Although the number of individuals who fall for the infamous Nigerian prince scam has declined, phishing remains a significant concern. In fact, over the past year, hackers worldwide have executed 65% more phishing attacks.
Phishing is a fraudulent activity where hackers create emails, forms, and websites that look like those of legitimate companies to trick people into sharing their sensitive and personal information, such as credit card numbers, social security details, account logins, and personal identifiers. Usually, the victim remains unaware of the attack until their finances or identity are compromised, which can happen long after the event. Previously, hackers would quickly steal money from the compromised account once the victim provided their information. However, it is now more lucrative for hackers to sell that information on the Dark Web, resulting in more prolonged and devastating attacks.
3 Types of Phishing Attacks
Spear Phishing
Spear phishing refers to targeting individuals or companies with personalized phishing attacks. Attackers use this technique to increase their chances of success by collecting personal information about their targets. This approach is currently the most effective method of cyber attack, accounting for 91% of all attacks.
In 2016, Threat Group-4127 employed spear phishing tactics to target email accounts associated with Hillary Clinton’s presidential campaign. They launched over 1,800 attacks on Google accounts and threatened their targets using the domain accounts-google.com.
Clone Phishing
Clone phishing is a specific type of phishing attack. In this attack, a legitimate email previously delivered is used to create a nearly identical or cloned email. The attacker replaces the attachment or link within the email with a malicious version and then sends it from a spoofed email address that appears to be from the original sender. The cloned email may claim to be a resend of the original or an updated version. Attackers use this technique to exploit the social trust associated with the inferred connection between the two parties involved in the original email. By doing so, they can indirectly gain access to another machine and establish a foothold.
Whaling
Phishing attacks are becoming more sophisticated, with some explicitly targeting high-profile individuals within businesses. These attacks are known as whaling and are designed to mimic executive-level communications. The content of a whaling attack will be tailored to the target’s position and typically involves a falsified company-wide concern, such as a legal subpoena or customer complaint. Phishers have also created official-looking FBI subpoena emails to trick recipients into downloading malicious software.
If you’ve ever received an email from your bank or medical office asking you to update your information online or a suspicious email from your boss asking you to execute a wire transfer. In that case, it’s likely a spear phishing attempt. Unfortunately, you’re not alone – 76% of businesses have been victims of phishing attacks in the past year.
Method of Delivery
Phishing scams are not always received through email, and hackers are getting trickier and trickier with their preferred method of execution. In 2017, officials caught onto attacks using SMS texting (smishing), Voice phishing (vishing), or social engineering, a technique in which users can be encouraged to click on various kinds of unexpected content for various technical and social reasons.
Ransomware: The Consequence
Phishing has become the most widely used method for spreading ransomware and has increased significantly since the birth of major ransomware viruses like Petya and WannaCry. It is important to note that anyone can become a victim of phishing or, in turn, ransomware attacks. However, hackers have started targeting organizations that are more likely to pay the ransom. Small businesses, education, government, and healthcare organizations often don’t have valid data backups. Therefore, they are unable to roll back to a pre-ransomed version of their data. Instead, they have to pay their way out or cease to exist. Apart from ransom costs, victims of phishing campaigns are often branded as untrustworthy, and as a result, many of their customers turn to their competitors, which leads to even greater financial losses.
Why are effective phishing campaigns so rampant despite public awareness from media coverage?
Volume: Nearly 5 million new phishing sites are created every month, according to Webroot Threat Report. There are now even companies offering Phishing as a Service in exchange for payment. One Russian website, “Fake Game,” claims over 61,000 subscribers and 680,000 credentials stolen.
They work: Over 30% of phishing messages get opened, and 12% of targets click on the embedded attachments or links, according to the Verizon Data Breach Investigations Report. In short, these hackers have gotten really good at looking really legitimate.
They’re simple to execute: New phishing campaigns and sites can be built by sophisticated hackers in a matter of minutes. While we think there are far more legitimate ways to be earning money, these individuals have made a living out of duplicating their successful campaigns.
Now that you have an understanding of what phishing is, our next two blogs will teach you how to spot a phishing attack and fix your weakest link: Your employees.