Cyber Tales

Spear-phishing: What is it? What to do?

In a cyber incident reported to us last week, a senior employee in the insured’s finance department discovered their email address had been compromised; when a phishing email was broadcast from their email address to their entire contact list.

Luckily they were on the ball. They contacted their broker as soon as they discovered the incident and are currently working hard to contain the damage and the reputation hit.

This incident, and the many thousand mirror copies that occur each day, highlight the role and responsibility all levels of the firm play in ensuring the security of their own company’s assets.

C-Suite email credentials are for sale on the dark web from $250 per user.

Phishing is becoming increasingly commoditized. As an example, cybercriminals have created a phishing kit featuring fake Microsoft Office 365 password alerts as a lure to target the credentials of chief executives, business owners and with ‘chief financial something’ in their title.

Security specialist, Trend Micro, has identified several dark web forums selling compromised Office 365 credentials for executives at a cost of $250 to $500 per user.

Leader Courage – “It won’t happen to me!”

Unfortunately, this type of threat isn’t always easy to get across to senior executives. You probably still come across top executives sometimes that view email security mechanisms or policies as “an inconvenience to them”.

The attackers know this and target high profile employees who may not be as technically – or cybersecurity – savvy, and may be more likely to be deceived into clicking on malicious links.

If an executive is tricked into giving away their credentials – the criminals can use those details to conduct additional attacks. In our incident last week, business email compromise (BEC) was the desired outcome; targeting other employees and third-party partners in the executive’s address book with a mission to phish them as well.

Phishing scams are no joke!

We recently conducted a test to highlight the threats of spear phishing. We did this to show how easy it is to be tricked by a phishing email, and why we all have to remind ourselves ever day to be extra vigilant.

33% OF OUR BROKER READERS FELL FOR THE SCAM of the people who opened the simulated spear phishing email, 33% clicked through to the fake “attack” website.

This is what spear phishing criminals do every day – impersonate a trusted brand to try and get you to go to sites that you should avoid, download viruses, or give away your passwords.

We see the crippling costs that a Spear phishing attack can lead to, especially for insurance brokers that handle sensitive data and have earned the trust of high-value customers – high-value targets in the eyes of criminals.

What do you think is behind the gusto?

We asked why some executives behave in this risky manner. We distilled it down to three points – I am sure you have others.

  1. Some executives believe that they are immune to being duped, even though “they are well aware that phishing techniques have evolved,” said one.

  2. For others, they may not have yet experienced a significant breach, meaning the perception of the risks are not as real as they should be.

  3. Some executives also use a personal assistant to go through emails, which can impact the individual’s ability to spot suspicious messages.

So, what to do?

Here’s the choice for top operators at your clients’ firms:

• Spend an extra minute or two each day to be a bit more vigilant with what they click on, and become a role model for others in the firm.

OR

• Continue being cavalier and risk being at the end of a spear-phishing attack; resulting in reputational damage and costs.

Hang on. Got to go. Just received an urgent email request to update my Office 365 password.

 

Blog written by Vishal Kundi,
CEO & Co-Found of BOXX Insurance Inc.

Related Posts

Cyber Tips Reducing the risk of RDP brute force attacks

Reducing the risk of RDP brute force attacks

RDP brute force attacks are commonly used by hackers targeting remote working employees, and this new control will make brute forcing much harder.

18/08/2022
Cyber Tales Insider threats are more common than you think

Insider threats are more common than you think

The largest association of credit unions in North America, announced that over 2.9 million records of personal data had been leaked.

16/07/2019

Sign up for the BOXX Insurance Newsletter

Get the latest updates about Cyber Insurance and Protection with our newsletter.