In the previous chapter, Huck Phinn, who works for an environmental group, narrowly escaped a phishing email trap by recognizing red flags. But he still remained a target of other “phishers” trying to lure him.
One day, a message to Huck’s business email address, huckleberry.phinn@spwf.org, popped up. It looked legit because Huck's office does use Microsoft Office 365 for their email. (Figure 1)
Uh oh! Huck took the bait and clicked “Read Now.” Unfortunately, that’s all it took for the bad actors to take their next steps in a sophisticated spear phishing attack targeting Huck’s organization:
At this point, Huck recalled the recent phishing email that he received (covered in Chapter 2), and deciding not to take a risk by going any further with this one, forwarded the email to the Ingalls Phishing Email Helpdesk to have their expert SOC analysts review it first. The Ingalls Phishing Email Helpdesk Analysts investigated the email and sent Huck a response to let him know that it was malicious and recommended immediately deleting the email (Figure 4).
Ingalls’ investigation revealed this was more than a standard phishing attack. This was a deliberate spear phishing attack using tricky tactics like obscuring the known phishing domain with a redirect from a legitimate site, such as the job posting site (nexxt.com) to avoid detection by email security and filtering solutions.
Open source threat intelligence revealed a number of other potential victims were targeted with similar attacks, and one of the domains used in this attack was included on a pastebin dump of known phishing domains.
This time, Huck realized something was wrong just in time. If he had continued on the fake login page, he would have encountered a prompt to enter his password. Flags that would have helped him identify the malicious content included additional spelling and grammatical errors.
After entering a password, whether correct or not, Huck would encounter an error stating "Your email or password is inorrect." Whatever password information entered by Huck on the fake login page would have been captured by the attackers (Figure 6).
All of this could have been avoided if Huck had noticed these telltale signs the email was malicious:
Security Awareness is increasingly important as part of a culture of security for every organization. It can no longer be considered strictly your IT department’s responsibility to keep the organization safe. No amount of sophisticated technical controls can fully account for every opportunity a bad actor has to take advantage of the most basic human instincts - to respond when prompted.
Does your organization have an effective solution for reporting and evaluating suspicious emails? Do your employees know where to go for help and what to do if they spot a phish? Ingalls Managed Detection and Response Services include a Phishing Email Help Desk to make it easy for your employees to report emails they are unsure of and lighten the burden on your IT team of analyzing and responding to phishing attacks. Contact us today for a free consultation and get peace of mind for your cybersecurity.
Catch Huck’s ongoing phishing adventures in the next chapter in the series, coming soon…
Ingalls helps businesses large and small manage security risks and defend against cyberattacks. If you’d like to learn more please contact us here. One of our cybersecurity experts will be more than happy to assist you and answer any questions you may have.
|
Our “How to Spot a Phish” checklist can help you identify phishing emails and provides advice on what to do with them. |
About the AuthorCyrus Robinson, CISSP, MCSE, MCITP, CEH, CHFI, Sec+
Mr. Robinson is a skilled Information Security professional with experience working with diversified technologies and environments. Mr. Robinson’s professional IT career began as an electronic forensics engineer as an active duty Airman with primary responsibilities with testing and evaluating digital forensic software, policies, and procedures. In this capacity, he worked alongside federal investigators and various DoD, CIA, FBI, NSA, and NIST employees. Following his active duty role with the USAF, Mr. Robinson went on to work in change management and system administration as a DoD Contractor. Mr. Robinson also has extensive experience in the roles of Information Security Officer and IT Director for a large medical group which contribute to his knowledge with security risk assessments, HIPAA compliance, and drafting and implementing corporate IT security and business continuity policies. Mr. Robinson holds various industry standard certifications and a Masters of Science in Information Security and Assurance.
|