There are two primary types of attacks.
Standard attacks. This method targets a large number of individuals and counts on one or more victims. The attacker understands that this approach is scattershot. However, that isn’t of much consequence since the attacker only needs one successful victim to gain a foothold.
These scams target a wide audience with general bait.
Example of a standard attack
- An attacker sends a mass email to employees posing as a member of the IT department.
- The email is a notification for recipients to take the mandatory annual online IT security training module—however, the training module is attacker controlled.
- During the course, the victim user is directed to enter their employee credentials which are then delivered directly to the attacker.
A mass distribution is also a double-edged sword. The potential for luring in at least one victim is higher with a larger distribution. At the same time, the likelihood of gaining the attention of the organization’s real IT or security teams is also higher.
Spear phishing. Compared to standard strategies, this is a more targeted attack. It requires more time and effort on behalf of the attacker since it targets fewer individuals through a carefully manipulated email. It’s also common for the attacker to spend time building trust with the target before directing them to take malicious actions. This type of attack is more commonly used to place malware on an internal network.
Example of a spear phishing attack
- An attacker becomes aware of a sensitive internal project at a target organization.
- The attacker spoofs the original sender's email address.
- The attacker sends out an otherwise innocuous email to the limited recipient list with the subject line, "Minutes from the last meeting" or "Action Items."
- The recipients see what looks to be a legitimate email about a recent meeting regarding the project. Because there is there's an implicit trust, they are much more likely to open the attachment.
Such campaigns have been used to gain access to internal networks used by high-level executives in an organization who are authorized to access more sensitive information. The result is the same as a general operation, except the compromise occurs much deeper within the organization. Spear phishing aims to extract specific information or gain specific access to an internal network.