An adversary-in-the-middle (AITM) attack occurs when a perpetrator inserts himself into a dialogue between a user and an application to either listen in on the discussion or to mimic one of the parties, giving the impression that regular information flow is taking place.

What is the symptoms of an adversary-in-the-middle attack?

Adversary-in-the-middle (AitM) attacks may show symptoms like unexpected SSL certificate warnings, sudden HTTPS-to-HTTP changes, frequent authentication requests, unusual network behavior, unsolicited device pairing, missing security indicators, SSL certificate mismatches, and unfamiliar devices on networks.

Unexplained redirects to HTTPS sites, authentication prompts, or slow network speed can signal potential AitM activity.

What is the most famous adversary-in-the-middle attack?

An extremely sophisticated piece of cyber espionage malware called Flame, also known as Flamer or Skywiper, was found in 2012. It was probably created by a nation-state and was aimed toward the Middle East, particularly Iran, Israel, and the surrounding nations.

The flame could enter computers through USB sticks, network shares, and email attachments while utilizing several vulnerabilities because of its complexity and modular architecture. It spreads over networks, gathering information from emails, instant messages, and documents while staying covert and encrypted to avoid being discovered.

Instructions were given, and its command and control servers received stolen data. If necessary, Flame’s self-destruct function removed all traces.

Mastering and Leveraging the MITRE ATT&CK Framework on Cyber Threat Detection

by hse | Oct 16, 2023 | Security information

History of MITRE ATTACK Framework

The requirement to track and catalog typical TTPs (Tactics, Techniques, and Procedures) that APT (Advanced Persistent Threat) organizations used against business Windows networks was first addressed by MITRE in 2013. FMX (Fort Meade Experiment), an internal experiment, was where it all began.

In this project, a group of security experts was assigned to simulate adversarial TTPs against a network, and information was gathered from the attacks on this network. The information obtained was used to build the first components of the ATT&CK framework, as it is known today.

What Is in the MITRE ATT&CK Matrix?

MITRE ATT&CK matrix provides a systematic and structured flow of the threat actors’ tactics and techniques carried out in cyber attacks. This framework’s main purpose is to provide cybersecurity professionals insight into the different stages of an attack, how adversaries operate, and their next steps.

The ATT&CK framework has grown and expanded throughout the years. One notable expansion was that the framework focused solely on the Windows platform but expanded to other platforms, such as macOS and Linux, SaaS, Iaas Containers, and many more.

Each technique in the MITRE ATT&CK Matrix is documented with details on how it is executed, potential mitigations, and associated threat groups known to use it. The matrix is continuously updated to reflect the latest threat landscape and tactics employed by adversaries.

If you haven’t done so, navigate to the ATT&CK website.

MITRE ATT&CK Top Horizontal Matrix column describes Tactics, which start with Reconnaissance, Resource Development, Initial Access, and others. Each Tactic has a lot of techniques drawn from each of its vertical columns.

Based on MITRE’s presentation at a conference, the Technique in the table above is the result of hard work from various Adversary Groups over the past 10 years based on findings from cyber security researchers or threat intelligence reports.

Defining Retention Policies

MITRE ATT&CK currently has 14 tactics/categories that contain the techniques an adversary could use to perform the tactic. The categories cover the seven-stage Cyber Attack Lifecycle (credit Lockheed Martin for the Cyber Kill Chain, see below).

Reconnaissance: Method used to gather intelligence for a target network, system or individual to identify potential vulnerabilities.
Resource Development: Tactics used by adversaries to craft or acquire the resources necessary for their operations, such as tools, malware, or credentials.
Initial Access: Tactic used to gain an initial foothold in a target environment.
Execution: Tactic to run malicious code on a victim system.
Persistence: Methods to maintain a presence on a compromised system.
Privilege Escalation: Tactic to gain higher-level access and permissions.
Defense Evasion: Methods to avoid detection and analysis by security tools.
Credential Access: Tactic to steal or acquire user credentials.
Discovery: Methods for gathering information about the target network.
Lateral Movement: Tactics to move laterally within a network.
Collection: Tactics for gathering data or valuable information.
Command and Control: Tactics used by attackers to take over infiltrated computers, keep control over them, and communicate with their malicious software.
Exfiltration: Tactics used to steal and transfer data outside the target environment.
Impact: Tactics that cause damage or disruptions to systems or data.

Under Initial Access, there are 9 techniques, and some of the techniques have sub-techniques, in this case 3:

Spearphishing Attachment
Spearphishing Link
Spearphishing Via Service

On the other hand, “sub-techniques” such as Spearphishing Attachment are more precisely defined and subsets of the parent technique. They demonstrate several approaches or variations that adversaries may use to employ to achieve their goal. Read on about spear phishing examples.

Sub-techniques deliver greater clarity and insight into numerous strategies, enabling cybersecurity experts to comprehend the several paths adversaries could use to achieve the objective.

Adjusting RTOs, RPOs, and Retention Policies to Match Practical Restraints

Although the Cyber Kill Chain and MITRE ATT&CK are both popular frameworks in the cybersecurity field, they have different functions and take different methods of assessing and reducing cyber risks.

In contrast to MITRE ATT&CK, which focuses on understanding the “how” of an attack, describing the specific tactics, techniques, and procedures used by adversaries at various stages of the attack lifecycle, the Cyber Kill Chain framework originates from a military concept known as “kill chain,” which specifies the planning of an attack.

Identification of the target, deployment of troops, attack on the target, and eventual destruction of the target comprise it. However, “breaking” an adversary’s kill chain is a defensive or aggressive tactic.

The following steps make up the Cyber Kill Chain:

Reconnaissance

Attackers assess potential vulnerabilities and weaknesses in the target system or organization.

Weaponization

Attackers can turn the payload into a weapon by combining a harmful payload (such as malware) with a delivery method (such as a phishing email).

Delivery

The weaponized payload is sent to the intended system or user, frequently through social engineering or other dubious methods.

Exploitation

After the malicious payload is run, it exploits holes in the target’s defenses to gain a foothold in your organization

Installation

Once inside the system, the attacker sets up backdoors or additional access points to create a persistent presence.

Installation

The attacker establishes communication channels to keep hold of the compromised system and accept orders.

Actions on Objectives

With full control established, the attacker carries out their primary objective, which could be data theft, system disruption, or other malicious activities.

Use Cases of the MITRE ATT&CK Matrix

As we dive deeper into technology and make our lives easier and more automated, the only downside is that risks are increasing proportionally. It is an ongoing battle that seems to never end, playing catch up with threat actors who use ransomware techniques to hijack critical data.

MITRE ATT&CK Matrix is continuously improving and staying up to date thanks to the security researchers, and several uses cases can be employed, depending on your company mission:

Incident Response

Supports comprehension of and reaction to online threats during investigations.

Threat intelligence

Examines the strategies and methods used by adversaries in reports.

Red Team testing

This technique simulates actual attacks to evaluate defenses.

Security awareness training

Security awareness training informs staff members about typical attack vectors.

Threat hunting

Threat hunting involves aggressively looking for signs of compromise.

Analysis of security

Analysis of security tool efficacy and coverage holes.

Threat sharing

Promotes the exchange of intelligence among peers.

Risk assessment

Finds gaps in defenses and strengthens them.

Security standards

Supports the observance of security standards.

Enhance employee awareness and safeguard critical data by leveraging Hornetsecurity’s Security Awareness Service for comprehensive cyber threat education and protection.

We work hard perpetually to give our customers confidence in their Spam & Malware Protection, Advanced Threat Protection, Email Encryption, and Email Archiving strategies.

To keep up to date with the latest articles and practices, pay a visit to our Hornetsecurity blog now.

Conclusion

Despite cybersecurity frameworks like MITRE ATT&CK and the Cyber Kill Chain offering helpful perspectives into adversarial strategies and attack phases, they can be challenging for those without Security Awareness to understand because of their complexity and technical nature.

You can read more about Cybersecurity training here, after all, the humans are the ones navigating the ship.

FAQ

What is the MITRE ATT&CK framework?

MITRE ATT&CK framework is a smart toolkit for digital investigators that reads like a spy manual, outlining the malicious schemes (tactics), nifty devices (techniques), and top-secret operations (procedures) employed by online criminals.

What are MITRE ATT&CK techniques?

MITRE ATT&CK Matrix are the attack’s nuts and bolts, basically groups of approaches. Attackers use tactics to accomplish their stages or aims, whereas they use specific techniques (bolts) to carry them out.

How does the MITRE ATT&CK framework improve security?

For the past 40 years, MIT’s spin-off MITRE Attack has sought to strengthen cyber defenses with government funding. It is connected to several top-secret and commercial programs for numerous agencies.

One of the big benefits, and a large reason for it’s popularity, of the framework is that it provides a common language for defenders to communicate about different types of intrusions and attack types.

It promotes a threat-based defensive strategy with a balanced security posture and timely adoption of a cyber-attack response strategy by utilizing cyber threat intelligence. Nevertheless, given the quantity and variety of MITRE attack strategies, it is difficult for an organization to assess every MITRE attempt.

Because of this, MITRE Attack created the ATT&CK framework, an abbreviation for Adversarial Tactics, Techniques, and Common Knowledge, as a knowledge base.

Malware vs. Viruses: Understanding the Threat Landscape

by hse | Oct 9, 2023 | Security information

There is a misconception about what malware and viruses are. Many people use it interchangeably, however, they are two different things. Malware is any malicious software that has a goal to harm someone’s data or systems. The virus is just a type of malware.

In this article, we will discuss malware, viruses, and their variations, address common questions, and provide you with some insights on how to protect your infrastructure.

The Frequent Misuse of Malware and Virus Terminology

The confusion between malware and viruses arises from various factors. One of them is media representations in TV and movies. In some movies, the term virus has been used to describe any form of malicious software. For instance, in the 1995 movie Hackers, the virus was used broadly to refer to various cyber threats.

Furthermore, the internet contains a significant amount of misinformation, including on technical websites. Therefore, as technical professionals, we must represent information accurately.

All of these things contribute to a lack of clear understanding of the terms malware and viruses and their broader context.

Here we are to explain it the right way.

The Difference Between Malware and a Virus

We’ve already clarified that a virus is just one type of malware, and malware is a broader term used to describe various malicious software. Common questions about malware and viruses can be found under the FAQ section at the end of the article.

How viruses are spread? Viruses can be spread via email attachments, file-sharing networks, Internet downloads, removable media, and software packages.

How is malware spread? Different types of malware are spread the same way as viruses. Additionally, phishing and social engineering are two of the most common types of attacks. Phishing and social engineering involve tricking people into revealing their sensitive data by impersonation. Phishing attacks are delivered through emails, SMS; voice, and QR scam codes. For example, impersonating a CEO and calling HR to request payroll lists. Does it sound legitimate or not?

Types of Malware

There are various types of malware. In this section, we will address the most common ones.

Viruses

Viruses are malicious programs that attach themselves to legitimate files and executable programs and replicate themselves when executed. One of the first viruses to emerge in the market was Melissa (1999). It was attached to Word documents and spread via email. When opened, it infected documents and sent them to people in the user’s address book.

Trojans

Trojans (The Trojan Horse) appear as legitimate software but contain hidden malicious code. Trojans do not replicate like viruses but provide a backdoor to attack the victim’s machine. The story of the Trojan Horse in the movie Troy has also become a metaphor for trojans malware. Have you watched the movie?

Worms

Worms are a type of malware that spreads and replicates across networks without user intervention. One of the first worms, ILOVEYOU (2000), was spread as an email attachment with the subject ‘ILOVEYOU,’ which is how it got its name.

Once executed, it infected the computer, overwriting files and sending copies to the victim’s email contacts. Sounds similar to viruses? It does, but the difference is that viruses require user intervention, whereas worms don’t.

Ransomware

Ransomware encrypts files and machines in your infrastructure, and attackers demand payment for the decryption key. Ransomware is one of the most common attacks nowadays. WannaCry made headlines in 2017 when it infected thousands of computers in over 150 countries.

It exploited vulnerabilities in Windows systems. Since COVID started and with the shift to remote work, new ransomware has been appearing almost every week.

According to our Ransomware attacks survey, major data breaches in 2022 cost their victims an average of $4.35 million, a 2.6% rise from the 2021 average of $4.24 million. Additionally, 14.1% of ransomware victims lost data, and 6.6% had to pay the ransom.

Spyware

Spyware collects information about a user’s online activities, often without their knowledge, and sends his data to a remote server. A spyware attack sounds dirty. Does it?

Adware

Adware is a type of malicious software that displays unwanted ads and often redirects you to untrusted websites.

Keylogger

Keyloggers record what users are typing on the keyboard (credit card information, credentials) and send it to attackers. Keyloggers are a monitoring tool that, in most cases, are associated with criminal activity.

RAM scrapers

RAM scrapers are a type of malicious activity where attackers steal information from the RAM, such as credentials and credit card numbers.

Botnet

A botnet is a network of infected computers that work together to launch DDoS or other types of attacks and are controlled by an attacker.

Rootkits

Rootkits hide in the root of the operating system and provide attackers with access to it. These are some types of malware. Additionally, there are variations of them.

Types of Viruses

There are also various types of viruses. One of the questions that usually pops up is if all viruses are considered malware. The answer is yes, all viruses are a type of malware, but not all malware are viruses. Here are some types of viruses:

File infector viruses

File Infector viruses attach themselves to executable files and can infect others when executed.

Boot sector virtuses

Boot sector viruses target the boot sector of the operating system and execute when the operating system boots.

Macro viruses

Macro viruses are found in documents and spreadsheets. They exploit macros in applications like Microsoft Word and Excel. It is recommended to turn off macros.

Polymorphic and metamorphic viruses

There are also polymorphic and metamorphic viruses. Polymorphic viruses change their code each time to infect a new host, making it very difficult to detect. On the other hand, metamorphic virus rewrites their code with each infection making it also very difficult to detect.

There are other types of viruses, including web scripting viruses, browser hijackers, resident viruses, direct action viruses, multipartite viruses, and more.

Is It Necessary to Have Both Antivirus and Malware Protection?

While it can be conflicting to have two antivirus programs running simultaneously, having antivirus and malware protection on the same machine is recommended. The reason lies in the difference between malware and viruses.

Does an antivirus remove malware? Antiviruses are designed to detect and remove viruses, not malware. That being said, standard antiviruses may not provide full protection for other types of malware threats.

However, with some security vendors, their capabilities extend to other types of malware.

How to Protect Against Malware and Viruses

Several different methods help protect against malware and viruses. As a fundamental rule, we should ensure that we have a proper understanding of IT security.

Keep your operating systems updated to the latest version. This is one of the most important criteria, as many attacks occur due to unpatched operating systems.

Install antivirus software on your computer. Antivirus programs offer real-time protection, which helps detect viruses while you work.

Don’t use pirated software; they are often packaged with malware and backdoors, which can help attackers remotely access your system. Always purchase commercial software.

According to our Cyber Security Report, almost 40% of attacks are delivered via phishing emails. We often see viruses or other types of malware integrated into different file types, including Word, Excel, PDF, and archives.

Most-used file types in malicious emails

Ensure that you have ongoing cybersecurity training in your company. Your IT department and end users should be trained in how to handle phishing emails, social engineering, and anything suspicious.

At Hornetsecurity, we have developed Security Awareness Training that helps you simulate different types of attacks that usually come from phishing emails. Find out why cybersecurity training is an imperative for your employees.

Keep your operating systems updated to the latest version. Ensure the installation of all types of updates, as even we humans can pose a threat to our system.

To properly protect your cyber environment, use Hornetsecurity Security Awareness Service, Spam & Malware Protection, and Advanced Threat Protection to secure your critical data.

We work hard perpetually to give our customers confidence in their Email Encryption, and Email Archiving strategies.

To keep up to date with the latest articles and practices, pay a visit to our Hornetsecurity blog now.

Conclusion

Malware and viruses are very often used to refer to the same thing, however, they are not. The virus is just a type of malware among many others. There are different variations of malware including viruses, worms, trojans, adware, spyware, ransomware, and more.

Additionally, there are different types of viruses as well. That includes file infector viruses, boot sector viruses, macro viruses, polymorphic, metamorphic, and others.

In order to protect your infrastructure against viruses and malware, it is recommended to have both antivirus and malware protection installed on your machine.

FAQ

Is malware the same as a virus?

No, it is not. A virus is just one type of malware among many others.

What is malware?

Malware refers to various malicious software used to infect and harm victim data and systems. It is spread in different ways, mostly through phishing and social engineering attacks.

What is a virus?

A virus is a type of malware that attaches itself to files and folders.

Is Trojan a virus or malware?

A Trojan is a type of malware, and both Trojans and viruses are different categories of malicious software (malware).

Is malware a virus or spam?

Malware and spam are two different things. Malware is a broad term used for various types of malicious software, including viruses, Trojans, ransomware, spyware, and more. Spam is one of the ways malware is spread, mostly via emails.

Human Vulnerabilities – Exploring Types of Social Engineering Attacks

by hse | Oct 2, 2023 | Security information

It’s Monday morning; you have a fresh cup of coffee in hand and are ready to check the emails from the weekend. A new email has arrived in just the last hour from the CFO requesting the immediate payment of an attached overdue invoice missed by the finance team. A massive restocking fee will be incurred if the invoice isn’t paid for the products pending shipment.

Being the person usually responsible for tracking invoices of this nature, you feel a sinking feeling in your stomach that you have made a massive mistake, and to top it off, it’s only Monday!

Wanting to resolve this matter as quickly as possible and not let the team down, you reply to the email from the CFO to clarify some details. They respond promptly with praise that you have picked this task up so quickly and are grateful the matter will be resolved.

With the confidence gained from confirming the details with the CFO, you quickly authorize the invoice payment and enter the remittance into the system. Taking a deep breath and a long sip of your coffee, you feel much better, avoiding what could have been a morning disaster.

This feeling was short-lived, as you received a call from the CFO questioning the payment of a rogue invoice. After inspection of the email with the IT team, it was discovered that you were the target of a Spear Phishing social engineering attack where the attacker used an email domain, so like that of the company, it was difficult for you to notice in the initial panic.

Although this is only a hypothetical story, this scenario is all too common in the modern workplace. One of the more prolific social engineering attacks was that of Ubiquiti (UBNT) back in 2015.

The attacker targeted the finance department by sending a company email from what looked like a C-level executive. Ubiquiti never revealed the exact specifics of the email, but it has been speculated that the domain name of the email address was made to look like the company domain.

The fraudsters convinced the internal team to share usernames and passwords to finance systems, allowing the attackers to extract approximately $46.7 million into overseas accounts.

These types of social engineering attacks have been on the rise, with more complex and sophisticated methods being deployed by attackers each year. We will cover some of the types of social engineering attacks and how these can be identified and prevented.

How Do Social Engineering Attacks Work?

Social Engineering is a form of hacking relating directly to the human component. The goal is to extract information, money, or steal an identity. The intent of the hacker is to use psychological manipulation to invoke a sense of urgency, fear, curiosity, or embarrassment to overload you with emotions.

These types of strong emotions can enact our fight or flight response and fire up the amygdala part of the brain, which uses instincts for decision-making, rather than the prefrontal cortex. By essentially exploiting the human loophole and bypassing the conscious decision-making of the prefrontal cortex, our better judgment is clouded, and we make illogical decisions.

In the modern workforce, most of us experience a perpetuity of small stressful situations that cause the amygdala to fire multiple times throughout the day. With just a tiny amount of additional or surprise stress, this can be enough for people to react entirely irrationally in ways that, in hindsight, they struggle to explain.

This highlights how effective social engineering can be on most organizations and the need to invest resources in employee mindfulness and awareness to deal with malicious intent from external sources.

With the increasing types of social engineering attacks, it can be a daunting task for organizations to stay on top of the countermeasures.

Social Engineering Attack Techniques

There are many social engineering types of attacks and techniques, all of which prey upon our human phychological loophole. It’s often said that no matter how much time, money, or resources you spend on IT security, the number one weakness is the human employee.

This is why it is essential to understand and keep updated on attack techniques and recent attacks. To help understand how these attacks may impact your organization, it is best to understand the methods used by the attackers.

Although this list is forever growing, the following outline the different types of social engineering attacks we see today.

Phishing

Probably the most prevalent method of social engineering, phishing scams are usually deployed via email or text message campaigns to create a sense of urgency, fear, curiosity, or embarrassment within the target.

A task or action will usually be requested to avoid fear or embarrassment by coercing the target to provide sensitive information, clicking on malicious links, or opening attachments with embedded malware.

Spear Phishing

Similar to the phishing attack, the spear phishing attack is the more targeted version. This is usually explicitly deployed to a designated target within an organization based on their role or job.

Spear phishing requires much more effort from the attacker as these messages are usually crafted based on information gathered over time to improve the chances of hooking the target. Usually, this can evolve to the point where the attacker might hop between marks to reach their final victim for higher gain.

These are usually more difficult to detect than other types of social engineering attacks and typically contain wording or mannerisms used by internal staff.

Whaling

Whaling is used when targeting the “big fish” within a company, usually executive level or high-profile government officials. The attacker’s goal in a Whaling scenario is to dupe the Whale into a large financial payout or the extraction of sensitive information. Whaling usually involves a combination of other types of social engineering attacks like Baiting to maximize success rates.

Smishing & Vishing

Smishing is the method of phishing via SMS text messages. Attackers will rotate phone numbers to send large smishing campaigns, usually containing links to malicious websites.

Vishing is the voice version of phishing done via the phone. These types of social engineering attacks usually target a company’s HR or IT department to extract information or gain unauthorized access to systems.

Baiting

Baiting usually involves the method of false reward to intrigue a target via greed or curiosity. The goal is to extract personal information or deploy malicious software onto the victim’s device.

The most common method of baiting is that of the humble car park or bathroom flash drive. The attacker will load malware onto flash drives and label them in a way that sparks the target’s curiosity to investigate the content—once inserted into a computer, the malware can be injected, and the mark can be owned.

Other forms of baiting are enticing advertisements or even QR codes on bathroom stalls and public places. All of which have the same outcome: infect the target device with malware.

Piggybacking & Tailgating

Another method of physical and social engineering is Piggybacking or Tailgating. As the name suggests, this usually involves the attacker following someone into a building behind an authorized employee. Attackers sometimes dress up as maintenance workers, delivery drivers, or service workers to reduce the chances of being detected.

Pretexting

Pretexting involves the creation of a fake persona or fabricated scenario to coerce the target into providing unauthorized access to systems or to provide sensitive information. This is sometimes used with Piggybacking/Tailgating to improve the feasibility of physical access requirements or the persona ruse.

Business Email Compromise (BEC) & Email Account Compromise (EAC)

Both Business Email Compromise and Email Account Compromise involve some methods of compromised or spoofed email accounts.

BEC usually is the latter; the attacker spoofs a legitimate vendor or outside contact to coerce the target into an action. EAC is where the attacker has already gained access to an external vendor or contact and can manipulate existing email threads to gain information or funds.

This type of attack is usually very sophisticated, with planning required to compromise the email accounts of vendors or contacts. All of which allows a more undetectable and legitimate method to deploy other social engineering techniques and extract content. Depending on the source of the data, BEC actually generates more money for the criminals worldwide than ransomware attacks.

Quid Pro Quo

Quid Pro Quo, from Latin, meaning “something for something,” is most used where the attacker promises the target a favor in exchange for information. Some scenarios include the promise of gift cards for completing a survey, testing software, or even speeding up their internet by allowing a technician to test some things on their computer.

Honeytraps

The Honeytrap, more so synonymous with fake celebrity romantic relationships, involves exploiting the target’s romantic or physical interest to extract money, gifts, or compromising information/media for further exploitation.

Although this doesn’t usually have too much impact on corporations, the effect can bleed into the target’s professional life and, in some cases, involve extracting company money or sensitive information.

Scareware

Scareware is mostly seen as fake antivirus programs or advertisements. These ads will usually pop up with warnings about viruses detected on your system to coerce the victim to download the phony antivirus software onto their device.

In most circumstances, the downloaded software may also trick the victim into purchasing the antivirus to remove the detected viruses. This usually results in stolen credit card information and fraudulent charges being processed onto the account.

Watering Hole

The phrase “Poisoning the Water Hole” is the inspired version of this type of attack. The attacker will infect or even spoof a legitimate website frequently accessed by the target to capture credentials or infect the victim’s machine with malware.

How to Identify and Prevent Most Types of Social Engineering Attacks

As we have covered, attackers’ main loophole with social engineering is the exploitation of our amygdala, our survivalist irrational instincts. The best way to identify whether a social engineering attack has targeted you is if the content has the following characteristics:

Check the sender’s email address by hovering over the sender’s name. Is the email domain incorrect, misspelled, or slightly off?
Does the email’s subject line have urgency or emotionally charged wording?
Are there spelling or grammar mistakes in the body of the email?
Is there relevance to the message or content with your role or situation?
Are there suspicious links or attachments?
Have you seen/met/interacted with this person before?
Does it sound too good to be true?

Although most of these are general and primarily targeted toward phishing, it is best to ask yourself these questions and try not to engage with the emotional payload the attacker has deployed. It pays to be suspicious of unknown contacts or unsolicited communication.

Request identification in physical scenarios and always contact colleagues face-to-face or via a call if something doesn’t add up. Slow down any actions and take a moment to observe the scenario so that your prefrontal cortex can do the heavy lifting.

It is this mentality that will reduce these types of social engineering cyber-attacks.

Here’s Why Hackers Don’t Need Your Passwords

A primary goal for most social engineering hackers is how they can move laterally through an organization. If they can own one target, they will usually look for the next target with higher system privileges or access rights. This is where social engineering attacks work in conjunction with attacks such as Pass the Hash (PtH).

If a hacker can access a system with local administration or someone with enough privileges to scrape their system for other user hashes. This can allow the attacker to use these hashes in a Pass the Hash (PtH) attack and reuse these hashed credentials to authenticate via NTLM to other resources.

The attacker doesn’t need to decrypt or even know the password, as this hashed password can be used as is to exploit authentication protocols.

This can continue throughout the environment allowing the attacker potentially to gain higher privileges until they might get lucky and find the hashed credentials of a domain administrator.

Although the scope of social engineering and the tools utilized by attackers is broad, you can implement certain strategies to reduce the attack surface. The list of types of social engineering attacks continues to grow; therefore it’s education of users and administrators that will reduce your vulnerability.

User awareness training and regular testing campaigns are the best methods to prevent social engineering attacks. To adequately protect your cyber environment, use Hornetsecurity Advanced Threat Protection, Security Awareness Service, and VM Backup to secure your critical data.

We work hard perpetually to give our customers confidence in their Spam & Malware Protection, Email Encryption, and Email Archiving strategies.

To keep up with the latest articles and practices, visit our Hornetsecurity blog now.

FAQ

What is social engineering?

Social engineering is the term used to hack the human component of an organization. These involve many different types of phychological exploitation and manipulation of the victim.

What are the types of social engineering attacks?

The different kinds of social engineering attacks include:

Phishing
Spear Phishing
Whaling
Smishing
Vishing
Baiting
Piggybacking/Tailgating
Pretexting
Business Email Compromise (BEC)
Email Account Compromise (EAC)
Quid Pro Quo
Honeytraps
Scareware
Watering Hole

What is the most common type of social engineering?

Phishing is the most common type of social engineering, with approximately 3.4 billion emails sent daily.

The Significance of Encrypted File Transfer for Data Security

by hse | Sep 25, 2023 | Security information

In this article, we’re going to look at encrypted file transfers and why this is an important but often overlooked component of cyber security.

There are a few basic things in computer security that will never change, such as the need to protect your data against theft, failing hardware, human errors, and natural disasters.

There are three states your data can be in, stored on disks, cloud storage (or tape), referred to as “data at rest”, on the network being transferred from one system to another, “data in flight” and finally “data in use” when it’s being processed by the system. There are ways to protect your data in all three states, in this article we’ll look at encrypted file transfer and how it fits in with the data-in-flight paradigm.

To set the context, let’s cover data at rest first – in modern datacenters on-premises it’s likely that some physical storage is encrypted, in public clouds all physical storage is encrypted, and most laptops also come with full disk encryption enabled. BitLocker has been a native part of Windows for many years and is easy to manage.

The main risk that full disk encryption mitigates is physical theft of the disk or the device leading to loss of data. In other words, if you steal my laptop or pull a set of disks out of my servers, you can wipe them and sell them, but you can’t get to my data because you don’t have access to the decryption key.

Data in use is a much newer scenario, covered by Confidential Computing. The risk you’re mitigating here is theft or access to data while it’s being processed, for example by a rogue admin at a public cloud provider or a malicious database administrator in your company reading sensitive data. The building block of confidential computing are special versions of Intel or AMD processors that provide a Trusted Execution Environment (TEE) and encryption of parts of the memory.

If the code you want to run confidentially attests as your code that hasn’t been altered, keys are released and data processing takes place in the enclave, prohibiting access even from an administrator on the system. There are some predictions that just like encryption of data in transit is now taken as a given, in 10 years, Confidential Computing will be the norm for all systems.

Today the easiest way to access confidential computing is in public clouds, particularly Microsoft’s Azure, which is a leader in this space.

Encrypted File Transfer (courtesy of Bing Image Creator)

Encrypted File Transfer – Data in Flight

Whenever you want to transfer sensitive data files over an insecure or untrusted network you should use encrypted file transfer. Just like the example of data at rest above, if someone intercepts the file(s) during transit and they’re in clear text, they can simply read them.

But if they’re encrypted, all they’ll see is cipher text and your data stays private.

In some scenarios this is already the default, if you’re using a browser and connecting to almost any site on the internet, especially your bank or a site where you purchase goods, the connection will be encrypted.

This is the difference between the HTTP and the HTTPS protocol, where the S in the latter indicates that the site has a digital certificate, supporting a public/private key pair used to encrypt the traffic between your browser and the site. The same applies to your personal cloud storage, services like OneDrive for Business, Dropbox, Google Drive, etc. also use HTTPS to encrypt the upload and download of files to your device.

There are many other situations, however, where file transfers are a manual operation, and you need control over the encryption of the files.

There are a number of ways you can ensure secure file transfer, at the lowest level this involves selecting a protocol such as FTPS (Secure File Transfer Protocol) or SFTP encryption (SSH File Transfer Protocol). The former is the standard, unencrypted FTP protocol combined with TLS, the same encryption that’s used in HTTPS. These protocols have been around for many years and provide end-to-end encryption.

FileZilla is an open-source FTP application that supports SFTP

Behind the scenes, each file is encrypted before the file transfer and then decrypted on the receiving end. This also means, just as with any encryption system, that your data protection security now relies on good key management. Protecting the keys, and in the case of certificates, the private key is now paramount.

That’s the basics of data protection for file sharing, perhaps for a once-off move of some data files, but beyond that, you’ll need to look at your business needs and what file transfer solution will work best for your situation.

Here are some questions to investigate as you decide what IT security measures to take for your file transfer solutions.

What’s the nature of the data in the files? Is it Personally Identifiable Information (PII), financial information, confidential data, or other sensitive information?
Are the files being shared covered by a regulation that your organization must adhere to? If so, make sure that your chosen file transfer solution complies with the relevant regulation.
How many files and are they large files?
How frequent is the file sharing? Is it an hourly, daily, weekly or end-of-month process? Is it a regular pattern or does it change, depending on external circumstances?
Are you transferring files from one location to another, such as every branch office uploading daily data feeds to a centralized location? Or are you sharing files, either privately with data consumers that you know and provide access to, or are you sharing files publicly?
How automated do you need the process to be? Is it an irregular occurrence where you need manual control, or do you need automated managed file transfer?

Once you have established the business requirements for data sharing, you can start investigating secure file transfer solutions.

What Not to Do

At this point, many enterprises and small organizations look for a managed file transfer solution.

Put an appliance in each end, connect them and now you have a secure file transfer solution with very little management overhead. Except, based on industry experience over the last few years, these types of appliances, often brought to market many years ago, have an absolutely terrible track record of security.

In February 2023 a zero-day led to extensive data breaches. Before that Accelion’s FTA was compromised back in early 2021, and later in 2021, FileZen from Soliton suffered a similar fate.

Illustration of a secure file transfer appliance in a datacenter (courtesy of Bing Image Creator)

And in current news, the MOVEit file transfer service vulnerability has resulted in the Cl0p criminal group stealing data from many high-profile organizations, over 600 at the time of writing.

This group “specializes” in secure file transfer service attacks and extorts their victims by threatening to release the data publicly unless paid. This is a variant of ransomware attacks, which you can read more about in our Ransomware attacks survey.

So, don’t trust your data sharing to one of these file transfer solutions, the risk is just too high.

There are many risks to manage in cyber security, our annual Cyber Security Report 2023 gives some great insights into the threat landscape and ways you can protect your business.

What to Do

If you want an enterprise-grade secure file transfer solution, open source or proprietary “do it yourself” options aren’t going to cut it. And as seen above, using an appliance to transfer files “securely” is going to be very, very risky.

A better approach is enlisting a SaaS platform for your secure file transfer needs. These are generally more modern (SaaS solutions are generally less than 5 years old, whereas many file transfer appliances gathering dust in your datacenter stopped receiving patches 5 years ago), are monitored by the vendor (so they’re more likely to catch an attack than you are on an appliance where you can’t install a monitoring agent) and will be patched much quicker by the vendor if a vulnerability is found.

Enhance employee awareness and safeguard critical data by leveraging Hornetsecurity’s Security Awareness Service for comprehensive cyber threat education and protection.

We work hard perpetually to give our customers confidence in their Spam & Malware Protection, Email Encryption, and Email Archiving strategies.

To keep up to date with the latest articles and practices, pay a visit of our Hornetsecurity blog now.

Conclusion

The importance of encrypted file transfers cannot be understated, both to protect against data breaches and prevent unauthorized access to the files in transit. As the last few years have shown, relying on a proprietary appliance is a recipe for disaster and selecting a frequently updated SaaS secure file transfer solution is preferable.

Frequently Asked Questions

What is encrypted file transfer?

In the most basic form, it’s encrypting files for data security, then transferring those files over an untrusted network and then decrypting it on the receiving end. While you can use strong protocols such as secure file transfer protocol (FTPS) or SSH File Transfer Protocol (SFTP) for ad-hoc transfers, you’ll need a SaaS-based secure file transfer solution in an enterprise.

How do I send an encrypted file?

Depending on the system you’re using you’ll define the files to transfer and then they’re sent to the receiving system(s).

What is the most secure way to transfer files?

Both secure file transfer protocol (FTPS) or SSH File Transfer Protocol (SFTP) provide good security but aren’t particularly user-friendly nor easy to configure for regular, scheduled secure file transfers.

Defending Your Organization Against Whaling Phishing

by hse | Sep 13, 2023 | Security information

Do you hold a high-authority position within your organization, such as a C-level executive like CEO, CTO, CFO, CMO, and CLO? If so, this article is written to assist you in navigating through phishing attacks that target profiles of individuals in your role. It is called whaling phishing. Phishing is one of the most common ways to spread malware by tricking people to open malicious URLs or attachments. It only takes a second of tiredness and unconscious clicking on the link or attachment within our inbox. At first glance, that link or attachment might seem legitimate, but what is behind it is often what puts our organizations in chaos. In this article, we will discuss phishing attacks, with a focus on whaling attempts. We’ll cover how to identify them, how they operate, and the most effective methods to combat these attacks. Let’s start by breaking down the fundamentals.

What Is a Phishing Attack?

Phishing is the malicious practice of tricking people into revealing sensitive personal or business information (credentials, credit cards, or similar). Attackers create or design phishing emails in such a way that they are challenging to distinguish from legitimate emails. According to our research from 2023, phishing attacks remain number one on the list at 39.6%. It is very often combined with other malware such as HTML, URL, PDF, and executables.

Also, according to Ransomware Attacks Survey 2022, nearly 6 in 10 ransomware attacks (58.6%) originated from malicious email or phishing attacks.

What are the types of phishing attacks?

There are different types of phishing attacks and their variations, but they all share one common goal: tricking us to open harmful links or attachments. The thing that sets them apart is how they spread and who they’re trying to target. That includes spear phishing, whaling phishing, angler phishing, pharming, pop-up phishing, and others. Spear phishing and whaling phishing are about who the targets are. Spear phishing targets regular employees while whaling phishing targets high-profile employees, such as C-level executives.

What Is Whaling Phishing?

The whale is often seen as the king of the ocean, representing a symbol of high authority. In terms of phishing, a whale refers to C-level executives. C-level executives hold significant authority within an organization, and the metaphor draws a parallel between these powerful individuals and the whale in the ocean. With their authority, C-level executives become targets for whaling attacks, which aim to deceive and exploit them due to their access to sensitive information and decision-making power. When the CEO asks for an urgent request from employees, they usually get it. Isn’t it? There are two data breaches involving whaling phishing we would like to share with you. One happened at Seagate in 2016 when a group of hackers compromised the payrolls and tax information of approximately 10,000 current and former employees. In this case, the attackers targeted the HR department by impersonating a CEO. The second attack occurred in 2016 during the FACC Cyber Heist, where attackers tricked the finance department into transferring almost 42 million € to their accounts. They used the same trick, impersonating a CEO. The money was never recovered. The CEO was fired.

How Whaling Phishing Is Distributed

As with any phishing attack, whaling phishing is distributed via email, SMS, and voice. Let’s explore them through real-world examples.

Email phishing

According to our Cyber Security Report 2023, email continues to be the primary mechanism of communication for many organizations, with 333.2 billion emails sent every day. That is exactly how whaling phishing attacks are being spread. Attackers create deceptive emails, pretending to be CxO, and ask you to share payroll, tax information, or the latest project plan.

An example of whaling phishing spread via email

Smishing (SMS Phishing)

Smishing (SMS Phishing) is a type of attack where attackers use SMS text messages to trick the victim. For example, attackers impersonate a CEO and ask the Finance representative to make important payments ASAP. Here is an example of an SMS Message. “URGENT: Hey John – I’m in a meeting right now, and we need to make an important payment ASAP. Please reply with the company credit card details, including the CVV, so I can proceed. Thanks.” Never do this. Your CEO would never ask you to send credit card details via SMS.

Vishing (Voice Phishing)

Vishing (Voice Phishing) is tricking people via phone. Here is one example. Attacker (impersonating a CEO): Hello, this is Max Musterman, CEO of YYY organization. I am calling your (HR) department as I need your urgent assistance. May I know whom I am speaking to? Employee (Victim): My name is John, working as an HR representative. How can I assist you? Attacker (impersonating a CEO): We are analyzing the investments we make for salaries. As all systems are down, including email, I would like to ask you to send me the payroll report for all employees to my private email (Name.Surname@gmail.com). Would that be okay for you, please? Employee (Victim): Sure. You will have it soon in your inbox. Why do you think the employee promptly shared details with the CEO in his private email? In this voice phishing attack, the attacker gained access to legitimate information that the company had publicly disclosed. The company had a system outage due to a bandwidth issue, which they publicly shared with their customers. Taking advantage of this situation, the attacker successfully deceived the HR representative. That was a social engineering and phishing attack! There are also other variations of how phishing can be delivered, including QR code scams. Stay safe by reading more here: All You Need to Know About QR Code Scams.

How Whaling Phishing Attacks Work

There are three different phases in the phishing attack that are also applicable to the whaling attack.

First, an attacker would do research about the potential target, his role in the company, and his relationship with other employees.
Secondly, based on the data the attacker has found, he will create a tailored phishing email that looks like a legitimate email. Remember from the previous part, that is how HR and Finance departments from Seagate and FACC Cyber Heist were tricked.
From there, the attacker will attempt to deceive and convince the target into clicking on the link or attachment to gain access to the system. Once the victim clicks on the link, the attacker will need to bypass security measures, inject a malicious payload, and ultimately steal data and sensitive information.

Examples of Whaling Attacks

When we examine the examples of whaling attacks, we can identify a few. The first one would be CEO Fraud, where the attacker impersonates the CEO and asks lower management to share sensitive information or make an urgent payment. The second example could involve an impersonated board member. The attacker might send an email to the CEO and request sensitive information about projects, financial plans, growth strategies, or other business strategies. Another type involves targeting vendors or partners. The attacker pretends to be a trusted partner with whom the organization regularly interacts and asks for the latest project plan, changes to the payment plan, account information, or similar details. Some other examples may target the legal team, finance team, HR, marketing, IT department, executive assistant, and others.

Detecting a Whaling Attack

There are two crucial factors here. The first one is to have proper IT security tools and hardened systems that follow security best practices. The second factor is to have continuous security training, which will help CxOs recognize whaling phishing attacks and forward them to the IT team for analysis. Here are some potential red flags that lead to suspicion:

Check the email address

Even if the name in the email address appears to be that of a CxO, upon closer examination, you may notice that the actual email address is different, indicating a possible phishing attempt. Also, keep an eye on the domain name; for example, @Company.com is not the same as @Company.net.

Check the email content

Have you ever received this kind of request before? Pay attention to the tone and language of the email. Are there any grammatical errors? All of these can be red flags.

Urgent actions are needed

Phishing, including whaling attacks, often employs urgency to pressure you into immediate action. Don’t fall for it; take your time to verify the request before proceeding.

Flag external emails

You can use security tools to flag external emails, giving you a heads-up that you should pay attention to. This helps against partner and vendor fraud.

Report whaling attempts

You should use tools to report whaling phishing emails to IT for further analysis. This helps enhance the infrastructure, create reports, and learn from new incidents. Being aware of these red flags can help protect against whaling phishing attacks.

How to Protect Your Organization From Whaling Phishing With Hornetsecurity

Phishing is created and sent by malicious actors, but we often end up clicking on it due to human error. According to the World Economic Forum – The Global Risks Report 2022, 95% of all cybersecurity incidents are caused by human error. So, if we train CxOs and our end users, this number will definitely decrease. Do you agree? Here at Hornetsecurity, we have developed a Security Awareness Service to help you train your CxOs on how to stay safe. Our system can assist you in creating realistic whaling phishing attacks for training purposes.

You can simulate whaling phishing attacks in Hornetsecurity

You can also use the awareness dashboard to track your CxOs’ progress. The awareness dashboard can be customized based on your organization’s needs, and it provides real-time monitoring, ESI reporting with history and forecasts. ESI stands for Employee Security Index and helps determine the level of security within the organization. The Security Awareness Platform also includes a security hub with all learning materials to increase security awareness. It offers an evaluation of each user’s individual phishing simulation, a gamification approach, and learning content available in multiple languages. For an overall look at cybersecurity risks gained from analyzing 25 billion emails, see our free Cyber Security Report 2023.

To properly protect your cyber environment, use Hornetsecurity Security Awareness Service to train your employees in deterring cyber threats and securing your critical data. We work hard perpetually to give our customers confidence in their Spam & Malware Protection, Email Encryption, and Email Continuity strategies. To keep up to date with the latest articles and practices, pay a visit to our Hornetsecurity blog now.

Wrap Up

Phishing attack is one of the most common techniques to trick people into opening harmful links or attachments. It has different variations, and one of them is whaling phishing. Whaling phishing targets profiles of high authority, including C-executives. It is spread via email, SMS, and voice, and it sounds convincing since it comes from the higher levels in the organization. One of the best ways to prepare your CxO level against whaling phishing is to train them. You can do this by simulating whaling phishing attacks in Hornetsecurity. This article explains phishing attacks with an emphasis on whaling attacks, discussing the various ways they are spread and how you can secure your data against them.

FAQ

What is whaling phishing?

Whaling represents a prevalent cyber-attack strategy wherein attackers employ sophisticated spear phishing techniques to target prominent and significant individuals, often aiming at top-tier (C-level) executives within an organization.

What is whale vs. spear phishing?

Spear phishing is a targeted cyber-attack that singles out a particular group of individuals. In contrast, whaling directs its efforts toward key executives within an organization. Spear phishing primarily aims to pilfer login credentials and sensitive information. On the other hand, Whaling sets its sights on acquiring confidential trade secrets capable of significantly impacting a company’s overall performance.

What is an example of whaling phishing?

Here are the top three examples of whaling phishing:

Unencrypted Email Conversation Interception – Cybercriminals can seize and disrupt unencrypted email exchanges to redirect substantial bank transfers.
Malicious Meeting Invitation – Employing a deceptive tactic, attackers might arrange a fictitious meeting while embedding a malware link masked as a Zoom link.
Deceptive Payroll Data Request – Cyber attackers could pose as legitimate sources, requesting confidential payroll details for present and former employees, potentially leading to identity theft and fraud.

What is whaling also known as?

Also recognized as CEO fraud, whaling resembles phishing as it employs techniques like email and website spoofing. These tactics are utilized to deceive a target into carrying out particular actions, such as disclosing sensitive information or executing money transfers.

What safeguards can be taken to defend against whaling phishing attacks?

Perform Security Awareness Training for employees
Utilize Two-Factor Authentication (2FA)
Email filtering and verification
Validation of email addresses
Exercise caution regarding urgency
Implement Security Policies

« Older Entries

Next Entries »