0. Spear Phishing

1. Spear Phishing Common cause of data breaches Targeted emails
Sent to small groups or individuals
Uses social engineering tactics
Common cause of data breaches
Targeted s
Spear phishing messages are targeted at small groups or individuals. Attackers personalize these messages to bypass technical controls like spam filters.
Sent to small groups or individuals
Use social engineering tactics
Examples of social engineering tactics:
Pretexting: Exploiting the authority of another person or organization (e.g. pretending to be the IT department to solicit a password)
Baiting: dangling an item (or file) of value
Appealing to emotions or sense of urgency

2. Spear Phishing Emails Deliver file attachments
Entice you to click on links 
Trick you into handing over your login credentials 
Spear phishing s:
Deliver file attachments that can infect your computer with malware
Entice you to click on links that take you to websites that will infect your computer
Trick you into handing over your login credentials, which phishers can later use to gain access to your network, sites, and data

3. Type #1: Highly Personalized
Spear phishers personalize s to try to gain your trust
Full name
Mailing address
Bank account number
Name of your employer
Even if the or text message appears to be from someone you know, use caution.
Examples of advanced spear phishing attacks include Highly Personalized, Double Barrel, and Business Compromise.
Highly Personalized phishing s include personal information to gain the target’s trust.
Spear phishers often use information like your full name, mailing address, tax ID number, phone number, bank account number, and the name of your employer to try to gain your trust.
Spear phishers scavenge social media profiles to craft highly personalized messages. They could also use information like the names of your family, friends, and colleagues to trick you into clicking a link or downloading an attachment. Every bit of information you post on a social network makes you vulnerable to spear phishing.
Even if the or text message appears to be from someone you know, use caution. Phishers can also impersonate addresses and phone numbers.

4. Type #1: Highly Personalized
This example of a real phishing includes the target’s address (redacted) to establish a sense of trust.

5. Type #2: Double Barrel
The Double Barrel uses multiple s to create a believable narrative.
The Lure:
The first is designed to build trust
The Double Barrel uses multiple s to create a believable narrative.
First, phishers send a Lure designed to build trust. In this example, Jack receives an from his boss Lena, letting him know that she is about to get on a flight and to expect a file soon.
In this , the phisher tells the target to expect another with an attachment or link.

6. Type #2: Double Barrel The Phish:
The second contains malicious attachments or links
After a period of time, the attacker sends a follow-up that is a phish, and it contains malicious attachments or links.

7. Type #3: Business Email Compromise
Use to solicit wire transfers
Impersonate executives or vendors/suppliers
Resemble spear phishing
Targets financial officers
Phishers have stolen billions of dollars in these scams.
A Business Compromise scam uses s to trick recipients into initiating a fraudulent wire transfer, often by impersonating a high-ranking executive or a vendor/supplier.
A BEC scam may resemble a spear phishing attack.
However, it does not always contain a malicious hyperlink or attachment.
Most often, BEC scams target financial officers and other employees who are authorized to initiate a wire transfer, like financial directors and accountants.
According to the United States FBI, phishers have stolen over 5.3 billion dollars in these scams as of 2017.

8. Type #3: Business Email Compromise
Here is an example of an attempt against PhishMe. Our VP of Finance was able to identify the BEC scam because the says “Sent from my iPhone,” but he knew Rohyt uses Android.
There are a few formatting mistakes (an extra space before “?”) and punctuation errors (“i”). That’s no surprise since errors in punctuation, spelling, grammar and formatting are common in phishing s.

9. Why You Should Be Concerned
The global cost of cyber crime was $445 billion in 2016 [1]
The typical 10,000 employee company spends $3.7 million per year dealing with phishing attacks [1]
5.3 Billion (USD) in actual and attempted losses from BEC [2]
131 Countries have recently been impacted by BEC scams [2]
References:
[1] – PhishMe. “Techniques for Dealing with Ransomware, Business Compromise and Spearphishing”
[2] – PhishMe. “Business Fraud Scams: What They Are and How to Shut Them Down”
The World Economic Forum places the global cost of cyber crime at $445 billion in 2016
The Ponemon Institute estimates that the typical 10,000 employee company spends $3.7 million per year dealing with just phishing attacks
Those losses – representing more than USD 5.3 billion – affected over 22,000 companies (large and small) in all 50 states and in 131 countries.

10. How to Spot a Phish Look closely for errors Look for Contextual Clues
Grammar
Spelling
Punctuation
Syntax
Look for Contextual Clues
Device
Tone
Signature
Look for unusual grammar, spelling, punctuation, or syntax errors, which are often present in malicious s.
If you know the sender, look for clues that something isn’t right. For example: the is overly formal, when you and the sender are on friendly terms, or the uses an incorrect signature.  

11. Prevent Spear Phishing Attacks
Never download strange/unsolicited attachments
Update software frequently
Back up your files regularly
Use caution while surfing the web and checking your inbox
Keep your emotions in check
Always verify
Never download attachments that are out of context, like if you received an with the subject “Attached Invoices” and you work in the engineering department.
Even if the is from someone you know, it is always safest to verify with the sender if anything in the seems off.
Update software frequently.
Unpatched software can contain security holes, used to gain access into your system.
Back up your files regularly.
Secure your backup in a safe place and disconnect it from your computer when you aren’t using it. Some malware will encrypt network and USB drives.
Use caution while surfing the web and checking your inbox.
Never download attachments or click any links from unknown senders.
Never enable macros on Microsoft Office documents from unknown senders.
Enabling macros can allow a malicious program to run and download malware.
Keep your emotions in check
Spear phishing s are successful because they catch recipients off guard by appealing to emotions like fear, curiosity, recognition, urgency, and opportunity.
Always verify.
Reach out to the sender on the phone to verify that the file is legitimate.

12. Report It! Report Spear Phishing Report any suspected threats
Help stop attacks
Protect your co-workers
Protect customer data
Report It!
Report any suspected threats
Prompt reporting allows our IT team or security provider to respond before more damage is done
Help stop attacks
Protect your co-workers
If they’ve targeted you, they may have also targeted other people that you work with or for.
Protect customer data
Any successful cyber attack puts sensitive customer data at risk.
Prompt reporting satisfies an obligation to our customers by doing our best to prevent the loss or breach of sensitive information.

13. Related Resources
Whitepapers
Techniques for Dealing with Ransomware, BEC, and Spearphishing
Business Fraud Scams: What They Are and How to Shut Them Down
Why Can’t We Solve Phishing?
Blog posts
Threat Actors Continue Abusing Google Docs and Other Cloud Services to Deliver Malware
FBI Announces That BEC Scam Losses Continue to Skyrocket, as Losses Exceed $3.1B
BEC Scams Hits Technology Giants for over $100 Million Dollars
With apologies to Led Zeppelin fans: The (BEC) Song (Still) Remains the Same
CBT
Advanced Spear Phishing
BEC Scams
Infographics
How to Spot a Phish
Phishing and Social Media
How to Shield Your Company from BEC Attacks
Videos
Phishing vs. Spear Phishing
Please see the above resources to learn more about BEC scams.