In the Crosshairs: Spear Phishing and Its Threat to Your Customers

In the realm of cyber threats, spear phishing stands out as one of the most insidious and dangerous tactics used by cybercriminals. Unlike generic phishing attempts, spear phishing is highly targeted and often difficult to detect, making it a significant risk for businesses of all sizes.

Spear phishing is a type of phishing attack where cybercriminals target specific individuals or organisations with tailored messages designed to elicit a response. These messages often appear to come from a trusted source, such as a colleague, business partner, or a legitimate service provider, and typically aim to steal sensitive information or install malware on the victim’s system.

Key Characteristics

Spear phishing emails are customised with information about their target, such as their name, job title, or recent activities, making the fraudulent emails appear more legitimate.

Attackers often impersonate someone the target knows or trusts, increasing the likelihood that the target will respond or click on a malicious link.

3. Specific Objectives

The goal of spear phishing can vary, from stealing login credentials to installing ransomware or stealing sensitive business information.

4. Social Engineering

To enhance their chances of success, attackers will often spend time gathering information about their target to make their attack feel as credible as possible. That could include watching company websites, industry press and social media, or following the social media activity and posts of the individuals targeted, including those in their vicinity like team members or other familiar contacts. For example, an out of office message or social media shares from an offsite conference or travel can be useful in tailoring a spear phish.

Why is Spear Phishing so Dangerous?

The personalised nature of spear phishing makes the attacks more convincing and harder to spot. As a result, they have a higher success rate compared to generic phishing attacks. Employees, even those who are vigilant, can easily be deceived by well-crafted spear phishing emails.

Spear phishing attacks can lead to substantial financial losses. For instance, attackers may trick employees into wiring money to fraudulent accounts or stealing sensitive financial information. The cost of dealing with a successful spear phishing attack can be immense too, including the cost of remediation, legal fees, and lost revenue.

Aside from pure financial gain through fraudulent payments, spear phishing is often also a precursor to larger attacks, such as data breaches. Once attackers gain access to an individual’s credentials, they can infiltrate the company’s network, steal sensitive data, or exfiltrate intellectual property. This can result in severe reputational damage and competitive disadvantage.

When attackers successfully steal credentials or install malware through spear phishing, they can gain control over critical systems, leading to prolonged security incidents. This not only disrupts business operations but also compromises the integrity of your security infrastructure.

Here’s a Real-life Example

As reported by CNN, earlier this year ‘A finance worker at a multinational firm was tricked into paying out US$25 million to fraudsters using deepfake technology to pose as the company’s chief financial officer in a video conference call, according to Hong Kong police.

The elaborate scam saw the worker duped into attending a video call with what he thought were several other members of staff, but all of whom were in fact deepfake recreations

(In the) multi-person video conference, it turns out that everyone [he saw] was fake.

Senior Superintendent Baron Chan Shun-ching of RTHK said, ‘The worker had grown suspicious after he received a message that was purportedly from the company’s UK-based chief financial officer. Initially, the worker suspected it was a phishing email, as it talked of the need for a secret transaction to be carried out.

However, the worker put aside his early doubts after the video call because other people in attendance had looked and sounded just like colleagues he recognized.’

How MailGuard Customers Can Protect Themselves

Regular training programs are essential to educate employees about the dangers of spear phishing and how to recognize suspect emails. The MailGuard blog is a great source of threat examples to share with customers and their teams, and they can subscribe for weekly updates. All employees should be encouraged to be careful and think twice before they click, verifying the authenticity of any unexpected or unusual email requests, especially those involving sensitive information or financial transactions.

Other security measures like implementing MFA should also be mandated. It adds an extra layer of security to your customer’s accounts and other valuable IP. Even if attackers obtain login credentials through spear phishing, they will still need the second form of authentication to gain access, significantly reducing the risk of unauthorized access.

Regular security audits and assessments will also help to identify other vulnerabilities that could be exploited by spear phishing attacks. Ensure the customer’s security policies are up-to-date and that they have robust incident response plans in place.

Adding MailGuard Spear Phishing Policies

And to ensure that they’re getting the most out of their decision to choose MailGuard to defend their inboxes, check that they’re taking advantage of MailGuard’s Spear Phishing policies. You can read about them here when you’re logged in to the MailGuard management console, or reach out and speak to a member of our team.

As the help article explains, they are designed to catch:

• Emails that are attempting to imitate specific high-level users within an organisation, and
• Generic spear phishing attempts.

It explains the steps involved to create a new spear phishing policy for a customer:

• Log in to the MailGuard Console
• Go to Configure → MailGuard → Mail Policies
• Under Company Policy click on Add
• Give the policy a Name
• Set the Direction as Inbound (Spear phishing rules can only be set in an inbound direction), and
• Select the policy type Spear Phishing from the drop-down menu.

The policies allow you to add the user display name of the employees that you want to prevent from being impersonated, along with any variations on their name, and any domains that apply. Finally, the article sets out how to edit the policies, quarantine and release management.

Spear phishing represents a formidable threat to businesses, leveraging personalization and preying on user trust to deceive even the most cautious employees. By understanding the nature of spear phishing and implementing comprehensive security measures, your customers can better protect themselves against these targeted attacks.

Keeping Businesses Safe and Secure

Prevention is always better than a cure, and one of the best defences is to encourage businesses to proactively boost their company’s cyber resilience levels to avoid threats landing in inboxes in the first place. The fact that a staggering 94% of malware attacks are delivered by email, makes email an extremely important vector for businesses to fortify.

No one vendor can stop all email threats, so it’s crucial to remind customers that if they are using Microsoft 365 or Google Workspace, they should also have a third-party email security specialist in place to mitigate their risk. For example, using a specialist third-party cloud email solution like MailGuard.   

MailGuard provides a range of solutions to keep businesses safe, from email filtering to email continuity and archiving solutions. Speak to your customers today to ensure they’re prepared and get in touch with our team to discuss fortifying your customer’s cyber resilience.

Talk to us

MailGuard's partner blog is a forum to share information; we want it to be a dialogue. Reach out to us and tell us what your customers need so we can serve you better. You can connect with us on social media or call us and speak to one of our consultants.

Australian partners, please call us on 1300 30 65 10

US partners call 1888 848 2822

UK partners call 0 800 404 8993

We’re on Facebook, Twitter and LinkedIn.

Keep Informed with Weekly Updates