Phishing resources highlighting expert guidance, best practices, and platform solutions.
Discover the recent targeting shift of the Fog Ransomware group towards the financial services sector. Learn how Adlumin’s technology prevented encryption and data theft.
By: Krystal Rennie, Director of Corporate Communications, and Brittany Demendi, Corporate Communications Manager
Recently, we took a 360-degree view of phishing to examine various attacks and how harmful they can be to businesses. This blog will zoom in on a subsection of those attacks and learn more about six specific methodologies behind phishing.
You might already know that phishing attacks are increasing in popularity, and cybercriminals are finding new creative ways to strike. If you have had access to an email, phone, or social media account in the last decade, you have most likely been exposed to a phishing attempt.
When most people think of phishing, they think of email. This is often reinforced by awareness training and testing programs that disproportionately cover email-based campaigns. Unfortunately, this emphasis often neglects to consider other forms equally effective as tricking recipients into surrendering confidential information.
Email is the most common form of phishing, and it occurs when cybercriminals often send emails with phishing URLs to collect sensitive information. According to a Forcepoint article, “an email may present with links that spoof legitimate URLs; manipulated links may feature subtle misspellings (double “nn”s replace a “m” or uppercase “i” replaces lowercase “l”) or use of a subdomain.” Once access is gained through these links, criminals can successfully launch an attack.
More sophisticated email phishing uses infected attachments and contains evocative content encouraging recipients to open the attachment, automatically downloading malicious code. These emails can use positive messages, such as prizes or hefty discounts, or negative ones, such as complaints or lawsuits. They often appear to come from an authority to add weight to the recipient’s need for immediate action.
SMS and Text Messages are utilized when cybercriminals use text messages to target individuals to get them to disclose personal information via a link that would lead them to a phishing website and expose their information to the attacker.
During the early stages of Covid and work-from-home measures, executives were targeted through their assistants who received fake text messages from their boss. These themes often involved the fake boss reporting a stolen device, a new phone number, and an email. Once a persistent connect was made, the criminals would ask for confidential information in the hopes the assistant would surrender it over text.
Web-based forgery is a very sophisticated phishing techniques, as it uses fake websites to fool users. According to Phishing.org, this technique is “also known as ‘man-in-the-middle,’ the hacker is located between the original website and the phishing system. The phisher traces details between the legitimate website and the user during a transaction. As the user continues to pass information, it is gathered by the phishers, without the user knowing about it.”
One ransomware gang used fake Microsoft Office 365 log-in prompts to collect credentials and then passed the legitimate log-in information to Microsoft servers to complete the log-in creating a seamless and expected transaction. The victims were oblivious to the credential scrape.
Malvertising involves malicious advertising with active scripts created to download malware or force undesired content into your networks. The most common and popular methods of malvertising include Adobe PDFs and Flash. You should steer clear if you have seen these advertisements pop up on your browser.
Content Injection occurs when the cybercriminal maliciously alters a portion of content hosted on a reliable website. This will mislead the user and make them go to a page that leads them outside their intended website. Once they land on that redirected page, they will be asked to enter personal information.
The criminal group, Gootloader, used this technique to solicit the credentials of executives and professionals looking for templates, tools, and other planning resources.
Keyloggers use a specific kind of malware to recognize and record (or log) user keyboard input. The information collected is sent to cybercriminals so that they can decipher passwords and gain access to other types of personal information.
In one case, criminals used keystroke loggers to tailgate financial transactions and stole $1.9 million from a tech start-up in 24 hours. The money was moved to banks in China, Russia, and Turkey and was never recovered.
The first step to protecting yourself and your organization from falling victim to these phishing techniques is learning to spot them, which can be done through consistent training. In other words, by implementing a Proactive Defense Program. As we know, knowledge is power. Teaching employees to feel confident in their ability to report a phishing scheme can be the difference between temporarily shutting down operations, an organization folding, and conducting business as usual. The advantages and benefits are endless, educating employees on how to recognize cyber threats, the types out there, and what actions to take when they encounter one.
It is evident that IT staff already carry a heavy load, so many turn to third-party services to implement and manage security awareness testing and training. These pieces of training deliver real-world scenarios and context-rich security awareness programs in line with the organization’s security operation center services. So, what can an organization expect from a Proactive Defense Program?
The first step to protecting yourself and your organization from falling victim to these phishing techniques is learning to spot them, which can be done through consistent training. In other words, by implementing a Proactive Defense Program. As we know, knowledge is power. Teaching employees to feel confident in their ability to report a phishing scheme can be the difference between temporarily shutting down operations, an organization folding, and conducting business as usual. The advantages and benefits are endless, educating employees on how to recognize cyber threats, the types out there, and what actions to take when they encounter one.
It is evident that IT staff already carry a heavy load, so many turn to third-party services to implement and manage security awareness testing and training. These pieces of training deliver real-world scenarios and context-rich security awareness programs in line with the organization’s security operation center services. So, what can an organization expect from a Proactive Defense Program?
Six Popular Phishing Techniques and How to Combat Them is a part of Adlumin’s Cyber Blog content series. For more information about how your organization can protect itself from cybercriminals, browse more from our knowledge-rich series here.
Or contact our experts if your team is ready for a demo of Adlumin’s Managed Detection and Response Plus Platform extended risk management and security services.
By:
Krystal Rennie, Director of Corporate Communications,
and Brittany Demendi, Corporate Communications Manager
Have you ever received an email informing you that you’ve won an all-expense paid trip to the Bahamas in a raffle you never entered? Or received an email from a streaming service notifying you that your credit card was rejected and to click on the link to update your payment method? You’ve been exposed to a form of phishing. These are examples of email phishing, which use tactics that are untargeted but appear everywhere. By comparison, more targeted versions of phishing are more dangerous and can lead to identity theft, unauthorized access to sensitive data, or the defrauding of funds.
To an organization, phishing is always a severe risk. Phishing is an early-stage and reliable tactic used by hackers to gain access to networks as a part of a larger attack. For example, if you’ve been mentoring a graduate student for weeks and they send you an academic survey would you open it? If your CFO receives formal notification of a lawsuit from a competitor, would you contact the law firm? If your IT department sends a message about service upgrades that require a new log in, would you follow the instructions? These can all examples be examples of phishing.
Cybercriminals commonly use phishing to lure potential victims into performing harmful actions that could put your organization’s data at risk. This technique is the art of manipulating people to give up confidential information by either typing their login credentials to a fake company website or clicking a malicious attachment they thought was an invoice. Because phishing is effective and straightforward, cybercriminals launch thousands of attacks daily and can often be successful.
Regardless of the type of organization, large or small, they will be targeted by cybercriminals attempting a phishing attack. Phishing attacks are getting more difficult to spot, as some attacks will even surpass the most observant employees. Education on these different types of phishing attacks is essential. Below are five common types of phishing attacks:
Although the types of phishing attacks vary regarding risk levels, one thing they all have in common is the power to damage a business. Below are a few possible results of a successful phishing attack:
These are just a few examples of what could become compromised when these attacks occur. Companies must invest in the proper Managed Detection and Response platform and Proactive Defense Program to help protect sensitive information and train employees on security awareness.
Equipping employees with the proper knowledge is the best defense when protecting an organization’s data and assets from phishing attacks. In 2019, a major healthcare company reported that one of its employees stopped a phishing attack within 19 minutes, according to Comparitech. Their employee said that they received suspicious emails, and their Security Operations Center was able to take care of it immediately. Creating a security culture within every department, not just IT, is vital.
As phishing emails become harder to detect, investing in security awareness training like a Proactive Defense Program will be the main differentiator between robust risk management plans from the weak ones. The truth is that phishing attacks’ future depends on many factors. Cybercriminals are discovering new ways to step their game up daily and have become more sophisticated with their attacks. That said, it is up to the rest of us to find new ways to combat their tactics. At the end of the day, there is too much at stake if we do not think multiple steps ahead of cybercriminals.
1140 3rd St. NE, Suite 340
Washington, DC 20002
(202) 570-7907
Copyright 2024 Adlumin, Inc. All Rights Reserved