Unfortunately, everything malicious isn’t always caught by your email filtering or anti-virus. Because of the rise in email-born attacks over the last few months, we’ve begun debunking some of the most well-known spear phishing emails sent to local business owners. With an estimated 91% of successful data breaches started by spear phishing, this type of scam has garnered a lot of media attention. Once reserved for the C-level executive, spear phishing has grown, targeting managers and other employees as an essential component of a social engineering attack.
Did You Know That 91% of Successful Breaches Start with a Spear Phishing Attack?
1. “Funding for Your Business DocuSign Scam”
One of our partners here at CCS sent this brilliant example of a spear phishing scam, that can get past ANY email or web filtering.
This message sails through filters and protects devices as it’s presented as a close-to-real document. Utilizing Adobe DocuSign, this example is built to grab your information, not to deliver a malicious payload.
By reviewing documents, and clicking the entirely legit DocuSign page, it will spawn what appears as a loan application. By completing this form, it will send your information directly to the hackers. Making it even easier for them, towards the bottom of this application there is a place to upload your last three paychecks or pay stubs.
If someone in your account’s receivables, accounting, or finance department were to submit this information, the damage could be extensive, and bankruptcy has unfortunately become a harsh reality for small-to-medium sized businesses due to the potential repercussions.
2. Unwitting Job Applicant Victims to Malware Ad Attacks
The way spear phishing works is by evoking trust and credibility to entrap victims into providing information that grants them access to personal records, employee information, and company data.
Like many professionals in the SF Bay Area, I’m on LinkedIn, where thousands of people are searching for employment opportunities. Given you’re on a website that knows your job title, industry sector, GPS Location, etc. it wouldn’t raise suspicion in most cases.
That’s exactly what these hackers were counting on when they hosted several malicious LinkedIn Ads to target a bank employee. The victim was a financial company employee that was contacted by, and even held a Skype call with the potential new employer. Once the interview was conducted, and the employee’s defenses are down, cybercriminals asked the employee to install a program called ApplicationPDF.exe that would generate his application.
Because this program was able to bypass anti-virus and suspicion, it’s believed the hackers were attempting to gain access into the network of financial records, debit cards, and control over localized ATMs.
We often begin seeing employees as the easiest line of defense in your cybersecurity. It’s stories like these that continue to keep our clients vigilant with security and elevate the awareness employees have to surround these malicious threats and looking for red flags. In this case, the PDF application was the scam that allowed access into localized network operations.
Steps Towards a Spear Phishing Remedy:
By focusing on the unique needs of your network, and its users there are low-cost solutions for making major strides in stepping up spear phishing prevention. With the implementation and setup of policies, permissions, and email filtering, begin minimizing the risk your business can incur. As part of our commitment to the SF Bay Area Community, we have begun offering Security Awareness Training for companies looking to strengthen their security posture. We understand the uniqueness of your business, and so do each of our employees. Leverage our staff, and knowledge to toughen up security today.
