Anatomy of phishing attacks

Day by day, Phishing attacks are becoming one of the fast-growing cyber threats for all sizes of businesses. Phishing attacks emulate legitimate companies or individuals used to fool victims into disclosing sensitive information like login credentials, credit card data, or other personal information. This type of serious attack is even used by cyber threats to get initial access to the internal network of the corporate. In this post, we will discuss several types of phishing attacks, how the attack is executed by an attacker, Examples, and possible protection against them.

Types of Phishing Attacks

To protect yourself from phishing attacks it is important to learn about the type of phishing methods. Here are some common types of phishing attacks:

1. Spear Phishing: This attack is customized to target specific people. For instance, a hacker can ask for a wire transfer to be made to a new account in a phishing email sent to a company’s CEO while posing as the CFO.
2. Whaling: Whaling is a type of phishing attack to target high-profile individuals. For example, The attacker creates a bogus email to pretend to be a CEO of an enterprise and sends it to the CFO, asking for sensitive information.
3. Smishing: A smishing attack is done via SMS or another form of text message. For instance, an attacker sends a message to a bank account holder with a bogus link and pretended to come from the bank asking to log in. If the victim tries to log in, his credential gets stolen.
4. Vishing: Vishing attack performed over the phone. For example, an attacker may call the victim that pretends to be a government agency, and ask for personal information.
5. Pharming: Pharming is a phishing method to redirect the victim to fake websites that look like legitimate ones. For example, an attacker sends an email to bank customers with a fake website link that looks similar to the legitimate bank website. The victim is prompted to download and execute files If he clicks on the link.
6. Business Email Compromise: The attacker research on a high-profile individual such as the CEO or CFO, compromises a business email, or creates a similar business email as the legitimate company, then communicates with the victim to earn trust for further actions.

The Stages of a Phishing Attack

Phishing attacks can be done in many ways. There is a limitation to the right form for phishing attacks. A typical phishing attack would look like this:

1. Research The Target: Cyber threats research well on the targets to plan an effective phishing attack.
2. Email Creation: The attacker creates an email similar to the target organization or the individual. This may involve registering a new domain that looks like the organization’s one. Then attacker crafts the email with an attachment or links to visit the infected sites.
3. Deployment: The attacker executes the phishing campaign to send mail to organizations or a large number of people.
4. Victim Interaction: The victim is asked to input personal information or download files if he clicks on the link.
5. Final Action: Attackers steal personal information that can be used for various malicious purposes or completely lead to the compromise of the internal network. It depends on what kind of action is taken by the victim.

A practical Scenario

An employee of a hospital receives an email that appears to be from the CEO of the hospital. The email comes with a Microsoft word macro-enabled document attachment. The email also explains that the resume was collected from a trusted source and sent to that employee for review. 

As the email has legitimate CEO’s profile pictures, name, and signatures, the employee downloads the attached file, opens it on his official computer, and enables the macro. As a result, the employee’s computer gets infected and the attacker gets access to the internal network.

From this initial access, the attacker now can move to a high-valued computer or server to reach his goal.

Protecting yourself

Your organization can take several actions to prevent phishing attacks. Here are some tips:

1. Train Your Employees: Train your employees to recognize a suspicious email 
2. Implement Email Security: Email security can be enhanced by applying email filters to block known phishing mail.
3. Implement Two-Factor Authentication: Add another layer of security such as Two-Factor Authentication. Implement it for email or other types of accounts.
4. Conduct Regular Vulnerability Assessments: Regularly scan your network, system, or application for vulnerabilities and remediate them as quickly as possible.

Conclusion

Phishing attacks are an influential threat to any kind of business. But Having the right understanding of various types of phishing attacks, and being aware of them businesses can hugely reduce the risk of being a victim. Phishing attack increases the possibility of success if your organization or supply chain network is one or another way vulnerable. Our customized security solutions, and staying up-date on the latest cyber attack techniques can help you stay protected from most kinds of cyber threats. If you have concerns or questions, feel free to reach out.